# Twenty twenty/v2.30.0 — Release & Upgrade Intelligence
- **Product:** Twenty (https://twenty.com)
- **Version:** twenty/v2.30.0
- **Released:** Aug 11, 2026
- **Impact Score:** 7/10
- **Breaking Changes:** Source flagged
- **Canonical Analysis:** https://changelogs.us/twenty/updates/twenty-v2.30.0/

## Executive Summary (TL;DR)
Twenty twenty/v2.30.0. Source highlight: The GraphQL metadata API no longer uses nestjs-query cursor types. Remove ObjectConnection, FieldConnection, CursorPaging, and related cursor inputs from metadata queries and switch to the new resolver-based shape. (#23925)

## Breaking Changes & Deprecations
- ⚠️ Breaking changes - The GraphQL metadata API no longer uses nestjs-query cursor types. Remove ObjectConnection, FieldConnection, CursorPaging, and related cursor inputs from metadata queries and switch to the new resolver-based shape. ([#23925](https://github.com/twentyhq/twenty/pull/23925)) by @abdulrahmancodes
- - Server image security update: undici bumped from v6/v7 to v8 (potentially breaking for direct callers), plus js-yaml, sharp, brace-expansion, ip-address, and dompurify patched for critical and high CVEs. Self-hosters should update. ([#23963](https://github.com/twentyhq/twenty/pull/23963)) by @charlesBochet
- - [BREAKING CHANGE] refactor(server): migrate the metadata API off nestjs-query ([#23925](https://github.com/twentyhq/twenty/pull/23925)) by @abdulrahmancodes

## New Features
- The runAgent API now accepts a messages array for multi-turn bot conversations alongside the existing single-prompt form. (#23395)
- Apps can now run an agent on behalf of a specific workspace member, scoping the run to that person's permissions. (#23470)
- Large-company signups now see an optional Cal.com call-booking step during onboarding, between the team invite and plan selection. (#23521)
- The Slack bot now includes direct links to records it creates or surfaces, so you can open them from the reply. (#23539)
- Fireflies calls missed by webhooks can be backfilled via POST /fireflies/backfill; the work fans out as batched background jobs. (#23622)
- Campaign email bodies now open in a canvas editor with sections, columns, buttons, dividers, and image blocks that render to email-safe HTML per recipient. (#23657)

## Improvements
- A failed page chunk load no longer shows a raw browser error string in a snackbar. (#23571)
- Microsoft Graph webhook lifecycle events now route correctly: subscriptionRemoved recreates the subscription, reauthorizationRequired renews it in place. (#23707)
- Onboarding no longer shows free-credit tags or reward prompts when billing is disabled on the instance. (#23717)
- The Slack bot no longer calls the Slack API to identify itself on every channel-join event; the bot user id is cached at connect time. (#23726)
- Expired invitations are no longer treated as active and no longer count toward the onboarding invitation limit. (#23749)
- Drag-and-drop across the app now uses a single consistent drop-position algorithm; table rows, Kanban cards, and tabs drop where you aim them. (#23752)

## Bug Fixes
- Server image security update: undici bumped from v6/v7 to v8 (potentially breaking for direct callers), plus js-yaml, sharp, brace-expansion, ip-address, and dompurify patched for critical and high CVEs. Self-hosters should update. (#23963)
- A stray ] that sometimes appeared after AI chat record chips is fixed. (#23798)
- Hidden records no longer appear as chart labels — charts grouped by a relation field now filter the join and show only records the viewer is allowed to see. (#23369)
- A view grouped by a field with only one groupable option (e.g. People grouped by Company) can now have its grouping changed or removed. (#23619)
- App-manifest RECORD_TABLE widgets can now reference a view by viewUniversalIdentifier, matching the portability that FIELDS widgets already had. (#23634)
- HTML and HTM file previews now expand to fill the preview modal instead of rendering at the default inline iframe size. (#23676)