Skip to content

twenty

vtwenty/v2.19.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 19d Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

crm crm-system customer graphql javascript marketing
+8 more
monorepo nestjs postgresql react reactjs sales typescript web

Summary

AI summary

Touched server, AI, front, chore, and fixes across multiple modules.

Full changelog

What's Changed

  • fix(page-layout): render relation field widgets in table display mode by @ehconitin in https://github.com/twentyhq/twenty/pull/22220
  • chore: bump version to 2.19.0 by @twenty-pr[bot] in https://github.com/twentyhq/twenty/pull/22363
  • Fix draft send: read messageChannel from core, not workspace ORM by @neo773 in https://github.com/twentyhq/twenty/pull/22365
  • messaging remove dead workspace entities by @neo773 in https://github.com/twentyhq/twenty/pull/22366
  • i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22371
  • [FIX_TYPECHECK_ON_MAIN] Add missing inviteTeamMaxCreditsReward to OnboardingConfig type by @prastoin in https://github.com/twentyhq/twenty/pull/22370
  • Front fallback flat object search field metadata by @prastoin in https://github.com/twentyhq/twenty/pull/22369
  • chore: auto pre-translate untranslated docs strings before Crowdin pull by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/22334
  • [REQUIRED FOR 2.18 RELEASE] Show the upgrade-plan step at the end of V1 onboarding by @bosiraphael in https://github.com/twentyhq/twenty/pull/22368
  • feat(server): make workspace Custom application carry an applicationRegistration so custom labels are translatable by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22378
  • fix: drop domain from computed remote name when subdomain present by @martmull in https://github.com/twentyhq/twenty/pull/22376
  • chore: sync AI model catalog from models.dev by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22387
  • fix(workflow): stop relative date filter from crashing on empty/invalid date values by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/22384
  • Backfill webhook subscriptions for existing connected accounts by @neo773 in https://github.com/twentyhq/twenty/pull/22314
  • feat: show group-by context in record show breadcrumb by @parshipcy in https://github.com/twentyhq/twenty/pull/22247
  • Handle field isNullable update by @Weiko in https://github.com/twentyhq/twenty/pull/22362
  • fix(dpa): correct US processor entity to Twenty.com PBC by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/22393
  • Add install your first apps onboarding V2 step by @bosiraphael in https://github.com/twentyhq/twenty/pull/22347
  • feat(twenty-sdk): terraform-style plan/apply for app metadata sync by @Weiko in https://github.com/twentyhq/twenty/pull/22372
  • SearchVector derivation via migration-scoped index (alt to #2622 __warmedUpCache) by @prastoin in https://github.com/twentyhq/twenty/pull/22389
  • Add smooth page transitions to onboarding v2 by @bosiraphael in https://github.com/twentyhq/twenty/pull/22392
  • i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22400
  • feat(last-contact): design for Last contact by + Last contact item by @martmull in https://github.com/twentyhq/twenty/pull/22308
  • Update onboarding v2 credit reward amounts by @bosiraphael in https://github.com/twentyhq/twenty/pull/22399
  • Let the sign-in screen scroll when its content overflows the viewport by @bosiraphael in https://github.com/twentyhq/twenty/pull/22397
  • fix(billing): link billing emails to the workspace subdomain by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22401
  • Add installed workspaces view to application registration by @martmull in https://github.com/twentyhq/twenty/pull/22359
  • refactor(server): unify metadata override-blob computation (step 1 of override unification) by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22404
  • Fix BlockNote placeholder alignment + paddings by @Bonapara in https://github.com/twentyhq/twenty/pull/22409
  • Update app name by @martmull in https://github.com/twentyhq/twenty/pull/22410
  • feat(sdk): translate front-component strings with t()/Trans/useTranslate by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22301
  • Improve billing settings UI by @Bonapara in https://github.com/twentyhq/twenty/pull/22377
  • i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22413
  • Add twenty-app keyword by @martmull in https://github.com/twentyhq/twenty/pull/22415
  • Fix lint by @martmull in https://github.com/twentyhq/twenty/pull/22416
  • chore: sync DPA sub-processors from trust center by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22403
  • i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22420
  • test(server): fix DPA Annex C test broken by sub-processor sync action by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22422
  • feat(shared): require defaultValue on non-nullable field manifests by @martmull in https://github.com/twentyhq/twenty/pull/22419
  • feat(twenty-sdk): include app readme in published package by @martmull in https://github.com/twentyhq/twenty/pull/22431
  • fix(billing) - invalidate activationStatus after billing event by @etiennejouan in https://github.com/twentyhq/twenty/pull/22414
  • fix(website): tighten product-feature spotlight height and align bento spacing by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/22428
  • feat(website): add Product to menu + footer nav, move Why into Resources dropdown by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/22429
  • i18n - website translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22436
  • Add Last contact app to onboarding v2 installable apps by @bosiraphael in https://github.com/twentyhq/twenty/pull/22433
  • fix: bump json-2-csv 5.5.10 -> 5.5.11 (Dependabot) by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/22438
  • refactor(schema): reorganize IndexField and related types by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/22439
  • fix(website): center the User Guide nav preview image by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/22445
  • refactor(server): unify the two metadata override mechanisms into one by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22417
  • fix(ai) - Fix date stripped from agent tool output by @etiennejouan in https://github.com/twentyhq/twenty/pull/22443
  • feat(ai) - add delete_workflow tool by @etiennejouan in https://github.com/twentyhq/twenty/pull/22432
  • chore(server): ship the 2.20 standardOverrides drop as a dormant command by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22448
  • fix(website): restore footer CTA buttons on the light card inside the dark stage by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/22447
  • fix(server): apply row-level security predicates to API key and application principals by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22456
  • fix(front): render pinned command-menu buttons inline in page header by @Weiko in https://github.com/twentyhq/twenty/pull/22446
  • fix(front): hide sub-item tree connector in navigation drag preview by @Weiko in https://github.com/twentyhq/twenty/pull/22442
  • feat(server): improve traceability of flat-entity map mutation errors by @prastoin in https://github.com/twentyhq/twenty/pull/22396
  • feat(ai): surface AI chat stream failures through one typed error channel by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22434
  • fix(twenty-sdk): stop dev-mode OOM by caching compiled manifest modules by @martmull in https://github.com/twentyhq/twenty/pull/22435
  • Fix front component crash on unknown elements by @bosiraphael in https://github.com/twentyhq/twenty/pull/22455
  • feat(emailing): forward SES events to Tatami Monitor by @neo773 in https://github.com/twentyhq/twenty/pull/22407
  • feat(ai): add ask_questions interactive clarifying-question tool by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22346
  • feat(emailing): local unsubscribe URL + full-content log driver by @neo773 in https://github.com/twentyhq/twenty/pull/22412
  • [Breaking change] fix: make pageLayout type field required by @etiennejouan in https://github.com/twentyhq/twenty/pull/22450
  • Drop unsafe props from front component elements by @bosiraphael in https://github.com/twentyhq/twenty/pull/22458
  • perf(front): query only rendered fields in application settings pages by @martmull in https://github.com/twentyhq/twenty/pull/22454
  • feat(server): workspace opt-out of root-domain directory listing by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22423
  • Gate and meter email group: enterprise license (self-host) + credits (cloud) by @neo773 in https://github.com/twentyhq/twenty/pull/22390
  • feat(call-recorder): cap media file size during ingestion to avoid OOM by @ehconitin in https://github.com/twentyhq/twenty/pull/22463
  • Fire front component window error handlers by @bosiraphael in https://github.com/twentyhq/twenty/pull/22462
  • fix(ai): offer Retry when the failed turn persisted partial assistant output by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22478
  • fix(sse): treat expected event-stream coordination errors as 403s and never crash the sync loop by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22475
  • test(ai): pin StreamAgentChatJob stream lifecycle with a reusable spec harness by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22479
  • fix(ai): delete the Redis chunk list on credits-exhausted terminal events by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22477
  • fix(ai): route missing-workspace stream failures through the standard error path by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22480
  • perf(sse): drop the per-workspace lock around atomic activeStreams set operations by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22476
  • fix(ai): tell members without billing permission why AI stopped at the usage cap by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22487
  • fix(ai): apply stream chunks in exact server seq order via a client-side sequencer by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22484
  • fix(ai): bound silent stream recovery and surface a terminal CONNECTION_LOST state by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22486
  • perf(ai): render streaming markdown as memoized blocks by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22489
  • chore(server): fix stream-agent-chat job spec formatting breaking main's lint by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22493
  • feat(ai): typed CONTEXT_WINDOW_EXCEEDED error that hides the pointless Retry by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22488
  • fix(ai): converge every tab's transcript when a stream fails with partial output by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22494
  • fix(ai): notify all tabs when a pending question is answered by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22491
  • fix(ai): fully roll back a question answer when the resume enqueue fails by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22492
  • use Temporal for date filter evaluation and fix IS operand by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/22408
  • test(ai): pin the queue-updated event that now follows stream-error on the failure path by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22500
  • fix(upgrade): re-slot all 2-19 upgrade commands to their real merge epochs and guard timestamps in CI by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22498
  • fix: format numbers according to user preferences in settings views by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22501
  • fix: align email validation between front and server and roll back optimistic value on failed save by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/22490
  • fix(front): skip unknown fields in SSE optimistic updates instead of dropping the event by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22474
  • Fix non-idempotent application sync for viewSorts (subFieldName undefined vs null) by @martmull in https://github.com/twentyhq/twenty/pull/22505
  • Self-host Inter and DM Mono fonts by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22506
  • Add billing plans comparison page by @Bonapara in https://github.com/twentyhq/twenty/pull/22424
  • fix(ai): make stream claims atomic via conditional UPDATEs with claim-or-queue send by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22481
  • fix(front): gate SSO and audit logs on enterprise validity token by @charlesBochet in https://github.com/twentyhq/twenty/pull/22459
  • fix(ai) - sync AI agent step output schema when agent response format changes by @etiennejouan in https://github.com/twentyhq/twenty/pull/22466
  • feat(applications): add type and options to application variables by @martmull in https://github.com/twentyhq/twenty/pull/22157
  • Fix webhook entity dropdown layout by @Bonapara in https://github.com/twentyhq/twenty/pull/22497
  • i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22511
  • perf(twenty-server): browser-cache picture file responses (avatars/logos) by @clivemeister in https://github.com/twentyhq/twenty/pull/22166
  • feat(server): first-class logo on application registration + narrowed settings queries by @martmull in https://github.com/twentyhq/twenty/pull/22453
  • feat(server): import application logo into file storage at install by @martmull in https://github.com/twentyhq/twenty/pull/22437
  • fix(server): resolve foreign key violation blocking application uninstall by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/22502
  • perf(twenty-server): drive immutable file caching from fileFolderConfigs on both serving paths by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22510
  • chore(server): remove the five dead FileFolder values and their legacy serving pipeline by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22516
  • feat(logic-function): namespace shared Lambda resources per instance by @charlesBochet in https://github.com/twentyhq/twenty/pull/22509
  • feat(ai): add a stream heartbeat and reap dead claims so a worker crash cannot brick a thread by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22482
  • feat(server): promote registration display fields to first-class columns by @martmull in https://github.com/twentyhq/twenty/pull/22513
  • fix email alias guard with message channel availibility by @neo773 in https://github.com/twentyhq/twenty/pull/22521
  • fix(server): tolerate metadata-physical index drift in legacy index name normalization by @prastoin in https://github.com/twentyhq/twenty/pull/22472
  • feat(files): direct-to-storage upload endpoints with pending file lifecycle by @martmull in https://github.com/twentyhq/twenty/pull/22449
  • feat(ai): dashboard & view building by @etiennejouan in https://github.com/twentyhq/twenty/pull/22411
  • fix(server): restrict /webhooks/server dispatch to server-route-exposed functions by @prastoin in https://github.com/twentyhq/twenty/pull/22469
  • perf(twenty-server): cache BuiltFrontComponent and PublicAsset responses by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22523
  • perf(front-component): fingerprint built-JS URLs by path for CDN caching by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22530
  • Support sender variable on workflow send-email action by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22512
  • Expose sent message identifiers in workflow send-email step output by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22520
  • Remove v1 onboarding and rely only on v2 by @bosiraphael in https://github.com/twentyhq/twenty/pull/22398
  • Centralized side effects devxp basis by @prastoin in https://github.com/twentyhq/twenty/pull/22295
  • feat(ai): persist assistant chat messages progressively during streaming by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22524
  • Add configurable call recorder summaries by @ehconitin in https://github.com/twentyhq/twenty/pull/22405
  • feat(server): drain queue workers gracefully on SIGTERM by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22514
  • fix(ai): gate chat thread totals on stream ownership to prevent usage under-counting by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22534
  • Call recorder: skeleton loading state + port front components to twenty-ui by @ehconitin in https://github.com/twentyhq/twenty/pull/22473
  • Squirclesssss 🟦🔵 by @Bonapara in https://github.com/twentyhq/twenty/pull/22535
  • fix(docker): bump node base to 24.17.0 for CVE-2026-48930 (critical) by @charlesBochet in https://github.com/twentyhq/twenty/pull/22529
  • feat(helm): parametrize liveness, readiness and startup probes for server by @mhorcajada in https://github.com/twentyhq/twenty/pull/22268
  • feat(twenty-for-twenty): bump to SDK 2.18 with local UI components by @charlesBochet in https://github.com/twentyhq/twenty/pull/22542
  • fix(front): don't blank record title when the title cell is untouched by @avonian in https://github.com/twentyhq/twenty/pull/22293
  • feat(ci): detect bot signatures in PR description, comments and reviews by @charlesBochet in https://github.com/twentyhq/twenty/pull/22547
  • Add MCP setup screen by @Bonapara in https://github.com/twentyhq/twenty/pull/22468
  • chore(apps): remove the twenty-for-twenty app (consolidated into twenty-eng) by @charlesBochet in https://github.com/twentyhq/twenty/pull/22549
  • fix(server): require confidential client auth in authorization_code grant by @charlesBochet in https://github.com/twentyhq/twenty/pull/22548
  • feat(server): refresh application registration on install by @martmull in https://github.com/twentyhq/twenty/pull/22527
  • feat: expose marketplace app detail fields explicitly and deprecate manifest blob by @martmull in https://github.com/twentyhq/twenty/pull/22526
  • QA follow up - Polish settings billing and MCP UI by @Bonapara in https://github.com/twentyhq/twenty/pull/22554
  • refactor(server): regroup application resolvers by resource and unify install permission flag by @martmull in https://github.com/twentyhq/twenty/pull/22532
  • Run integration tests against the real BullMQ driver by @neo773 in https://github.com/twentyhq/twenty/pull/22551
  • Add focus-safe side panel shortcuts by @Bonapara in https://github.com/twentyhq/twenty/pull/22499
  • chore: sync AI model catalog from models.dev by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22558
  • message campaign redesign by @neo773 in https://github.com/twentyhq/twenty/pull/22508
  • feat(server): abort ai stream jobs that outlive the shutdown drain budget by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22517
  • messaging: Prefer plain text calendar event description over HTML for Microsoft calendar. by @mvanhorn in https://github.com/twentyhq/twenty/pull/22540
  • Call recorder: parse conference links from calendar event text by @ehconitin in https://github.com/twentyhq/twenty/pull/22555
  • chore: sync AI model catalog from models.dev by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22568
  • feat(files): content-verify direct uploads and pin pending files to octet-stream by @martmull in https://github.com/twentyhq/twenty/pull/22533
  • feat(files): reap stale pending direct-upload files via hourly cron by @martmull in https://github.com/twentyhq/twenty/pull/22531
  • Reverse pinned command menu item order on record header by @bosiraphael in https://github.com/twentyhq/twenty/pull/22577
  • refactor(server): remove nestjs-query from key-value-pair module by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/22575
  • Don't list headless front components in the widget picker by @bosiraphael in https://github.com/twentyhq/twenty/pull/22578
  • feat(server): add instance-level file storage layer by @martmull in https://github.com/twentyhq/twenty/pull/22560
  • fix(server): pace lambda control-plane calls to avoid 'Rate exceeded' on release by @thomtrp in https://github.com/twentyhq/twenty/pull/22569
  • chore(server): remove unused flat-field-metadata per-object mocks by @prastoin in https://github.com/twentyhq/twenty/pull/22581
  • Revert "feat(server): add instance-level file storage layer" by @martmull in https://github.com/twentyhq/twenty/pull/22579
  • Fix stale token race forcing re-login on verify pages by @bosiraphael in https://github.com/twentyhq/twenty/pull/22573
  • Inject functions URL into logic function env by @ehconitin in https://github.com/twentyhq/twenty/pull/22583
  • feat(front): upload files directly to storage for files-field, attachments and workflow by @martmull in https://github.com/twentyhq/twenty/pull/22576
  • Deterministic system field universal identifier by @prastoin in https://github.com/twentyhq/twenty/pull/22565
  • Polish onboarding v2 verify animation and step screens by @bosiraphael in https://github.com/twentyhq/twenty/pull/22585
  • feat(ai): open Ask AI side panel with a preprompt in two modes by @Weiko in https://github.com/twentyhq/twenty/pull/22582
  • feat: publish MCP & API discovery documents (well-known standards) by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22589
  • (Billing for self hosts) Tie enterprise key to server by @ijreilly in https://github.com/twentyhq/twenty/pull/22464
  • feat(messaging): message campaign delivery stats + views by @neo773 in https://github.com/twentyhq/twenty/pull/22452
  • fix(server): converge app-sync isUnique diff for single-column unique constraints by @ijreilly in https://github.com/twentyhq/twenty/pull/22592
  • chore: bump sdk packages to 2.19.0-alpha.1 prerelease by @prastoin in https://github.com/twentyhq/twenty/pull/22599
  • feat(files): use direct-to-storage upload for email and AI-chat attachments by @martmull in https://github.com/twentyhq/twenty/pull/22610
  • Remove book a call step from onboarding by @bosiraphael in https://github.com/twentyhq/twenty/pull/22597
  • Fix side panel open/close animation glitches in the page header and panel content by @bosiraphael in https://github.com/twentyhq/twenty/pull/22598
  • Use record pickers for People Data Labs enrichment workflow inputs by @bosiraphael in https://github.com/twentyhq/twenty/pull/22596
  • fix(server): make all view children reparentable across a workspace migration sync by @prastoin in https://github.com/twentyhq/twenty/pull/22600
  • feat(app): allow claiming ownership of unclaimed app registrations by @martmull in https://github.com/twentyhq/twenty/pull/22609
  • Add Document Generator SDK app + step-by-step tutorial by @martmull in https://github.com/twentyhq/twenty/pull/22522
  • i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22617
  • Use SDK calendarEventRecordPageFields identifiers in call-recorder by @ehconitin in https://github.com/twentyhq/twenty/pull/22618
  • App installation workspace version check engines constraint by @prastoin in https://github.com/twentyhq/twenty/pull/22613
  • chore(server): remove nestjs-query from user-workspace module by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/22591
  • chore(server): migrate 5 modules off NestjsQueryTypeOrmModule wiring by @abdulrahmancodes in https://github.com/twentyhq/twenty/pull/22595
  • Update claude session settings for a proper PR behavior by @martmull in https://github.com/twentyhq/twenty/pull/22619
  • Widen front component crossing attributes to aria-, data- and draggable by @bosiraphael in https://github.com/twentyhq/twenty/pull/22614
  • fix(front): honor user-set label on LINKS/URL social links by @thomtrp in https://github.com/twentyhq/twenty/pull/22586
  • chore(apps): bump sdk to 2.19.0-alpha.1 and require twenty server >=2.19.0 by @prastoin in https://github.com/twentyhq/twenty/pull/22601
  • chore(apps): patch bump public apps moved to sdk 2.19.0-alpha.1 by @prastoin in https://github.com/twentyhq/twenty/pull/22623
  • i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22624
  • feat(index): support composite unique indexes in create-many upsert conflict resolution by @etiennejouan in https://github.com/twentyhq/twenty/pull/22604
  • Revert "feat(messaging): message campaign delivery stats + views" (#22452) by @prastoin in https://github.com/twentyhq/twenty/pull/22627
  • Remove logo from onboarding trust badges by @bosiraphael in https://github.com/twentyhq/twenty/pull/22628
  • test(messaging): messaging and calendar sync integration suites by @neo773 in https://github.com/twentyhq/twenty/pull/22567
  • Call recorder: sweep upcoming calendar events for recording bots on install by @ehconitin in https://github.com/twentyhq/twenty/pull/22552
  • fix(ai-chat): sort message parts by orderIndex on reload by @thomtrp in https://github.com/twentyhq/twenty/pull/22629
  • Create billing customer at signup so onboarding rewards are credited by @bosiraphael in https://github.com/twentyhq/twenty/pull/22633
  • Display featured applications in marketplace by @martmull in https://github.com/twentyhq/twenty/pull/22635

Full Changelog: https://github.com/twentyhq/twenty/compare/twenty/v2.18.0...twenty/v2.19.0

Breaking Changes

  • [Breaking change] fix: make pageLayout type field required

Security Fixes

  • fix(docker): bump node base to 24.17.0 for CVE-2026-48930 (critical)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track twenty

Get notified when new releases ship.

Sign up free

About twenty

Building a modern alternative to Salesforce, powered by the community.

All releases →

Related context

Earlier breaking changes

  • vtwenty/v2.20.0 Deprecate `fieldMetadata` and `objectMetadata` standardOverrides.
  • vtwenty/v2.13.0 Gate record creation on isUICreatable only, decoupled from isSystem.
  • vtwenty/v2.13.0 Rename isUIReadOnly to isUIEditable and add isUICreatable, affecting app developers.
  • vtwenty/v2.12.0 Deprecate isCustom for Objects and Fields.
  • vtwenty/v2.12.0 Deprecate dummy enterprise key (2/2).

Beta — feedback welcome: [email protected]