Twenty

Highlights

Features

• Relation traversal in filter dropdown — drill into related-record fields when filtering, via a stacked dropdown (#20533)
• Signing keys management tab — admin-panel UI for JWT signing keys with usage tracking (#20586)
• Pricing plan card refresh (#20614)
• MCP tool annotations (#20672)
• Resume workspace selection on /welcome when a valid tokenPair cookie is present (#20575)

⚠️ Breaking changes

• APP_SECRET no longer used for approved-access-domain validation or session cookies — moved to the encryption-key path (#20580)
• Permission-flag rename and catalog — permissionFlag → rolePermissionFlag, plus new permission-flag catalog and backfill (#20481)

Notable improvements

• Upgrade-aware entity decorators — entity columns can be marked added/removed at specific versions, enabling cross-version upgrades (#20686)
• Password length capped at 50 characters (#20655)
• Index messageChannel / calendarChannel for per-workspace sync crons (#20678)
• Batch upgrade-migration inserts to stay under the Postgres parameter limit (#20588)
• Add relationTargetFieldMetadataId column early in the upgrade sequence (#20664)
• AI Chat: file uploads (#20681)
• Settings / navigation-drawer polish (#20634)

Security

• node:24-alpine pinned to specific digest (#20603)

Bug fixes

~15 fixes including: reactivating deactivated relations, theme-aware side panel & body text colors, currency icon alignment, REST network-error handling, billing query timeout, OpenAPI schema for phones.additionalPhones, partial-index rebuild for unique phone constraints, legacy PK-name handling in the 2.6 permission-flag upgrade.

Full Changelog: https://github.com/twentyhq/twenty/compare/v2.5.0…v2.6.0