Skip to main content

Changelog

Updates, changes, and improvements at Retool.

Refer to the stable and edge release notes for detailed information about self-hosted releases.

2 posts tagged with "Breaking Changes"

Updates related to breaking changes.

View All Tags

Microsoft SQL Server (Windows Authentication): unsupported ODBC connection params are now rejected

Retool now blocks Microsoft SQL Server resources that use Windows Authentication with custom ODBC connection parameters outside an approved allowlist. Previously, unsupported parameters were logged as warnings but still applied. They now cause resource setup to fail.

Who is affected​

Self-hosted deployments using Microsoft SQL Server resources with Connect using Windows Auth enabled and one or more custom entries in Connection options (or equivalent resource JSON) whose keys are not on the allowlist. Windows Authentication is not available on Retool Cloud.

How to check if you are affected before upgrading​

Search your Retool deployment logs (dbconnector / backend) for this exact string from the prior log-only release:

MSSQL Windows Auth ODBC connection string parameter not on allowlist

Each matching log line includes the parameter key (parameterKey in structured logs). Resources that logged this message will fail to connect or save after upgrading until those parameters are removed or replaced.

What you will see after upgrading​

Resource setup or test connection fails with an error like:

Unsupported MSSQL ODBC connection string parameter "<key>". Only a fixed set of ODBC attributes may be supplied via connection params.

Remediation​

  1. Open each affected MSSQL Windows Auth resource.
  2. Remove unsupported keys from paramsFromConnectionString.
  3. Use Retool's built-in resource fields where possible. For example, use SSL/TLS for encryption and certificate verification.
  4. If you need an ODBC attribute that is not listed below, contact Retool Support before upgrading.

Allowed paramsFromConnectionString keys​

ODBC attributeAlternate spellings accepted
APPapp
ApplicationIntentapplicationintent
ColumnEncryptioncolumnencryption
ConnectRetryCountconnectretrycount
ConnectRetryIntervalconnectretryinterval
Connect TimeoutConnectTimeout, connecttimeout
Failover_Partnerfailoverpartner
FailoverPartnerSPNfailoverpartnerspn
HostnameInCertificatehostnameincertificate
IpAddressPreferenceipaddresspreference
KeepAlivekeepalive
Languagelanguage
LoginTimeoutlogintimeout
MARS_Connectionmarsconnection
MultiSubnetFailovermultisubnetfailover
Packet SizePacketSize, packetsize
QueryLog_Onquerylogon
QueryLogTimequerylogtime
Regionalregional
ServerSPNserverspn, Server_SPN
Workstation IDWorkstationID, workstationid
WSIDwsid

Security-sensitive attributes (Driver, Encrypt, Trusted_Connection, credentials, Server, Database, and similar) are set by Retool and cannot be supplied via connection params.

Common parameters that are blocked​

  • Encryption and certificate trust settings such as Encrypt and TrustServerCertificate — use the resource SSL/TLS settings instead.
  • LoginRetryCount / LoginRetryInterval — use ConnectRetryCount / ConnectRetryInterval.
  • Credential keys such as Uid, Pwd, User, or Password.
  • Keys containing ; or crafted to inject additional ODBC attributes.

Updated paths for static JavaScript files

Browsers now load static .js files from the following locations:

  • Custom component libraries: /libs/custom-component-collections.${hash}.umd.js
  • Legacy custom components: /libs/custom-components.${hash}.umd.js
  • Workflows sandbox: /libs/sandbox.${hash}.umd.js
note

This change will not disrupt most self-hosted organizations. However, if you have additional infrastructure that sits between your user's browser and your Retool instance, such as a load balancer, you might need to update your infrastructure configuration.

The reason for this is because these files are requested from an iframe, and so regular browser cookies will be missing from those requests for these files. If you have a load balancer that requires additional cookies be present (such as for SSO), it may block requests to these files from an iframe.

If you need to account for this, the recommend solution is to allow-list requests to these file paths in your infrastructure so that they don't require any additional authentication to access.

Perform these tests if you want to confirm that your Retool instance is correctly serving these files:

  1. Edit any app.
  2. View an app with a custom component (and the legacy version of custom components if you use it).
  3. Edit any workflow (if you use the workflows product).