Abdullah. e83e616fde fix: qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion (#16886) ...

Resolves [Dependabot Alert
354](https://github.com/twentyhq/twenty/security/dependabot/354) and
[Dependabot Alert
355](https://github.com/twentyhq/twenty/security/dependabot/355).

Upgraded express by one minor version. Removed redundant type definition
in root `package.json` since we already have it in twenty-server's
`package.json`.

Upgraded body-parser patch version in serverless package.json.

Co-authored-by: Félix Malfait <felix.malfait@gmail.com>

2026-01-07 15:58:12 +00:00

..

__mocks__

Deprecate object metadata maps in favor of flat entities (#16080)

2025-11-27 13:43:34 +01:00

actor

Improve userFriendlyMessage devX (#16815)

2025-12-30 09:08:43 +00:00

admin-panel

1895 extensibility v1 application tokens (#16365)

2025-12-08 10:42:46 +01:00

api-key

refactor: Migrate CRUD services to use Common API (#16869)

2025-12-31 10:24:50 +01:00

app-token

Explicitly set workspaceId column as uuid type to ease pg LEFT JOIN (#15430)

2025-10-29 19:08:44 +01:00

application

feat: Serverless Functions as AI Tools (#16919)

2026-01-05 11:13:06 +01:00

applicationVariable

Improve userFriendlyMessage devX (#16815)

2025-12-30 09:08:43 +00:00

approved-access-domain

[BREAKING_CHANGE_NESTED_WORKSPACE]Refactor FlatEntity typing in aim of introducing UniversalFlatEntity (#16701)

2025-12-30 13:47:02 +00:00

audit

Improve userFriendlyMessage devX (#16815)

2025-12-30 09:08:43 +00:00

auth

Row level permissions - POC 1 (#16599)

2025-12-31 16:15:17 +01:00

billing

Billing - Update alert when meter price is updated (#16952)

2026-01-06 12:25:28 +00:00

billing-webhook

feat(billing): implement credit rollover from one billing period to another (#16802)

2025-12-28 15:42:18 +01:00

cache-lock

Update lock parameters (#15901)

2025-11-18 15:40:42 +00:00

cache-storage

fix cache service mset (#16327)

2025-12-04 15:49:17 +01:00

calendar

Message/Calendar thread temporary fix during datasource refactoring (#16480)

2025-12-11 00:22:48 +01:00

captcha

Improve userFriendlyMessage devX (#16815)

2025-12-30 09:08:43 +00:00

client-config

feat(ai): refresh AI models with deprecation support and multi-provider defaults (BREAKING: deploy server before frontend please) (#16503)

2025-12-11 21:47:38 +01:00

cloudflare

Add comprehensive permission guard coverage across GraphQL and REST endpoints (#15739)

2025-11-10 12:17:38 +01:00

code-interpreter

feat: soft disable LOCAL code interpreter driver in production (#16647)

2025-12-18 08:03:13 +01:00

cron

Fix assert unreachable, remove unused variables (#13753)

2025-08-08 09:04:45 +02:00

dns-manager

feat(server): enforce userFriendlyMessage on all exceptions (#16589)

2025-12-16 14:44:27 +01:00

domain

(breaking change) Allow users with a single workspace to update their email. (#15736)

2025-11-13 15:00:02 +01:00

email

Add queue management dashboard (#15202)

2025-10-21 16:02:50 +02:00

email-verification

Improve userFriendlyMessage devX (#16815)

2025-12-30 09:08:43 +00:00

emailing-domain

[BREAKING_CHANGE_NESTED_WORKSPACE]Refactor FlatEntity typing in aim of introducing UniversalFlatEntity (#16701)

2025-12-30 13:47:02 +00:00

event-emitter/utils

Function trigger updates 2 (#16608)

2025-12-16 18:20:26 +01:00

exception-handler

feat: add AI chat error handling for billing and API key errors (#16797)

2025-12-24 15:30:28 +01:00

feature-flag

Clean workflow run stoppage flag (#16950)

2026-01-06 17:05:46 +01:00

file

[BREAKING_CHANGE_NESTED_WORKSPACE]Refactor FlatEntity typing in aim of introducing UniversalFlatEntity (#16701)

2025-12-30 13:47:02 +00:00

file-storage

Improve userFriendlyMessage devX (#16815)

2025-12-30 09:08:43 +00:00

geo-map

Add comprehensive permission guard coverage across GraphQL and REST endpoints (#15739)

2025-11-10 12:17:38 +01:00

graphql

fix: prevent infinite loop when metadata version cache is empty (#16816)

2025-12-27 07:09:44 +01:00

guard-redirect

fix: Add reserved subdomains constant and update validation on generateSubdomain (#15217)

2025-10-21 16:53:48 +02:00

health

Add comprehensive permission guard coverage across GraphQL and REST endpoints (#15739)

2025-11-10 12:17:38 +01:00

i18n

i18n - translations (#16989)

2026-01-07 16:21:49 +01:00

imap-smtp-caldav-connection

remove IMAP_SMTP_CALDAV feature flag (#16695)

2025-12-19 18:20:12 +01:00

impersonation

1895 extensibility v1 application tokens (#16365)

2025-12-08 10:42:46 +01:00

jwt

1895 extensibility v1 application tokens 3 (#16504)

2025-12-15 17:44:23 +01:00

key-value-pair

Twenty standard and workspace custom applications 1/3 (#15625)

2025-11-10 16:13:12 +01:00

lab

1895 extensibility v1 application tokens (#16365)

2025-12-08 10:42:46 +01:00

logger

Extract field metadata build out of object metadata build (#14763)

2025-10-02 16:07:34 +00:00

message-queue

Add metrics for completed and failed jobs (#16969)

2026-01-06 18:51:54 +01:00

messaging

Message/Calendar thread temporary fix during datasource refactoring (#16480)

2025-12-11 00:22:48 +01:00

metrics

Add metrics for completed and failed jobs (#16969)

2026-01-06 18:51:54 +01:00

onboarding

Twenty standard and workspace custom applications 1/3 (#15625)

2025-11-10 16:13:12 +01:00

open-api

1895 extensibility v1 application tokens 3 (#16504)

2025-12-15 17:44:23 +01:00

postgres-credentials

[BREAKING_CHANGE_NESTED_WORKSPACE]Refactor FlatEntity typing in aim of introducing UniversalFlatEntity (#16701)

2025-12-30 13:47:02 +00:00

public-domain

[BREAKING_CHANGE_NESTED_WORKSPACE]Refactor FlatEntity typing in aim of introducing UniversalFlatEntity (#16701)

2025-12-30 13:47:02 +00:00

record-crud

feat: Serverless Functions as AI Tools (#16919)

2026-01-05 11:13:06 +01:00

record-position

[Fix] Fix NaN position in notes resulting in not being able to create notes (#16818)

2025-12-29 13:55:20 +01:00

record-transformer

Improve userFriendlyMessage devX (#16815)

2025-12-30 09:08:43 +00:00

redis-client

Fix subscription cross tenant issue (#16670)

2025-12-18 15:22:17 +01:00

search

Improve userFriendlyMessage devX (#16815)

2025-12-30 09:08:43 +00:00

serverless

fix: qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion (#16886)

2026-01-07 15:58:12 +00:00

session-storage

Fix workspace logo, cookie security, and improve workspace impersonation (#14838)

2025-10-02 18:36:52 +02:00

sso

[BREAKING_CHANGE_NESTED_WORKSPACE]Refactor FlatEntity typing in aim of introducing UniversalFlatEntity (#16701)

2025-12-30 13:47:02 +00:00

telemetry

feat(billing): implement credit rollover from one billing period to another (#16802)

2025-12-28 15:42:18 +01:00

throttler

Improve userFriendlyMessage devX (#16815)

2025-12-30 09:08:43 +00:00

tool

feat: Serverless Functions as AI Tools (#16919)

2026-01-05 11:13:06 +01:00

tool-generator

feat(workflow): use authContext in CRUD services for Common API migration (#16857)

2025-12-30 21:36:15 +01:00

tool-provider

feat: Serverless Functions as AI Tools (#16919)

2026-01-05 11:13:06 +01:00

twenty-config

Set default SMTP value to true (#16967)

2026-01-06 18:25:33 +00:00

two-factor-authentication

Improve userFriendlyMessage devX (#16815)

2025-12-30 09:08:43 +00:00

user

Improve userFriendlyMessage devX (#16815)

2025-12-30 09:08:43 +00:00

user-workspace

refactor: Migrate CRUD services to use Common API (#16869)

2025-12-31 10:24:50 +01:00

webhook

[BREAKING_CHANGE_NESTED_WORKSPACE]Refactor FlatEntity typing in aim of introducing UniversalFlatEntity (#16701)

2025-12-30 13:47:02 +00:00

workflow

feat(ai): add code interpreter for AI data analysis (#16559)

2025-12-15 16:11:24 +01:00

workspace

Add otel collector to reserved subdomains (#16988)

2026-01-07 15:11:34 +00:00

workspace-invitation

Improve userFriendlyMessage devX (#16815)

2025-12-30 09:08:43 +00:00

core-engine.module.ts

Add metrics for completed and failed jobs (#16969)

2026-01-06 18:51:54 +01:00