Self-hosted Retool Edge release 4.31
Release notes for the Self-hosted Retool 4.31 edge release.
Releases on the Edge channel occur weekly. Each release occurs one week after the equivalent release for cloud-hosted Retool.
Edge releases are available for organizations that want the latest features or to use closed beta functionality. Retool recommends most organizations use Stable releases unless you have a specific need for Edge releases and can keep your deployment up-to-date.
Retool supports only the most recent release on the Edge channel. As Edge releases are weekly, bug fixes and improvements are included in the next release. All previous releases are then considered deprecated.
Documentation for this release
Retool's main documentation site reflects the latest Edge release. Since Edge updates weekly and only the most recent release is supported, the docs you're already browsing apply to this release — there's no separate version to switch to.
Self-hosted Retool 4.31
Latest releaseCurrently supported
Edge release notes
Bug fixes, improvements, and other incremental updates across all edge releases in this release.
| Type | Description |
|---|---|
| 4.31.041 changes↑ | |
| added | Added Claude Sonnet 5, Claude Fable 5, and GPT-5.6 to the Retool React Agent model picker. [#81697] |
| added | Added support for keyless Azure Blob Storage authentication in the new app builder. [#81891] |
| fixed | Fixed interactive writes during evaluation phase. [#81027] |
| fixed | Fixed Mobile image dimension handling. [#81069] |
| fixed | Fixed Mobile TextArea auto-grow, bottom sheet clipping, and Select truncation. [#81079] |
| fixed | Fixed AI provider queries not appearing in search. [#81080] |
| fixed | Fixed Agent AI provider resource remapping on import. [#81330] |
| fixed | Fixed App Saved event timing to preserve page name during navigation. [#81386] |
| fixed | Fixed drag-and-drop preview in newly added containers. [#81395] |
| fixed | Fixed source control sync to continue when protected-apps.yaml is missing. [#81439] |
| fixed | Fixed memory leak during source control sync. [#81474] |
| fixed | Fixed MCP resource search to use display name instead of technical name. [#81604] |
| fixed | Fixed Image component height preservation on reload. [#81661] |
| fixed | Fixed public API v2 resource endpoints returning errors or omitting plugin-based resources such as Google Drive, Gmail, and Microsoft Graph. [#81669] |
| fixed | Fixed the Show AI prompt box on homepage toggle in AI settings not working correctly. [#81708] |
| fixed | Fixed Retool Email recipient limit enforcement. [#81792] |
| fixed | Fixed an infinite loop when calling utils.setUrlParameters() with unchanged values. [#81296] |
| fixed | Fixed excessive logging when large workflow runs exceeded the block result fetch cap. [#81571] |
| fixed | Fixed a foreign key error when deploying workflows through source control. [#81607] |
| changed | Enabled SEAL_OBJECT_PROTOTYPE by default in all environments. [#81790] |
| improved | Enabled attaching query results to audit log streams. [#81208] |
| improved | Enabled Gmail integration for self-hosted instances. [#81398] |
| improved | Enhanced Snowflake access control error classification. [#81472] |
| improved | Introduced deprecation banner for Microsoft SQL connector versions 1 and 2. [#81603] |
| improved | Enabled self-hosted instances to relay MCP client requests through the main ingress without a dedicated /mcp routing rule. [#81629] |
| improved | Enforced MSSQL version allowlist for self-hosted customers. [#81759] |
| removed | Removed autocomplete and hover support for bundled Code Executor libraries (lodash, moment, papaparse, numbro, uuid) in workflow and agent editors. [#81211] |
| removed | Removed the deprecated From template option from the Create app menu. [#81432] |
| removed | Removed the deprecated From JSON/ZIP option from the Create app menu. [#81442] |
| security fix | Patched shell-quote to address a quadratic-complexity denial-of-service vulnerability. Resolves CVE-2026-13311 and GHSA-395f-4hp3-45gv. [#81490] |
| security fix | Patched tar to address multiple denial-of-service and process-crash vulnerabilities. Resolves CVE-2026-59873, CVE-2026-59874, CVE-2026-59871, and CVE-2026-59875. [#81493] |
| security fix | Patched axios to address multiple vulnerabilities including proxy configuration leaks, prototype pollution, and request-size bypasses. Resolves GHSA-gcfj-64vw-6mp9, GHSA-7q8q-rj6j-mhjq, GHSA-f4gw-2p7v-4548, GHSA-hcpx-6fm6-wx23, GHSA-jqh4-m9w3-8hp9, GHSA-mmx7-hfxf-jppx, and GHSA-mwf2-3pr3-8698. [#81494] |
| security fix | Patched brace-expansion to address a denial-of-service vulnerability from exponential-time expansion. Resolves CVE-2026-13149 and GHSA-3jxr-9vmj-r5cp. [#81495] |
| security fix | Patched js-yaml to address a denial-of-service vulnerability from quadratic CPU consumption in YAML merge-key chains. Resolves CVE-2026-59869 and GHSA-52cp-r559-cp3m. [#81496] |
| security fix | Patched hono to address multiple vulnerabilities including cross-request data disclosure and server-side XSS. Resolves CVE-2026-59896, CVE-2026-59895, CVE-2026-59897, GHSA-hvrm-45r6-mjfj, GHSA-w62v-xxxg-mg59, and GHSA-xgm2-5f3f-mvvc. [#81497] |
| security fix | Patched protobufjs to address a denial-of-service vulnerability from an infinite loop in proto option parsing. Resolves CVE-2026-59877 and GHSA-j3f2-48v5-ccww. [#81499] |
| security fix | Patched webpack-dev-server to address CSRF and denial-of-service vulnerabilities. Resolves CVE-2026-14620 and CVE-2026-14631. [#81500] |
| security fix | Patched ip-address to address a cross-site scripting vulnerability in Address6 HTML-emitting methods. Resolves CVE-2026-42338. [#81526] |
| security fix | Patched uuid to address a missing output-buffer bounds check in v3, v5, and v6 generation. Resolves CVE-2026-41907 and GHSA-w5hq-g745-h8pq. [#81528] |
| security fix | Applied resource-level access checks to schema search and cache eligibility endpoints, preventing privilege escalation. [#81727] |
| security fix | Fixed a host header injection vulnerability in the Google SSO OAuth redirect flow. [#81541] |
| 41 changes | |