This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+8 more
ReleasePort's take
Moderate signalThis release fixes several UI and test stability issues while introducing a critical security enhancement for workspace database schema enforcement.
Why it matters: Severity 90 enforces the `workspace.databaseSchema` invariant via a check constraint, guaranteeing data integrity across all workspaces; developers must validate existing schemas before upgrade.
Summary
AI summaryUpdates server, chore, and workflow across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Backfill and enforce workspace.databaseSchema invariant with a check constraint. Backfill and enforce workspace.databaseSchema invariant with a check constraint. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Medium |
Add receipt metrics and logs to connected account sync webhooks. Add receipt metrics and logs to connected account sync webhooks. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Medium |
Preload Stripe.js before the onboarding payment step. Preload Stripe.js before the onboarding payment step. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Medium |
Export `getFieldUniversalIdentifier` from SDK and update docs. Export `getFieldUniversalIdentifier` from SDK and update docs. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Low |
Record board column drag and drop functionality. Record board column drag and drop functionality. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Feature | Low |
Paginate admin panel app registrations list. Paginate admin panel app registrations list. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Dependency | Low |
Upgrade call-recorder, last-contact, people-data-labs to twenty-sdk 2.20. Upgrade call-recorder, last-contact, people-data-labs to twenty-sdk 2.20. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Performance | Low |
Bypass corrupted cached front‑component responses with a cache‑bust query parameter. Bypass corrupted cached front‑component responses with a cache‑bust query parameter. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Medium |
Disable install button when no app is selected in onboarding. Disable install button when no app is selected in onboarding. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Throw proper error on duplicate emailing domain. Throw proper error on duplicate emailing domain. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Stabilize app install version‑gate integration test. Stabilize app install version‑gate integration test. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Stabilize flaky app‑install workspace‑version gate test. Stabilize flaky app‑install workspace‑version gate test. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Backfill `isSystemSideEffect` on system fields provisioned before 2.15. Backfill `isSystemSideEffect` on system fields provisioned before 2.15. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Fix stale relation table in field widget when switching records in side panel. Fix stale relation table in field widget when switching records in side panel. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Make prefilled workflow IDs unique per workspace. Make prefilled workflow IDs unique per workspace. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Medium |
Gate workspaceDiscoverability behind upgrade decorator. Gate workspaceDiscoverability behind upgrade decorator. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Medium |
Query isVetted so the apps marketplace renders again. Query isVetted so the apps marketplace renders again. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
Full changelog
What's Changed
- chore: bump version to 2.21.0 by @twenty-pr[bot] in https://github.com/twentyhq/twenty/pull/22820
- [Twenty-Front]: Record board column drag and drop functionality by @git-init-priyanshu in https://github.com/twentyhq/twenty/pull/22323
- i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22817
- fix(workflow): make prefilled workflow ids unique per workspace by @thomtrp in https://github.com/twentyhq/twenty/pull/22800
- i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22824
- Disable install button in app install onboarding when no app is selected by @bosiraphael in https://github.com/twentyhq/twenty/pull/22822
- fix(server): stabilize app install version-gate integration test by @prastoin in https://github.com/twentyhq/twenty/pull/22826
- ci: test twenty-apps install against latest dockerhub and local server + new trigger by @prastoin in https://github.com/twentyhq/twenty/pull/22636
- Throw proper error on duplicate emailing domain by @neo773 in https://github.com/twentyhq/twenty/pull/22790
- i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22833
- chore: sync AI model catalog from models.dev by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22842
- fix(server): stabilize flaky app-install workspace-version gate test by @prastoin in https://github.com/twentyhq/twenty/pull/22851
- fix(server): backfill
isSystemSideEffecton system fields provisioned before 2.15 by @prastoin in https://github.com/twentyhq/twenty/pull/22850 - Bypass corrupted cached front-component responses with a cache-bust query parameter by @martmull in https://github.com/twentyhq/twenty/pull/22854
- chore: upgrade call-recorder, last-contact, people-data-labs to twenty-sdk 2.20 by @prastoin in https://github.com/twentyhq/twenty/pull/22852
- fix(website): query isVetted so the apps marketplace renders again by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/22859
- Paginate admin panel app registrations list by @martmull in https://github.com/twentyhq/twenty/pull/22734
- i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22861
- fix(server): gate workspaceDiscoverability behind upgrade decorator by @prastoin in https://github.com/twentyhq/twenty/pull/22818
- Add receipt metrics and logs to connected account sync webhooks by @neo773 in https://github.com/twentyhq/twenty/pull/22853
- Preload Stripe.js before the onboarding payment step by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22858
- Sdk exports
getFieldUniversalIdentifier+ docs by @prastoin in https://github.com/twentyhq/twenty/pull/22856 - Fix stale relation table in field widget when switching records in side panel by @Weiko in https://github.com/twentyhq/twenty/pull/22829
- harden(server): backfill and enforce workspace.databaseSchema invariant with a check constraint by @prastoin in https://github.com/twentyhq/twenty/pull/22855
Full Changelog: https://github.com/twentyhq/twenty/compare/twenty/v2.20.0...twenty/v2.21.0
Breaking Changes
- Enforce `workspace.databaseSchema` invariant with a check constraint (hardened server behavior).
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Earlier breaking changes
- vtwenty/v2.20.0 Deprecate `fieldMetadata` and `objectMetadata` standardOverrides.
- vtwenty/v2.13.0 Gate record creation on isUICreatable only, decoupled from isSystem.
- vtwenty/v2.13.0 Rename isUIReadOnly to isUIEditable and add isUICreatable, affecting app developers.
- vtwenty/v2.12.0 Deprecate isCustom for Objects and Fields.
- vtwenty/v2.12.0 Deprecate dummy enterprise key (2/2).
Beta — feedback welcome: [email protected]