Changelog

Claude Fable 5 is now available through Anthropic. It can be used with AI resource queries when you connect Anthropic with your own API key.

Retool now blocks Microsoft SQL Server resources that use Windows Authentication with custom ODBC connection parameters outside an approved allowlist. Previously, unsupported parameters were logged as warnings but still applied. They now cause resource setup to fail.

Who is affected​

Self-hosted deployments using Microsoft SQL Server resources with Connect using Windows Auth enabled and one or more custom entries in Connection options (or equivalent resource JSON) whose keys are not on the allowlist. Windows Authentication is not available on Retool Cloud.

How to check if you are affected before upgrading​

Search your Retool deployment logs (dbconnector / backend) for this exact string from the prior log-only release:

MSSQL Windows Auth ODBC connection string parameter not on allowlist

Each matching log line includes the parameter key (parameterKey in structured logs). Resources that logged this message will fail to connect or save after upgrading until those parameters are removed or replaced.

What you will see after upgrading​

Resource setup or test connection fails with an error like:

Unsupported MSSQL ODBC connection string parameter "<key>". Only a fixed set of ODBC attributes may be supplied via connection params.

Remediation​

1. Open each affected MSSQL Windows Auth resource.
2. Remove unsupported keys from paramsFromConnectionString.
3. Use Retool's built-in resource fields where possible. For example, use SSL/TLS for encryption and certificate verification.
4. If you need an ODBC attribute that is not listed below, contact Retool Support before upgrading.

Allowed paramsFromConnectionString keys​

Security-sensitive attributes (Driver, Encrypt, Trusted_Connection, credentials, Server, Database, and similar) are set by Retool and cannot be supplied via connection params.

Common parameters that are blocked​

• Encryption and certificate trust settings such as Encrypt and TrustServerCertificate — use the resource SSL/TLS settings instead.
• LoginRetryCount / LoginRetryInterval — use ConnectRetryCount / ConnectRetryInterval.
• Credential keys such as Uid, Pwd, User, or Password.
• Keys containing ; or crafted to inject additional ODBC attributes.

The following patches are now available on the Stable release channel:

• Retool 4.0.4
• Retool 3.334.21

Update your Retool instance to apply the latest bug fixes and security patches.

Retool 4.16 is now available on the Edge release channel for self-hosted organizations.

Classic apps that include custom components and organization-level themes can now be converted to the new app building experience.

To support custom components, the agent investigates the custom component and recreates it in the converted app with as few changes as possible.

To support classic organization-level themes, the agent applies the same style, color, and typography to the app as were represented in the organization-level theme. The agent does not create a new organization-level theme that applies to apps created with the new app builder.

Retool now provides a native integration for Microsoft Graph, the unified API for Microsoft 365 services. You can create a Microsoft Graph resource with OAuth 2.0 or Microsoft Azure Identity authentication to read and manage Entra ID users, mail, calendars, OneDrive and SharePoint files, and Teams messages—all from Retool apps and automations.

Presto resources are now supported by Retool Agents. You can @ tag a Presto resource when building a custom tool to give an agent typed, structured access to your Presto queries alongside your other SQL resources.

Retool now provides a native integration for Snowflake Postgres, Snowflake's PostgreSQL-compatible interface for querying your Snowflake data. You can create a Snowflake Postgres resource to connect over SSL with a CA certificate and run SQL queries to create, read, update, and delete data—all from Retool apps and automations.

Retool now supports publishing apps on custom domains. If you self-host Retool (which inherently uses a custom domain) or use a custom domain on a cloud instance, your apps are published to the domain you define in the following format: https://example.retool.com/rr/app/<appName>.

If your organization uses custom domains, previously-published apps should be republished in order to serve them from the appropriate domain.

Apps published on custom domains are subject to an additional set of limitations that are applied because Retool runs your app inside a sandboxed iframe with allow-same-origin disabled.

The following patches are now available on the Stable release channel:

• Retool 4.0.3
• Retool 3.334.20

Update your Retool instance to apply the latest bug fixes and security patches.