Self-hosted Retool Edge release 4.93
Release notes for the Self-hosted Retool 4.93 edge release.
Releases on the Edge channel occur weekly. Each release occurs one week after the equivalent release for cloud-hosted Retool.
Edge releases are available for organizations that want the latest features or to use private beta functionality. Retool recommends most organizations use Stable releases unless you have a specific need for Edge releases and can keep your deployment up-to-date.
Retool supports only the most recent release on the Edge channel. As Edge releases are weekly, bug fixes and improvements are included in the next release. All previous releases are then considered deprecated.
Documentation for this release
Retool's main documentation site reflects the latest Edge release. Since Edge updates weekly and only the most recent release is supported, the docs you're already browsing apply to this release — there's no separate version to switch to.
Self-hosted Retool 4.93
Latest releaseCurrently supported
Edge release notes
Bug fixes, improvements, and changes in this release.
| Type ↑ | Description ↕ |
|---|---|
| 4.93.057 changes↑ | |
| added | Added --environment option to retool init, retool clone, and retool start in the Retool CLI. [#84386] |
| added | Added a dismissible Try the new Retool experience tile to the classic app editor canvas. [#88897] |
| added | Added the Enhanced security checks for decoupled queries Beta setting for stricter resource override permission checks. [#89527] |
| added | Added the retool apps protect command to the Retool CLI to put an app under source control protection. [#89623] |
| added | Added Custom Auth support for resources used by app builder apps, including OAuth and redirect steps. [#90364] |
| fixed | Fixed the app builder version history pane hanging on loading after renaming a branch. [#89212] |
| fixed | Fixed branch cleanup deleting Azure Repos branches that still exist in the remote repository. [#89400] |
| fixed | Fixed the Jobs Runner starting overlapping branch cleanup runs that deleted each other's clones. [#89405] |
| fixed | Fixed new app builder apps created from the Home page landing in Published instead of Drafts. [#89496] |
| fixed | Fixed workflow editor crashing when importing a workflow JSON file with corrupted template data. [#89663] |
| fixed | Fixed admin space apps in the app builder being limited to 60 characters instead of 63 for the app identifier. [#89697] |
| fixed | Fixed MongoDB and Retool DB resource forms showing an unsupported Read/Write connection option. [#89864] |
| fixed | Fixed stopping a Google Sheets query so it cancels in-flight write requests. [#89875] |
| fixed | Fixed secrets and configuration variables not resolving in AI resource connection fields. [#90001] |
| fixed | Fixed sign-in from a published app's hostname redirecting to the apps list on self-hosted. [#90120] |
| fixed | Fixed false The workspace has not confirmed your recent edits warnings in the app builder. [#88295] |
| fixed | Fixed classic app Select and Multiselect components adding case-only duplicate custom values. [#88597] |
| fixed | Fixed app builder naming and commit messages failing without a default LLM provider. [#89396] |
| fixed | Fixed Spend Controls listing AI models that are past their deprecation date. [#89553] |
| fixed | Fixed the Retool MCP server intermittently missing the app builder thread, file, and status tools. [#89630] |
| fixed | Fixed app builder MCP tools being unavailable on deployments that use pg-boss without Temporal. [#89647] |
| fixed | Fixed apps built in the app builder not setting the browser tab title when published. [#89667] |
| fixed | Fixed app owners who are not admins sharing apps when Allow app owners to manage permissions is off. [#89678] |
| fixed | Fixed density spacing classes not overriding each other in app builder shadcn components. [#89712] |
| fixed | Fixed long-running backend functions in the app builder losing their responses behind proxies with idle timeouts. [#89791] |
| fixed | Fixed MongoDB resource connection tests not returning correct success and error results. [#89826] |
| fixed | Fixed the AI Monitoring BYOK usage table crashing when a usage row had no model. [#89874] |
| fixed | Fixed Number Input arrow-key shortcuts ignoring minimum and maximum values in classic apps. [#89879] |
| fixed | Fixed a malformed app error causing other errors in the same batch to be dropped. [#89999] |
| fixed | Fixed a 500 error when removing a group's object access granted by several roles. [#90046] |
| fixed | Fixed the app builder resource @-mention dropdown rendering behind the preview canvas. [#90316] |
| fixed | Fixed agents API endpoints returning 500 instead of 400 for non-UUID IDs. [#90333] |
| fixed | Fixed app builder merges from main failing on conflicts in read-only testing files. [#90380] |
| improved | Improved the Workflows editor Triggers panel to show the full trigger text in a tooltip on hover. [#89503] |
| improved | Improved performance of updating group members through the public API for large groups. [#89809] |
| changed | Changed JS_EXECUTOR_READINESS_CHECKER_ENFORCE to default to true for JS Executor readiness checks. [#89822] |
| changed | Changed the Google Search Console integration to be available without enabling it in Beta settings. [#89835] |
| changed | Changed new public apps to block dynamic resource queries by default. [#87568] |
| changed | Changed the app builder to save its pg-boss or Temporal backend choice on first boot. [#88979] |
| changed | Changed the default OpenAI model for the app builder to GPT 6.1 Sol. [#89395] |
| changed | Changed Microsoft SQL Server resources to ignore connection string parameters not on an allowlist. [#89561] |
| changed | Changed Retool Storage file deletion to remove the file entry only after the storage provider confirms deletion. [#89701] |
| changed | Updated the Salesforce resource to use a newer version of its client library. [#89710] |
| changed | Replaced the on-prem iframe-hosted mode setting with Enable app hostnames for published apps. [#90070] |
| changed | Changed the app builder publish button to Push to main branch for apps pinned to a tag. [#90304] |
| security fix | Required owner access to re-authenticate resources that share OAuth credentials. [#89672] |
| security fix | Restricted Google SSO account linking by email to Gmail and Google Workspace accounts. [#89897] |
| security fix | Closed a gap in code executor routes that allowed signed-in users to run queries and code beyond their permissions. [#90357] |
| security fix | Prevented Azure Repos source control checkouts from writing files outside the clone directory. Resolves CVE-2026-63478. [#90545] |
| security fix | Patched json5 against prototype pollution in template key parsing. Resolves CVE-2022-46175. [#88674] |
| security fix | Blocked link-local IPv4 addresses (169.254.0.0/16) in the SSH dbconnector service. [#88991] |
| security fix | Patched the Snowflake client library by updating it to version 3.4.0. Resolves CVE-2026-86597. [#89714] |
| security fix | Prevented disabled users from continuing to open published apps with an existing session. [#89797] |
| security fix | Deleted the unused example app that pdf-creator-node ships in the code executor image. Resolves CVE-2025-7783 and CVE-2026-12143. [#89800] |
| security fix | Restricted sign-in so a login token can only create a session for the user it was issued to. [#90322] |
| security fix | Hardened org admin endpoints for libraries, group assignment, and group admins to accept only permitted fields and same-organization IDs. [#90447] |
| security fix | Restricted Toolscript imports to supplied app files so they no longer read from the server's disk. [#90468] |
| 57 changes | |