twenty

v2.5.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 15d Productivity & Wikis

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

crm crm-system customer graphql javascript marketing

+8 more

monorepo nestjs postgresql react reactjs sales typescript web

Affected surfaces

auth crypto_tls breaking_upgrade

Summary

AI summary

Broad release touches server, chore, fix, and preview-env.

Changes in this release

Type	Severity	Summary	CVE
Security	Medium	harden CI against supply-chain attacks harden CI against supply-chain attacks Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low	—
Breaking	Medium	[breaking: deploy server before front] feat(view-sort): pick sort sub-field inline on the chip [breaking: deploy server before front] feat(view-sort): pick sort sub-field inline on the chip Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low	—
Feature
Feature	Medium	Add Twenty Claude skills package Add Twenty Claude skills package Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high	—
Feature	Medium	add workspace toggle to sync internal emails add workspace toggle to sync internal emails Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high	—
Feature	Medium	forward file input metadata forward file input metadata Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high	—
Feature	Medium	Show logic function label instead of technical name in workflow UI Show logic function label instead of technical name in workflow UI Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high	—
Feature	Medium	Support optional labels on logic-function input schema fields Support optional labels on logic-function input schema fields Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high	—
Feature	Medium	migrate all remaining JWT token types to ES256 migrate all remaining JWT token types to ES256 Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high	—
Feature	Medium	introduce ENCRYPTION_KEY env var with versioned envelope introduce ENCRYPTION_KEY env var with versioned envelope Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high	—
Feature	Medium	Stop ai thinking if credits exhausted Stop ai thinking if credits exhausted Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high	—
Feature	Medium	Dedicated REST controllers for object & field metadata Dedicated REST controllers for object & field metadata Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high	—
Feature	Medium	Simplify create-twenty-app command Simplify create-twenty-app command Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high	—
Feature	Medium	Twenty discord integration Twenty discord integration Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high	—
Feature	Medium	one-hop relation filters in GraphQL API one-hop relation filters in GraphQL API Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high	—
Dependency	Medium	bump react-dropzone from 14.2.3 to 14.4.1 bump react-dropzone from 14.2.3 to 14.4.1 Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low	—
Bugfix
Bugfix	Medium	prevent admin panel workspace upgrade error from overflowing the table prevent admin panel workspace upgrade error from overflowing the table Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high	—
Bugfix	Medium	preserve caret position on controlled input/textarea updates preserve caret position on controlled input/textarea updates Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high	—
Bugfix	Medium	Fix application variable issue Fix application variable issue Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high	—
Bugfix	Medium	handle ImapFlow socket errors instead of crashing the process handle ImapFlow socket errors instead of crashing the process Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high	—
Bugfix	Medium	add subFieldName column early in upgrade sequence add subFieldName column early in upgrade sequence Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high	—
Bugfix	Medium	scope workspace findOne in 1-21 backfill-datasource command scope workspace findOne in 1-21 backfill-datasource command Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high	—
Bugfix	Medium	scope workspace findOne in ApplicationService scope workspace findOne in ApplicationService Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high	—
Refactor
Refactor	Medium	use workflow inputSchema to render boolean, number, and enum fields in code/logic function steps use workflow inputSchema to render boolean, number, and enum fields in code/logic function steps Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low	—
Refactor	Medium	Refactor SAML relayState structure Refactor SAML relayState structure Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low	—
Refactor	Medium	Ignore twenty versions constant files in prettier Ignore twenty versions constant files in prettier Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low	—
Refactor	Medium	rename "Access" tab to "Invite" + fix e2e rename "Access" tab to "Invite" + fix e2e Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low	—
Other	Medium	bump @mui/material from 7.3.8 to 7.3.11 bump @mui/material from 7.3.8 to 7.3.11 Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low	—
Other	Medium	bump vite-plugin-svgr from 4.3.0 to 4.5.0 bump vite-plugin-svgr from 4.3.0 to 4.5.0 Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low	—

Full changelog

What's Changed

Stop rejecting application token on calendar and message events requests by @martmull in https://github.com/twentyhq/twenty/pull/20440
fix: update broken AI documentation link by @ajitkumarsaini02 in https://github.com/twentyhq/twenty/pull/20401
Upgrade sdk version by @martmull in https://github.com/twentyhq/twenty/pull/20444
chore: bump version to 2.5.0 by @twenty-pr[bot] in https://github.com/twentyhq/twenty/pull/20446
chore(members): rename "Access" tab to "Invite" + fix e2e by @FelixMalfait in https://github.com/twentyhq/twenty/pull/20447
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20449
Refactor SAML relayState structure by @prastoin in https://github.com/twentyhq/twenty/pull/20430
Use workflow inputSchema to render boolean, number, and enum fields in code/logic function steps by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/20439
Ignore twenty versions constant files in prettier by @prastoin in https://github.com/twentyhq/twenty/pull/20448
[codex] Add Twenty Claude skills package by @Bonapara in https://github.com/twentyhq/twenty/pull/20450
Encrypt connected account accessToken and refreshToken by @prastoin in https://github.com/twentyhq/twenty/pull/20441
Stop rejecting application install when APP_VERSION is wrong by @martmull in https://github.com/twentyhq/twenty/pull/20443
i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20451
fix: prevent admin panel workspace upgrade error from overflowing the table by @charlesBochet in https://github.com/twentyhq/twenty/pull/20394
[Website] Replace feature card screenshots with interactive visuals by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/20442
refactor(file v2) - deletion by @etiennejouan in https://github.com/twentyhq/twenty/pull/20356
i18n - website translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20454
fix(front-component): preserve caret position on controlled input/textarea updates by @QuantumByteMaster in https://github.com/twentyhq/twenty/pull/20416
Fix(UI): Side panel having two scrollbars by @git-init-priyanshu in https://github.com/twentyhq/twenty/pull/20456
ci(preview-env): replace bore.pub with Cloudflare quick tunnel by @FelixMalfait in https://github.com/twentyhq/twenty/pull/20459
feat(messaging): add workspace toggle to sync internal emails by @neo773 in https://github.com/twentyhq/twenty/pull/20457
feat(front-component-renderer): forward file input metadata by @charlesBochet in https://github.com/twentyhq/twenty/pull/20458
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20461
ci(preview-env): use --light seed so Apple is the default workspace by @FelixMalfait in https://github.com/twentyhq/twenty/pull/20464
Fix lint:diff-with-main oxlint rules build dependency by @bitloi in https://github.com/twentyhq/twenty/pull/20389
Show logic function label instead of technical name in workflow UI by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/20470
Support optional labels on logic-function input schema fields by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/20471
fix(ci): probe real schema in breaking-changes server readiness check by @FelixMalfait in https://github.com/twentyhq/twenty/pull/20465
ci(preview-env): drop yarn -- separator so --light reaches the seed command by @FelixMalfait in https://github.com/twentyhq/twenty/pull/20479
chore: remove dead feature flags by @charlesBochet in https://github.com/twentyhq/twenty/pull/20460
Billing - Add default ff by @etiennejouan in https://github.com/twentyhq/twenty/pull/20480
security: harden CI against supply-chain attacks by @neo773 in https://github.com/twentyhq/twenty/pull/20476
fix(kanban): give title full width when card is not hovered by @FelixMalfait in https://github.com/twentyhq/twenty/pull/20455
chore: add an icon to why-twenty page and update preview by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/20482
i18n - website translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20495
Upgrade cli tools by @martmull in https://github.com/twentyhq/twenty/pull/20496
feat(server): asymmetric JWT signing with kid + key rotation table by @charlesBochet in https://github.com/twentyhq/twenty/pull/20467
Improve linear app by @martmull in https://github.com/twentyhq/twenty/pull/20453
fix: map FlatEntityMaps and WorkspaceMigrationRunner exceptions to proper status codes on REST and GraphQL by @Weiko in https://github.com/twentyhq/twenty/pull/20494
Fix application variable issue by @martmull in https://github.com/twentyhq/twenty/pull/20500
chore: sync AI model catalog from models.dev by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20523
[twenty-server] no floating promises lint rule by @prastoin in https://github.com/twentyhq/twenty/pull/20499
feat(server): migrate all remaining JWT token types to ES256 by @charlesBochet in https://github.com/twentyhq/twenty/pull/20513
Fix phone unique constraints by @MkDev11 in https://github.com/twentyhq/twenty/pull/20261
Dedicated REST controllers for object & field metadata by @Weiko in https://github.com/twentyhq/twenty/pull/20364
[twenty-server] no-misused-promise lint by @prastoin in https://github.com/twentyhq/twenty/pull/20529
fix(ai-agent-node) - agent node execution error by @etiennejouan in https://github.com/twentyhq/twenty/pull/20534
fix(server): add Apple seed workspace as fallback for single-workspace mode by @Rpaudel379 in https://github.com/twentyhq/twenty/pull/20498
fix(navigation): settings drawer should never appear collapsed by @GusFromSpace in https://github.com/twentyhq/twenty/pull/20505
feat(ai-chat) - Stop ai thinking if credits exhausted by @etiennejouan in https://github.com/twentyhq/twenty/pull/20526
fix(server): handle ImapFlow socket errors instead of crashing the process by @davidfarah2003 in https://github.com/twentyhq/twenty/pull/20510
feat(twenty-server): introduce ENCRYPTION_KEY env var with versioned envelope by @charlesBochet in https://github.com/twentyhq/twenty/pull/20528
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20547
Inject none secret env variables into front components by @martmull in https://github.com/twentyhq/twenty/pull/20511
fix - nav drawer expansion by @etiennejouan in https://github.com/twentyhq/twenty/pull/20545
chore(billing) - remove feature flag by @etiennejouan in https://github.com/twentyhq/twenty/pull/20531
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20548
i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20549
Simplify create-twenty-app command by @martmull in https://github.com/twentyhq/twenty/pull/20512
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20551
i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20553
[breaking: deploy server before front] feat(view-sort): pick sort sub-field inline on the chip by @FelixMalfait in https://github.com/twentyhq/twenty/pull/20445
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20554
feat(upgrade): emit structured logfmt logs for upgrade flow by @charlesBochet in https://github.com/twentyhq/twenty/pull/20539
fix(auth): preserve returnToPath across Google/Microsoft SSO redirects by @FelixMalfait in https://github.com/twentyhq/twenty/pull/20537
Add default value to apiKey for authentication method by @martmull in https://github.com/twentyhq/twenty/pull/20552
feat(upgrade): expose twenty_upgrade_workspaces_up_to_date_total by @charlesBochet in https://github.com/twentyhq/twenty/pull/20555
chore(page-layout): remove IS_RECORD_PAGE_LAYOUT_* feature flags by @charlesBochet in https://github.com/twentyhq/twenty/pull/20556
feat(twenty-server): migrate remaining at-rest encryption sites to versioned envelope by @charlesBochet in https://github.com/twentyhq/twenty/pull/20550
chore(deps): bump react-dropzone from 14.2.3 to 14.4.1 by @dependabot[bot] in https://github.com/twentyhq/twenty/pull/20560
chore(auth): drop unused workspacePersonalInviteToken from SSO state by @FelixMalfait in https://github.com/twentyhq/twenty/pull/20557
chore(deps-dev): bump @mui/material from 7.3.8 to 7.3.11 by @dependabot[bot] in https://github.com/twentyhq/twenty/pull/20562
chore(deps-dev): bump vite-plugin-svgr from 4.3.0 to 4.5.0 by @dependabot[bot] in https://github.com/twentyhq/twenty/pull/20561
Update OAuth consent modal design by @Bonapara in https://github.com/twentyhq/twenty/pull/20540
Regrant id token write to claude for oidc swap by @prastoin in https://github.com/twentyhq/twenty/pull/20564
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20567
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20569
[Website] Replace product page hero visual with interactive CRM depicting AI chat in action. by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/20566
chore(server): drop unused postgresCredentials feature by @charlesBochet in https://github.com/twentyhq/twenty/pull/20573
Fix time consuming search ilike fallback by @Weiko in https://github.com/twentyhq/twenty/pull/20544
[Website] Refine feature card scroll entrance to a subtle opacity fade by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/20574
fix(auth): exclude /authorize from MinimalMetadataGater loading gate by @FelixMalfait in https://github.com/twentyhq/twenty/pull/20572
fix(server): decouple SDK client generation from workspace activation by @neo773 in https://github.com/twentyhq/twenty/pull/20514
chore(.vscode): add remaining packages to VSCode workspace by @Rpaudel379 in https://github.com/twentyhq/twenty/pull/20570
Twenty discord integration by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/20530
feat(server): migrate TOTP secret encryption to SecretEncryptionService by @charlesBochet in https://github.com/twentyhq/twenty/pull/20577
feat(twenty-server): one-hop relation filters in GraphQL API by @FelixMalfait in https://github.com/twentyhq/twenty/pull/20527
i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20582
fix(server): scope workspace findOne in 1-21 backfill-datasource command by @charlesBochet in https://github.com/twentyhq/twenty/pull/20581
fix(server): scope workspace findOne in ApplicationService by @charlesBochet in https://github.com/twentyhq/twenty/pull/20583
fix(server): add subFieldName column early in upgrade sequence by @charlesBochet in https://github.com/twentyhq/twenty/pull/20584

New Contributors

@ajitkumarsaini02 made their first contribution in https://github.com/twentyhq/twenty/pull/20401
@MkDev11 made their first contribution in https://github.com/twentyhq/twenty/pull/20261
@GusFromSpace made their first contribution in https://github.com/twentyhq/twenty/pull/20505
@davidfarah2003 made their first contribution in https://github.com/twentyhq/twenty/pull/20510

Full Changelog: https://github.com/twentyhq/twenty/compare/v2.4.0...v2.5.0

Breaking Changes

[breaking: deploy server before front] feat(view-sort): pick sort sub-field inline on the chip

Security Fixes

security: harden CI against supply-chain attacks

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track twenty

Get notified when new releases ship.

About twenty

Building a modern alternative to Salesforce, powered by the community.

All releases →

Related context

Related tools

Earlier breaking changes

v2.8.0 Introduces a new permission flags system defined by apps
v2.8.0 Permission flags system replaces previous permission model
v2.7.0 Unify connected account permissions.
v2.7.0 Encrypt `ConnectedAccount` connectionParameters field.
v2.6.0 Rename permissionFlag to rolePermissionFlag and add catalog/backfill