Twenty v2.6.0 — Release Notes & Engineering Impact

Source available — automated, not human-reviewed

Component: twenty · Channel: stable. Automated analysis, not a compatibility certification. How this works.

Analysis updated: 2026-11-01.

Breaking-change evidence from the source

⚠️ Breaking changes - **`APP_SECRET` no longer used** for approved-access-domain validation or session cookies — moved to the encryption-key path (#20580) - **Permission-flag rename and catalog** — `permissionFlag` → `rolePermissionFlag`, plus new permission-flag catalog and backfill (#20481)

Read the original context ↗

Source flags breaking changes — review applicability

📄 .MD

✨ Features 6 ⚡ Improvements 5 ⚠️ Breaking & Deprecations 1

⚡ Executive Summary (TL;DR)

Twenty v2.6.0. Source highlight: **Relation traversal in filter dropdown** — drill into related-record fields when filtering, via a stacked dropdown (#20533)

Visit Twenty Official Site ↗ Official Release Source ↗ All Twenty Releases 📡 Twenty RSS

Who Does This Impact? (Role-Based Analysis)

💻 Software Engineers & Devs

Check the source notes against the package and APIs you use before upgrading.

📊 Product & Engineering Leads

Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.

⚙️ DevOps & Security

Verify the target version, runtime requirements and rollback procedure in the official documentation.

⚠️ Breaking Changes & Deprecations (1)

⚠️ Breaking changes - **`APP_SECRET` no longer used** for approved-access-domain validation or session cookies — moved to the encryption-key path (#20580) - **Permission-flag rename and catalog** — `permissionFlag` → `rolePermissionFlag`, plus new permission-flag catalog and backfill (#20481)

✨ New Features & Capabilities (6)

**Relation traversal in filter dropdown** — drill into related-record fields when filtering, via a stacked dropdown (#20533)
**Signing keys management tab** — admin-panel UI for JWT signing keys with usage tracking (#20586)
**Pricing plan card refresh** (#20614)
**MCP tool annotations** (#20672)
**Resume workspace selection on `/welcome`** when a valid `tokenPair` cookie is present (#20575)
**Upgrade-aware entity decorators** — entity columns can be marked added/removed at specific versions, enabling cross-version upgrades (#20686)

⚡ Performance & Enhancements (5)

**Password length capped at 50 characters** (#20655)
Index `messageChannel` / `calendarChannel` for per-workspace sync crons (#20678)
Batch upgrade-migration inserts to stay under the Postgres parameter limit (#20588)
AI Chat: file uploads (#20681)
Settings / navigation-drawer polish (#20634)

📄 View Raw Release Notes (Original Developer Log)

## Highlights ### Features - **Relation traversal in filter dropdown** — drill into related-record fields when filtering, via a stacked dropdown (#20533) - **Signing keys management tab** — admin-panel UI for JWT signing keys with usage tracking (#20586) - **Pricing plan card refresh** (#20614) - **MCP tool annotations** (#20672) - **Resume workspace selection on `/welcome`** when a valid `tokenPair` cookie is present (#20575) ### ⚠️ Breaking changes - **`APP_SECRET` no longer used** for approved-access-domain validation or session cookies — moved to the encryption-key path (#20580) - **Permission-flag rename and catalog** — `permissionFlag` → `rolePermissionFlag`, plus new permission-flag catalog and backfill (#20481) ### Notable improvements - **Upgrade-aware entity decorators** — entity columns can be marked added/removed at specific versions, enabling cross-version upgrades (#20686) - **Password length capped at 50 characters** (#20655) - Index `messageChannel` / `calendarChannel` for per-workspace sync crons (#20678) - Batch upgrade-migration inserts to stay under the Postgres parameter limit (#20588) - Add `relationTargetFieldMetadataId` column early in the upgrade sequence (#20664) - AI Chat: file uploads (#20681) - Settings / navigation-drawer polish (#20634) ### Security - `node:24-alpine` pinned to specific digest (#20603) ### Bug fixes ~15 fixes including: reactivating deactivated relations, theme-aware side panel & body text colors, currency icon alignment, REST network-error handling, billing query timeout, OpenAPI schema for `phones.additionalPhones`, partial-index rebuild for unique phone constraints, legacy PK-name handling in the 2.6 permission-flag upgrade. **Full Changelog**: https://github.com/twentyhq/twenty/compare/v2.5.0...v2.6.0

← Older Version Twenty v2.5.0 Newer Version → Twenty v2.7.0