Changelog

The following patches are now available on the Stable release channel:

• Retool 4.0.6
• Retool 3.334.23

Update your Retool instance to apply the latest bug fixes and security patches.

Retool 4.23 is now available on the Edge release channel for self-hosted organizations.

The following patches are now available on the Stable release channel:

• Retool 4.0.5
• Retool 3.334.22
• Retool 3.300.33

Update your Retool instance to apply the latest bug fixes and security patches.

Retool now supports object roles—a new role type that grants groups Use, Edit, or Own access to specific apps, workflows, resources, and agents. Object roles are separate from organization roles, which control access to admin settings like billing and SSO.

When you create an object role, you set an access level for each object type and choose how the role applies:

• Universal access—The role applies to all current and future objects of that type across the organization.
• Individual access—Access is scoped to specific objects or folders, which you define when assigning the role to a group.

Object roles are assigned to groups from the Groups page. Once assigned, all members of the group inherit the role's permissions. You can view a group's or user's full object-level access from the Object permissions tab on their detail page in Settings.

Updates to organization roles​

As part of this launch, organization roles have been updated to cleanly separate admin settings access from object-level access. The Create Role button on the Roles & Permissions page is now a dropdown where you choose between creating an object role or an organization role. A filter control on the roles list lets you view all roles, object roles only, or organization roles only.

To get started:

• Object roles—Understand how object roles work, including universal vs. individual access and folder inheritance.
• Create an object role—Step-by-step instructions for creating and managing object roles.
• Organization roles—Updated UI for managing organization roles, including a new role type selector and filter controls on the Roles & Permissions page.
• Assign roles to groups—Assign object or organization roles to groups.

Claude Sonnet 5 is now available on paid plans through Anthropic and Amazon Bedrock. It can be used with AI resource queries and Retool Agents.

You can now trigger workflows from functions in the new app builder. Converting classic apps that trigger workflows is now supported as a result.

To trigger a workflow from your app, open the Chat tab and prompt your agent with the workflow's name.

The triggered workflow is run on behalf of the app's authenticated user.

Retool 4.19 is now available on the Edge release channel for self-hosted organizations.

Claude Fable 5 is now available through Anthropic. It can be used with AI resource queries when you connect Anthropic with your own API key.

Retool now blocks Microsoft SQL Server resources that use Windows Authentication with custom ODBC connection parameters outside an approved allowlist. Previously, unsupported parameters were logged as warnings but still applied. They now cause resource setup to fail.

Who is affected​

Self-hosted deployments using Microsoft SQL Server resources with Connect using Windows Auth enabled and one or more custom entries in Connection options (or equivalent resource JSON) whose keys are not on the allowlist. Windows Authentication is not available on Retool Cloud.

How to check if you are affected before upgrading​

Search your Retool deployment logs (dbconnector / backend) for this exact string from the prior log-only release:

MSSQL Windows Auth ODBC connection string parameter not on allowlist

Each matching log line includes the parameter key (parameterKey in structured logs). Resources that logged this message will fail to connect or save after upgrading until those parameters are removed or replaced.

What you will see after upgrading​

Resource setup or test connection fails with an error like:

Unsupported MSSQL ODBC connection string parameter "<key>". Only a fixed set of ODBC attributes may be supplied via connection params.

Remediation​

1. Open each affected MSSQL Windows Auth resource.
2. Remove unsupported keys from paramsFromConnectionString.
3. Use Retool's built-in resource fields where possible. For example, use SSL/TLS for encryption and certificate verification.
4. If you need an ODBC attribute that is not listed below, contact Retool Support before upgrading.

Allowed paramsFromConnectionString keys​

Security-sensitive attributes (Driver, Encrypt, Trusted_Connection, credentials, Server, Database, and similar) are set by Retool and cannot be supplied via connection params.

Common parameters that are blocked​

• Encryption and certificate trust settings such as Encrypt and TrustServerCertificate — use the resource SSL/TLS settings instead.
• LoginRetryCount / LoginRetryInterval — use ConnectRetryCount / ConnectRetryInterval.
• Credential keys such as Uid, Pwd, User, or Password.
• Keys containing ; or crafted to inject additional ODBC attributes.

The following patches are now available on the Stable release channel:

• Retool 4.0.4
• Retool 3.334.21

Update your Retool instance to apply the latest bug fixes and security patches.