Twenty twenty/v2.12.0 release notes

What’s Changed

chore: bump version to 2.12.0 by @twenty-pr[bot] in https://github.com/twentyhq/twenty/pull/21358
Increase logicFunctionQueue worker concurrency to 10 by @thomtrp in https://github.com/twentyhq/twenty/pull/21364
Remove default command by @martmull in https://github.com/twentyhq/twenty/pull/21357
Restore content-box sizing for components broken by the global border-box reset by @bosiraphael in https://github.com/twentyhq/twenty/pull/21361
Fix: pinned command-menu actions run with empty selection by @bosiraphael in https://github.com/twentyhq/twenty/pull/21366
chore(twenty-server): temporary instrumentation for app-install 504 by @charlesBochet in https://github.com/twentyhq/twenty/pull/21365
fix(twenty-front): restore top-bar-title testid to unbreak merge queue by @charlesBochet in https://github.com/twentyhq/twenty/pull/21367
feat(website): book an intro call after partner application by @rashad in https://github.com/twentyhq/twenty/pull/21343
Deprecate dummy enterprise key 2/2 by @ijreilly in https://github.com/twentyhq/twenty/pull/21328
Fix various graphs bugs by @ijreilly in https://github.com/twentyhq/twenty/pull/21311
fix(twenty-front): new layout fast-follows by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21360
fix(billing) - Suspend workspace at trial period end if cancelation is planned by @etiennejouan in https://github.com/twentyhq/twenty/pull/21363
isCustom deprecation for Objects and Fields by @Weiko in https://github.com/twentyhq/twenty/pull/21228
Enrich app:add field relation and morph relations by @martmull in https://github.com/twentyhq/twenty/pull/21368
fix(front): reject backslash paths in isValidReturnToPath (open-redirect hardening) by @joeltco in https://github.com/twentyhq/twenty/pull/21287
security: bump path-to-regexp and defu to patched versions (lockfile refresh) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21369
feat(twenty-server): allow shouldHideEmptyGroups in app view manifest by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21370
security: bump vite to 7.3.5 in twenty-apps lockfiles (GHSA-v2wj-q39q-566r) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21371
security(apps): bump twenty-sdk to 2.10.1 for the 3 remaining pre-2.0 apps (tmp, undici) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21374
security: force shell-quote >= 1.8.4 (GHSA-w7jw-789q-3m8p, critical) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21372
fix(server): repair server typecheck broken by isCustom deprecation by @charlesBochet in https://github.com/twentyhq/twenty/pull/21376
fix(auth): additional workspace and identity validation in auth flows by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21347
security: clear all High minimatch Dependabot alerts via parent bumps by @charlesBochet in https://github.com/twentyhq/twenty/pull/21373
fix(front): surface widget render errors via ErrorBoundary onError by @clivemeister in https://github.com/twentyhq/twenty/pull/21009
security: refresh lodash + picomatch in twenty-apps lockfiles by @charlesBochet in https://github.com/twentyhq/twenty/pull/21378
security: clear fast-uri + fast-xml-parser High alerts (lockfile only) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21379
perf(twenty-front): stop Sentry Replay from re-serializing record-table mutations on navigation by @Weiko in https://github.com/twentyhq/twenty/pull/21381
feat(server): in-app server-level admin management (#19785) by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21321
[Website] Re-introduce footer language switcher by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21387
i18n - website translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21384
fix(security): bump @scalar/api-reference-react to clear unhead XSS by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21382
chore: sync AI model catalog from models.dev by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21392
security: clear immutable High alert via @graphql-codegen typescript plugins v4 by @charlesBochet in https://github.com/twentyhq/twenty/pull/21380
security: clear all High next alerts by upgrading react-email 5 → 6 by @charlesBochet in https://github.com/twentyhq/twenty/pull/21377
Improve log visibility in dev mode by @martmull in https://github.com/twentyhq/twenty/pull/21393
fix(twenty-front): new layout fast-follows — settings drawer, loading & command menu by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21389
fix: gracefully handle missing logic functions during workflow destroy by @thomtrp in https://github.com/twentyhq/twenty/pull/21362
security: clear happy-dom High alerts by upgrading wyw-in-js 0.7 → 1.1 by @charlesBochet in https://github.com/twentyhq/twenty/pull/21394
feat(twenty-partners): website field + restructured partner & opportunity views by @rashad in https://github.com/twentyhq/twenty/pull/21385
security: clear koa High alert by bumping nx 22.5.4 → 22.7.5 by @charlesBochet in https://github.com/twentyhq/twenty/pull/21396
security: clear serialize-javascript High alert (terser-webpack-plugin refresh) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21397
fix: reload stale clients on any older app version, not just major by @clivemeister in https://github.com/twentyhq/twenty/pull/21011
fix(server): prevent SSE stream teardown errors from crashing all pods by @charlesBochet in https://github.com/twentyhq/twenty/pull/21395
fix(docker): upgrade Alpine system OpenSSL libs to patched 3.5.7-r0 by @charlesBochet in https://github.com/twentyhq/twenty/pull/21399
security: clear picomatch High alert via @angular-devkit/core resolution by @charlesBochet in https://github.com/twentyhq/twenty/pull/21398
security: clear yeoman-environment High alert via resolution to 6.0.1 by @charlesBochet in https://github.com/twentyhq/twenty/pull/21400
fix(front): sanitize optimistic input when creating a record by @brendanerofeev in https://github.com/twentyhq/twenty/pull/21076
security: upgrade @nestjs/graphql 12→13 + @ptc-org/nestjs-query 4→9 (+ @nestjs/config 4) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21402
fix(server): include relation join column names in updatedFields of update events by @thomtrp in https://github.com/twentyhq/twenty/pull/21405
Prevent self-hosting app from re-matching/re-creating people on no-op updates by @ijreilly in https://github.com/twentyhq/twenty/pull/21406
fix(ui): freeze framer-motion in Argos runs to stop flaky visual diffs by @charlesBochet in https://github.com/twentyhq/twenty/pull/21412
security: clear 8 Dependabot alerts via transitive/parent bumps (no resolutions) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21409
security: clear twenty-apps & seed-dependencies CVE alerts by @charlesBochet in https://github.com/twentyhq/twenty/pull/21410
security: close lodash CVEs (#824/#823/#385) via parent upgrades, no resolution by @charlesBochet in https://github.com/twentyhq/twenty/pull/21414
security: close ws & file-type alerts via parent upgrades (no resolution) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21417
security: drop end-of-life apollo-server-core (#735, #736) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21418
fix: i18n missing hardcoded strings in settings by @AmilGael in https://github.com/twentyhq/twenty/pull/21424
fix: match relation field filters in optimistic & RLS record matchers by @josephj in https://github.com/twentyhq/twenty/pull/21301
chore(deps): bump @tabler/icons-react from 3.31.0 to 3.44.0 by @dependabot[bot] in https://github.com/twentyhq/twenty/pull/21426
chore(deps-dev): bump @types/aws-lambda from 8.10.161 to 8.10.162 by @dependabot[bot] in https://github.com/twentyhq/twenty/pull/21427
chore(deps-dev): bump storybook from 10.2.13 to 10.4.3 by @dependabot[bot] in https://github.com/twentyhq/twenty/pull/21428
fix(twenty-front): new layout fast-follows — command menu, field options & logs by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21429
security: scoped resolution for webpack-dev-server 5.2.4 (Dependabot alerts 1237/691/692) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21420
fix(kanban): preserve scroll on board re-init + propagate same-column reorders via SSE by @ehconitin in https://github.com/twentyhq/twenty/pull/20637
fix(server): register Lingui message compiler to stop “Uncompiled message detected” log flood by @machinagod in https://github.com/twentyhq/twenty/pull/21416
security: upgrade express 4.22.2 + qs 6.15.2 resolution for dev-tool holdouts (Dependabot alert 1305) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21434
[Website] Convert remaining images to WebP and compress some current ones. by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21404
Migrate twenty UI by @bosiraphael in https://github.com/twentyhq/twenty/pull/21407
i18n - website translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21439
Add People Data Labs enrichment logic functions by @bosiraphael in https://github.com/twentyhq/twenty/pull/21254
security: postcss CVE via styled-components bump + next/postcss resolution (Dependabot alert 1061) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21438
security: uuid CVE — bump bullmq/msal/blocknote + scoped resolutions for the rest (Dependabot alert 1289) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21441
security: scoped ajv 8.20.0 resolution for react-doc-viewer (Dependabot alert 481) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21445
chore(deps): prune yarn resolutions down to load-bearing entries by @charlesBochet in https://github.com/twentyhq/twenty/pull/21446
feat(partners): partner role row-level security (RLS) with scoped edits by @rashad in https://github.com/twentyhq/twenty/pull/21386
Replace random remote images in stories to stop flaky Argos diffs by @bosiraphael in https://github.com/twentyhq/twenty/pull/21447
fix(billing) - enable upgrade if invoice already paid by @etiennejouan in https://github.com/twentyhq/twenty/pull/21450
fix(ai) - add logs + remove dashboard building by @etiennejouan in https://github.com/twentyhq/twenty/pull/21440
security: strip Node dev headers from images + lingui 5.9.5 (drops vulnerable esbuild) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21448
i18n - website translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21453
fix(server): stop redundant lambda rebuilds causing build-lock acquisition failures by @thomtrp in https://github.com/twentyhq/twenty/pull/21442
Fix missing datetime filter type by @martmull in https://github.com/twentyhq/twenty/pull/21451
fix(metadata): nestjs-query batched relation queries truncate results across parents by @charlesBochet in https://github.com/twentyhq/twenty/pull/21455
security: upgrade typeorm to 0.3.26 (CVE-2025-60542) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21456
fix(ai): correct RICH_TEXT and MORPH_RELATION record filter operators by @richroberts-prog in https://github.com/twentyhq/twenty/pull/21106
security: bump wait-on 7.2.0 -> 9.0.10 to drop vulnerable joi (Dependabot alert 1437) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21457
Fix: prevent unexpected navigation when destroying record from side panel by @DeviSriSaiCharan in https://github.com/twentyhq/twenty/pull/21391
feat(server): convert view to overridable entity by @Weiko in https://github.com/twentyhq/twenty/pull/21436
fix: restore isCustom gate in metadata label resolvers by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21432
chore: sync AI model catalog from models.dev by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21476
feat(partners): lock admin-managed + ownership fields on Partner role by @rashad in https://github.com/twentyhq/twenty/pull/21471
People data labs: update app logo by @bosiraphael in https://github.com/twentyhq/twenty/pull/21479
feat(workflow) - Add validation layer by @etiennejouan in https://github.com/twentyhq/twenty/pull/21422
People data labs app: remove navigation menu items by @bosiraphael in https://github.com/twentyhq/twenty/pull/21478
(Fix) Upsert no longer rewrites position on existing records by @ijreilly in https://github.com/twentyhq/twenty/pull/21375
fix(server): restore absolute TTL in PromiseMemoizer by @charlesBochet in https://github.com/twentyhq/twenty/pull/21480
Fix missing WasIntroducedInUpgrade for overridable view entity by @Weiko in https://github.com/twentyhq/twenty/pull/21483
feat: inline image thumbnails and legacy-label fallback for FILES field chips by @mvanhorn in https://github.com/twentyhq/twenty/pull/21294
fix(server): bypass stale workspace cache when resolving currentUser during onboarding by @charlesBochet in https://github.com/twentyhq/twenty/pull/21461
Add CI workflow for people data labs app by @bosiraphael in https://github.com/twentyhq/twenty/pull/21487
Add dev:generate-client command to sdk by @martmull in https://github.com/twentyhq/twenty/pull/21489

New Contributors

@joeltco made their first contribution in https://github.com/twentyhq/twenty/pull/21287
@brendanerofeev made their first contribution in https://github.com/twentyhq/twenty/pull/21076
@AmilGael made their first contribution in https://github.com/twentyhq/twenty/pull/21424
@machinagod made their first contribution in https://github.com/twentyhq/twenty/pull/21416

Full Changelog: https://github.com/twentyhq/twenty/compare/twenty/v2.11.0…twenty/v2.12.0