Skip to content

twenty

vtwenty/v2.23.2 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 4d Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

crm crm-system customer graphql javascript marketing
+8 more
monorepo nestjs postgresql react reactjs sales typescript web

Affected surfaces

deps

Summary

AI summary

Broad release touches chore, server, workflow, and ai-chat.

Full changelog

What's Changed

  • Unify application version gate, registration writes and upgrade paths across sources by @martmull in https://github.com/twentyhq/twenty/pull/22931
  • chore: bump version to 2.23.0 by @twenty-pr[bot] in https://github.com/twentyhq/twenty/pull/22975
  • fix(serverless): flush IPC message before exiting local function runner by @phelix001 in https://github.com/twentyhq/twenty/pull/22920
  • [2/2] Write CREATED at activation, clean stale onboarding workspaces by @charlesBochet in https://github.com/twentyhq/twenty/pull/22915
  • Revert "Remove calendar week view feature flag from public flags" by @Weiko in https://github.com/twentyhq/twenty/pull/22987
  • Add mostly-empty field hints to data model settings by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22962
  • i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/22988
  • fix(docker): bump curl pin to 8.20.0-r0 (2 high + 6 medium CVEs) by @charlesBochet in https://github.com/twentyhq/twenty/pull/22994
  • Only show the install-apps onboarding step to workspace creators by @charlesBochet in https://github.com/twentyhq/twenty/pull/22990
  • fix(server): stop treating Microsoft Graph 401 as a permanent failure by @neo773 in https://github.com/twentyhq/twenty/pull/22989
  • fix(front): only sign out when token renewal is rejected by the server by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22983
  • Reduce Recall bot lifecycle reconciliation traffic by @ehconitin in https://github.com/twentyhq/twenty/pull/22908
  • Count self-hosted billable seats per distinct user by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22986
  • Fix join at in the past by @martmull in https://github.com/twentyhq/twenty/pull/23000
  • docs(skills): use 'twenty apply' in codex-plugin skills (dev --once deprecated) by @admin-laicadev in https://github.com/twentyhq/twenty/pull/22880
  • Copy application source files during build and install by @Weiko in https://github.com/twentyhq/twenty/pull/22991
  • fix(twenty-server): re-list marketplace registration when catalog serves an app first installed locally by @nicoko93 in https://github.com/twentyhq/twenty/pull/22877
  • Client brief wizard — /partners/brief by @rashad in https://github.com/twentyhq/twenty/pull/22291
  • Converge email recipient fields on existing patterns: shared parser/formatter, search-index members, one display-name rule by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22997
  • i18n - website translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/23005
  • feat(email-group): communications UX, per-record DNS status by @neo773 in https://github.com/twentyhq/twenty/pull/23002
  • i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/23007
  • chore: sync AI model catalog from models.dev by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/23015
  • fix(server): shard the server-test unit job to stop the intermittent crash by @FelixMalfait in https://github.com/twentyhq/twenty/pull/23009
  • Reduce call-recorder Recall API load and harden bot scheduling recovery by @martmull in https://github.com/twentyhq/twenty/pull/23014
  • Bump app version by @martmull in https://github.com/twentyhq/twenty/pull/23049
  • Skip install-apps onboarding step for invited users by @bosiraphael in https://github.com/twentyhq/twenty/pull/22823
  • Ignore call-recorder bots for unsupported meeting platforms by @martmull in https://github.com/twentyhq/twenty/pull/23050
  • fix(messaging): register and harden webhook subscription renewal cron by @neo773 in https://github.com/twentyhq/twenty/pull/23006
  • feat(workflow): backfill + dual-write for core workflow entity by @thomtrp in https://github.com/twentyhq/twenty/pull/22776
  • fix(server): recover workflow runs whose queue job was lost - monitoring only by @thomtrp in https://github.com/twentyhq/twenty/pull/22995
  • Fix duplicate searchFieldMetadata inserts in the 2.16 backfill upgrade command by @prastoin in https://github.com/twentyhq/twenty/pull/23060
  • v1.3.0 — Partner workspace self-service (glowup app) by @rashad in https://github.com/twentyhq/twenty/pull/22929
  • fix(server): stop cross-pod recompute cascade on localDataOnly workspace cache keys by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22980
  • Show the onboarding welcome animation on sign-up only by @bosiraphael in https://github.com/twentyhq/twenty/pull/23057
  • chore(twenty-exa): bump to 0.2.0, add marketplace metadata and Twenty version floor by @etiennejouan in https://github.com/twentyhq/twenty/pull/23063
  • Add auto-upgrade-in-apps by @martmull in https://github.com/twentyhq/twenty/pull/23001
  • i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/23068
  • Add autofocus to 2FA OTP inputs by @martmull in https://github.com/twentyhq/twenty/pull/23067
  • Show connect emails step to invited users without granting credits by @bosiraphael in https://github.com/twentyhq/twenty/pull/23058
  • i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/23074
  • feat(call-recorder): add copy-to-clipboard buttons for transcript, summary, and video link by @martmull in https://github.com/twentyhq/twenty/pull/23052
  • feat(app): allow non-admin developers to claim and list marketplace apps by @martmull in https://github.com/twentyhq/twenty/pull/22621
  • i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/23076
  • Fix record board column header action accessibility by @Gautam5514 in https://github.com/twentyhq/twenty/pull/22496
  • i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/23077
  • Widen the front component event allow-list by @bosiraphael in https://github.com/twentyhq/twenty/pull/22616
  • System side effect relations by @prastoin in https://github.com/twentyhq/twenty/pull/22882
  • fix(workflow): show account select in Send Email node when no account is connected by @thomtrp in https://github.com/twentyhq/twenty/pull/23066
  • fix(ai): show answered ask_questions as a card in chat history by @etiennejouan in https://github.com/twentyhq/twenty/pull/23075
  • i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/23082
  • i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/23083
  • i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/23085
  • chore: bump npm packages to 2.23.0-alpha.1 by @prastoin in https://github.com/twentyhq/twenty/pull/23084
  • Add metadata cache tracing and avoid duplicate cache lookups by @Weiko in https://github.com/twentyhq/twenty/pull/23080
  • i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/23087
  • i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/23090
  • Marketplace glowup — live partner profiles, case studies & matching (website) by @rashad in https://github.com/twentyhq/twenty/pull/23016
  • Reduce call-recorder recovery crons to daily to relieve production by @martmull in https://github.com/twentyhq/twenty/pull/23099
  • fix(ai-chat) - fix record chips in AI ask-questions card by @etiennejouan in https://github.com/twentyhq/twenty/pull/23106
  • Fix "Go to roles settings" command by @ijreilly in https://github.com/twentyhq/twenty/pull/23105
  • Fix: allow API key creation without Roles permission by @ijreilly in https://github.com/twentyhq/twenty/pull/23102
  • Upgrade call-recorder, people-data-labs, last-contact and partners apps to twenty-sdk 2.23.0-alpha.1 by @prastoin in https://github.com/twentyhq/twenty/pull/23098
  • feat: kanban, calendar and group-by table layouts for dashboard view widgets by @FelixMalfait in https://github.com/twentyhq/twenty/pull/22963
  • i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/23108
  • Instrument Node runtime and workspace cache metrics by @Weiko in https://github.com/twentyhq/twenty/pull/23107
  • fix(shared): multi-select "contains any" filter matcher should use OR semantics by @winklemad in https://github.com/twentyhq/twenty/pull/23010
  • Forward editing and clipboard events to front components by @bosiraphael in https://github.com/twentyhq/twenty/pull/22630
  • Make upgrade applications batch size a job parameter defaulting to 5 by @martmull in https://github.com/twentyhq/twenty/pull/23101
  • i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/23114
  • Add per-application API rate limiter by @martmull in https://github.com/twentyhq/twenty/pull/23100
  • fix(ai-chat) - fix AI record references when display names contain markdown characters by @etiennejouan in https://github.com/twentyhq/twenty/pull/23113
  • Cache twenty-client-sdk modules host-side via content-addressed URLs by @prastoin in https://github.com/twentyhq/twenty/pull/22981
  • i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/23116
  • i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/23117
  • Fix invalid UUID insert in workflow core-links backfill by @Weiko in https://github.com/twentyhq/twenty/pull/23118
  • Documentation update by @BOHEUS in https://github.com/twentyhq/twenty/pull/23091
  • Fix update events reporting untouched columns as changed by @bosiraphael in https://github.com/twentyhq/twenty/pull/22797
  • i18n - website translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/23096
  • Remove dead code from legacy metadataVersion cache mechanism by @Weiko in https://github.com/twentyhq/twenty/pull/23122
  • Add real estate demo app by @thomtrp in https://github.com/twentyhq/twenty/pull/23111
  • i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/23125
  • Upgrade remaining official apps to 2.23 alpha by @prastoin in https://github.com/twentyhq/twenty/pull/23124
  • i18n - translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/23126
  • fix(billing) - expand billing sub uniqueness constraint by @etiennejouan in https://github.com/twentyhq/twenty/pull/23123
  • i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/23136
  • Fix workspace cache flush versioned metadata by @Weiko in https://github.com/twentyhq/twenty/pull/23121
  • chore: sync AI model catalog from models.dev by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/23143
  • Fix instance fast migration, fallback index creation by @prastoin in https://github.com/twentyhq/twenty/pull/23149

New Contributors

  • @admin-laicadev made their first contribution in https://github.com/twentyhq/twenty/pull/22880
  • @nicoko93 made their first contribution in https://github.com/twentyhq/twenty/pull/22877
  • @Gautam5514 made their first contribution in https://github.com/twentyhq/twenty/pull/22496
  • @winklemad made their first contribution in https://github.com/twentyhq/twenty/pull/23010

Full Changelog: https://github.com/twentyhq/twenty/compare/twenty/v2.22.0...twenty/v2.23.2

Security Fixes

  • fix(docker): bump curl pin to 8.20.0-r0 (2 high + 6 medium CVEs)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track twenty

Get notified when new releases ship.

Sign up free

About twenty

Building a modern alternative to Salesforce, powered by the community.

All releases →

Related context

Related tools

Earlier breaking changes

  • vtwenty/v2.20.0 Deprecate `fieldMetadata` and `objectMetadata` standardOverrides.
  • vtwenty/v2.13.0 Gate record creation on isUICreatable only, decoupled from isSystem.
  • vtwenty/v2.13.0 Rename isUIReadOnly to isUIEditable and add isUICreatable, affecting app developers.
  • vtwenty/v2.12.0 Deprecate isCustom for Objects and Fields.
  • vtwenty/v2.12.0 Deprecate dummy enterprise key (2/2).

Beta — feedback welcome: [email protected]