beclab · TShentu · Jul 21, 2026
diff --git a/twenty/Chart.yaml b/twenty/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
-appVersion: '1.15.0'
+appVersion: '2.22.0'
 description: Twenty CRM
 name: twenty
 type: application
-version: 1.0.6
+version: 1.0.9
diff --git a/twenty/OlaresManifest.yaml b/twenty/OlaresManifest.yaml
@@ -13,7 +13,7 @@ metadata:
   description: 'The #1 Open-Source CRM - A modern alternative to Salesforce'
   appid: twenty
   title: Twenty
-  version: '1.0.6'
+  version: '1.0.9'
   categories:
   - Productivity_v112
 
@@ -26,7 +26,7 @@ entrances:
   port: 8080
   title: Twenty
 spec:
-  versionName: '1.15.0'
+  versionName: '2.22.0'
   promoteImage:
   - https://app.cdn.olares.com/appstore/twenty/1.webp
   - https://app.cdn.olares.com/appstore/twenty/2.webp
@@ -50,57 +50,11 @@ spec:
     - API & Webhooks: Connect to other apps and build custom integrations. Start integrating.
 
   upgradeDescription: |
-    Upgrade Twenty version to 1.15.0
+    Upgrade Twenty to v2.22.0 (`twentycrm/twenty:v2.22.0`).
 
-    What's Changed
-    - Destroy core view by @BOHEUS in #16868
-    - Clean workflow run stoppage flag by @thomtrp in #16950
-    - Add metrics for completed and failed jobs by @thomtrp in #16969
-    - fix e2e tests by @charlesBochet in #16970
-    - Remove tests run on push on main by @ijreilly in #16971
-    - fix calendar save events transaction by @neo773 in #16763
-    - fix: enable save button when changing currency default value by @mabdullahabaid in #16864
-    - Set default SMTP value to true by @FelixMalfait in #16967
-    - fix(16819): Add NoteDeleteOnePostQueryHook for soft removing note targets by @alvhix in #16826
-    - fix purple color palette by @ehconitin in #16972
-    - If else node tests by @abdulrahmancodes in #16916
-    - Workspace creation prefill fix by @prastoin in #16983
-    - Fix view field updates not persisting by @RajdeepDs in #16672
-    - Fix memory crash when creating record in table view by @etiennejouan in #16984
-    - Updated the user guide with new article + updated old content by @StephanieJoly4 in #16955
-    - [PAGE LAYOUTS] Add widgets validation by @bosiraphael in #16635
-    - i18n - translations by @github-actions[bot] in #16989
-    - Add otel collector to reserved subdomains by @charlesBochet in #16988
-    - Provide executed step output instead of result by @thomtrp in #16991
-    - fix: qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion by @mabdullahabaid in #16886
-    - fix: composite field matching in relation field orderBy with groupBy by @ehconitin in #16992
-    - Update updatedat field on dashboards after edition by @bosiraphael in #16964
-    - i18n - docs translations by @github-actions[bot] in #16993
-    - Fix kanban view when grouping select field has null value by @etiennejouan in #16998
-    - i18n - docs translations by @github-actions[bot] in #17000
-    - i18n - docs translations by @github-actions[bot] in #17002
-    - i18n - docs translations by @github-actions[bot] in #17004
-    - Change bar chart tooltips interaction from bar to slice by @ehconitin in #16938
-    - [DASHBOARDS] Fix dashboard duplication createdBy by @bosiraphael in #16999
-    - BREAKING CHANGE: Removing remote integration feature by @Weiko in #17001
-    - i18n - translations by @github-actions[bot] in #17005
-    - i18n - translations by @github-actions[bot] in #17007
-    - i18n - docs translations by @github-actions[bot] in #17008
-    - [IF/ELSE] Capitalize branch titles + remove ending separator by @thomtrp in #17009
-    - Fix view picker small bugs by @lucasbordeau in #16987
-    - i18n - translations by @github-actions[bot] in #17012
-    - Fix the crash of the app page when object view is configured to open only on record page. by @araj00 in #16977
-    - fix(graph): fix toggle click and multiple dropdown issues by @aditya-cherukuru in #16874
-    - i18n - docs translations by @github-actions[bot] in #17014
-    - [Dashboards] Fix chart axis label behavior by @ehconitin in #17011
-    - [DASHBOARDS] Select title input upon tab or widget creation by @bosiraphael in #17010
-    - feat: helm chart by @dnplkndll in #16808
-    - Fix chart sorting by @bosiraphael in #16996
-    - Enable switching field to group records by on existing kanban view by @ijreilly in #17015
-    - i18n - docs translations by @github-actions[bot] in #17020
-    - Fix workspace application fk command re-run by @prastoin in #17018
+    Move sensitive credentials (`APP_SECRET`, `PG_DATABASE_URL`, `REDIS_URL`, `EMAIL_SMTP_PASSWORD`) into a Kubernetes Secret and inject them via `secretKeyRef`, so Deployment specs no longer embed plaintext secrets.
 
-    Full release note at: https://github.com/twentyhq/twenty/releases/tag/v1.15.0
+    Full release note at: https://github.com/twentyhq/twenty/releases/tag/v2.22.0
 
   developer: Twenty PBC
   website: https://twenty.com

diff --git a/twenty/i18n/en-US/OlaresManifest.yaml b/twenty/i18n/en-US/OlaresManifest.yaml
@@ -18,54 +18,8 @@ spec:
     - API & Webhooks: Connect to other apps and build custom integrations. Start integrating.
 
   upgradeDescription: |
-    Upgrade Twenty version to 1.15.0
-
-    What's Changed
-    - Destroy core view by @BOHEUS in #16868
-    - Clean workflow run stoppage flag by @thomtrp in #16950
-    - Add metrics for completed and failed jobs by @thomtrp in #16969
-    - fix e2e tests by @charlesBochet in #16970
-    - Remove tests run on push on main by @ijreilly in #16971
-    - fix calendar save events transaction by @neo773 in #16763
-    - fix: enable save button when changing currency default value by @mabdullahabaid in #16864
-    - Set default SMTP value to true by @FelixMalfait in #16967
-    - fix(16819): Add NoteDeleteOnePostQueryHook for soft removing note targets by @alvhix in #16826
-    - fix purple color palette by @ehconitin in #16972
-    - If else node tests by @abdulrahmancodes in #16916
-    - Workspace creation prefill fix by @prastoin in #16983
-    - Fix view field updates not persisting by @RajdeepDs in #16672
-    - Fix memory crash when creating record in table view by @etiennejouan in #16984
-    - Updated the user guide with new article + updated old content by @StephanieJoly4 in #16955
-    - [PAGE LAYOUTS] Add widgets validation by @bosiraphael in #16635
-    - i18n - translations by @github-actions[bot] in #16989
-    - Add otel collector to reserved subdomains by @charlesBochet in #16988
-    - Provide executed step output instead of result by @thomtrp in #16991
-    - fix: qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion by @mabdullahabaid in #16886
-    - fix: composite field matching in relation field orderBy with groupBy by @ehconitin in #16992
-    - Update updatedat field on dashboards after edition by @bosiraphael in #16964
-    - i18n - docs translations by @github-actions[bot] in #16993
-    - Fix kanban view when grouping select field has null value by @etiennejouan in #16998
-    - i18n - docs translations by @github-actions[bot] in #17000
-    - i18n - docs translations by @github-actions[bot] in #17002
-    - i18n - docs translations by @github-actions[bot] in #17004
-    - Change bar chart tooltips interaction from bar to slice by @ehconitin in #16938
-    - [DASHBOARDS] Fix dashboard duplication createdBy by @bosiraphael in #16999
-    - BREAKING CHANGE: Removing remote integration feature by @Weiko in #17001
-    - i18n - translations by @github-actions[bot] in #17005
-    - i18n - translations by @github-actions[bot] in #17007
-    - i18n - docs translations by @github-actions[bot] in #17008
-    - [IF/ELSE] Capitalize branch titles + remove ending separator by @thomtrp in #17009
-    - Fix view picker small bugs by @lucasbordeau in #16987
-    - i18n - translations by @github-actions[bot] in #17012
-    - Fix the crash of the app page when object view is configured to open only on record page. by @araj00 in #16977
-    - fix(graph): fix toggle click and multiple dropdown issues by @aditya-cherukuru in #16874
-    - i18n - docs translations by @github-actions[bot] in #17014
-    - [Dashboards] Fix chart axis label behavior by @ehconitin in #17011
-    - [DASHBOARDS] Select title input upon tab or widget creation by @bosiraphael in #17010
-    - feat: helm chart by @dnplkndll in #16808
-    - Fix chart sorting by @bosiraphael in #16996
-    - Enable switching field to group records by on existing kanban view by @ijreilly in #17015
-    - i18n - docs translations by @github-actions[bot] in #17020
-    - Fix workspace application fk command re-run by @prastoin in #17018
+    Upgrade Twenty to v2.22.0 (`twentycrm/twenty:v2.22.0`).
 
-    Full release note at: https://github.com/twentyhq/twenty/releases/tag/v1.15.0
+    Move sensitive credentials (`APP_SECRET`, `PG_DATABASE_URL`, `REDIS_URL`, `EMAIL_SMTP_PASSWORD`) into a Kubernetes Secret and inject them via `secretKeyRef`, so Deployment specs no longer embed plaintext secrets.
+
+    Full release note at: https://github.com/twentyhq/twenty/releases/tag/v2.22.0
diff --git a/twenty/i18n/zh-CN/OlaresManifest.yaml b/twenty/i18n/zh-CN/OlaresManifest.yaml
@@ -18,45 +18,9 @@ spec:
     - API 与 Webhooks：连接其他应用并构建自定义集成。开始集成。
 
   upgradeDescription: |
-    升级 Twenty 版本至 1.15.0
+    升级 Twenty 至 v2.22.0（`twentycrm/twenty:v2.22.0`）。
 
-    更新内容
-    - @BOHEUS 在 #16868 中销毁核心视图
-    - @thomtrp 在 #16950 中清理工作流运行停止标志
-    - @thomtrp 在 #16969 中增加已完成和失败任务的指标统计
-    - @charlesBochet 在 #16970 中修复 e2e 测试
-    - @ijreilly 在 #16971 中移除 main 分支 push 时的测试
-    - @neo773 在 #16763 中修复日历保存事件的事务问题
-    - @mabdullahabaid 在 #16864 中修复更改货币默认值时保存按钮无法启用的问题
-    - @FelixMalfait 在 #16967 中将 SMTP 默认值设置为 true
-    - @alvhix 在 #16826 中修复（16819）：添加 NoteDeleteOnePostQueryHook 以软删除备注目标
-    - @ehconitin 在 #16972 中修复紫色调色板
-    - @abdulrahmancodes 在 #16916 中添加 If/Else 节点测试
-    - @prastoin 在 #16983 中修复工作区创建时的预填充问题
-    - @RajdeepDs 在 #16672 中修复视图字段更新未持久化的问题
-    - @etiennejouan 在 #16984 中修复表格视图创建记录时的内存崩溃
-    - @StephanieJoly4 在 #16955 中用新文章和旧内容更新用户指南
-    - @bosiraphael 在 #16635 中为页面布局添加组件验证
-    - @github-actions[bot] 在 #16989 中进行 i18n 翻译
-    - @charlesBochet 在 #16988 中添加 otel 收集器到保留子域名
-    - @thomtrp 在 #16991 中提供已执行步骤的输出而不是结果
-    - @mabdullahabaid 在 #16886 中修复：qs 的 arrayLimit 被括号表示法绕过，导致内存耗尽 DoS
-    - @ehconitin 在 #16992 中修复 relation 字段 orderBy 与 groupBy 混合时的复合字段匹配
-    - @bosiraphael 在 #16964 中更新仪表盘编辑后的 updatedat 字段
-    - @github-actions[bot] 在 #16993、#17000、#17002、#17004、#17008、#17014、#17020 进行文档翻译更新
-    - @etiennejouan 在 #16998 中修复看板视图分组选择字段为 null 时的处理
-    - @ehconitin 在 #16938 中修改柱状图提示的交互方式从 bar 到 slice
-    - @bosiraphael 在 #16999 中修复仪表盘复制时的 createdBy 字段
-    - @Weiko 在 #17001 中移除远程集成功能（重大变更）
-    - @thomtrp 在 #17009 中将 IF/ELSE 分支标题大写并移除结尾分隔符
-    - @lucasbordeau 在 #16987 中修复视图选择器的小 bug
-    - @araj00 在 #16977 中修复对象视图只开放到记录页时应用页崩溃的问题
-    - @aditya-cherukuru 在 #16874 中修复图表中切换点击及多下拉问题
-    - @ehconitin 在 #17011 中修正仪表盘图表轴标签行为
-    - @bosiraphael 在 #17010 中使标签在新建选项卡或小部件时自动选中
-    - @dnplkndll 在 #16808 中新增 helm chart
-    - @bosiraphael 在 #16996 中修复图表排序
-    - @ijreilly 在 #17015 中允许在现有看板视图内切换分组字段
-    - @prastoin 在 #17018 中修复工作区应用外键命令的重新运行
+    将敏感凭证（`APP_SECRET`、`PG_DATABASE_URL`、`REDIS_URL`、`EMAIL_SMTP_PASSWORD`）迁入 Kubernetes Secret，并通过 `secretKeyRef` 注入，避免 Deployment 清单中出现明文密钥。
+
+    完整发布说明：https://github.com/twentyhq/twenty/releases/tag/v2.22.0
 
-    完整发布说明请访问：https://github.com/twentyhq/twenty/releases/tag/v1.15.0
diff --git a/twenty/templates/deployment.yaml b/twenty/templates/deployment.yaml
@@ -41,6 +41,44 @@ spec:
         terminationMessagePath: /dev/termination-log
         terminationMessagePolicy: File
         imagePullPolicy: IfNotPresent
+      - name: migrate-appcache-to-appdata
+        image: "docker.io/beclab/busybox:1.37"
+        imagePullPolicy: IfNotPresent
+        command: ["sh", "-c"]
+        args:
+          - |
+            set -e
+            SOURCE=/old-data
+            DEST=/new-data
+            MARKER="${DEST}/.migration_from_appcache_done"
+
+            if [ -f "$MARKER" ]; then
+              echo "[migrate] marker present, skip."
+              exit 0
+            fi
+
+            # Destination already has content (ignore our marker name if present).
+            if [ -n "$(ls -A "$DEST" 2>/dev/null | grep -v '^\.migration_from_appcache_done$' || true)" ]; then
+              echo "[migrate] appData already has data, skip."
+              echo "skipped existing dest at $(date -Iseconds 2>/dev/null || date)" > "$MARKER"
+              exit 0
+            fi
+
+            if [ -n "$(ls -A "$SOURCE" 2>/dev/null || true)" ]; then
+              echo "[migrate] copying appCache -> appData..."
+              cp -a "$SOURCE"/. "$DEST"/
+              echo "migrated from appCache at $(date -Iseconds 2>/dev/null || date)" > "$MARKER"
+              echo "[migrate] done; legacy appCache left intact for rollback."
+            else
+              echo "[migrate] no legacy data, fresh install."
+              echo "fresh install at $(date -Iseconds 2>/dev/null || date)" > "$MARKER"
+            fi
+        volumeMounts:
+          - name: appcache-legacy
+            mountPath: /old-data
+            readOnly: true
+          - name: appcache
+            mountPath: /new-data
       - name: init-chmod-data
         image: "docker.io/beclab/aboveos-busybox:1.37.0"
         command:
@@ -61,18 +99,20 @@ spec:
           runAsUser: 0
       containers:
       - name: twenty
-        image: "docker.io/beclab/twentycrm-twenty:v1.15.0"
+        image: "docker.io/twentycrm/twenty:v2.22.0"
         env:
         - name: NODE_PORT
           value: "3000"
         - name: PG_DATABASE_URL
-          value: "postgres://{{ .Values.postgres.username }}:{{ .Values.postgres.password }}@{{ .Values.postgres.host }}:{{ .Values.postgres.port }}/{{ .Values.postgres.databases.twenty }}"
+          valueFrom:
+            secretKeyRef:
+              name: twenty-secrets
+              key: PG_DATABASE_URL
         - name: REDIS_URL
-          {{- if .Values.redis.password }}
-          value: "redis://:{{ .Values.redis.password }}@{{ .Values.redis.host }}:{{ .Values.redis.port }}"
-          {{- else }}
-          value: "redis://{{ .Values.redis.host }}:{{ .Values.redis.port }}"
-          {{- end }}
+          valueFrom:
+            secretKeyRef:
+              name: twenty-secrets
+              key: REDIS_URL
         - name: SERVER_URL
           {{- if $appDomain }}
           value: "https://{{ $appDomain }}"
@@ -86,7 +126,10 @@ spec:
           value: "http://localhost:3000"
           {{- end }}
         - name: APP_SECRET
-          value: "{{ .Values.appSecret }}"
+          valueFrom:
+            secretKeyRef:
+              name: twenty-secrets
+              key: APP_SECRET
         - name: DISABLE_DB_MIGRATIONS
           value: "{{ .Values.disableDbMigrations | default false }}"
         - name: DISABLE_CRON_JOBS_REGISTRATION
@@ -109,7 +152,10 @@ spec:
         {{- end }}
         {{- if .Values.olaresEnv.SMTP_PASSWORD }}
         - name: EMAIL_SMTP_PASSWORD
-          value: "{{ .Values.olaresEnv.SMTP_PASSWORD }}"
+          valueFrom:
+            secretKeyRef:
+              name: twenty-secrets
+              key: EMAIL_SMTP_PASSWORD
         {{- end }}
         {{- if .Values.olaresEnv.MAIL_DEFAULT_SEND_FROM }}
         - name: EMAIL_FROM_ADDRESS
@@ -165,15 +211,11 @@ spec:
           name: appcache
       volumes:
       - hostPath:
-          {{- if .Values.sysVersion }}
-            {{- if semverCompare ">=1.12.3-0" (toString .Values.sysVersion) }}
           path: '{{ .Values.userspace.appCache }}/data'
-            {{- else }}
-          path: '{{ .Values.userspace.appCache }}/twenty/data'
-            {{- end }}
-          {{- else }}
-          path: '{{ .Values.userspace.appCache }}/twenty/data'
-          {{- end }}
+          type: DirectoryOrCreate
+        name: appcache-legacy
+      - hostPath:
+          path: '{{ .Values.userspace.appData }}/data'
           type: DirectoryOrCreate
         name: appcache
 ---

diff --git a/twenty/templates/secret.yaml b/twenty/templates/secret.yaml
@@ -0,0 +1,32 @@
+{{- $existing := lookup "v1" "Secret" .Release.Namespace "twenty-secrets" -}}
+{{- $appSecret := .Values.appSecret | default "" -}}
+{{- if and $existing $existing.data (index $existing.data "APP_SECRET") -}}
+{{- $appSecret = index $existing.data "APP_SECRET" | b64dec -}}
+{{- else if eq $appSecret "" -}}
+{{- $appSecret = randAlphaNum 32 -}}
+{{- end -}}
+{{- $pgPort := .Values.postgres.port | toString -}}
+{{- $redisPort := .Values.redis.port | toString -}}
+{{- $redisUrl := printf "redis://%s:%s" (.Values.redis.host | toString) $redisPort -}}
+{{- if .Values.redis.password -}}
+{{- $redisUrl = printf "redis://:%s@%s:%s" (.Values.redis.password | toString) (.Values.redis.host | toString) $redisPort -}}
+{{- end -}}
+{{- $pgUrl := printf "postgres://%s:%s@%s:%s/%s" (.Values.postgres.username | toString) (.Values.postgres.password | toString) (.Values.postgres.host | toString) $pgPort (.Values.postgres.databases.twenty | toString) -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: twenty-secrets
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: twenty
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  annotations:
+    helm.sh/resource-policy: keep
+type: Opaque
+stringData:
+  APP_SECRET: {{ $appSecret | quote }}
+  PG_DATABASE_URL: {{ $pgUrl | quote }}
+  REDIS_URL: {{ $redisUrl | quote }}
+  {{- if and .Values.olaresEnv .Values.olaresEnv.SMTP_PASSWORD }}
+  EMAIL_SMTP_PASSWORD: {{ .Values.olaresEnv.SMTP_PASSWORD | quote }}
+  {{- end }}