Self-hosted Retool Edge release 4.16
Release notes for the Self-hosted Retool 4.16 edge release.
Releases on the Edge channel occur weekly. Each release occurs one week after the equivalent release for cloud-hosted Retool.
Edge releases are available for organizations that want the latest features or to use closed beta functionality. Retool recommends most organizations use Stable releases unless you have a specific need for Edge releases and can keep your deployment up-to-date.
Retool supports only the most recent release on the Edge channel. As Edge releases are weekly, bug fixes and improvements are included in the next release. All previous releases are then considered deprecated.
Self-hosted Retool 4.16
No longer supported
Edge release notes
Bug fixes, improvements, and other incremental updates across all edge releases in this release.
| Type | Description |
|---|---|
| 4.16.039 changes↑ | |
| added | Added the Microsoft Graph resource with OAuth authentication. [#78880] |
| added | Added Azure Identity authentication for the Microsoft Graph resource. [#80035] |
| added | Added the Snowflake Postgres resource for querying Snowflake over the PostgreSQL protocol. [#80106] |
| added | Added the Presto resource for querying Presto databases. [#80100] |
| added | Added a share modal to the new app builder for managing app permissions and access. [#80268] |
| added | Added support for converting classic apps that use org-level themes to the new app builder. [#79228] |
| added | Added support for Zlib and MIT/X11 licensed npm packages in the new app builder. [#80282] |
| added | Added audit logs for Retool Database schema changes. [#80285] |
| fixed | Fixed the Microsoft Graph resource not accepting client ID and secret inputs. [#80373] |
| fixed | Fixed image text generation queries failing for Anthropic, OpenAI, and Google AI models. [#79961] |
| fixed | Fixed Vertex AI queries not working in workflows. [#80264] |
| fixed | Fixed the connection string autofill popover being unclickable in resource setup. [#80117] |
| fixed | Fixed unexpected page scrolling when apps contain Tabs or Tabbed Containers. [#80029] |
| fixed | Fixed the Integrate changes banner not appearing in the new app builder when branches diverge. [#80316] |
| fixed | Fixed the new app builder failing to publish when a thread branch is empty. [#80295] |
| fixed | Fixed the nested folder permissions label. [#80219] |
| fixed | Fixed object search and caret collapse in the permissions assignment modal. [#80258] |
| fixed | Fixed workflow resource permissions not refreshing when switching environments. [#80276] |
| fixed | Fixed utils.playSound failing silently on Android mobile apps. [#80243] |
| fixed | Fixed the HTML component ignoring inline CSS styles on Android mobile apps. [#80253] |
| fixed | Fixed the Signature component not tracking drag input on Android mobile apps. [#79673] |
| fixed | Fixed Android mobile apps crashing on startup. [#79798] |
| changed | Moved the Azure Blob Storage and CockroachDB resources out of beta to general availability. [#80286] |
| improved | Improved the Salesforce resource to accept custom API versions as freeform input. [#79513] |
| improved | Improved Radio Group component accessibility with keyboard navigation and focus indicators. [#79929] |
| security fix | Fixed a SQL injection vulnerability in Retool Database column type validation. [#80284] |
| security fix | Patched dompurify to address multiple XSS vulnerabilities. Fixes CVE-2026-49458, CVE-2026-49459, CVE-2026-49978, GHSA-76mc-f452-cxcm, GHSA-cmwh-pvxp-8882, GHSA-gvmj-g25r-r7wr, and GHSA-vxr8-fq34-vvx9. [#80045] |
| security fix | Patched undici. Fixes CVE-2026-6733, CVE-2026-6734, CVE-2026-9678, CVE-2026-9679, CVE-2026-9697, CVE-2026-11525, and CVE-2026-12151. [#80043] |
| security fix | Patched aiohttp. Fixes CVE-2026-54273, CVE-2026-54274, CVE-2026-54275, CVE-2026-54276, CVE-2026-54277, CVE-2026-54278, CVE-2026-54279, and CVE-2026-54280. [#80047] |
| security fix | Patched hono. Fixes CVE-2026-54286, CVE-2026-54287, CVE-2026-54288, CVE-2026-54289, and CVE-2026-54290. [#80041] |
| security fix | Patched protobufjs. Fixes CVE-2026-48712 and CVE-2026-54269. [#79691] |
| security fix | Patched nodemailer. Fixes GHSA-268h-hp4c-crq3, GHSA-r7g4-qg5f-qqm2, and GHSA-wqvq-jvpq-h66f. [#79684] |
| security fix | Patched esbuild. Fixes GHSA-gv7w-rqvm-qjhr and GHSA-g7r4-m6w7-qqqr. [#79682] |
| security fix | Patched ws. Fixes CVE-2026-48779. [#79693] |
| security fix | Patched form-data. Fixes CVE-2026-12143. [#79690] |
| security fix | Patched tar. Fixes CVE-2026-53655. [#79694] |
| security fix | Patched js-yaml. Fixes CVE-2026-53550. [#79695] |
| security fix | Patched markdown-it. Fixes CVE-2026-48988. [#80046] |
| security fix | Patched the tmp dependency. Fixes CVE-2026-44705. [#80093] |
| 39 changes | |