Changelog

Self-hosted deployments of Retool missing the BASE_DOMAIN environment variable may in some cases be vulnerable to host header injections. All vulnerable versions can be remediated immediately by properly setting the BASE_DOMAIN environment variable to the full URL of the deployment, such as https://retool.example.com. Beginning with 3.196.0, this environment variable will be required for an instance on boot.

Is my version of Retool affected?​

All current Retool on-prem instances that have not yet disabled password based authentication may be vulnerable (this is easily checked by verifying that there is no form to login with a password when opening up Retool.) If password auth has not been disabled, your Retool instance is potentially vulnerable if all of the following apply to you:

• You do not have the BASE_DOMAIN environment variable set.
• Your Retool instance is reachable without any request filtering based on the Host header. This is likely the case if you’re not using a reverse proxy or that reverse proxy forwards requests for all domains.
• A user in your instance solely relies on password based authentication. This is the case when all of the following apply
  • You have the Disable Login with Email and Password setting disabled
  • You have not enforced Two Factor Authentication
  • A user in your instance does not have a second factor authentication configured.

Affected release versions​

Notification Update: 2025-05-09​

An email to customers sent on 2025-05-09 incorrectly described which Retool instances are affected. The section on affected versions should instead be Is my version of Retool affected?.

Improvements to source control on Workflows are now generally available on Self-hosted Retool 3.200.0-edge and in the upcoming stable release. The following features are now supported for all users on Enterprise plans:

Retool made several improvements to the usage of Source Control with Retool Workflows. The following features are now supported on Enterprise plans:

• Branched changes. You can now make changes to workflows using branches. Previously, all Source Control changes on workflows were branchless.
• Multi-element branching. You can make edits to workflows on the same branch as edits to apps, modules, and Query Library queries.
• Collaborative branches. Multiple users can commit changes and merge pull requests on collaborative branches.

Retool now supports an integration to the Google Calendar API. Use this integration in combination with the Calendar or Timeline components to interact with calendars and events.

Refer to the Calendar guide for information on how to use this resource with the Calendar component.

Retool now supports an integration to Google Docs, which utilizes the Google Docs API and the Google Drive API. Use this integration to retrieve, create, and update documents.

Retool can record user behavior and interactions with apps using Fullstory. When enabled, data about user interactions with apps are reported directly to Fullstory for you to review in detail. You can then analyze app analytics, evaluate impact, and review interactions with session replay. This integration is useful for monitoring user activity across different apps, and using advanced analytical tools like heatmaps and funnels to identify usage patterns, debug errors, and improve the overall user experience.

The backend runtime in self-hosted Retool 3.163 and later has been upgraded to use Node.js v20.18. This change may result in memory and CPU usage of containers to increase. Without sufficient resources, this could impact the performance of Retool Workflows. If necessary, you can increase the memory limits for workflows using the WORKFLOW_MEMORY_LIMIT_MBS environment variable.

If your organization uses Source Control, Retool sometimes creates an automatic commit, called a catch-up commit, which keeps your branches up to date. If you want to ensure that developers in your organization retain complete control of changes within their feature branches, you can now disable catch-up commits using the following steps:

1. Navigate to Settings > Source Control and click the Edit Settings button on the top right.
2. Toggle on the Disable auto catch up commits setting.

To avoid issues with catch-up commits and other merge control mechanisms, refer to Retool's Merge conflict prevention strategies.

Multi-step functions are now generally available in Retool Workflows. They operate as self-contained workflows with optional parameters.

Multi-step functions improve the Workflows experience in several key areas:

• Isolating complex operations with many steps.
• Enabling nested looping, replacing the need for multiple subsequent Loop blocks operating on the same piece of data.
• Eliminating the need to call a workflow from within another, therefore decreasing the number of billable workflow runs.
• Enabling builders to reuse blocks of code within a single workflow.

You can now connect your organization to Sentry and Datadog for workflow error monitoring and event logging.

To set up error reporting, go to the Settings and navigate to Configuration > Observability. Enter your Sentry and Datadog credentials to emit workflow errors and run events to either or both providers.

Connecting to external observability providers is especially useful for your organization if:

• You have a high volume of workflow runs that your organization would prefer to monitor systematically, outside of the workflows run panel UI.
• You use a cloud instance and you want to retain a record of workflow run events beyond the 90 day retention period.

Retool updated the Export to Module feature for usability improvements. This feature allows you to select components on the canvas and “refactor” them into a module.

The following key changes were made:

• You can now export a single component to a module. For example, you could export a single container (and all its children) to a module.
• When making the export, all the related logic, such as queries, variables, and transformers, is automatically included in the exported module. This eliminates the need to manually copy logic to the module.
• Once the export is complete, Retool automatically replaces the selection with the newly created module. This eliminates the need to import the module after you export the selection.

Access Export to Module in one of the following ways:

• Select one or multiple components, right-click, and select Export to module.
• Select multiple components and click in the Inspector.