This release includes 17 security fixes for security teams reviewing exposed deployments.
Published 1mo
Productivity & Wikis
✓ No known CVEs patched
This release patches 17 known CVEs
Topics
crm
crm-system
customer
graphql
javascript
marketing
+8 more
monorepo
nestjs
postgresql
react
reactjs
sales
typescript
web
Summary
AI summaryUpdates span server, front UI, workflow engine, AI tools, security patches and website.
Full changelog
What's Changed
- Move twenty-client-sdk to dev dep by @prastoin in https://github.com/twentyhq/twenty/pull/21611
- chore: bump version to 2.15.0 by @twenty-pr[bot] in https://github.com/twentyhq/twenty/pull/21624
- chore(server): temporary diagnostic logging for empty verification email body by @charlesBochet in https://github.com/twentyhq/twenty/pull/21628
- fix(front): set up Monaco workers for GraphQL playground by @charlesBochet in https://github.com/twentyhq/twenty/pull/21620
- fix(command-menu-item): persist overrides after save and add reset-to-default by @Weiko in https://github.com/twentyhq/twenty/pull/21623
- i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21633
- Fix relation-traversal filters showing no options on select fields by @bosiraphael in https://github.com/twentyhq/twenty/pull/21616
- fix(twenty-partners): reuse existing company by domain in partner-application handler by @rashad in https://github.com/twentyhq/twenty/pull/21615
- Add call recording scheduling backend by @ehconitin in https://github.com/twentyhq/twenty/pull/21629
- fix(ai) - workflow tool outputs optim + display fix by @etiennejouan in https://github.com/twentyhq/twenty/pull/21500
- Add single-record People Data Labs enrich functions (company & person) by @bosiraphael in https://github.com/twentyhq/twenty/pull/21650
- fix(front): remove runtime default-view creation fallback by @charlesBochet in https://github.com/twentyhq/twenty/pull/21652
- fix(docker): run twenty-server in production mode (NODE_ENV=production) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21635
- fix(ui): default Monaco CodeEditor to scrollBeyondLastLine: false by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21657
- fix(server): run 2-14 standard relation label/icon heal as a system build by @charlesBochet in https://github.com/twentyhq/twenty/pull/21658
- Add Recall webhook status handler to the meeting bot app by @ehconitin in https://github.com/twentyhq/twenty/pull/21659
- fix(route-trigger): return 422 instead of 500 for logic function execution errors by @charlesBochet in https://github.com/twentyhq/twenty/pull/21656
- fix(server): run 2-14 standard relation label/icon heal as a system build by @charlesBochet in https://github.com/twentyhq/twenty/pull/21667
- Enable inline field editing in calendar event details by @ehconitin in https://github.com/twentyhq/twenty/pull/21666
- Update GitHub banners and remove unused assets by @Bonapara in https://github.com/twentyhq/twenty/pull/21655
- Clean up MCP Monaco editor by @Bonapara in https://github.com/twentyhq/twenty/pull/21643
- Load twenty-ui global styles in twenty-front Storybook by @bosiraphael in https://github.com/twentyhq/twenty/pull/21665
- feat(ai-agent): suggest similar tool names when tool discovery misses by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21654
- ci: migrate cross-repo dispatch senders to workflow_dispatch (actions:write) by @prastoin in https://github.com/twentyhq/twenty/pull/21648
- feat(admin-panel) - add billing/usage section by @etiennejouan in https://github.com/twentyhq/twenty/pull/21672
- Update Connection provider path by @martmull in https://github.com/twentyhq/twenty/pull/21678
- i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21681
- fix(cli): detect expired token on deploy and offer interactive re-auth by @Manibharadwaj in https://github.com/twentyhq/twenty/pull/21335
- Hide Input and Test tabs for app logic function nodes by @bosiraphael in https://github.com/twentyhq/twenty/pull/21671
- Show app name on workflow logic function nodes by @bosiraphael in https://github.com/twentyhq/twenty/pull/21675
- feat(onboarding): prefill the invite step with teammates from the connected calendar by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21640
- feat(workflow): expand manual-trigger runtime payload with payload + _metadata by @thomtrp in https://github.com/twentyhq/twenty/pull/21676
- fix(messaging): honor IMAP/SMTP encryption setting instead of inferring it from the port by @neo773 in https://github.com/twentyhq/twenty/pull/21562
- Support variables file email attachment by @neo773 in https://github.com/twentyhq/twenty/pull/21613
- Stabilize flaky Argos stories in twenty-front storybook by @bosiraphael in https://github.com/twentyhq/twenty/pull/21691
- fix(messaging): pin Google OAuth2 client to native fetch by @neo773 in https://github.com/twentyhq/twenty/pull/21668
- fix(server): default timeline thread visibility to METADATA by @neo773 in https://github.com/twentyhq/twenty/pull/21669
- perf(onboarding): compute invite suggestions on-demand by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21696
- fix(onboarding): show the connect step after workspace creation by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21701
- feat(code-interpreter): reuse a warm sandbox per conversation (E2B) by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21664
- Show app logo and name in workflow step side panel header by @bosiraphael in https://github.com/twentyhq/twenty/pull/21689
- Let users pick their workspace subdomain during sign-up by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21641
- feat(sdk): let docker:start choose the server version by @charlesBochet in https://github.com/twentyhq/twenty/pull/21690
- Fix selectable list arrow focus by @Bonapara in https://github.com/twentyhq/twenty/pull/21679
- Remove twenty-ui-deprecated and migrate frontend to twenty-ui by @bosiraphael in https://github.com/twentyhq/twenty/pull/21596
- Partners app: profile picture (additive file field), derived region & deployment, scope cleanup (0.5.4) by @rashad in https://github.com/twentyhq/twenty/pull/21709
- fix(route-trigger): distinguish user vs platform logic function execution errors by @charlesBochet in https://github.com/twentyhq/twenty/pull/21715
- Added page card box-shadow by @Bonapara in https://github.com/twentyhq/twenty/pull/21688
- i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21724
- fix(front): wait for viewFields + fieldMetadataItems before opening the metadata gate by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21713
- fix(front): home redirect honors first object of the navigation menu by @thomtrp in https://github.com/twentyhq/twenty/pull/21626
- docs: update calendar-email page by @neo773 in https://github.com/twentyhq/twenty/pull/21719
- i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21741
- feat(server): add isSystemSideEffect & merge createOneObject/createOneField side-effect migrations by @Weiko in https://github.com/twentyhq/twenty/pull/21673
- feat(workflow): use workspace member as variable sender for emails by @thomtrp in https://github.com/twentyhq/twenty/pull/21582
- Point New UI visual regression at the twenty-ui Argos project by @bosiraphael in https://github.com/twentyhq/twenty/pull/21728
- Provide custom workspace id while seeding by @prastoin in https://github.com/twentyhq/twenty/pull/21721
- Add limit on view widget by @martmull in https://github.com/twentyhq/twenty/pull/21718
- i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21746
- Add stale Recall bot reconciliation by @ehconitin in https://github.com/twentyhq/twenty/pull/21720
- fix(server): allow app-defined permission flags to be referenced by a role in the same sync by @Weiko in https://github.com/twentyhq/twenty/pull/21742
- feat(workflow): surface manual-trigger payload + metadata in variable picker by @thomtrp in https://github.com/twentyhq/twenty/pull/21692
- fix(ai): handle dynamic-tool message parts in chat persistence by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21740
- [BREAKING CHANGE] fix chart cache collisions with key-based data plumbing by @ehconitin in https://github.com/twentyhq/twenty/pull/21743
- feat(billing) - facilitate top up in ai chat by @etiennejouan in https://github.com/twentyhq/twenty/pull/21645
- ci: remove merge queue, run e2e on push to main by @charlesBochet in https://github.com/twentyhq/twenty/pull/21722
- fix(server): enforce lowercase universalIdentifier in sync by @Weiko in https://github.com/twentyhq/twenty/pull/21754
- fix(ai): prevent chat thread bricking from tool parts with null input by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21752
- fix(front): stop impersonation from corrupting the impersonator's profile name by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21757
- Twenty app e2e app prod parity dispatch by @prastoin in https://github.com/twentyhq/twenty/pull/21750
- feat(workflow): expected output schema for runtime-output steps + validation by @etiennejouan in https://github.com/twentyhq/twenty/pull/21744
- fix: enforce strict rules for currency value handling by ai chatbot by @dankgarlic1 in https://github.com/twentyhq/twenty/pull/21470
- Add post-call recording ingestion and billing by @ehconitin in https://github.com/twentyhq/twenty/pull/21758
- Reorganize twenty-ui into best-practice component domains and per-component folders by @bosiraphael in https://github.com/twentyhq/twenty/pull/21745
- Tool execution metrics by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/21587
- chore(deps-dev): bump @babel/core from 7.28.0 to 7.29.7 by @dependabot[bot] in https://github.com/twentyhq/twenty/pull/21760
- chore(deps-dev): bump @electron-forge/maker-zip from 7.11.1 to 7.11.2 by @dependabot[bot] in https://github.com/twentyhq/twenty/pull/21761
- chore(deps): bump mintlify from 4.2.595 to 4.2.629 by @dependabot[bot] in https://github.com/twentyhq/twenty/pull/21762
- Reworked website. by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21763
- Centralize and standardize impersonation validation rules by @prastoin in https://github.com/twentyhq/twenty/pull/21717
- Fix typecheck by @bosiraphael in https://github.com/twentyhq/twenty/pull/21783
- fix: exclude non-groupBy date fields (deletedAt) from calendar field selection by @ehconitin in https://github.com/twentyhq/twenty/pull/21764
- Remove twenty-shared import from postcard app by @prastoin in https://github.com/twentyhq/twenty/pull/21786
- Configure Recall bot server variables by @ehconitin in https://github.com/twentyhq/twenty/pull/21774
- Add search input to manual record trigger object select by @bosiraphael in https://github.com/twentyhq/twenty/pull/21777
- feat(workflow): add update_agent tool and responseFormat-aware AI Agent step schema by @etiennejouan in https://github.com/twentyhq/twenty/pull/21755
- Bump call recording app version by @martmull in https://github.com/twentyhq/twenty/pull/21787
- Accessibility fix pass for twenty-ui input components by @bosiraphael in https://github.com/twentyhq/twenty/pull/21776
- Fix flaky Argos diffs by @bosiraphael in https://github.com/twentyhq/twenty/pull/21771
- fix(server): prevent enum migration failure for long identifier names by @thomtrp in https://github.com/twentyhq/twenty/pull/21748
- i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21789
- fix(server): type WasRemovedInUpgrade columns with WasRemovedInUpgrade<> by @Weiko in https://github.com/twentyhq/twenty/pull/21785
- Fix side panel command menu header controls by @Bonapara in https://github.com/twentyhq/twenty/pull/21747
- Converge Recall transcript artifacts on meeting start by @ehconitin in https://github.com/twentyhq/twenty/pull/21788
- feat(workflow): auto-layout steps on AI workflow creation via shared tidy-up by @etiennejouan in https://github.com/twentyhq/twenty/pull/21756
- Accessibility fix pass for remaining twenty-ui domains by @bosiraphael in https://github.com/twentyhq/twenty/pull/21790
- [Website] Full-bleed hero/testimonials, nav restructure, OpenNext deploy config by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21794
- Partner application form: required fields, skills rework, fail-fast validation by @rashad in https://github.com/twentyhq/twenty/pull/21710
- fix(logic-function): treat invoke timeout as a user-level error, not a platform error by @thomtrp in https://github.com/twentyhq/twenty/pull/21779
- i18n - website translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21795
- Disable Claude Code attribution on commits and PRs by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21798
- feat(auth): collect the workspace logo on the sign-up creation step by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21723
- [Website] Carry over README assets, .well-known, and an env template by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21803
- feat(website - self hosts billing): add internal endpoint to reissue enterprise keys by @ijreilly in https://github.com/twentyhq/twenty/pull/21660
- [Website] Port partner application form rework (required fields, skills, fail-fast) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21802
- [Website] Straighten the footer 20 model by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21797
- feat(server): report enterprise instance metadata on license validation by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21793
- fix(metadata): remove deprecated isCustom from Objects and Fields by @Weiko in https://github.com/twentyhq/twenty/pull/21799
- Scope empty fixture workspaces to upgrade integration tests by @neo773 in https://github.com/twentyhq/twenty/pull/21778
- Fix(record table): Drag select position by @git-init-priyanshu in https://github.com/twentyhq/twenty/pull/21579
- Fix view type label casing by @Bonapara in https://github.com/twentyhq/twenty/pull/21772
- fix(front): unwrap react-qr-code default export to fix 2FA crash on prod by @charlesBochet in https://github.com/twentyhq/twenty/pull/21804
- messaging: gmail folder backfill by @neo773 in https://github.com/twentyhq/twenty/pull/21753
- fix(workflow): hide empty option for non-nullable select fields by @brendanerofeev in https://github.com/twentyhq/twenty/pull/21075
- feat(server): derive email/calendar timelines from object relations by @neo773 in https://github.com/twentyhq/twenty/pull/21684
- fix(twenty-shared): derive short-number suffix from the rounded value by @yashs33244 in https://github.com/twentyhq/twenty/pull/21591
- fix(security): bump form-data to 4.0.6 (CRLF injection) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21808
- fix(security): remove vulnerable lodash 4.17.23 (code injection + prototype pollution) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21809
- fix(security): bump piscina to 4.9.3 (prototype pollution → RCE) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21810
- fix(security): bump protobufjs to 7.6.4 (DoS + property shadowing) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21811
- fix(security): bump http-proxy-middleware to 3.0.7 (multipart field injection) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21812
- fix(security): bump tar to 7.5.16 across lockfiles (PAX file smuggling) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21813
- fix(security): bump markdown-it to 14.2.0 (smartquotes ReDoS) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21814
- fix(security): dedupe uuid to 11.1.1 (missing buffer bounds check) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21815
- fix(security): patch yaml across both major lines (stack overflow) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21817
- [Website] Add internal enterprise key reissue endpoint. by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21807
- Infer record pickers for record-typed logic function workflow inputs by @bosiraphael in https://github.com/twentyhq/twenty/pull/21494
- fix(security): bump webpack-dev-server resolution to 5.2.5 (HMR WS interception) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21818
- feat(partners): add partner-application-triage and partner-meeting-recap skills by @rashad in https://github.com/twentyhq/twenty/pull/21819
- fix call recording bot automatic leave activate after bug by @ehconitin in https://github.com/twentyhq/twenty/pull/21820
- feat(onboarding): always show the Create Profile step by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21823
- [Website] Cut over to the rebuilt site by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21825
- fix(front): emit error instead of completing empty on failed token renewal by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21822
- fix(front): pass auth headers to GraphiQL fetcher for introspection by @etiennejouan in https://github.com/twentyhq/twenty/pull/21821
- fix: filtered view resetting to unfiltered list on navigation by @parshipcy in https://github.com/twentyhq/twenty/pull/21080
- i18n - website translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21827
- Create CI workflow for internal apps by @martmull in https://github.com/twentyhq/twenty/pull/21791
- fix: reorder table columns against visible fields only (#20940) by @singhharsh1708 in https://github.com/twentyhq/twenty/pull/21084
- feat(billing): embed Stripe Payment Element in onboarding by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21759
- fix(security): bump tar to 7.5.16 in seed-dependencies (PAX file smuggling) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21829
- fix(workflow): show fields for system objects in record-updated trigger by @thomtrp in https://github.com/twentyhq/twenty/pull/21826
- Add application to test input in workflow by @martmull in https://github.com/twentyhq/twenty/pull/21830
- fix(workflow): label manual trigger record output as Record/Records by @thomtrp in https://github.com/twentyhq/twenty/pull/21832
- fix: prevent Create Workspace redirect from being cancelled by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21835
- docs(user-guide): remove unsupported Between operator for Number filters by @thomtrp in https://github.com/twentyhq/twenty/pull/21838
- fix: Edit Layout keeping the command menu open by @parshipcy in https://github.com/twentyhq/twenty/pull/21161
- Deprecate legacy encryption by @prastoin in https://github.com/twentyhq/twenty/pull/21831
- fix(front): recompute ExpandableList visible chips on resize by @dilanmelvin in https://github.com/twentyhq/twenty/pull/21139
- Update ci internal applications by @martmull in https://github.com/twentyhq/twenty/pull/21837
- fix(ai): validate AI agent output field names against schema-key constraint by @charlesBochet in https://github.com/twentyhq/twenty/pull/21834
- i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21841
- Enable getting started translations by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/21842
- Add Update fields select to People Data Labs enrichment functions by @bosiraphael in https://github.com/twentyhq/twenty/pull/21801
- fix(onboarding): refresh stale workspace in currentWorkspace field resolver by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21839
- fix(front): allow null subfields in Phones default value so Save enables by @thomtrp in https://github.com/twentyhq/twenty/pull/21847
- App uninstall lambda, layers cleanup by @prastoin in https://github.com/twentyhq/twenty/pull/21749
- reset filter search input on field select by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/21850
- fix(front): keep record table footer visible below information banner by @thomtrp in https://github.com/twentyhq/twenty/pull/21852
- i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21859
- fix(website): restore deploymentId, security headers and redirects in next config by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21851
- Accessibility guardrails and component hardening for twenty-ui by @bosiraphael in https://github.com/twentyhq/twenty/pull/21848
- feat: add resizable kanban column width by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21828
- Fix record table footer hidden when an information banner is visible by @bosiraphael in https://github.com/twentyhq/twenty/pull/21860
- Add standard record page layout for calendar events by @ehconitin in https://github.com/twentyhq/twenty/pull/21857
- fix(workflow): add tooltip explaining why the variable picker is disabled by @thomtrp in https://github.com/twentyhq/twenty/pull/21862
- Add twenty slack to internal application ci by @martmull in https://github.com/twentyhq/twenty/pull/21849
- i18n - website translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21864
- i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21865
- i18n - website translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21866
- Workspace migration post transaction commit side effect by @prastoin in https://github.com/twentyhq/twenty/pull/21845
- Fix broken CSV import grid layout by @bosiraphael in https://github.com/twentyhq/twenty/pull/21867
- fix(security): drop vulnerable serialize-javascript via terser-webpack-plugin bump by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21871
- i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21873
- fix(security): refresh undici across lockfiles (6.x → 6.27.0, 7.x → 7.28.0) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21870
- fix(security): bump socks to clear vulnerable ip-address (XSS) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21872
- Clear stale parent-view filters on front-component cross-object navigation by @bosiraphael in https://github.com/twentyhq/twenty/pull/21869
- Add transcript tab to calendar record page by @ehconitin in https://github.com/twentyhq/twenty/pull/21792
- Rename meeting bot app variables from RECALL_BOT_* to MEETING_BOT_* by @ehconitin in https://github.com/twentyhq/twenty/pull/21878
- Add recall io webhook endpoint by @martmull in https://github.com/twentyhq/twenty/pull/21879
- i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21884
- fix(front): respect user number format for counts and aggregates by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21894
- test(server): make timeline integration test self-seed its data by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21896
- fix(security): bump nodemailer to 9.0.1 (raw-option SSRF / file read) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21903
- fix(security): bump dompurify to 3.4.11 (config/hook pollution) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21905
- feat(website): spotlight visual on top and uniform tile background by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21906
- fix(twenty-website): fill feature-card visual frame on wide viewports by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21876
- fix: hide restricted objects and views nested in navigation folders by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/21914
- Fix dangling relation fields crashing records after deleting a custom object by @Weiko in https://github.com/twentyhq/twenty/pull/21874
- feat(workflow): condition filter on database-event triggers by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21868
- fix: cannot create record from table view — empty morph to-many relation returns null by @charlesBochet in https://github.com/twentyhq/twenty/pull/21846
- fix(front): prevent AI agent output field error message from overlapping the Type field by @charlesBochet in https://github.com/twentyhq/twenty/pull/21921
- feat(workflow): add Pick Record action (1/3 — random selection) by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21899
- feat(sdk): declare row-level permission predicates in the role manifest by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21919
- feat(workflow): Pick Record round robin strategy (2/3) by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21900
- i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21923
- feat(workflow): Pick Record load balanced strategy (3/3) by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21902
- fix(twenty-server): remove uuid format from openapi pageInfo cursors by @Manibharadwaj in https://github.com/twentyhq/twenty/pull/21920
- fix(ai): gemini not working in ask ai by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/21898
- ci: block bot contributors from PR commit history by @charlesBochet in https://github.com/twentyhq/twenty/pull/21926
- chore(deps): bump wrangler to 4.102.0 and drop the wrangler/esbuild resolution by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21930
- fix(security): bump react-router to 6.30.4 via react-router-dom (open redirect) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21931
- [Twenty-front]: Bunch of View Picker Fixes and improvements. by @git-init-priyanshu in https://github.com/twentyhq/twenty/pull/21290
- fix(security): drop vulnerable postcss via styled-components bump (XSS) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21932
- Add twenty-discord on internal ci apps by @martmull in https://github.com/twentyhq/twenty/pull/21928
- Fix meeting bot CalendarEvent field visibility and editability by @ehconitin in https://github.com/twentyhq/twenty/pull/21883
- Add twenty-exa application to internal app ci by @martmull in https://github.com/twentyhq/twenty/pull/21882
- fix: surface proper errors for People create/delete constraint violations by @Pantkartik in https://github.com/twentyhq/twenty/pull/21270
- fix(workflow): serialize object variables in resolved prompts by @ijreilly in https://github.com/twentyhq/twenty/pull/21612
- Add twenty-fireflies on internal ci apps by @martmull in https://github.com/twentyhq/twenty/pull/21939
- Add self-hosting on internal ci apps by @martmull in https://github.com/twentyhq/twenty/pull/21940
- fix(front): isolate record table dashboard widget filters on duplicate by @ehconitin in https://github.com/twentyhq/twenty/pull/21936
- make mergeMany atomic and optimize relation/field-map handling by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/21885
- Add twenty-for-twenty on internal ci apps by @martmull in https://github.com/twentyhq/twenty/pull/21944
- Add twenty-linear on internal ci apps by @martmull in https://github.com/twentyhq/twenty/pull/21942
- fix(server): surface nested QueryFailedError detail in upgrade error formatting by @charlesBochet in https://github.com/twentyhq/twenty/pull/21948
- Remove jotai from twenty-ui by @bosiraphael in https://github.com/twentyhq/twenty/pull/21937
- Add people-data-labs on internal ci apps by @martmull in https://github.com/twentyhq/twenty/pull/21941
- suport non aws providers 1 by @jubinsoni in https://github.com/twentyhq/twenty/pull/21927
- Refactor search vector field by @prastoin in https://github.com/twentyhq/twenty/pull/21947
- Add gallery screenshot to People Data Labs app by @bosiraphael in https://github.com/twentyhq/twenty/pull/21960
- chore(twenty-server): upgrade typeorm to 0.3.29 by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21957
- fix(front): keep relation field record tables scoped to the host record by @rcshetty3 in https://github.com/twentyhq/twenty/pull/21293
- feat: real-time email & calendar tabs on record pages by @neo773 in https://github.com/twentyhq/twenty/pull/21953
- fix(website): render partner marketplace dynamically to stop profile 404s by @rashad in https://github.com/twentyhq/twenty/pull/21963
- perf(server): rate-limit the active event stream count scan by @charlesBochet in https://github.com/twentyhq/twenty/pull/21951
- perf(server): raise workspace local cache size and meter evictions by @charlesBochet in https://github.com/twentyhq/twenty/pull/21954
- Remove unused call-recording application by @martmull in https://github.com/twentyhq/twenty/pull/21966
- fix(server): skip callRecordings widget in calendar-event page sync when field is absent by @charlesBochet in https://github.com/twentyhq/twenty/pull/21967
- Improve twenty-ui packaging for standalone publishing by @bosiraphael in https://github.com/twentyhq/twenty/pull/21946
- fix(front): scope relation table widget via currentRecordId by @charlesBochet in https://github.com/twentyhq/twenty/pull/21965
- Fix field widget textarea focus reset by @Bonapara in https://github.com/twentyhq/twenty/pull/21959
New Contributors
- @dankgarlic1 made their first contribution in https://github.com/twentyhq/twenty/pull/21470
- @singhharsh1708 made their first contribution in https://github.com/twentyhq/twenty/pull/21084
- @dilanmelvin made their first contribution in https://github.com/twentyhq/twenty/pull/21139
- @jubinsoni made their first contribution in https://github.com/twentyhq/twenty/pull/21927
- @rcshetty3 made their first contribution in https://github.com/twentyhq/twenty/pull/21293
Full Changelog: https://github.com/twentyhq/twenty/compare/twenty/v2.14.0...twenty/v2.15.0
Breaking Changes
- [BREAKING CHANGE] fix chart cache collisions with key-based data plumbing
Security Fixes
- fix(security): bump form-data to 4.0.6 (CRLF injection)
- fix(security): remove vulnerable lodash 4.17.23 (code injection + prototype pollution)
- fix(security): bump piscina to 4.9.3 (prototype pollution → RCE)
- fix(security): bump protobufjs to 7.6.4 (DoS + property shadowing)
- fix(security): bump http-proxy-middleware to 3.0.7 (multipart field injection)
- fix(security): bump tar to 7.5.16 across lockfiles (PAX file smuggling)
- fix(security): bump markdown-it to 14.2.0 (smartquotes ReDoS)
- fix(security): patch yaml across both major lines (stack overflow)
- fix(security): bump webpack-dev-server resolution to 5.2.5 (HMR WS interception)
- fix(security): bump tar to 7.5.16 in seed-dependencies (PAX file smuggling)
- fix(security): drop vulnerable serialize-javascript via terser-webpack-plugin bump
- fix(security): refresh undici across lockfiles (6.x → 6.27.0, 7.x → 7.28.0)
- fix(security): bump socks to clear vulnerable ip-address (XSS)
- fix(security): bump nodemailer to 9.0.1 (raw-option SSRF / file read)
- fix(security): bump dompurify to 3.4.11 (config/hook pollution)
- fix(security): bump react-router to 6.30.4 via react-router-dom (open redirect)
- fix(security): drop vulnerable postcss via styled-components bump (XSS)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- vtwenty/v2.20.0 Deprecate `fieldMetadata` and `objectMetadata` standardOverrides.
- vtwenty/v2.13.0 Gate record creation on isUICreatable only, decoupled from isSystem.
- vtwenty/v2.13.0 Rename isUIReadOnly to isUIEditable and add isUICreatable, affecting app developers.
- vtwenty/v2.12.0 Deprecate isCustom for Objects and Fields.
- vtwenty/v2.12.0 Deprecate dummy enterprise key (2/2).
Beta — feedback welcome: [email protected]