Self-hosted Retool Edge release 3.357
Release notes for the Self-hosted Retool 3.357 edge release.
Releases on the Edge channel occur weekly. Each release occurs one week after the equivalent release for cloud-hosted Retool.
Edge releases are available for organizations that want the latest features or to use closed beta functionality. Retool recommends most organizations use Stable releases unless you have a specific need for Edge releases and can keep your deployment up-to-date.
Retool supports only the most recent release on the Edge channel. As Edge releases are weekly, bug fixes and improvements are included in the next release. All previous releases are then considered deprecated.
Self-hosted Retool 3.357
No longer supported
Edge release notes
Bug fixes, improvements, and other incremental updates across all edge releases in this release.
| Type | Description |
|---|---|
| 3.357.030 changes↑ | |
| added | Added OpenAPI spec change detection to the guided REST API editor, automatically applying non-breaking changes and displaying a warning banner for breaking changes. [#73131] |
| added | Added Python version configuration to workflow language settings. [#72290] |
| improved | Improved the Agents page to show inline error banners instead of replacing the page when the agents API fails. [#73072] |
| improved | Improved Assist in Ask mode to include database schema tools. [#73032] |
| fixed | Fixed Assist's REST API query tool to correctly handle existing key-value pair body formats. [#73164] |
| fixed | Fixed Assist always using the fallback model instead of the user-configured model. [#73154] |
| fixed | Fixed frame resolution incorrectly dropping when a folder node is selected in the component tree. [#73143] |
| fixed | Removed empty description column from the workflows table on the workflows index page. [#73137] |
| fixed | Fixed OAuth nonce handler firing twice in some authentication flows. [#73132] |
| fixed | Fixed /api/verifyEmail endpoint crashing on malformed input. [#73081] |
| fixed | Fixed agents metadata API timeouts that caused the Agents page to load slowly. [#73068] |
| fixed | Fixed image upload to enforce LLM provider size limits and compress oversized images automatically. [#73066] |
| fixed | Fixed Date Picker component failing to parse date-fns format tokens PP, PPP, PPPP, and G. [#73040] |
| fixed | Fixed periodic query checkbox unchecking when the interval input is cleared by backspacing. [#73030] |
| fixed | Fixed loop blocks incorrectly showing 'No Resource Selected' when a function runner is selected. [#73025] |
| fixed | Fixed collaborative editing errors when applying document updates. [#72970] |
| fixed | Fixed Snowflake OAuth infinite reauth loop caused by stale refresh token expiration not persisting after token refresh. [#72838] |
| fixed | Fixed workflow memory limit error message to show the configured WORKFLOW_MEMORY_LIMIT_MBS value instead of a hardcoded number. [#72837] |
| fixed | Fixed OAuth consent page showing generic icons for Databricks and Slack resource types. [#72719] |
| fixed | Fixed guided REST API editor to prevent adding duplicate Server Variable keys. [#72600] |
| fixed | Fixed workflow blocks to validate payload size against RETOOL_CLIENT_MAX_BODY_SIZE and return a descriptive error for oversized payloads. [#72041] |
| security fix | Upgraded flatted to patch a DoS vulnerability in JSON parsing. Fixes CVE-2026-32141. [#73168] |
| security fix | Upgraded langchain from 0.0.106 to 0.3.37 to address a prompt injection vulnerability in the workflow executor. Fixes GHSA-r399-636x-v7f6. [#72894] |
| security fix | Upgraded hono to 4.10.2 to address a JWT audience claim validation bypass. Fixes CVE-2025-62610. [#72892] |
| security fix | Upgraded markdown-it to 14.1.1 to address a ReDoS vulnerability via crafted markdown input. Fixes GHSA-38c4-r59v-3vqw. [#72889] |
| security fix | Upgraded bn.js to 5.2.3 to patch a timing side-channel vulnerability in Snowflake SDK cryptographic operations. Fixes GHSA-378v-28hj-76wf. [#72885] |
| security fix | Upgraded ip to 1.1.9 to patch a ReDoS vulnerability via crafted IP strings. Fixes GHSA-78xj-cgh5-2h22. [#72884] |
| security fix | Patched immutable from 3.7.6 to 3.8.3 to fix Prototype Pollution in draft-js and rc-editor transitive dependencies. Fixes CVE-2026-29063. [#72874] |
| security fix | Fixed SAML error response to no longer reflect request body or headers, preventing PII disclosure. [#71873] |
| security fix | Fixed approval workflow API to enforce organization ownership checks on execution updates, preventing unauthorized cross-org modifications. [#71781] |
| 30 changes | |