This release includes 2 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+8 more
Affected surfaces
Summary
AI summaryUpdates affect auth, server, admin-panel, twenty-front, front, billing, and AI integrations.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Breaking | Medium |
Drop APP_SECRET from approved-access-domain validation and session cookies Drop APP_SECRET from approved-access-domain validation and session cookies Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low |
— |
| Breaking | Medium |
Rename permissionFlag to rolePermissionFlag and add catalog/backfill Rename permissionFlag to rolePermissionFlag and add catalog/backfill Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low |
— |
| Feature | Medium |
Resume workspace selection on /welcome with valid tokenPair cookie Resume workspace selection on /welcome with valid tokenPair cookie Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
| Feature | Medium |
Signing keys management tab with usage tracking in admin panel Signing keys management tab with usage tracking in admin panel Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
| Feature | Medium |
Relation traversal in filter dropdown (stacked) in twenty-front Relation traversal in filter dropdown (stacked) in twenty-front Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
| Feature | Medium |
Set 50-character maximum length on passwords in auth Set 50-character maximum length on passwords in auth Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low |
— |
| Feature | Medium |
Sync AI model catalog from models.dev Sync AI model catalog from models.dev Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low |
— |
| Feature | Medium |
Make product stepper visuals interactive on website Make product stepper visuals interactive on website Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low |
— |
| Feature | Medium |
Sync AI model catalog from models.dev again Sync AI model catalog from models.dev again Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low |
— |
| Feature | Medium |
Add MCP tool annotations Add MCP tool annotations Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low |
— |
| Dependency | Medium |
Bump twenty-sdk, twenty-client-sdk, create-twenty-app to 2.5.0 Bump twenty-sdk, twenty-client-sdk, create-twenty-app to 2.5.0 Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low |
— |
| Performance | Medium |
Index messageChannel/calendarChannel for per‑workspace sync crons Index messageChannel/calendarChannel for per‑workspace sync crons Source: granite4.1:30b@2026-05-19-audit Confidence: low |
— |
| Bugfix | Medium |
Batch upgrade migration inserts to stay under PG param limit Batch upgrade migration inserts to stay under PG param limit Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
| Bugfix | Medium |
Drop correlated subquery in getWorkspaceLastAttemptedCommandName Drop correlated subquery in getWorkspaceLastAttemptedCommandName Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
| Bugfix | Medium |
Treat plaintext-under-isSecret rows as plaintext in app variable encryption migration Treat plaintext-under-isSecret rows as plaintext in app variable encryption migration Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
| Bugfix | Medium |
Pin node:24-alpine to 24.15.0-alpine3.23 digest in Dockerfile Pin node:24-alpine to 24.15.0-alpine3.23 digest in Dockerfile Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
| Bugfix | Medium |
Rebuild unique phone indexes drops legacy non-empty partial WHERE clause Rebuild unique phone indexes drops legacy non-empty partial WHERE clause Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
| Bugfix | Medium |
Normalize composite defaultValues in manifest converter for app re-install compatibility Normalize composite defaultValues in manifest converter for app re-install compatibility Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
| Bugfix | Medium |
Use theme-aware color for side panel title in front Use theme-aware color for side panel title in front Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
| Bugfix | Medium |
Scope workspace findOne in incrementMetadataVersion Scope workspace findOne in incrementMetadataVersion Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
| Bugfix | Medium |
Add relationTargetFieldMetadataId column early in upgrade sequence Add relationTargetFieldMetadataId column early in upgrade sequence Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
| Bugfix | Medium |
Handle network errors in RestApiService catch block Handle network errors in RestApiService catch block Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
| Bugfix | Medium |
Query timeout fix in billing Query timeout fix in billing Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
| Bugfix | Medium |
Replace removed Mintlify build command in docs Replace removed Mintlify build command in docs Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low |
— |
| Bugfix | Medium |
Anchor body text color to theme var in twenty-front Anchor body text color to theme var in twenty-front Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low |
— |
| Bugfix | Medium |
Correct OpenAPI schema for phones.additionalPhones Correct OpenAPI schema for phones.additionalPhones Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low |
— |
| Bugfix | Medium |
Align currency icon vertically with amount text in front Align currency icon vertically with amount text in front Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low |
— |
| Other | Medium |
Translations updates by github-actions[bot] Translations updates by github-actions[bot] Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low |
— |
| Other | Medium |
Additional translations updates by github-actions[bot] Additional translations updates by github-actions[bot] Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low |
— |
| Other | Medium |
More translations updates by github-actions[bot] More translations updates by github-actions[bot] Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low |
— |
| Other | Medium |
Additional docs translations updates by github-actions[bot] Additional docs translations updates by github-actions[bot] Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low |
— |
Full changelog
What's Changed
- feat(auth): resume workspace selection on /welcome with valid tokenPair cookie by @FelixMalfait in https://github.com/twentyhq/twenty/pull/20575
- chore: bump version to 2.6.0 by @twenty-pr[bot] in https://github.com/twentyhq/twenty/pull/20585
- Bump twenty-sdk, twenty-client-sdk, create-twenty-app to 2.5.0 by @charlesBochet in https://github.com/twentyhq/twenty/pull/20587
- fix(server): batch upgrade migration inserts to stay under PG param limit by @charlesBochet in https://github.com/twentyhq/twenty/pull/20588
- fix(server): drop correlated subquery in getWorkspaceLastAttemptedCommandName by @charlesBochet in https://github.com/twentyhq/twenty/pull/20591
- fix(server): treat plaintext-under-isSecret rows as plaintext in app variable encryption migration by @charlesBochet in https://github.com/twentyhq/twenty/pull/20590
- chore: sync AI model catalog from models.dev by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20601
- feat(secret-encryption): drop APP_SECRET from approved-access-domain validation and session cookies by @charlesBochet in https://github.com/twentyhq/twenty/pull/20580
- [Website] Make product stepper visuals interactive. by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/20602
- fix(docker): pin node:24-alpine to 24.15.0-alpine3.23 digest by @charlesBochet in https://github.com/twentyhq/twenty/pull/20603
- fix(docs): replace removed Mintlify build command by @Ariqhermawan in https://github.com/twentyhq/twenty/pull/20578
- feat(admin-panel): signing keys management tab with usage tracking by @charlesBochet in https://github.com/twentyhq/twenty/pull/20586
- i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20605
- fix(server): rebuild unique phone indexes drops legacy non-empty partial WHERE clause by @charlesBochet in https://github.com/twentyhq/twenty/pull/20606
- feat(twenty-front): relation traversal in filter dropdown (stacked) by @FelixMalfait in https://github.com/twentyhq/twenty/pull/20533
- i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20609
- fix(server): normalize composite defaultValues in manifest converter (unblock app re-install on 2.5-normalized workspaces) by @charlesBochet in https://github.com/twentyhq/twenty/pull/20615
- chore: sync AI model catalog from models.dev by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20620
- feat(auth): set 50-character maximum length on passwords by @FelixMalfait in https://github.com/twentyhq/twenty/pull/20655
- i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20661
- fix(front): use theme-aware color for side panel title by @shubham-0707 in https://github.com/twentyhq/twenty/pull/20645
- fix(twenty-front): anchor body text color to theme var by @ehconitin in https://github.com/twentyhq/twenty/pull/20622
- fix(server): scope workspace findOne in incrementMetadataVersion by @charlesBochet in https://github.com/twentyhq/twenty/pull/20660
- fix(server): add relationTargetFieldMetadataId column early in upgrade sequence by @charlesBochet in https://github.com/twentyhq/twenty/pull/20664
- fix(server): correct OpenAPI schema for phones.additionalPhones by @HachemOuanes in https://github.com/twentyhq/twenty/pull/20631
- fix(front): align currency icon vertically with amount text by @shubham-0707 in https://github.com/twentyhq/twenty/pull/20646
- fix(server): handle network errors in RestApiService catch block by @shubham-0707 in https://github.com/twentyhq/twenty/pull/20644
- [1/3] Rename permissionFlag to rolePermissionFlag + add permissionFlag catalog/backfill by @ehconitin in https://github.com/twentyhq/twenty/pull/20481
- i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20674
- Add MCP tool annotations by @Bonapara in https://github.com/twentyhq/twenty/pull/20672
- fix(billing) - query timeout by @etiennejouan in https://github.com/twentyhq/twenty/pull/20669
- Add OpenAI Apps domain challenge file by @Bonapara in https://github.com/twentyhq/twenty/pull/20677
- i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20680
- perf(server): index messageChannel/calendarChannel for per-workspace sync crons by @charlesBochet in https://github.com/twentyhq/twenty/pull/20678
- [Navigation Drawer] Multiple fixes in settings and app drawer by @ehconitin in https://github.com/twentyhq/twenty/pull/20634
- Fix 19026 deactivated relation unassignable by @Lakshayyy-m in https://github.com/twentyhq/twenty/pull/19296
- i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/20685
- fix(ai-chat) - upload files by @etiennejouan in https://github.com/twentyhq/twenty/pull/20681
- feat(server): upgrade-aware entity decorators for cross-version upgrades by @charlesBochet in https://github.com/twentyhq/twenty/pull/20686
- Update pricing plan cards by @Bonapara in https://github.com/twentyhq/twenty/pull/20614
- fix(server): handle legacy PK name in 2.6 rename-permission-flag upgrade by @charlesBochet in https://github.com/twentyhq/twenty/pull/20697
New Contributors
- @Ariqhermawan made their first contribution in https://github.com/twentyhq/twenty/pull/20578
- @shubham-0707 made their first contribution in https://github.com/twentyhq/twenty/pull/20645
- @HachemOuanes made their first contribution in https://github.com/twentyhq/twenty/pull/20631
Full Changelog: https://github.com/twentyhq/twenty/compare/v2.5.0...v2.6.0
Breaking Changes
- [1/3] Rename permissionFlag to rolePermissionFlag + add permissionFlag catalog/backfill
- feat(auth): set 50-character maximum length on passwords
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Earlier breaking changes
- v2.8.0 Introduces a new permission flags system defined by apps
- v2.8.0 Permission flags system replaces previous permission model
- v2.7.0 Unify connected account permissions.
- v2.7.0 Encrypt `ConnectedAccount` connectionParameters field.
- v2.5.0 [breaking: deploy server before front] feat(view-sort): pick sort sub-field inline on the chip
Beta — feedback welcome: [email protected]