- Adds a resolveObjectMetadataLabel utility that returns the singular or
plural label from object metadata based on the number of selected
records (e.g., "person" vs "people").
- Exposes a pre-computed objectMetadataLabel string on
CommandMenuContextApi, making it available for label interpolation
(e.g., Delete ${capitalize(objectMetadataLabel)}).
As per title, update a documentation on how to upload a file given
increasing amount of questions for this problem
CC: @StephanieJoly4
---------
Co-authored-by: Etienne <45695613+etiennejouan@users.noreply.github.com>
Drop @ai-sdk/react and resumable-stream in favor of a unified GraphQL SSE
subscription for all agent chat events (token streaming, message persistence,
queue updates). This makes the architecture server-driven and eliminates
the class of bugs caused by dual-state (AI SDK internal state vs Jotai atoms).
Key changes:
- Backend: publish UIMessageChunks via Redis PubSub instead of HTTP SSE +
resumable-stream. New AgentChatEventPublisherService, subscription resolver,
and unified POST /:threadId/message endpoint (server decides queue vs stream).
- Frontend: new useAgentChatSubscription hook bridges graphql-sse events into
readUIMessageStream (from ai package) for chunk accumulation. Optimistic
rendering preserves user messages during streaming. SSE client recycling
triggers automatic resubscription.
- Queue: messages sent during active streaming are placed directly in queue
atoms (no flash). Server auto-flushes next queued message after stream ends.
Made-with: Cursor
📄 Summary
This PR upgrades the nodemailer dependency to a secure version (≥ 8.0.4)
to fix a known SMTP command injection vulnerability
(GHSA-c7w3-x93f-qmm8).
🚨 Issue
The current version used in twenty-server (^7.0.11, resolved to 7.0.11 /
7.0.13) is vulnerable to SMTP command injection due to improper
sanitization of the envelope.size parameter.
This could allow CRLF injection, potentially enabling attackers to add
unauthorized recipients to outgoing emails.
🔍 Root Cause
The vulnerability originates from insufficient validation of
user-controlled input in the SMTP envelope, specifically the size field,
which can be exploited via crafted input containing CRLF sequences.
✅ Changes
Upgraded nodemailer to version ^8.0.4
Ensured compatibility with existing email sending logic
Verified that no breaking changes affect current usage
🔐 Security Impact
This update mitigates the risk of:
SMTP command injection
Unauthorized email recipient manipulation
Potential data leakage via crafted email payloads
📎 References
GHSA: GHSA-c7w3-x93f-qmm8
CVE: (see linked report in issue)
---------
Co-authored-by: Félix Malfait <felix.malfait@gmail.com>
Co-authored-by: Charles Bochet <charlesBochet@users.noreply.github.com>
## Summary
- Replaces `twentycrm/twenty-postgres-spilo` with the official
`postgres:16` image across all 7 CI workflow files
- Removes Docker Hub `credentials` blocks from all service containers
(postgres, redis, clickhouse)
- Removes the `Login to Docker Hub` step from the breaking changes
workflow
## Context
Fork PRs cannot access repository secrets/variables, causing `${{
vars.DOCKERHUB_USERNAME }}` and `${{ secrets.DOCKERHUB_PASSWORD }}` to
resolve to empty strings. GitHub Actions rejects empty credential values
at template validation time, failing the job before any step runs.
The custom spilo image was the original reason credentials were needed
(to avoid Docker Hub rate limits on non-official images). The only
Postgres extensions required in CI (`uuid-ossp`, `unaccent`) are built
into the official `postgres:16` image. Official Docker Hub images have
significantly higher pull rate limits and don't require authentication.
## Summary
- Adds `search` and `searches` to the `RESERVED_METADATA_NAME_KEYWORDS`
list in `twenty-shared`
- Prevents users from creating custom objects named "search", which
collides with the core `search` GraphQL resolver
## Summary
- Adds a new `upgrade:1-21:backfill-datasource-to-workspace` command
that copies `dataSource.schema` into `workspace.databaseSchema` for all
active/suspended workspaces that haven't been migrated yet
- Registers the command in the 1-21 upgrade module and wires it into the
upgrade runner (runs before other 1-21 commands)
- Part of the ongoing deprecation of the `dataSource` table in favor of
storing `databaseSchema` directly on `WorkspaceEntity`
This PR completes the sections we need for the Homepage. Assets, such as
images, are still placeholder, and will be replaced as they become
available. We're still waiting on Lottie and 3d asset files from the
design team.
Database batch events (update / insert / soft-delete / hard-delete) were
building recordsBefore / recordsAfter after formatResult ran twice: once
inside WorkspaceSelectQueryBuilder.getMany() / getOne(), and again in
the CUD query builders. On the second pass, already-shaped composite
fields (e.g. emails) went through formatFieldMetadataValue and kept the
same object references as the live TypeORM row, so recordsBefore could
change when the entity was updated—breaking workflow triggers and diffs.
Fixes: #18943
Follow-up pr: #19001
## Summary:
- Timeline activity shows file upload history, but deleted files had no
signed URL and were still rendered as clickable — clicking did nothing
- grab the fileId from properties.diff.after, look it up in the current
record's files field: if present, use live signed URL; if absent, mark
as deleted
- Deleted file chips show line-through label, not-allowed cursor, and
"File no longer exists" tooltip on hover
https://github.com/user-attachments/assets/5df6a675-0003-4fd1-ad57-a07e4338923f
---------
Co-authored-by: Etienne <45695613+etiennejouan@users.noreply.github.com>
## Context
Checked in the codebase where we are trying to rollback a non-active
transaction.
packages/twenty-server/src/engine/core-modules/auth/services/sign-in-up.service.ts
seemed to be the only place where it happens.
We could enforce this with a lint rule in the future 🤔
- Cast status to union type in mapDBMessagesToUIMessages
- Update client SDK generated schema/types to include status field
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Extract STREAM_AGENT_CHAT_JOB_NAME and StreamAgentChatJobData to
separate types file to break circular dependency between
stream-agent-chat.job.ts and agent-chat-streaming.service.ts
- Optimize flushNextQueuedMessage to check queued messages first
(lightweight query) before loading full conversation
- Add missing state field to reasoning parts in server-side mapper
- Use entity status value in controller response instead of string literal
- Narrow ExtendedUIMessage.status to 'queued' | 'sent' union type
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add optional status field to ExtendedUIMessage in twenty-shared
- Remove invalid providerOptions from reasoning part mapper
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add "core" schema prefix to migration SQL (fixes CI)
- Remove unused modelId param from queueMessage
- Scope promoteQueuedMessage to QUEUED status only
- Use AgentMessageStatus enum instead of string literals
- Create proper mapDBPartsToUIMessageParts server-side mapper
(fixes lossy mapping that dropped tool calls, reasoning, etc.)
- Merge getQueuedMessages + getMessagesForThread into single query
- Pass hasTitle from job data to avoid redundant thread lookup
- Remove modelId from frontend queue POST body
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace localStorage-based frontend queue with server-side persistence.
When a user sends a message while streaming, the message is stored in
the database with status='queued'. When streaming finishes, the worker
automatically picks up the next queued message and starts processing it.
- Add `status` column (queued/sent) and make `turnId` nullable on AgentMessage
- Add REST endpoints POST/:threadId/queue and DELETE/:threadId/queue/:messageId
- Add auto-flush logic in stream job's finally block
- Frontend reads queued messages from GraphQL instead of localStorage
- Delete queued messages via REST DELETE endpoint
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
