Skip to content

twenty

vtwenty/v2.14.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

crm crm-system customer graphql javascript marketing
+8 more
monorepo nestjs postgresql react reactjs sales typescript web

Affected surfaces

deps

ReleasePort's take

Moderate signal
editorial:auto 14d

Upgrade the esbuild dependency to version 0.28.1 immediately.

Why it matters: GHSA‑gv7w‑rqvm‑qjhr (CVSS 9.0) affects all deployments using the vulnerable esbuild version; patching eliminates remote code execution risk.

Summary

AI summary

Broad release touches deps, server, front, and twenty-front.

Changes in this release

Security Critical

Upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr)

Upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr)

Source: llm_adapter@2026-06-15

Confidence: high

 —
Feature Medium

Migrate frontend to React 19

Migrate frontend to React 19

Source: llm_adapter@2026-06-15

Confidence: high

 —
Feature Medium

Add useColorScheme hook to twenty‑sdk

Add useColorScheme hook to twenty‑sdk

Source: llm_adapter@2026-06-15

Confidence: high

 —
Feature Medium

Support morph relations in workflow record nodes

Support morph relations in workflow record nodes

Source: llm_adapter@2026-06-15

Confidence: high

 —
Feature Medium

Add twenty‑partner‑match skill to partners module

Add twenty‑partner‑match skill to partners module

Source: llm_adapter@2026-06-15

Confidence: high

 —
Feature Low

Add number format option to aggregate chart widget in page layout

Add number format option to aggregate chart widget in page layout

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

 —
Feature Low

Persist metadata store cache in IndexedDB instead of localStorage in front

Persist metadata store cache in IndexedDB instead of localStorage in front

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

 —
Feature Low

Add call recording schema and meeting bot scaffold

Add call recording schema and meeting bot scaffold

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

 —
Performance Medium

Avoid O(n²) when building flat entity maps in server

Avoid O(n²) when building flat entity maps in server

Source: llm_adapter@2026-06-15

Confidence: high

 —
Bugfix Medium

Coerce addressLat/addressLng to numbers in ORM result formatting

Coerce addressLat/addressLng to numbers in ORM result formatting

Source: llm_adapter@2026-06-15

Confidence: high

 —
Bugfix Medium

Repair 2.13 isUIReadOnly→isUIEditable rename fallout in server code

Repair 2.13 isUIReadOnly→isUIEditable rename fallout in server code

Source: llm_adapter@2026-06-15

Confidence: high

 —
Bugfix Medium

Prevent unbounded default‑view creation on record‑index load in twenty‑front

Prevent unbounded default‑view creation on record‑index load in twenty‑front

Source: llm_adapter@2026-06-15

Confidence: high

 —
Bugfix Medium

Mitigate integration‑test OOM flakiness in server

Mitigate integration‑test OOM flakiness in server

Source: llm_adapter@2026-06-15

Confidence: high

 —
Bugfix Low

Keep paging record board columns past the second page in twenty‑front

Keep paging record board columns past the second page in twenty‑front

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

 —
Bugfix Low

Mass update targets explicitly selected records in front

Mass update targets explicitly selected records in front

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

 —
Bugfix Low

Deduplicate morph relation fields in view field pickers in front

Deduplicate morph relation fields in view field pickers in front

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

 —
Bugfix Low

Keep filename when a file has no extension in front

Keep filename when a file has no extension in front

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

 —
Full changelog

What's Changed

  • feat(page-layout): add number format option to aggregate chart widget by @1alexandrer in https://github.com/twentyhq/twenty/pull/21521
  • fix(server): repair 2.13 isUIReadOnly→isUIEditable rename fallout (#21504) by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21537
  • fix(twenty-front): keep paging record board columns past the second page by @MarcBickel in https://github.com/twentyhq/twenty/pull/21348
  • Fix settings UI polish pass 2 by @Bonapara in https://github.com/twentyhq/twenty/pull/21540
  • fix(address): coerce addressLat/addressLng to numbers in ORM result formatting by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21542
  • fix(server): write 2.13 UI capability flags directly, bypassing validation by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21543
  • feat(deps): migrate frontend to React 19 by @charlesBochet in https://github.com/twentyhq/twenty/pull/21531
  • [Fix] : fix: Allow label identifier system fields in view creation and fix resulting duplicate header columns by @carbonFibreCode in https://github.com/twentyhq/twenty/pull/19009
  • Fix record index sync when view fields arrive via SSE by @channi23 in https://github.com/twentyhq/twenty/pull/19069
  • ci: exclude all twenty-apps from dependabot by @charlesBochet in https://github.com/twentyhq/twenty/pull/21554
  • feat(lint): forbid data mutations in fast instance command up() by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21547
  • fix(twenty-front): prevent stale transition page from blocking scroll by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21551
  • chore(apps): bump twenty-sdk & twenty-client-sdk to 2.13.0, vitest to 4 by @charlesBochet in https://github.com/twentyhq/twenty/pull/21553
  • fix: #19173 correct labels and icons for custom object default relations by @meManish47 in https://github.com/twentyhq/twenty/pull/19224
  • fix(front): mass update targets explicitly selected records by @charlesBochet in https://github.com/twentyhq/twenty/pull/21548
  • chore(deps): bump fs-extra from 11.2.0 to 11.3.5 by @dependabot[bot] in https://github.com/twentyhq/twenty/pull/21556
  • chore(deps): bump @ai-sdk/anthropic from 3.0.72 to 3.0.84 by @dependabot[bot] in https://github.com/twentyhq/twenty/pull/21557
  • chore(deps): bump @quilted/threads from 4.0.1 to 4.0.3 by @dependabot[bot] in https://github.com/twentyhq/twenty/pull/21560
  • fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21559
  • fix(setup-script): add database schema initialization to setup script by @ratishjain12 in https://github.com/twentyhq/twenty/pull/20063
  • chore(deps): ignore chokidar in dependabot by @charlesBochet in https://github.com/twentyhq/twenty/pull/21564
  • fix(server): load integration jest config transpile-only; drop tsx pin by @charlesBochet in https://github.com/twentyhq/twenty/pull/21563
  • chore(deps): bump @xyflow/react from 12.10.0 to 12.11.0 by @dependabot[bot] in https://github.com/twentyhq/twenty/pull/21561
  • chore(deps): bump @graphiql/plugin-explorer from 5.1.2 to 5.1.3 by @dependabot[bot] in https://github.com/twentyhq/twenty/pull/21565
  • chore(deps): bump @ai-sdk/azure from 3.0.55 to 3.0.74 by @dependabot[bot] in https://github.com/twentyhq/twenty/pull/21566
  • chore(deps): bump prettier from 3.8.3 to 3.8.4 by @dependabot[bot] in https://github.com/twentyhq/twenty/pull/21568
  • fix(front): keep the filename when a file has no extension by @yashs33244 in https://github.com/twentyhq/twenty/pull/21576
  • chore(deps): upgrade Tier-1 deps (googleapis 173, gaxios 7, express 5, jsdom 29, date-fns 4, stripe 20) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21570
  • chore(deps): bump @ai-sdk/amazon-bedrock from 4.0.97 to 4.0.117 by @dependabot[bot] in https://github.com/twentyhq/twenty/pull/21569
  • Ignore generated Storybook/Argos screenshot output by @bosiraphael in https://github.com/twentyhq/twenty/pull/21589
  • chore: bump version to 2.14.0 by @twenty-pr[bot] in https://github.com/twentyhq/twenty/pull/21593
  • Fix default view widget visibility by @martmull in https://github.com/twentyhq/twenty/pull/21590
  • Remove randomness from flaky twenty-front Storybook stories by @bosiraphael in https://github.com/twentyhq/twenty/pull/21594
  • fix(front): dedupe morph relation fields in view field pickers by @charlesBochet in https://github.com/twentyhq/twenty/pull/21580
  • perf(server): avoid O(n²) when building flat entity maps by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21585
  • Add useColorScheme hook to twenty-sdk by @martmull in https://github.com/twentyhq/twenty/pull/21595
  • Support morph relations in workflow record nodes by @ijreilly in https://github.com/twentyhq/twenty/pull/21403
  • Postcard app e2e front component rendering test by @prastoin in https://github.com/twentyhq/twenty/pull/21600
  • Add call recording schema and meeting bot scaffold by @ehconitin in https://github.com/twentyhq/twenty/pull/21584
  • Hide logic functions that are not exposed as tools by @ijreilly in https://github.com/twentyhq/twenty/pull/21598
  • chore(server): remove stray comment in flat-entity-maps spec by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21599
  • feat(front): persist metadata store cache in IndexedDB instead of localStorage by @charlesBochet in https://github.com/twentyhq/twenty/pull/21586
  • fix(server): mitigate integration-test OOM flakiness by @charlesBochet in https://github.com/twentyhq/twenty/pull/21588
  • fix(twenty-front): stop unbounded default-view creation on record-index load by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21592
  • Make flaky Storybook stories deterministic for Argos (animations + lazy-load) by @bosiraphael in https://github.com/twentyhq/twenty/pull/21609
  • feat(partners): add twenty-partner-match skill by @rashad in https://github.com/twentyhq/twenty/pull/21601

New Contributors

  • @1alexandrer made their first contribution in https://github.com/twentyhq/twenty/pull/21521
  • @MarcBickel made their first contribution in https://github.com/twentyhq/twenty/pull/21348
  • @meManish47 made their first contribution in https://github.com/twentyhq/twenty/pull/19224
  • @yashs33244 made their first contribution in https://github.com/twentyhq/twenty/pull/21576

Full Changelog: https://github.com/twentyhq/twenty/compare/twenty/v2.13.0...twenty/v2.14.0

Security Fixes

  • Upgraded esbuild to 0.28.1 — fixes CVE GHSA-gv7w-rqvm-qjhr
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track twenty

Get notified when new releases ship.

Sign up free

About twenty

Building a modern alternative to Salesforce, powered by the community.

All releases →

Related context

Earlier breaking changes

  • vtwenty/v2.20.0 Deprecate `fieldMetadata` and `objectMetadata` standardOverrides.
  • vtwenty/v2.13.0 Gate record creation on isUICreatable only, decoupled from isSystem.
  • vtwenty/v2.13.0 Rename isUIReadOnly to isUIEditable and add isUICreatable, affecting app developers.
  • vtwenty/v2.12.0 Deprecate isCustom for Objects and Fields.
  • vtwenty/v2.12.0 Deprecate dummy enterprise key (2/2).

Beta — feedback welcome: [email protected]