Self-hosted Retool Edge release 3.367
Release notes for the Self-hosted Retool 3.367 edge release.
Releases on the Edge channel occur weekly. Each release occurs one week after the equivalent release for cloud-hosted Retool.
Edge releases are available for organizations that want the latest features or to use closed beta functionality. Retool recommends most organizations use Stable releases unless you have a specific need for Edge releases and can keep your deployment up-to-date.
Retool supports only the most recent release on the Edge channel. As Edge releases are weekly, bug fixes and improvements are included in the next release. All previous releases are then considered deprecated.
Self-hosted Retool 3.367
No longer supported
Edge release notes
Bug fixes, improvements, and other incremental updates across all edge releases in this release.
| Type | Description |
|---|---|
| 3.367.048 changes↑ | |
| security fix | Upgraded samlify to v2.12.0 with XPath injection protection and XXE-safe XML parsing. [#74359] |
| security fix | Fixed a vulnerability allowing a user's TOTP secret to be overwritten or 2FA disabled without verifying the existing 2FA code. [#73915] |
| security fix | Fixed an IDOR vulnerability allowing authenticated users to access image blobs belonging to a different organization. [#73441] |
| security fix | Fixed a cross-organization IDOR vulnerability allowing authenticated users to send tool approval, auth approval, and terminate signals to agent runs belonging to other organizations. [#71878] |
| security fix | Fixed personal access tokens being restored without re-validating scopes against current user permissions, and added audit logging for token revocation and deletion. [#73537] |
| security fix | Upgraded fast-xml-parser to v5.5.6 in code-executor sandbox environments. Fixes CVE-2026-33036. [#73785] |
| security fix | Upgraded serialize-javascript to v7.0.5. Fixes CVE-2026-34043. [#74161] |
| security fix | Upgraded node-forge from v1.3.3 to v1.4.0. Fixes CVE-2026-33891, CVE-2026-33894, and CVE-2026-33895. [#74162] |
| security fix | Upgraded brace-expansion to address a zero-step DoS vulnerability. Fixes CVE-2026-33750. [#74166] |
| security fix | Added picomatch overrides to address a ReDoS vulnerability. Fixes CVE-2026-33671. [#74164] |
| security fix | Upgraded handlebars to v4.7.9 in sandbox environments. Fixes CVE-2026-33937. [#74253] |
| added | Added audit logging for workflow events including renames, trigger configuration changes, releases, protection toggles, and custom URL path changes. [#74149] |
| added | Added a DELETE /api/v2/workflows/:workflowId endpoint to the public REST API for deleting workflows programmatically. [#73879] |
| added | Added a Manage user seats permission scope for controlling seat management in custom role configurations. [#74474] |
| added | Added a link in the help menu to navigate to the local per-instance API reference. [#74393] |
| added | Added plan-tier badges and a plan filter to the per-instance /reference API documentation page. [#73628] |
| fixed | Fixed OAuth authentication failures being silently swallowed when the DBCS pipe was enabled, causing errors to go unreported. [#74584] |
| fixed | Fixed XML query responses returning undefined for rawXml and parsedXml properties when the DBCS pipe was enabled. [#74329] |
| fixed | Fixed Query Library showing raw error data as a successful result instead of displaying the error when the DBCS pipe was enabled. [#74298] |
| fixed | Fixed a crash in the DBCS XML response transformer by replacing xml2js with fast-xml-parser. [#74500] |
| fixed | Fixed a 500 error on the PATCH /api/resources/names/:resourceName endpoint caused by a foreign key constraint violation when creating a new environment-specific resource. [#74655] |
| fixed | Fixed a 500 error in the save query endpoint when the data parameter was missing, null, or not a valid JSON object. [#74646] |
| fixed | Fixed queries in modules failing to execute on page load due to a race condition between model lookup and eager query trigger. [#74482] |
| fixed | Fixed current_user.groups returning a literal string instead of a group array in apps using custom auth flows. [#74239] |
| fixed | Fixed an issue where setting Table row height to dynamic programmatically did not properly enable dynamic row heights. [#74062] |
| fixed | Fixed the Table component's Regenerate Columns feature only detecting columns from the first 10 rows of data. [#72039] |
| fixed | Fixed an error with mobile apps that caused screens to stop rendering. [#74635] |
| fixed | Fixed parent workflows showing a generic failure message instead of the actual error when a child workflow fails. [#74173] |
| fixed | Fixed the branch reset modal accepting unknown branch names that could not be matched to a real remote branch. [#74180] |
| fixed | Fixed the legacy Retool AI resource becoming uneditable when version control was locked. [#73771] |
| fixed | Fixed saving changes to a Retool Database resource configuration throwing a badData error due to incorrect deep equality comparison for nested option objects. [#73381] |
| fixed | Fixed a memory leak in the self-hosted proxy by automatically cleaning up aborted upstream socket connections. [#72210] |
| fixed | Fixed a false-positive "Workflow Backend Egress" health check appearing on the Code Executor card in the Services Debugging page. [#74185] |
| fixed | Fixed the Secrets Manager test connection endpoint to require admin permissions, and updated the UI to use the correct current API endpoint. [#74375] |
| fixed | Fixed system-scoped roles that are required for direct sharing from being deleted. [#74388] |
| fixed | Fixed the permission assignment modal displaying a resource's internal name instead of its display name on the Roles and Permissions settings page. [#74454] |
| fixed | Fixed scope selection in the Roles and Permissions UI to correctly enforce dependent scope graph constraints. [#74457] |
| fixed | Fixed multiplayer showing a persistent loading state when a WebSocket upgrade fails due to a permanent authentication error, now immediately displaying the error. [#74273] |
| fixed | Fixed mobile app query failures clearing rawData when the raw query payload was available. [#74437] |
| fixed | Fixed blank screens, missing version info in settings, and JSON parsing errors on Android. [#74364] |
| changed | Renamed the role context menu action from Edit to Change name / description for clarity. [#74452] |
| improved | Improved app availability when multiplayer fails to connect. Apps now fall back to single-user editing instead of showing a blocking overlay. [#74481] |
| improved | Improved error messaging when an app edit session fails due to authorization, now showing the specific error instead of a generic message. [#74280] |
| improved | Improved the Resources page to show a toast notification when a user attempts to access a resource they do not have permission to view. [#73987] |
| improved | Improved the organization scope creation modal with collapsible sections and selection count badges. [#74547] |
| improved | Extended time duration parsing to support compound strings such as '2m10s' or '1m30s500ms' in addition to single-unit values. [#74277] |
| improved | Increased the multiplayer sync message batch size from 10 to 50 to reduce message overhead during collaborative editing. [#74344] |
| improved | Clarified the wording of the truncated block results banner in the workflow Run history log viewer. [#74439] |
| 48 changes | |