All Edge releases of Self-hosted Retool
All release notes for the Edge channel of Self-hosted Retool
Text version of release notes for the Edge channel of Self-hosted Retool. Use the Self-hosted Retool release notes app to search and compare changes between versions.
Self-hosted Retool 3.357
Latest releaseCurrently supported
Patch release notes
Mar 18, 2026
added
- Added OpenAPI spec change detection to the guided REST API editor, automatically applying non-breaking changes and displaying a warning banner for breaking changes.
- Added Python version configuration to workflow language settings.
fixed
- Fixed Assist's REST API query tool to correctly handle existing key-value pair body formats.
- Fixed Assist always using the fallback model instead of the user-configured model.
- Fixed frame resolution incorrectly dropping when a folder node is selected in the component tree.
- Removed empty description column from the workflows table on the workflows index page.
- Fixed OAuth nonce handler firing twice in some authentication flows.
- Fixed
/api/verifyEmailendpoint crashing on malformed input. - Fixed agents metadata API timeouts that caused the Agents page to load slowly.
- Fixed image upload to enforce LLM provider size limits and compress oversized images automatically.
- Fixed Date Picker component failing to parse
date-fnsformat tokens PP, PPP, PPPP, and G. - Fixed periodic query checkbox unchecking when the interval input is cleared by backspacing.
- Fixed loop blocks incorrectly showing 'No Resource Selected' when a function runner is selected.
- Fixed collaborative editing errors when applying document updates.
- Fixed Snowflake OAuth infinite reauth loop caused by stale refresh token expiration not persisting after token refresh.
- Fixed workflow memory limit error message to show the configured
WORKFLOW_MEMORY_LIMIT_MBSvalue instead of a hardcoded number. - Fixed OAuth consent page showing generic icons for Databricks and Slack resource types.
- Fixed guided REST API editor to prevent adding duplicate Server Variable keys.
- Fixed workflow blocks to validate payload size against
RETOOL_CLIENT_MAX_BODY_SIZEand return a descriptive error for oversized payloads.
improved
- Improved the Agents page to show inline error banners instead of replacing the page when the agents API fails.
- Improved Assist in Ask mode to include database schema tools.
security-fix
- Upgraded
flattedto patch a DoS vulnerability in JSON parsing. Fixes CVE-2026-32141. - Upgraded
langchainfrom 0.0.106 to 0.3.37 to address a prompt injection vulnerability in the workflow executor. Fixes GHSA-r399-636x-v7f6. - Upgraded hono to 4.10.2 to address a JWT audience claim validation bypass. Fixes CVE-2025-62610.
- Upgraded markdown-it to 14.1.1 to address a ReDoS vulnerability via crafted markdown input. Fixes GHSA-38c4-r59v-3vqw.
- Upgraded bn.js to 5.2.3 to patch a timing side-channel vulnerability in Snowflake SDK cryptographic operations. Fixes GHSA-378v-28hj-76wf.
- Upgraded ip to 1.1.9 to patch a ReDoS vulnerability via crafted IP strings. Fixes GHSA-78xj-cgh5-2h22.
- Patched immutable from 3.7.6 to 3.8.3 to fix Prototype Pollution in draft-js and rc-editor transitive dependencies. Fixes CVE-2026-29063.
- Fixed SAML error response to no longer reflect request body or headers, preventing PII disclosure.
- Fixed approval workflow API to enforce organization ownership checks on execution updates, preventing unauthorized cross-org modifications.
Self-hosted Retool 3.355
No longer supported
Patch release notes
Mar 13, 2026
added
- Added bearer token authentication for Snowflake resources.
- Added Python 3.14 support for Python queries and transformers.
- Added
filterBysupport for Google Sheets read operations. - Added
describeanddescribeGlobaloperations for Salesforce resources. - Added static database role support for Vault secrets manager configuration.
- Added web grounding configuration support for Google Gemini resources.
- Added support for GPT-5.4 model with 1,050,000 token context window for AI resource queries.
fixed
- Fixed REST API URL parameter parsing truncating values containing
=characters. - Fixed SAML SSO login failures for identity providers whose X.509 certificates contain large OID arc values.
- Fixed
utils.copyToClipboardfailing in Safari browser. - Fixed Slack resource markdown mode toggle not bypassing HTML conversion.
- Fixed Edit Resource Modal stacking issues in workflows.
- Fixed passwordless magic link URLs to use custom domain when configured.
- Fixed Vault database engine to correctly handle 404 errors.
improved
- Improved REST API guided configuration to handle
deepObjectparameter style. - Improved REST API configuration to validate OpenAPI specification URLs.
changed
- Updated Kimi K2 model to automatically use Kimi K2.5.
- Changed audit log behavior to omit query content for improved security.
deprecated
- Deprecated Deepseek 3.2 and Kimi 0905 AI models.
security-fix
- Updated
fast-xml-parserto address CVE-2026-25896 XSS vulnerability and CVE-2026-26278 DoS vulnerability. - Updated
tardependency to address CVE-2026-26960 and CVE-2026-29786 path traversal vulnerabilities. - Updated
path-to-regexpdependency to address CVE-2024-45296 ReDoS vulnerability. - Updated
underscoredependency to address CVE-2026-27601 DoS vulnerability. - Updated
semverdependency to address CVE-2022-25883 ReDoS vulnerability. - Updated
nodemailerdependency to address CVE-2025-14874 DoS vulnerability. - Updated
basic-ftpdependency to address CVE-2026-27699 vulnerability. - Updated
jspdfdependency to address CVE-2026-25535 vulnerability. - Updated
minimatchdependency to address CVE-2026-26996 ReDoS vulnerability. - Updated
serialize-javascriptto address GHSA-5c6j-r48x-rmvq code injection vulnerability.
Self-hosted Retool 3.348
No longer supported