Self-hosted Retool Edge release 3.387
Release notes for the Self-hosted Retool 3.387 edge release.
Releases on the Edge channel occur weekly. Each release occurs one week after the equivalent release for cloud-hosted Retool.
Edge releases are available for organizations that want the latest features or to use closed beta functionality. Retool recommends most organizations use Stable releases unless you have a specific need for Edge releases and can keep your deployment up-to-date.
Retool supports only the most recent release on the Edge channel. As Edge releases are weekly, bug fixes and improvements are included in the next release. All previous releases are then considered deprecated.
Self-hosted Retool 3.387
No longer supported
Edge release notes
Bug fixes, improvements, and other incremental updates across all edge releases in this release.
| Type | Description |
|---|---|
| 3.387.029 changes↑ | |
| security fix | Fixed cross-tenant data leak in MotherDuck connector by embedding authentication token in JDBC URL. [#76977] |
| security fix | Fixed JDBC resource caching to prevent connection pool reuse across unsaved resources. [#76834] |
| security fix | Applied SSRF-safe DNS lookup compatibility with undici's autoSelectFamily. [#76842] |
| security fix | Applied SSRF validation for AI provider base URLs. [#76042] |
| security fix | Replaced timing-vulnerable string comparisons with constant-time comparisons in authentication paths. [#75920] |
| security fix | Patched CSV formula injection vulnerability in user export functionality. [#75905] |
| security fix | Updated axios to 1.15.2, patching multiple authentication bypass, SSRF, prototype pollution, and CRLF injection vulnerabilities. Fixes CVE-2026-42033, CVE-2026-42034, CVE-2026-42035, CVE-2026-42036, CVE-2026-42037, CVE-2026-42038, CVE-2026-42039, CVE-2026-42040, CVE-2026-42041, CVE-2026-42042, CVE-2026-42043, CVE-2026-42044, and CVE-2026-42264. [#76715] |
| security fix | Updated Java database connector dependencies for security improvements in Netty, Spring Boot, Spring Framework, and PostgreSQL driver. [#76722] |
| security fix | Patched postcss XSS via unescaped style tags in CSS stringify output. Fixes CVE-2026-41305. [#76719] |
| security fix | Patched hono bodyLimit bypass and JSX HTML injection vulnerabilities. Fixes CVE-2026-44455 and CVE-2026-44456. [#76717] |
| security fix | Patched uuid buffer bounds check in v3/v5/v6. Fixes CVE-2026-41907. [#76712] |
| security fix | Updated @anthropic-ai/sdk to patch insecure default file permissions in local filesystem memory tool. Fixes CVE-2026-41686. [#76713] |
| security fix | Patched simple-git remote code execution vulnerability. Fixes CVE-2026-6951. [#76718] |
| security fix | Patched smol-toml denial of service via documents with thousands of commented lines. Fixes GHSA-v3rj-xjv7-4jmq. [#76616] |
| security fix | Patched basic-ftp client-side DoS vulnerabilities. Fixes CVE-2026-41324 and CVE-2026-44240. [#76716] |
| security fix | Updated ws library to patch DoS via excessive HTTP headers. Fixes CVE-2024-37890. [#75553] |
| security fix | Updated markdown-it for security improvements in rendering. [#75554] |
| fixed | Fixed Secrets Manager error handling to display toast notifications instead of clearing all configurations on update or delete failures. [#76783] |
| fixed | Fixed 404 errors when using forward slashes in Secrets Manager configuration names by properly URL-encoding path components. [#76785] |
| fixed | Fixed REST API query editor retaining stale OpenAPI state when switching between resources, modes, or operations. [#76474] |
| fixed | Corrected Claude 4.6 and 4.7 token limits to reflect 1 million context window for Anthropic and Bedrock AI resources. [#76589] |
| fixed | Fixed validation schema mismatch for Google AI resource service account authentication. [#76674] |
| fixed | Fixed MongoDB resource authentication errors by updating the mongodb510 driver. [#76559] |
| added | Added environment variable to override default maximum SSH connection limit for PostgreSQL resources. [#73976] |
| changed | Migrated Retool-managed DeepSeek AI model from deprecated V3 to V3.1 endpoint. [#76453] |
| changed | Changed serverless function query execution timeout to match workflow query timeout. [#76800] |
| improved | Updated Snowflake SDK to version 2.4.0 to reduce socket hang-up errors. [#76628] |
| improved | Migrated REST API connector to native fetch implementation for improved performance. [#76470] |
| improved | Improved Workflow Analytics page performance by using pre-aggregated hourly statistics. [#75465] |
| 29 changes | |