Skip to content

twenty

vtwenty/v2.16.0 Security

This release includes 11 security fixes for security teams reviewing exposed deployments.

Published 1mo Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 11 known CVEs

Topics

crm crm-system customer graphql javascript marketing
+8 more
monorepo nestjs postgresql react reactjs sales typescript web

Affected surfaces

deps

Summary

AI summary

Updates span deps (security patches and version bumps), front-end UI fixes/enhancements, twenty‑partners marketplace v2 features, AI tooling improvements, workflow adjustments, CI pipeline refinements, and a breaking change to call recording handling.

Full changelog

What's Changed

  • Fix/sanitize chart filters on save by @ijreilly in https://github.com/twentyhq/twenty/pull/21958
  • chore: bump version to 2.16.0 by @twenty-pr[bot] in https://github.com/twentyhq/twenty/pull/21973
  • Decouple twenty-ui Avatar from app server-URL config by @bosiraphael in https://github.com/twentyhq/twenty/pull/21968
  • Add twenty meeting bot to internal application ci by @martmull in https://github.com/twentyhq/twenty/pull/21974
  • Set OpenAI Responses store false for AI chat and agents by @mfamularopsyc in https://github.com/twentyhq/twenty/pull/20888
  • Add twenty-partners on internal ci apps by @martmull in https://github.com/twentyhq/twenty/pull/21975
  • Deploy website only when twenty-website changes by @rashad in https://github.com/twentyhq/twenty/pull/21977
  • fix(deps): remediate HIGH image vulns (multer, ws, nodemailer) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21984
  • Logic function handler name hardened validation by @prastoin in https://github.com/twentyhq/twenty/pull/21956
  • fix(emails): stop reply composer infinite re-render by @neo773 in https://github.com/twentyhq/twenty/pull/21935
  • feat(twenty-partners): marketplace v2 — Application-driven matching workspace by @rashad in https://github.com/twentyhq/twenty/pull/21816
  • fix(front): unblock email verification on the central domain (blank modal) by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21980
  • [Twenty-front]: Record table Header drag and drop functionality by @git-init-priyanshu in https://github.com/twentyhq/twenty/pull/21304
  • feat(twenty-partners): import an opportunity from TFT via manual workflow by @rashad in https://github.com/twentyhq/twenty/pull/21979
  • Rework website PipelineVisual to match twenty-front kanban by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21989
  • fix(deps): bump http-proxy-middleware to 2.0.10 by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21992
  • Route Recall webhooks by workspace metadata by @ehconitin in https://github.com/twentyhq/twenty/pull/21991
  • fix(deps): dedupe esbuild to 0.28.1 by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21993
  • feat(messaging): webhook push sync for Gmail, Calendar and Microsoft by @neo773 in https://github.com/twentyhq/twenty/pull/21970
  • fix(workflow): stop trigger/action filter Conditions from flashing on edit by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21952
  • fix(front): include isUIEditable/isRemote in CreateOneObjectMetadataItem so new objects aren't read-only until refresh by @avonian in https://github.com/twentyhq/twenty/pull/21796
  • feat(ai): add AI tools to list and inspect workflow runs by @etiennejouan in https://github.com/twentyhq/twenty/pull/21983
  • fix(twenty-partners): update Partner view in place on upgrade instead of deleting by @rashad in https://github.com/twentyhq/twenty/pull/21995
  • feat(meeting-bot): configure Recall recording retention hours by @emmanuelhb56 in https://github.com/twentyhq/twenty/pull/21978
  • fix: month and year dropdowns in settings logs date picker by @parshipcy in https://github.com/twentyhq/twenty/pull/21529
  • feat(ai): large tool output handling + navigation tools by @etiennejouan in https://github.com/twentyhq/twenty/pull/21982
  • Organize twenty-website product-feature into folder structure by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21999
  • i18n - website translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22001
  • Use minimal babel presets for wyw to fix the website Cloudflare build by @bosiraphael in https://github.com/twentyhq/twenty/pull/21994
  • Make twenty-ui theming a consumer-facing API by @bosiraphael in https://github.com/twentyhq/twenty/pull/22007
  • fix(deps): bump opentelemetry suite to core 2.8.0 (+ sentry 10.59) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/22010
  • fix(deps): pin undici under @module-federation/dts-plugin to ^7.28.0 by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/22014
  • Source app About description from README and improve internal app READMEs by @bosiraphael in https://github.com/twentyhq/twenty/pull/22012
  • fix(twenty-partners): coerce null fields in TFT opportunity import by @rashad in https://github.com/twentyhq/twenty/pull/22017
  • Auto-generate app cover images from the app logo by @bosiraphael in https://github.com/twentyhq/twenty/pull/22011
  • Improve meeting bot recording tab layout and transcript speakers ui by @ehconitin in https://github.com/twentyhq/twenty/pull/22016
  • Wire up search field metadata by @prastoin in https://github.com/twentyhq/twenty/pull/21964
  • bump sdk and app version for call recording bot app by @ehconitin in https://github.com/twentyhq/twenty/pull/22019
  • fix(calendar): ID-first chunked import for Google and CalDAV by @neo773 in https://github.com/twentyhq/twenty/pull/22015
  • fix(deps): bump vitest to 4 in twenty-meeting-bot (drops vulnerable esbuild) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/22025
  • fix(deps): pin form-data under nx and zapier-platform-core to 4.0.6 by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/22023
  • fix(twenty-partners): restore partner side panel field visibility by @rashad in https://github.com/twentyhq/twenty/pull/22024
  • Simplify Recall webhook logic function config by @ehconitin in https://github.com/twentyhq/twenty/pull/22026
  • feat(timeline): activity kind registry (Layer A) by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21950
  • Rename CI New UI workflow to CI UI by @bosiraphael in https://github.com/twentyhq/twenty/pull/22030
  • feat(front): render Instagram URLs as @handles in link fields by @ptcrash in https://github.com/twentyhq/twenty/pull/21642
  • Remove framer-motion from twenty-ui by @bosiraphael in https://github.com/twentyhq/twenty/pull/22021
  • fix(deps): bump @module-federation/node to drop the koa-pinning 0.21.4 stack by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/22032
  • fix: keep AI chat open when opening a record full-page (e.g. workflows) by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22036
  • fix(domains): show custom domain DNS records and activation status without a page reload by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22037
  • Update location of settings by @signalwerk in https://github.com/twentyhq/twenty/pull/22033
  • Bump twenty-ui to 1.0.0-alpha.0 for first npm pre-release by @bosiraphael in https://github.com/twentyhq/twenty/pull/22040
  • Add a real README for the twenty-ui package by @bosiraphael in https://github.com/twentyhq/twenty/pull/22038
  • Fix main ci: generate client-sdk by @prastoin in https://github.com/twentyhq/twenty/pull/22042
  • Fix 2.16 search field metadata cross version upgrade by @prastoin in https://github.com/twentyhq/twenty/pull/22039
  • fix(deps): bump engine.io + socket.io-adapter to drop vulnerable ws 8.17.1 by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/22044
  • i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22047
  • fix(ai-tool): make search_output a raw-text occurrence search by @etiennejouan in https://github.com/twentyhq/twenty/pull/22034
  • add meeting bot app cover by @ehconitin in https://github.com/twentyhq/twenty/pull/22049
  • fix(deps): resolve qs to 6.15.2 (dedupe caret group + scope body-parser) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/22050
  • fix(filter): guard isMatchingDateFilter against empty date values by @charlesBochet in https://github.com/twentyhq/twenty/pull/22029
  • Remove custom widget from calendarEvent page layout by @martmull in https://github.com/twentyhq/twenty/pull/22046
  • ci: remove redundant twenty-meeting-bot per-app workflow by @martmull in https://github.com/twentyhq/twenty/pull/22057
  • Introduce search field metadata in 2 16 by @prastoin in https://github.com/twentyhq/twenty/pull/22055
  • feat(front): allow advanced relation fields in FieldWidget selector by @martmull in https://github.com/twentyhq/twenty/pull/22005
  • Map TFT useCase to partners need on opportunity import by @rashad in https://github.com/twentyhq/twenty/pull/22054
  • docs(apps): add key-value store guide for logic functions by @martmull in https://github.com/twentyhq/twenty/pull/22061
  • feat(metadata): deterministic universalIdentifiers for server-generated side-effects by @Weiko in https://github.com/twentyhq/twenty/pull/21949
  • fix(twenty-partners): opportunity stages, Partners per Stage grouped table (v1.1.12) by @rashad in https://github.com/twentyhq/twenty/pull/22052
  • Fix Opportunity email timeline relation traversal by @Bonapara in https://github.com/twentyhq/twenty/pull/22064
  • Factorize from entity to flat entity utils by @prastoin in https://github.com/twentyhq/twenty/pull/21972
  • feat(ui): additional social providers to link components by @rubixvi in https://github.com/twentyhq/twenty/pull/21716
  • feat(ai): humanize tool-call by @etiennejouan in https://github.com/twentyhq/twenty/pull/21976
  • i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22068
  • Add search to new sidebar item picker by @Bonapara in https://github.com/twentyhq/twenty/pull/22041
  • Add new onboarding login screen at /welcome-v2 by @bosiraphael in https://github.com/twentyhq/twenty/pull/22027
  • ci(server): cross-version upgrade check on PRs (v1.22 → from source) by @prastoin in https://github.com/twentyhq/twenty/pull/22065
  • fix: normalize date-time field input on backend to prevent timeline crash by @charlesBochet in https://github.com/twentyhq/twenty/pull/22035
  • Twenty standard backfill non searchable object search field metadata by @prastoin in https://github.com/twentyhq/twenty/pull/22063
  • fix(front): restore loading state on third-party app command menu actions by @charlesBochet in https://github.com/twentyhq/twenty/pull/22073
  • [BREAKING CHANGE] harden call recording failure handling by @ehconitin in https://github.com/twentyhq/twenty/pull/22062
  • Update data model object settings labels by @Bonapara in https://github.com/twentyhq/twenty/pull/22070
  • Add logo to twenty-ui README by @bosiraphael in https://github.com/twentyhq/twenty/pull/22077
  • fix(front): prevent lingui extract crash in buildCrudToolStatusMessage by @prastoin in https://github.com/twentyhq/twenty/pull/22080
  • fix(deps): scope js-yaml to 4.2.0 under the mintlify/verdaccio pinners by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/22078
  • feat(server): run server-exposed logic functions in the owner workspace by @martmull in https://github.com/twentyhq/twenty/pull/22002
  • Revert 21949 by @Weiko in https://github.com/twentyhq/twenty/pull/22081
  • Allow workflows listing in MCP by @Souheyl7Gouadria in https://github.com/twentyhq/twenty/pull/22013
  • ci(front): run lingui extract & compile on PRs to gate i18n breakage by @prastoin in https://github.com/twentyhq/twenty/pull/22084
  • ci(server,emails): run lingui extract & compile on PRs to gate i18n breakage by @prastoin in https://github.com/twentyhq/twenty/pull/22086
  • feat: serve HTTP logic functions on isolated *.withtwenty.com domain by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22045

New Contributors

  • @mfamularopsyc made their first contribution in https://github.com/twentyhq/twenty/pull/20888
  • @avonian made their first contribution in https://github.com/twentyhq/twenty/pull/21796
  • @ptcrash made their first contribution in https://github.com/twentyhq/twenty/pull/21642
  • @signalwerk made their first contribution in https://github.com/twentyhq/twenty/pull/22033
  • @rubixvi made their first contribution in https://github.com/twentyhq/twenty/pull/21716
  • @Souheyl7Gouadria made their first contribution in https://github.com/twentyhq/twenty/pull/22013

Full Changelog: https://github.com/twentyhq/twenty/compare/twenty/v2.15.0...twenty/v2.16.0

Breaking Changes

  • [BREAKING CHANGE] harden call recording failure handling

Security Fixes

  • fix(deps): remediate HIGH image vulns (multer, ws, nodemailer)
  • fix(deps): bump engine.io + socket.io-adapter to drop vulnerable ws 8.17.1
  • fix(deps): bump http-proxy-middleware to 2.0.10
  • fix(deps): dedupe esbuild to 0.28.1
  • fix(deps): pin undici under @module-federation/dts-plugin to ^7.28.0
  • fix(deps): bump opentelemetry suite to core 2.8.0 (+ sentry 10.59)
  • fix(deps): bump vitest to 4 in twenty-meeting-bot (drops vulnerable esbuild)
  • fix(deps): pin form-data under nx and zapier-platform-core to 4.0.6
  • fix(deps): resolve qs to 6.15.2 (dedupe caret group + scope body-parser)
  • fix(deps): bump @module-federation/node to drop the koa-pinning 0.21.4 stack
  • fix(deps): scope js-yaml to 4.2.0 under the mintlify/verdaccio pinners

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track twenty

Get notified when new releases ship.

Sign up free

About twenty

Building a modern alternative to Salesforce, powered by the community.

All releases →

Related context

Earlier breaking changes

  • vtwenty/v2.20.0 Deprecate `fieldMetadata` and `objectMetadata` standardOverrides.
  • vtwenty/v2.13.0 Gate record creation on isUICreatable only, decoupled from isSystem.
  • vtwenty/v2.13.0 Rename isUIReadOnly to isUIEditable and add isUICreatable, affecting app developers.
  • vtwenty/v2.12.0 Deprecate isCustom for Objects and Fields.
  • vtwenty/v2.12.0 Deprecate dummy enterprise key (2/2).

Beta — feedback welcome: [email protected]