Skip to content
TrustMyStack, home

twenty

v2.58.0
twentyhq/twenty

The open alternative to Salesforce, designed for AI.

Version of twentyhq/twenty you run

CompareView on GitHub
Maintenance
Active3623 commits in 3 months · bus factor 6
License
OtherUnknown
Security
15 advisories3 critical, 3 high, 9 medium
Supported versions
No scheduleendoflife.date does not track this project

61k stars · 10.1k forks · 116 open issues · last release 2 days ago · data checked 5 hours ago

OverviewTourReleasesDocker imagesSecurityLogos

Breaking changes

What to check before upgrading, taken from the notes of the last 30 releases.

  • sdk/v2.58.0Nov 13, 2026

    ⚠️ Breaking changes

    • [BREAKING_CHANGE] Drop the legacy workspace workflow object (#30036) by @charlesBochet
    • [BREAKING_CHANGE] Read row level permission rules in the permission compiler (#30132) by @charlesBochet
    • [BREAKING_CHANGE] Mask record grants with limiting roles and drop legacy current user permissions (#30145) by @charlesBochet
  • twenty/v2.58.0Nov 13, 2026

    ⚠️ Breaking changes

    • [BREAKING_CHANGE] Drop the legacy workspace workflow object (#30036) by @charlesBochet
    • [BREAKING_CHANGE] Read row level permission rules in the permission compiler (#30132) by @charlesBochet
    • [BREAKING_CHANGE] Mask record grants with limiting roles and drop legacy current user permissions (#30145) by @charlesBochet
    • chore(security): bump exa-js to 2.28.0 in the exa app (#30188) by @mabdullahabaid
  • twenty/v2.57.0Nov 9, 2026

    ⚠️ Breaking changes

    • chore(security): bump @modelcontextprotocol/sdk to 1.32.2 (#29768) by @mabdullahabaid
    • chore(security): bump lodash.omit to 4.18.0 (#29775) by @mabdullahabaid
    • Keep access group rows up to date behind a feature flag (#29890) by @charlesBochet
  • sdk/v2.57.0Nov 9, 2026

    ⚠️ Breaking changes

    • Keep access group rows up to date behind a feature flag (#29890) by @charlesBochet
  • twenty/v2.56.0Nov 5, 2026

    ⚠️ Breaking changes

    • [BREAKING_CHANGE] Let AI workflow steps run from their own config and permission scope (#29368) by @FelixMalfait
    • chore(security): bump follow-redirects to 1.16.2 in the app lockfiles (#29523) by @mabdullahabaid
    • chore(security): bump follow-redirects to 1.16.2 in the root and application dependency lockfiles (#29528) by @mabdullahabaid
    • Keep the Nx cache in the workspace on CI (#29587) by @charlesBochet
    • chore(security): bump happy-dom to 20.14.6 in the root lockfile (#29588) by @mabdullahabaid
  • sdk/v2.56.0Nov 5, 2026

    ⚠️ Breaking changes

    • [BREAKING_CHANGE] Let AI workflow steps run from their own config and permission scope (#29368) by @FelixMalfait
  • twenty/v2.55.0Nov 3, 2026

    ⚠️ Breaking changes

    • Every webhook now requires a role. Pass a roleId when calling createWebhook, and provide the ROLES permission alongside API_KEYS_AND_WEBHOOKS to create or edit webhooks. (#29273) by @charlesBochet
    • App settings tabs now support a URL slug. Connect and Reconnect now land on the app's first settings tab; any bookmarked routes to tab fragments may need updating. (#29355) by @martmull
    • setRecordGeneralAccess is removed. Use setRecordPrivate(true) to restrict a record to its creator and explicit shares, or setRecordPrivate(false) to let roles govern access. (#29383) by @charlesBochet
    • IconsProvider has moved out of twenty-ui/icon. Update any imports that reference it from that path. This also removes roughly 2 MB of icon code from shared bundles. (#29386) by @FelixMalfait
    • readability, writability, sharingReach, readabilityParentFieldUniversalIdentifiers, and fieldMetadata.writability are removed from the metadata GraphQL and REST APIs. (#29390) by @charlesBochet
  • sdk/v2.55.0Nov 3, 2026

    ⚠️ Breaking changes

    • allowedIframeOrigins on the workspace object is renamed — update any queries or mutations that reference it; the new updateWorkspaceIframeMediaPermissions mutation adds per-origin microphone and camera grants. (#29217) by @bosiraphael
    • createWebhook now requires a roleId; updateWebhook accepts an optional roleId to change it; creating or editing a webhook now also requires the ROLES permission. (#29273) by @charlesBochet
    • defineSettingsMenuItem now accepts an optional slug (lowercase kebab-case, max 64 chars) used as the URL hash for that settings tab; Connect and Reconnect now land on the app's first preferences tab. (#29355) by @martmull
    • Replace setRecordGeneralAccess with setRecordPrivate(recordId, isPrivate) — a record is now either private (creator and direct shares only) or role-governed. (#29383) by @charlesBochet
    • IconsProvider has moved out of twenty-ui/icon to a new export path; import it from there to stop inlining all 4,200 Tabler icons in bundles that only need the provider. (#29386) by @FelixMalfait
    • objectMetadata.readability, writability, readabilityParentFieldUniversalIdentifiers, sharingReach, and fieldMetadata.writability are removed from the GraphQL metadata API; remove them from all queries, fragments, and SDK calls. (#29390) by @charlesBochet

Release history

All releases on GitHub
Atom feed/feed/twentyhq/twenty
BadgeLatest version of twentyhq/twenty[![version](/badge/twentyhq/twenty)](/p/twentyhq/twenty)

⚠️ Breaking changes

  • [BREAKING_CHANGE] Drop the legacy workspace workflow object (#30036) by @charlesBochet
  • [BREAKING_CHANGE] Read row level permission rules in the permission compiler (#30132) by @charlesBochet
  • [BREAKING_CHANGE] Mask record grants with limiting roles and drop legacy current user permissions (#30145) by @charlesBochet

💅 Improvements & UX

  • Agents design fixes (#29288) by @Bonapara
  • Add an MCP tool workflow step backed by the cached server tools (#29668) by @abdulrahmancodes
  • Notify members mentioned in app and workflow inbox messages (#29675) by @bosiraphael
  • Let logic functions call the server through a private URL (#29687) by @prastoin
  • Let validation rules read a record's previous values (#29718) by @FelixMalfait
  • Add self-service two-factor authentication backup codes (#29833) by @abdulrahmancodes
  • Show grouped table and list views as tabs, behind a feature flag (#29855) by @FelixMalfait
  • Let messaging providers declare a chat or email conversation style (#29963) by @martmull
  • Run applications with their grant (#29965) by @prastoin
  • Let applications archive the inbox threads they wrote (#29982) by @FelixMalfait
  • Run HTTP requests through the logic function driver (#29996) by @prastoin
  • Send email-style replies through app messaging providers (#30002) by @martmull
  • Add Overview and Runs tabs to the workflow page (#30045) by @FelixMalfait
  • Show a receipt in outgoing Messages bubbles (#30103) by @martmull
  • Add the row level permission rule syncable entity (#30111) by @charlesBochet
  • Declare record event triggers as eventTriggerSettings with on: 'recordEvent' (#30126) by @FelixMalfait
  • Bump Playwright to 1.65 to support Ubuntu 26.04 runners (#30167) by @charlesBochet
  • Add stopGenerate to stop a followed ai.generate run (#30190) by @FelixMalfait
  • Let the permission engine create the record share and access group tables behind a flag (#30195) by @charlesBochet

🐛 Bug fixes

  • fix(cli): keep workflow code steps out of definition discovery (#30088) by @Weiko

🔧 Developer & API

  • Fix SDK metadata client index for senderApplicationId (#30001) by @charlesBochet
  • Fix order-dependent integration tests and stale SDK metadata client (#30068) by @charlesBochet
  • Export workflow filter enums from the SDK and report unconfigured widgets (#30118) by @FelixMalfait

Full changelog (26 PRs)

  • Agents design fixes (#29288) by @Bonapara
  • Add an MCP tool workflow step backed by the cached server tools (#29668) by @abdulrahmancodes
  • Notify members mentioned in app and workflow inbox messages (#29675) by @bosiraphael
  • Let logic functions call the server through a private URL (#29687) by @prastoin
  • Let validation rules read a record's previous values (#29718) by @FelixMalfait
  • Add self-service two-factor authentication backup codes (#29833) by @abdulrahmancodes
  • Show grouped table and list views as tabs, behind a feature flag (#29855) by @FelixMalfait
  • Let messaging providers declare a chat or email conversation style (#29963) by @martmull
  • Run applications with their grant (#29965) by @prastoin
  • Let applications archive the inbox threads they wrote (#29982) by @FelixMalfait
  • Run HTTP requests through the logic function driver (#29996) by @prastoin
  • Fix SDK metadata client index for senderApplicationId (#30001) by @charlesBochet
  • Send email-style replies through app messaging providers (#30002) by @martmull
  • [BREAKING_CHANGE] Drop the legacy workspace workflow object (#30036) by @charlesBochet
  • Add Overview and Runs tabs to the workflow page (#30045) by @FelixMalfait
  • Fix order-dependent integration tests and stale SDK metadata client (#30068) by @charlesBochet
  • fix(cli): keep workflow code steps out of definition discovery (#30088) by @Weiko
  • Show a receipt in outgoing Messages bubbles (#30103) by @martmull
  • Add the row level permission rule syncable entity (#30111) by @charlesBochet
  • Export workflow filter enums from the SDK and report unconfigured widgets (#30118) by @FelixMalfait
  • Declare record event triggers as eventTriggerSettings with on: 'recordEvent' (#30126) by @FelixMalfait
  • [BREAKING_CHANGE] Read row level permission rules in the permission compiler (#30132) by @charlesBochet
  • [BREAKING_CHANGE] Mask record grants with limiting roles and drop legacy current user permissions (#30145) by @charlesBochet
  • Bump Playwright to 1.65 to support Ubuntu 26.04 runners (#30167) by @charlesBochet
  • Add stopGenerate to stop a followed ai.generate run (#30190) by @FelixMalfait
  • Let the permission engine create the record share and access group tables behind a flag (#30195) by @charlesBochet

Full Changelog: https://github.com/twentyhq/twenty/compare/sdk/v2.57.1...sdk/v2.58.0

Full release notesCompare with previous