Self-hosted Retool Edge release 3.396
Release notes for the Self-hosted Retool 3.396 edge release.
Releases on the Edge channel occur weekly. Each release occurs one week after the equivalent release for cloud-hosted Retool.
Edge releases are available for organizations that want the latest features or to use closed beta functionality. Retool recommends most organizations use Stable releases unless you have a specific need for Edge releases and can keep your deployment up-to-date.
Retool supports only the most recent release on the Edge channel. As Edge releases are weekly, bug fixes and improvements are included in the next release. All previous releases are then considered deprecated.
Self-hosted Retool 3.396
No longer supported
Edge release notes
Bug fixes, improvements, and other incremental updates across all edge releases in this release.
| Type | Description |
|---|---|
| 3.396.017 changes↑ | |
| added | Added an IAM role authentication toggle for AWS CodeCommit source control configuration. [#77720] |
| added | Added AGENT_SANDBOX_* environment variable aliases for AGENT_EXECUTOR_* on self-hosted instances. [#77836] |
| added | Added auto-refresh support for Retool AI OAuth client-credentials tokens. [#77946] |
| added | Added support for the Gemini 3.5 Flash model in Google Gemini and Vertex AI resources. [#77972] |
| fixed | Fixed OpenAPI v3 spec imports defaulting to an incorrect base URL when the servers array is missing. [#74266] |
| fixed | Fixed FIDO2 passkey authentication failing with ECDSA signature parsing errors after the 3.393 dependency update. [#77851] |
| fixed | Fixed Amazon S3 workflow block result cleanup failing with malformed XML errors. [#77922] |
| fixed | Fixed vector crawl workflow failures caused by missing database access objects in automated requests. [#77925] |
| fixed | Fixed vector crawl URL queue not clearing after reaching the visited URL limit. [#77927] |
| fixed | Fixed Retool AI authentication banner incorrectly appearing for client-credentials OAuth failures. [#77976] |
| fixed | Fixed managed AI provider proxy authentication on self-hosted instances by adding a placeholder key. [#78002] |
| changed | Changed the app share modal to no longer require external domain setup. [#77942] |
| security fix | Updated ws to patch an uninitialized memory disclosure vulnerability. Fixes CVE-2026-45736. [#77570] |
| security fix | Updated brace-expansion to patch a denial-of-service vulnerability where large numeric ranges bypass the max protection. Fixes CVE-2026-45149. [#77571] |
| security fix | Updated protobufjs to patch a denial-of-service vulnerability via unbounded recursive JSON descriptor expansion. Fixes CVE-2026-45740. [#77732] |
| security fix | Updated idna to patch an internationalized domain name vulnerability. Fixes CVE-2026-45409. [#77733] |
| security fix | Updated commons-configuration2 to patch an XML external entity vulnerability. Fixes CVE-2026-45205. [#77830] |
| 17 changes | |