twenty

vtwenty/v2.20.0 Breaking

This release includes 2 breaking changes for platform teams planning a safe upgrade.

Published 16d Productivity & Wikis

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

crm crm-system customer graphql javascript marketing

+8 more

monorepo nestjs postgresql react reactjs sales typescript web

Affected surfaces

deps

ReleasePort's take

Moderate signal

editorial:auto 11d

The release upgrades the Node base to version 24.18.0, applying all available CVE fixes and addressing a premature‑close issue in http.Agent.

Why it matters: CVE patches reduce attack surface; upgrade to Node 24.18.0 immediately if you use http.Agent.

Summary

AI summary

Broad release touches workflow, apps, chore, and fix.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Bump Node base to 24.18.0, applying all CVE fixes and http.Agent premature‑close fix. Bump Node base to 24.18.0, applying all CVE fixes and http.Agent premature‑close fix. Source: llm_adapter@2026-07-15 Confidence: high	—
Breaking	High	Deprecate `fieldMetadata` and `objectMetadata` standardOverrides. Deprecate `fieldMetadata` and `objectMetadata` standardOverrides. Source: llm_adapter@2026-07-15 Confidence: low	—
Feature
Feature	Medium	Add public apps marketplace with one‑click install. Add public apps marketplace with one‑click install. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Support server‑scoped files via nullable `workspaceId` on file table. Support server‑scoped files via nullable `workspaceId` on file table. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Optionally preselect fast or smart model when opening Ask AI. Optionally preselect fast or smart model when opening Ask AI. Source: llm_adapter@2026-07-15 Confidence: high	—
Performance	Medium	Tighten `createMany` upsert candidate lookup to avoid broad OR scans. Tighten `createMany` upsert candidate lookup to avoid broad OR scans. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix
Bugfix	Medium	Fix root domain `/authorize` rendering workspace‑scoped consent page. Fix root domain `/authorize` rendering workspace‑scoped consent page. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Fix onboarding entry animations not triggering on first load. Fix onboarding entry animations not triggering on first load. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Fix billing upgrade invoices already settled from being paid again. Fix billing upgrade invoices already settled from being paid again. Source: llm_adapter@2026-07-15 Confidence: low	—
Bugfix	Medium	Prevent duplicate junction rows from double‑fired checkbox clicks in multi‑select menu items. Prevent duplicate junction rows from double‑fired checkbox clicks in multi‑select menu items. Source: llm_adapter@2026-07-15 Confidence: low	—
Bugfix	Medium	Skip paying upgrade invoices already settled at finalization in billing. Skip paying upgrade invoices already settled at finalization in billing. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—

Full changelog

What's Changed

chore: bump version to 2.20.0 by @twenty-pr[bot] in https://github.com/twentyhq/twenty/pull/22639
Unify featured/vetted app terminology to featured by @martmull in https://github.com/twentyhq/twenty/pull/22648
2.20 fieldMetadata and objectMetadata standardOverrides deprecation by @prastoin in https://github.com/twentyhq/twenty/pull/22650
Fix root domain /authorize rendering workspace-scoped consent page by @ehconitin in https://github.com/twentyhq/twenty/pull/22641
Fireflies: port app to the CallRecording standard object by @ehconitin in https://github.com/twentyhq/twenty/pull/22642
Suppress Claude session URL in generated PR bodies and commits by @martmull in https://github.com/twentyhq/twenty/pull/22651
feat(server): support server-scoped files via nullable workspaceId on file table by @martmull in https://github.com/twentyhq/twenty/pull/22587
fix(rls): prefill RLS predicate fields when creating related records by @Aressand in https://github.com/twentyhq/twenty/pull/22620
fix: corrected grammar in approved domain message by @brahmlower in https://github.com/twentyhq/twenty/pull/22646
fix(workflow): handle IS/IS_NOT operand in text and array filters by @thomtrp in https://github.com/twentyhq/twenty/pull/22640
fix(workflow): batch staled run reset to avoid Postgres param limit by @thomtrp in https://github.com/twentyhq/twenty/pull/22654
fix: add workspace command to backfill missing AGENT source enum values by @etiennejouan in https://github.com/twentyhq/twenty/pull/22593
fix: dropping favorites to the last position in a open folder by @parshipcy in https://github.com/twentyhq/twenty/pull/22360
feat(workflow): scaffold core workflowVersion entity + trigger cache (phase 0) by @thomtrp in https://github.com/twentyhq/twenty/pull/21674
fix(call-recorder): stream Recall media to storage to fix OOM by @ehconitin in https://github.com/twentyhq/twenty/pull/22652
Make onboarding steps responsive on mobile by @bosiraphael in https://github.com/twentyhq/twenty/pull/22659
feat(sdk): validate graph page-layout widgets at build time by @charlesBochet in https://github.com/twentyhq/twenty/pull/22559
Merge app Public URL and Public Domains settings into one App URL section by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22666
fix(messaging): add sender name to IMAP/SMTP From headers by @PratikMahajan in https://github.com/twentyhq/twenty/pull/22603
Fix email validation for over-length inline edits by @deep231w in https://github.com/twentyhq/twenty/pull/22426
fix(docker): pin node base back to 24.16.0 to stop premature-close fetch failures by @charlesBochet in https://github.com/twentyhq/twenty/pull/22673
i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22676
feat(server): add public marketplace resolver for vetted app catalog by @martmull in https://github.com/twentyhq/twenty/pull/22647
fix(docker): bump node base to 24.18.0 (all 24.17.0 CVE fixes + http.Agent premature-close fix) by @charlesBochet in https://github.com/twentyhq/twenty/pull/22677
[Billing for self hosts] Add info in description by @ijreilly in https://github.com/twentyhq/twenty/pull/22660
feat(messaging): message campaign delivery stats + views by @neo773 in https://github.com/twentyhq/twenty/pull/22661
Chore/remove messaging mock specs by @neo773 in https://github.com/twentyhq/twenty/pull/22665
Validate range version app dev sync by @prastoin in https://github.com/twentyhq/twenty/pull/22625
refactor(app-marketplace): rename featured to vetted by @martmull in https://github.com/twentyhq/twenty/pull/22674
feat(workflow): backfill workspace workflowVersion into core (phase A) by @thomtrp in https://github.com/twentyhq/twenty/pull/22663
fix(front): page header title overlap, Cmd+K on page layout pages & stable tooltip id by @ijreilly in https://github.com/twentyhq/twenty/pull/22678
feat(website): add public apps marketplace with one-click install by @martmull in https://github.com/twentyhq/twenty/pull/22611
[Twenty Fireflies] Add calendar event summary and transcript UI components by @ehconitin in https://github.com/twentyhq/twenty/pull/22667
feat(call-recorder): type application and server variables, make summary prompt rich text by @ehconitin in https://github.com/twentyhq/twenty/pull/22685
feat(ai): optionally preselect fast or smart model when opening Ask AI by @Weiko in https://github.com/twentyhq/twenty/pull/22679
chore: remove IS_MESSAGING_CALENDAR_WEBHOOK_ENABLED flag by @neo773 in https://github.com/twentyhq/twenty/pull/22680
feat(ai-chat): inject current date & per-message timestamps into agent context by @etiennejouan in https://github.com/twentyhq/twenty/pull/22632
chore: sync AI model catalog from models.dev by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22710
fix(billing) - skip paying upgrade invoices already settled at finalization by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22705
i18n - website translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22683
fix(billing): only reactivate suspended workspaces when subscription is in good standing by @etiennejouan in https://github.com/twentyhq/twenty/pull/22687
feat(ai) - add light AI chat turn instrumentation (metrics + Sentry correlation) by @etiennejouan in https://github.com/twentyhq/twenty/pull/22692
fix(sdk): report the connected server's real version in dev version check by @ijreilly in https://github.com/twentyhq/twenty/pull/22670
docs(apps): fix stale CLI commands in getting-started and operations pages by @martmull in https://github.com/twentyhq/twenty/pull/22688
docs(apps): fix nonexistent SDK import paths and unsupported config in layout pages by @martmull in https://github.com/twentyhq/twenty/pull/22689
docs(apps): align project structure and testing pages with the actual scaffold by @martmull in https://github.com/twentyhq/twenty/pull/22690
docs(apps): document missing enum values and complete entity references by @martmull in https://github.com/twentyhq/twenty/pull/22691
docs(apps): rewrite install hooks page — real client API, one explanation per concept by @martmull in https://github.com/twentyhq/twenty/pull/22694
fix(create-twenty-app): working docs URL in final message, complete dev:add table in AGENTS.md by @martmull in https://github.com/twentyhq/twenty/pull/22695
docs(apps): make the workspace functions URL the primary route-serving story by @martmull in https://github.com/twentyhq/twenty/pull/22693
Welcome animation when a workspace is set up by @bosiraphael in https://github.com/twentyhq/twenty/pull/22622
Fix flaky webhook delivery integration test (fixed sleep -> poll) by @martmull in https://github.com/twentyhq/twenty/pull/22699
Fix flaky e2e tests: CI-realistic timeouts + retry-safe kanban field label by @martmull in https://github.com/twentyhq/twenty/pull/22701
Fix flaky "read EINVAL" in integration tests: bump msw to 2.12.14 by @martmull in https://github.com/twentyhq/twenty/pull/22702
ci: add app-docs drift check agent by @martmull in https://github.com/twentyhq/twenty/pull/22696
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22714
i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22715
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22716
feat(billing): collect credit card in-app when starting subscription from billing page by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22706
Rebuild email composer recipient fields as a structured chip input with person resolution and autocomplete by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22668
i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22723
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22725
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22726
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22728
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22729
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22730
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22731
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22732
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22733
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22735
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22738
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22741
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22743
Fix onboarding entry animations not triggering on first load by @bosiraphael in https://github.com/twentyhq/twenty/pull/22724
Fail App docs drift check ci if doc drift detected by @martmull in https://github.com/twentyhq/twenty/pull/22713
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22744
perf(upsert) - tighten createMany upsert candidate lookup to avoid broad OR scans by @etiennejouan in https://github.com/twentyhq/twenty/pull/22721
fix: prevent duplicate junction rows from double-fired checkbox clicks in multi-select menu items by @thomtrp in https://github.com/twentyhq/twenty/pull/22737
Fix onboarding locale reverting to English after signup by @bosiraphael in https://github.com/twentyhq/twenty/pull/22675
docs: surface the self-serve partner marketplace on high-intent pages by @rashad in https://github.com/twentyhq/twenty/pull/22719
Centralize system field side effects + search field metadata by @prastoin in https://github.com/twentyhq/twenty/pull/22594
fix(server): allow relabelling onto a field introduced in the same manifest sync by @prastoin in https://github.com/twentyhq/twenty/pull/22727
i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22752
Only propose configured apps during onboarding install step by @bosiraphael in https://github.com/twentyhq/twenty/pull/22712
feat(workflow): add core workflow entity (syncable) + create-table by @thomtrp in https://github.com/twentyhq/twenty/pull/22746
Add Last contact on Companies and Opportunities to last-contact app by @martmull in https://github.com/twentyhq/twenty/pull/22720
i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22759
i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22762
i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22764
chore: sync AI model catalog from models.dev by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22770
Fix shard 12 integration test failure: regenerate stale object metadata snapshot from #22594 by @martmull in https://github.com/twentyhq/twenty/pull/22768
fix(twenty-sdk): restore require/__filename/__dirname in rolldown ESM CLI bundle by @martmull in https://github.com/twentyhq/twenty/pull/22711
Seed CHANGELOG.md and SETUP.md in create-twenty-app scaffold by @martmull in https://github.com/twentyhq/twenty/pull/22769
feat(workflow): add universalIdentifier + applicationId to core workflowVersion by @thomtrp in https://github.com/twentyhq/twenty/pull/22747
Fix integration test hang on unmocked requests + de-flake object metadata suite by @neo773 in https://github.com/twentyhq/twenty/pull/22758
Improve application asset management by @martmull in https://github.com/twentyhq/twenty/pull/22564
migrate 10 modules off NestjsQueryTypeOrmModule wiring by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/22763
Gate connected-account webhook subscriptions behind config by @neo773 in https://github.com/twentyhq/twenty/pull/22761
i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22777
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22745
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22779
Allow CLI dev mode on catalog-synced apps without mutating the shared registration by @martmull in https://github.com/twentyhq/twenty/pull/22756
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22781
Fix front-component serving on Safari, kill stale presigned caching, and cache built bundles client-side by @prastoin in https://github.com/twentyhq/twenty/pull/22672
remove nestjs-query from app-token and drop unused createOneAppToken mutation by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/22765
Fix front-component cache read rejection bypassing network fallback by @prastoin in https://github.com/twentyhq/twenty/pull/22785
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22784
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22787
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22788
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22789
fix(front): render +N button for right-edge-clipped chips in expandable list by @thomtrp in https://github.com/twentyhq/twenty/pull/22748
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22793
i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22794
fix(twenty-partners): align createdAt view field with 2.19 deterministic ids and bump to 1.2.10 by @prastoin in https://github.com/twentyhq/twenty/pull/22782
remove nestjs-query from user and workspace resolvers by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/22766
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22796
Catch Cursor's "Made with" attribution footer in blocked contributors check by @prastoin in https://github.com/twentyhq/twenty/pull/22791
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22798
remove nestjs-query auto-resolver from index-metadata by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/22775
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22799
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22802
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22804
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22806
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22807
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22809
docs: partner CTAs on high-traffic pages (workflows, data-model, docker-compose) by @rashad in https://github.com/twentyhq/twenty/pull/22808
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22810
fix(workflow): scope one-active-per-workflow index to workspace by @thomtrp in https://github.com/twentyhq/twenty/pull/22795
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22812
fix(front): clean stale morph relations from metadata store on object deletion by @ijreilly in https://github.com/twentyhq/twenty/pull/22681
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22813
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22814
Run front components in a sandboxed opaque-origin iframe by @bosiraphael in https://github.com/twentyhq/twenty/pull/22588
Fix SDK plan on non installed apps by @Weiko in https://github.com/twentyhq/twenty/pull/22805
accepts any valid expression, not just an identifier by @martmull in https://github.com/twentyhq/twenty/pull/22778
fix(emails): deterministic i18n catalog order to stop recurring i18n PR conflicts by @charlesBochet in https://github.com/twentyhq/twenty/pull/22803
i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22816
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22815
Fix Cloudflare rate limiting during last-contact backfill by @martmull in https://github.com/twentyhq/twenty/pull/22811

New Contributors

@Aressand made their first contribution in https://github.com/twentyhq/twenty/pull/22620
@brahmlower made their first contribution in https://github.com/twentyhq/twenty/pull/22646
@PratikMahajan made their first contribution in https://github.com/twentyhq/twenty/pull/22603
@deep231w made their first contribution in https://github.com/twentyhq/twenty/pull/22426

Full Changelog: https://github.com/twentyhq/twenty/compare/twenty/v2.19.0...twenty/v2.20.0

Breaking Changes

Removed `IS_MESSAGING_CALENDAR_WEBHOOK_ENABLED` flag
Deprecated `fieldMetadata` and `objectMetadata` standardOverrides

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track twenty

Get notified when new releases ship.

About twenty

Building a modern alternative to Salesforce, powered by the community.

All releases →

Related context

Related tools

Earlier breaking changes

vtwenty/v2.13.0 Gate record creation on isUICreatable only, decoupled from isSystem.
vtwenty/v2.13.0 Rename isUIReadOnly to isUIEditable and add isUICreatable, affecting app developers.
vtwenty/v2.12.0 Deprecate isCustom for Objects and Fields.
vtwenty/v2.12.0 Deprecate dummy enterprise key (2/2).
vtwenty/v2.11.0 Remove IS_WORKFLOW_RUN_STEP_LOGS_ENABLED feature flag