Self-hosted Retool Edge release 4.9
Release notes for the Self-hosted Retool 4.9 edge release.
Releases on the Edge channel occur weekly. Each release occurs one week after the equivalent release for cloud-hosted Retool.
Edge releases are available for organizations that want the latest features or to use closed beta functionality. Retool recommends most organizations use Stable releases unless you have a specific need for Edge releases and can keep your deployment up-to-date.
Retool supports only the most recent release on the Edge channel. As Edge releases are weekly, bug fixes and improvements are included in the next release. All previous releases are then considered deprecated.
Self-hosted Retool 4.9
No longer supported
Edge release notes
Bug fixes, improvements, and other incremental updates across all edge releases in this release.
| Type | Description |
|---|---|
| 4.9.056 changes↑ | |
| fixed | Fixed a crash on the Commit and push button in the source control panel when the button was in a disabled state. [#79631] |
| security fix | Hardened custom component collection file serving to prevent stored XSS via SVG file uploads on the Retool origin. [#79494] |
| security fix | Fixed a high severity security issue in Retool Forms. Blocked the $queryResponse system query from the public query endpoint, preventing anonymous callers from reading all prior form submissions. [#79546] |
| security fix | Fixed a cross-tenant IDOR in the image blob endpoint by scoping lookups to the request organization regardless of authentication state. [#79550] |
| security fix | Patched io.netty to 4.1.135.Final in the Java DB connector to remediate 11 CVEs. Fixes CVE-2026-44893. Fixes CVE-2026-44250. Fixes CVE-2026-44890. Fixes CVE-2026-44249. Fixes CVE-2026-45416. Fixes CVE-2026-45674. Fixes CVE-2026-47691. Fixes CVE-2026-46340. Fixes CVE-2026-47244. Fixes CVE-2026-45673. Fixes CVE-2026-45536. [#79354] |
| security fix | Patched shell-quote to 1.8.4 to remediate a critical code injection vulnerability. Fixes CVE-2026-9277. [#79353] |
| security fix | Fixed the JS executor sandbox restrictedFetch wrapper to deny redirect-follow, preventing 3xx responses from allowed origins from bypassing the fetch origin allowlist. [#79413] |
| security fix | Fixed a symlink-traversal remote code execution vulnerability in classic source control commit sinks where a push of a crafted symlink could plant a payload in .git/hooks. [#79448] |
| security fix | Hardened all backend git and zip write sinks against path traversal, closing a git-config injection RCE vector in external source-control sync. [#79372] |
| security fix | Fixed a sandbox escape in iframe-hosted apps where the published app bundle could be loaded directly as a top-level document with the user's Retool session. [#79426] |
| security fix | Fixed a host-file exfiltration vulnerability in the app git server where a committed symlink could allow users with push access to read arbitrary server files. [#79389] |
| security fix | Fixed the form publish endpoint to require write or own access, preventing read-only users from triggering destructive DDL operations on form backing tables. [#79427] |
| security fix | Removed OAuth scope data from error payloads in custom auth JavaScript steps to prevent credential details from leaking in error responses. [#79380] |
| improved | Improved serverless function support for preconfigured OpenAPI resources by including all sibling specs, enabling agent access to all operations for resources like Twilio, HubSpot, and Google Docs. [#79502] |
| fixed | Fixed non-admin users with source_control:manage permission being unable to view deployment details or initiate a sync from the Source Control settings page. [#79478] |
| fixed | Fixed self-hosted public app pages being clustered with unrelated Retool deployments by search engines, causing incorrect titles and favicons to appear in search results. [#79377] |
| fixed | Fixed the Workflows list rendering empty after moving a workflow into a folder until the user manually refreshed the page. [#79459] |
| fixed | Fixed template placeholders inside nested object and array query parameters not being resolved in OpenAPI resources. [#79446] |
| fixed | Fixed protected workflow triggers not being reconciled on manifest-pinned releases, preventing cron and webhook triggers from firing after a source-control deploy. [#79039] |
| fixed | Fixed the Agent version dropdown showing the save author's name instead of the user who published the release. [#79346] |
| fixed | Fixed mis-parsed binary responses in the REST API connector by consolidating binary content-type detection and adding support for the binary/octet-stream content type. [#79365] |
| fixed | Fixed the Resources tab in settings not appearing for users who had use-level access to resources but did not own any. [#79370] |
| fixed | Clarified the API error message for invalid subdomain format when creating a child space, showing the expected prefix format instead of only the required suffix. [#79378] |
| fixed | Fixed the invite claim page returning a generic error instead of a clear 422 message when a user entered a password that did not meet strength requirements. [#79396] |
| fixed | Fixed MCP OAuth dynamic client registration rejecting valid RFC 7591 and RFC 8252 request shapes, resolving VS Code's inability to connect to a Retool MCP server. [#79336] |
| added | Added a read-only groups toolset to the Retool MCP server, allowing MCP clients to list groups, get group membership, and read group access levels. [#79315] |
| fixed | Fixed SQS and SNS resources treating Assume Role and Default Credential Provider Chain as mutually exclusive, aligning them with other Node-based AWS resources. [#79402] |
| fixed | Fixed Ask AI returning a 400 error when the default AI model was set to a Gemini model. [#79301] |
| fixed | Fixed Azure OpenAI queries failing with a 400 error when the deployment used a model requiring max_completion_tokens instead of the legacy max_tokens parameter. [#79350] |
| fixed | Fixed Firebase connector queries intermittently returning 422 errors caused by unconditional connection teardowns during in-flight requests. [#79383] |
| fixed | Fixed queries referencing a non-existent secret in the secret manager returning a 500 error instead of a user-friendly error message. [#79384] |
| fixed | Fixed the browser tab title not updating to reflect the app title in apps served in iframe mode. [#79181] |
| fixed | Fixed backend function calls showing a generic error message when the response payload exceeded the 413 size limit. [#78347] |
| fixed | Fixed source control release manifest parsing to surface validation errors instead of silently dropping malformed manifests. [#78560] |
| fixed | Fixed the login page hanging indefinitely on the loading spinner when a chunk import request stalled and never sent a response. [#78897] |
| fixed | Fixed the app documentation icon being invisible in the editor sidebar and frame footer. [#79212] |
| fixed | Fixed a rendering loop in auto-height Table components caused by shared row and column virtualization refs, which also incorrectly disabled horizontal virtualization. [#79292] |
| fixed | Fixed the Workflows Analytics page being accessible to non-admin users with workflow viewer permission, despite all analytics API endpoints requiring admin access. [#78691] |
| fixed | Fixed versioned JDBC drivers not being packaged in legacy self-hosted images, causing Databricks driver loading failures. [#78680] |
| added | Added encrypted-media to the custom component iframe permission policy, enabling DRM-protected video playback inside Retool custom components. [#78566] |
| changed | Replaced Gemini 3 Pro Preview with Gemini 3.1 Pro Preview for Agents and AI queries. [#78209] |
| added | Added a Reconnect overlay to the app builder when the sandbox WebSocket connection is exhausted after all retries, replacing an indefinite loading state. [#78783] |
| fixed | Fixed the OpenAPI mini-spec slicer collapsing repeated $ref components to empty objects when the same component was referenced more than once in a single operation. [#78718] |
| fixed | Fixed deprecated and unsupported AI models appearing in the Agent model selection dropdown when using AI Provider resources. [#77637] |
| fixed | Fixed source control sync failing in the new app builder because the classic app file extension allowlist was incorrectly applied to new repositories. [#78631] |
| fixed | Fixed static assets in apps not requiring authentication on self-hosted deployments. [#78776] |
| added | Added the ability for the app building agent to pause and prompt users for input during app building via an interactive input form. [#79008] |
| improved | Improved the app builder to surface in-progress agent threads before starting new edits from main, preventing accidental overwrites of concurrent work. [#79221] |
| added | Added audit logging for changes to the require-approval setting on apps. [#79252] |
| fixed | Fixed source control branch cleanup soft-deleting branches with uncommitted local work, which could cause those branch saves to appear as main-branch saves. [#79456] |
| fixed | Fixed the billing banner showing subscription success copy instead of a plan-change notice when a downgrade had been scheduled. [#79414] |
| improved | Upgraded Retool Mobile to React Native / Expo SDK v54, adding support for Android 16KB page sizes required by Google Play and removing the CodePush dependency. [#76249] |
| fixed | Fixed the app builder chat showing a confusing error message by clarifying the remaining retry count when an agent step fails. [#79030] |
| fixed | Fixed the cache service worker Beta toggle having no effect because the flag was read from the global experiments channel instead of the per-org channel. [#79484] |
| changed | Changed the default Anthropic model for bring-your-own-key configurations to Claude Opus 4.8 in the new app builder. [#79369] |
| changed | Changed function execution in editor mode to require write access on referenced resources, consistent with the permission level needed to edit queries. [#78881] |
| 56 changes | |