Self-hosted Retool stable release 3.253
Release notes for the Self-hosted Retool 3.253 stable release.
Retool releases a version on the stable channel each quarter. A stable release is generally four versions behind the cloud-hosted version at the time.
Preparation and testing of a stable version occurs approximately four weeks prior to its release. Stable releases are rigorously tested before they are published. As the release cycle is less frequent, administrators can more easily maintain and upgrade deployments.
Retool supports each stable release for six months. During this time, Retool will release patch updates that contain bug fixes or security updates. Patch updates do not contain functionality changes and can be applied more quickly than performing a full version upgrade.
After six months, a stable release is considered deprecated. You can continue using a deprecated release but it will no longer receive updates. At this time, you should upgrade to the latest stable release.
Self-hosted Retool 3.253
No longer supported
| Release | Released | Digest | |
|---|---|---|---|
| First | 3.253.0 | Sep 9, 2025 | sha256:a8fc8b14e0fc71338a9d01d697eb3eb5c54e64119fa0d3edba73ebc3051a38db |
| Latest | 3.253.29 | Mar 12, 2026 | sha256:d078df571d43db29e775fd9a36e80ed7c51ff1591eb2b8109fb2636b5e7f3dc3 |
Best practice
Subscribe to the Atom feed for 3.253 to get notified when new patch releases are available.
Major changes in this release
New features, significant changes, and any actions required when upgrading.
| Type ↕ | Change ↑ |
|---|---|
| new | Access lists for workflows, resources, and agents View access lists for workflows, resources, and agents. |
| improved | Code executor changes in self-hosted 3.251 and later Code executor changes in self-hosted 3.251 and later require updating existing installations. |
| new | Data input typing for modules New data type validation improves the inputs for modules. |
| improved | Module layout updates New configuration options improve the layout of modules. |
| improved | Page UUIDs in Source Control Submit an empty commit in Source Control to support per-page permissions. |
| improved | Per-page view permissions for multipage apps Configure **Use** permissions for each page of a multipage app. |
| new | Protected workflows support manual releases Retool now supports versioning and releasing protected workflows. |
| new | Retool Agents Automate human work with AI. |
| new | Support for Bitbucket access tokens Retool now supports Bitbucket access tokens. |
| improved | Updates to workflow release language When your workflow is ready, you can publish a release. |
| 10 changes | |
Patch release notes
Bug fixes, improvements, and other incremental updates across all patch releases in this release.
| Type | Description |
|---|---|
| 3.253.282 changes↑ | |
| changed | Changed required permission level for folder delete, rename, and move to trash operations from edit to own access. [#71530] |
| security fix | Fixed authorization bypass vulnerability in folder deletion that allowed users without proper permissions to delete folders. [#71481] |
| 3.253.275 changes↑ | |
| fixed | Fixed an issue where global error handlers for workflows would trigger even when errors were already handled by block-level On Error handlers. [#70592] |
| fixed | Fixed an issue where Azure Repos source control diffs included directory entries as files, which caused deployment errors during partial deploys. [#71155] |
| fixed | Fixed an issue where admins were unable to delete or move workflows when VERSION_CONTROL_LOCKED is enabled. [#71231] |
| security fix | Fixed a security vulnerability in the Mailgun email webhook endpoint that could allow an unauthenticated attacker to exfiltrate the Mailgun API key. [#71482] |
| fixed | Fixed an issue with the source control manifest UI not correctly navigating to directory contents. [#71510] |
| 3.253.261 change↑ | |
| added | Added CACHE_CONTROL_NO_CACHE environment variable to return Cache-Control: no-cache headers. [#71101] |
| 3.253.242 changes↑ | |
| security fix | Fixed XSS vulnerability in REST API custom authentication by adding validation for custom auth URLs. [#70006] |
| fixed | Fixed an issue in Secrets Manager where HashiCorp Vault secret lookups may fail when the lookup occurs very near to the access token expiration time. [#70613] |
| 3.253.231 change↑ | |
| added | Added a search option to the Groups page. [#68732] |
| 3.253.221 change↑ | |
| security fix | Patched XSS vulnerability in the Rich Text Editor component. [#69973] |
| 3.253.211 change↑ | |
| security fix | Upgraded jsPDF library to version 4.0.0 to address CVE-2025-68428. [#69875] |
| 3.253.191 change↑ | |
| fixed | Fixed an issue that caused an error when connecting to Snowflake via OAuth. Retool no longer sends the parameter prompt. This extension to the OAuth protocol is not supported by Snowflake, and was ignored in the past, but now Snowflake treats it as an error. [#69651] |
| 3.253.181 change↑ | |
| security fix | Changed behavior so that the HTTP path field in the Databricks resource now sanitizes semicolons to prevent JDBC parameter injection. If you were previously including connection parameters in the HTTP path (e.g., /sql/1.0/warehouses/abc;parameter=value), these will now be stripped. Use the dedicated connection parameters field instead. [#69351] |
| 3.253.171 change↑ | |
| removed | Removed sensitive user tokens from audit logs with OAuth2 SSO. [#69279] |
| 3.253.153 changes↑ | |
| improved | Added the RESOURCE_TYPES_DENY_LIST environment variable to prevent users from creating and running against the provided resource types. [#68528] |
| fixed | Fixed an issue with GraphQL resources where the metadata.request properties may not always be correctly sanitized. [#68552] |
| added | Added support for more resource types behind RESOURCE_TYPES_DENY_LIST and introduced the RESOURCE_TYPES_CREATION_DENY_LIST environment variable. [#68574] |
| 3.253.141 change↑ | |
| added | Added Google Slides tools to Retool Agents. [#65697] |
| 3.253.132 changes↑ | |
| fixed | Fixed a bug that caused a ReferenceError Firebase` raw-mode queries. [#67921] |
| fixed | Fixed an issue that prevented the default credential provider from being utilized by SQS and SNS resources. [#68165] |
| 3.253.111 change↑ | |
| fixed | Fixed an issue where an error from an MCP server could cause a Retool backend service to crash. [#67688] |
| 3.253.91 change↑ | |
| added | Added the RTEL_SEND_TO_RETOOL_INPUT_ALLOWLIST environment variable to specify which data to send to Retool's telemetry server. [#67405] |
| 3.253.82 changes↑ | |
| fixed | Added the Retool AI Vector: Retool AI query writers (edit access) can manage vectors to the Beta settings which allows users with Retool AI edit permission to use create and manage vector documents. [#67220] |
| fixed | Fixed an issue causing workflows using OAuth resources to break inside of nested workflows. [#67305] |
| 3.253.72 changes↑ | |
| fixed | Fixed an issue with OAuth resources being used in workflows, restricting their usage to directly invoked workflows, apps, and agent tool calls. [#67155] |
| fixed | Fixed an issue with skipped releases getting unpublished for users with multi-instance releases and spaces. [#67265] |
| 3.253.61 change↑ | |
| added | Added support for the Jira v3 API in the Jira resource type. [#66707] |
| 3.253.51 change↑ | |
| changed | Changed permission configuration so that users who do not have permission for an agent, regardless of whether or not they have permission for a workflow, will be unable to see the Agents tab in the navigation bar. [#66421] |
| 3.253.25 changes↑ | |
| added | Added informational banner for organizations with admin granularity enabled on user, groups, and roles pages. [#65607] |
| fixed | Fixed an issue where instrumentation events would have scope errors if they were on the page. [#65525] |
| fixed | Fixed an issue causing login loops when signing in with two-factor authentication on Safari. [#65321] |
| fixed | Fixed an issue with the Resource dependencies permissions flyout bar. [#65849] |
| security fix | Patched a security vulnerability in the Databricks connector to prevent file inclusion attacks. [#65851] |
| 3.253.0155 changes↑ | |
| added | Added support for Gemini 2.5 Flash stable model. [#63016] |
| added | Added streaming support for the self-hosted managed key proxy. [#63003] |
| added | Added support for AWS Secrets Manager integration to use EKS Pod Identity Associations for authentication. [#62969] |
| added | Added Retool AI to role permissions. [#62928] |
| added | Added support for OpenAI's gpt-image-1 model for image generation. [#62752] |
| added | Added OAuth 2.0 authentication support for the Databricks resource. Previously, this option was only available to certain organizations. [#62282] |
| added | Added nowIndicator support to the Calendar component. [#61808] |
| added | Added DBCONNECTOR_GUI_MODE_POOL_MIN_SIZE and DBCONNECTOR_GUI_MODE_POOL_MAX_SIZE environment variables for tuning database connection behavior for GUI mode queries. [#61493] |
| added | Added header background and text colors as column properties for the Table component. [#60780] |
| added | Added audit log coverage for permission changes to apps and workflows for a permission group. [#58856] |
| added | Added audit log coverage for permission changes to folders and resource folders for a permission group. [#58897] |
| added | Added audit log coverage for changes to universal access levels on objects and for additional permission updates. [#58940] |
| added | Added audit log coverage for changes in the folder locations of resources and workflows. [#58972] |
| added | Added page number UI to the PDF viewer component. [#60947] |
| added | Added an affordance for suppressing page navigation during app testing recording. [#61505] |
| added | Added the operation'attribute to Datadog performance traces. [#60248] |
| added | Added the appUuid and traceType tags to all performance monitoring spans. [#60069] |
| added | Added support for creating an app and release in the same deployment for multi-instance releases beta users. [#60383] |
| added | Added an option to send email replies directly using SMTP and default Retool Email resources. [#60193] |
| added | Added access_level to the list of properties returned by the Get user apps and folders user action resource query. [#59515] |
| added | Added an icon next to certain app releases indicating that they are managed via source control. [#60337] |
| added | Added the ability to toggle between JSON and Table formats when viewing query results. [#61912] |
| added | Added support for AWS IAM Auth to authenticate with Retool's primary application database. [#58654] |
| added | Added Include "Sent via Retool Email" signature checkbox to Retool Email queries. For Free and Team organizations, this is always checked. For Business and Enterprise organizations, unchecking removes the signature. [#62232] |
| added | Added GUI Mode to the Agent Resource Query for easier invoking and progress checking of agent runs from workflows and apps when not using the Agent Chat component. [#62386] |
| added | Added resource name filtering for audit logs. [#62338] |
| added | Added audit log links in app and query menus. [#62366] |
| added | Added idpProvisioned field to audit log metadata. [#62218] |
| added | Added a security measure that prevents HTTP-based resources from accessing localhost, unless bypassed via either the ALLOW_PUBLIC_API_LOCAL_HTTP_REQUESTS or ALLOW_LESS_SECURE_LOCAL_HTTP_REQUESTS environment variable. [#62583] |
| added | Added AGENTS_ENABLED environment variable. [#62670] |
| added | Added USAGE_API_TOKEN_FILE to the list of environment variables that can be loaded from the file system with RETOOL_LOAD_FILE_SECRETS. [#62953] |
| added | Added API and UI support for access lists for resources, workflows, and agents. [#62941] |
| added | Added support for Databricks Lakebase connector, which allows connections to Databricks Lakebase instances using a PostgreSQL protocol. [#63406] |
| added | Added OAuth 2.0 authentication support for Databricks Lakebase connectors. [#63603] |
| added | Added a host configuration option for Snowflake proxy connections. [#60359] |
| added | Added a visual indicator (dashed line) to the Table component's column headers with tooltips. [#60552] |
| added | Added support for wrapping column header text to the Table component. [#60619] |
| added | Added token-based authentication as an option for Bitbucket repositories. [#63664] |
| added | Added a Trash folder display in the workflows UI with move to trash functionality. [#63618] |
| added | Added special footer for emails sent by Agents. [#63229] |
| added | Added ability for admin users to delete elements (apps, workflows, resources, queries, themes) when Source Control is on. [#63256] |
| added | Added UI changes to allow admin users to delete elements even when VERSION_CONTROL_LOCKED is set to true. [#63264] |
| added | Added support for using API tokens from parent admin organizations to create external users. [#63740] |
| fixed | Fixed an issue where disabled options in the Multiselect component could be removed when selected. [#61829] |
| fixed | Fixed an issue with apps currently being edited by multiple users where cursors weren't showing on page but would show after switching pages. [#62310] |
| fixed | Fixed an issue where custom CSS was not preserved when converting an app to multipage. [#59699] |
| fixed | Fixed an issue with text overflow for property values and parameters. [#60574] |
| fixed | Fixed an issue where Select components would not display the option list correctly on mobile browsers. [#60322] |
| fixed | Fixed an issue where the license status was not always checked when starting the jobsRunner. [#63707] |
| fixed | Fixed an issue that prevented restoring an older version of an app from the History tab. [#60765] |
| fixed | Fixed an issue that would cause data streaming functionality to fail. [#60836] |
| fixed | Fixed an issue where icons were not displaying properly. [#60848] |
| fixed | Fixed an issue where Table column option lists would not properly update if they reference currentRow or currentSourceRow. [#61707] |
| fixed | Fixed an issue where Retool would display a "Validation error" when a user logged in with SSO OIDC and certain group mapping conditions applied. [#62403] |
| fixed | Fixed an issue where queries would break when using moment() with array iteration. [#62362] |
| fixed | Fixed an issue where an error message would appear when setting a module output's value to a non-string. [#61101] |
| fixed | Fixed a race condition that would occasionally cause the initial render of custom components to use stale data. [#61352] |
| fixed | Fixed an issue where controls in Retool Forms editors would not have the correct colors when using a custom theme. [#61057] |
| fixed | Fixed an issue with user attributes scope. [#61046] |
| fixed | Fixed an issue where Tavily resources may not correctly save API key settings. [#61091] |
| fixed | Fixed an issue where URL params in single-page apps were not type casting directly. [#61149] |
| secutrity fix | Increased restrictions to only allow Admins access to the /api/organization/checkProtectedAppsRepo endpoint. [#61096] |
| added | Added a banner when the workflow doesn't include a response block. [#61161] |
| fixed | Fixed an issue where resources synced from source control would not inherit permissions from their parent folder. [#62859] |
| fixed | Fixed an issue where the UI crashed instead of showing an upgrade banner when self-hosted customers reached their maximum seat limit on Team and Business plans. [#62935] |
| fixed | Fixed an issue with variable substitution on Kafka queries. [#62926] |
| fixed | Fixed an issue with new moment() usage support in JavaScript code. [#63346] |
| fixed | Fixed an issue where users could create new apps and workflows from the home page despite Source Control being locked to prevent changes. [#63315] |
| fixed | Fixed an issue where an authentication error may be saved in the query result cache. [#61813] |
| fixed | Fixed an issue where blurring a Select input would not clear the search term. [#61859] |
| fixed | Fixed an issue where blurring a Multiselect input would not clear the search term. [#61870] |
| fixed | Fixed an issue where the Allow others to join the organization checkbox was incorrectly saved during the creation of an organization. [#61890] |
| fixed | Fixed an issue that allowed apps to be overwritten with stale data. [#60438] |
| fixed | Fixed an incorrect string in user settings referring to embed users as external. [#60496] |
| fixed | Fixed an issue where you could not set the view of a Tabbed Container from a module. [#61899] |
| fixed | Fixed an issue where SQS or Kafka workflows did not run as expected. [#61330] |
| fixed | Fixed an issue where module query folders were incorrectly added to the parent app when updating preloaded JavaScript. [#62013] |
| fixed | Fixed an issue where the runFunction block displayed the wrong icon. [#62075] |
| fixed | Fixed an issue where module input names were not truncated. [#62010] |
| fixed | Fixed several bugs with module input popovers, including value resets and popover behavior. [#62054] |
| fixed | Fixed an issue with folder interactions when multiple users are editing an app. [#63378] |
| fixed | Fixed an issue where a DELETE API call to remove a disabled user from a group would silently fail. [#63302] |
| fixed | Fixed an issue where the External settings tab may not be visible. [#63601] |
| fixed | Fixed an issue in the multiplayer feature where renaming a page in one tab caused page folders to disappear in another tab. [#63891] |
| fixed | Fixed an issue where moment.tz.names() and other static method access of sub-namespace function objects in moment were not working correctly. [#63049] |
| fixed | Fixed an issue causing intermittent failure when protecting query library queries that use a resource with multiple environments. [#63064] |
| fixed | Fixed an issue where rate limit errors could occur when using custom AI providers. [#61476] |
| fixed | Fixed an issue where the calendar overlay would show in read-only date/time components. [#61532] |
| fixed | Fixed an issue where a custom app theme remained after user clicked Hide all and Show all on form. [#59758] |
| fixed | Fixed an issue where alerts would appear in the Run panel of the Workflow IDE too frequently. [#59970] |
| fixed | Fixed an issue with the default AI model dropdown if no provider was enabled and no previous model was selected. [#60087] |
| fixed | Fixed an issue where URL hash parameters did not persist across Source Control branching actions. [#60026] |
| fixed | Fixed an issue where resetting a Source Control repository branch may fail. [#59216] |
| fixed | Fixed an issue where an authentication error may be saved in the query result cache. [#61554] |
| fixed | Fixed a minor UI bug where access lists could display a user count in their headers that included inactive users. [#61766] |
| fixed | Fixed an issue where a scrollbar would incorrectly appear for the Access List modal for apps. [#61767] |
| fixed | Fixed frame height jumping in certain cases. [#61685] |
| fixed | Fixed automatic text color contrast for header cells in the Table component. [#61654] |
| fixed | Fixed an issue where the save button could be pushed off screen by a long group name. [#61232] |
| fixed | Fixed an issue where the enumLabels property did not work for custom components. [#61530] |
| fixed | Fixed an issue where Cell Click events for link columns in the Table component would trigger when clicking anywhere in the cell. [#61662] |
| fixed | Fixed an issue where a validation error was not shown when users set 'id' as module input name. [#61118] |
| fixed | Fixed broken documentation links for resource types in queries. [#63121] |
| fixed | Fixed an issue causing an infinite toast loop when renaming a workflow. [#63078] |
| fixed | Fixed an issue where MongoDB resources could not override the default authMechanism. [#62978] |
| fixed | Fixed an issue where the documentation link for the Libraries tab in Settings was incorrect. [#62153] |
| fixed | Fixed Self-hosted Retool committed customers' ability to receive monthly free hours of Agents usage. [#62139] |
| fixed | Fixed an issue where external settings were incorrectly hidden from admin users. [#63596] |
| fixed | Fixed an issue with SCIM when deactivating users with some providers like Microsoft Entra. [#56617] |
| fixed | Fixed an error when viewing the access list for some resources. [#63629] |
| fixed | Fixed an issue where retoolContext.pages wasn't updating when another user added a new page in multiplayer multipage apps. [#63850] |
| removed | Removed the Disable Multiplayer toggle from the app settings menu. [#62029] |
| removed | Removed the Disable Multiplayer toggle from the app settings menu. [#62031] |
| improved | Improved module layout by adding height and overflow configuration options. [#62231] |
| improved | Improved style editors that support CSS length values with minor enhancements. [#62363] |
| improved | Improved the HIDE_PROD_AND_STAGING_TOGGLES environment variable to also hide resource environment toggles in workflows and resource configuration UIs, disable editing existing resource environments, and display an explanatory banner on the Environments settings page. [#62115] |
| improved | Improved the Postgres connector to return preview data for read-only queries, aiding inspection. [#61756] |
| improved | Improved output preview UI. [#62598] |
| improved | Improved test case editing in side panel. [#62773] |
| improved | Improved the OpenAPI resource form to display supported versions information. [#62096] |
| improved | Improved styling on the Output container for query runs. [#62027] |
| improved | Improved reset password error and success messages by moving them to inline alerts for better visibility. [#61165] |
| improved | Added environment scope check to allow non-admin users with environments:manage permission to access environment settings. [#60987] |
| improved | Improved Source Control branch management by adding hotfix branch filtering when viewing all branches. [#61439] |
| improved | Improved List Objects API to support include_inherited_access for apps. [#60630] |
| improved | Added observability scope check to allow non-admin users with observability:manage permission to edit observability settings. [#61037] |
| improved | Added a scope check to Retool API to allow non-admin users with retool_api:manage permission to edit Retool API settings. [#61066] |
| improved | Improved permission handling of public pages. [#61515] |
| improved | Improved permission handling of Source Control endpoints. [#61514] |
| improved | Improved execution of workflows with the 'function' triggerType. [#61074] |
| improved | Improved descriptions for migration commits for better clarity. [#61534] |
| improved | Improved the navigation to selected table when clicking on Retool DB resource link in Forms editor. [#60119] |
| improved | Improved resizing support on the source control deployments page. [#60314] |
| improved | Improved the radio button for permission group selection for consistent UI experience across access type selectors. [#60039] |
| improved | Improved the OpenAPI resource integration to support text responses similar to REST API resources. [#61410] |
| improved | Select and Radio Group components now support label wrapping. [#59855] |
| improved | Improved component documentation links to component guides instead of component references where available. [#61676] |
| improved | Improved overflow handling for long email addresses in usage analytics Top viewers list. [#62861] |
| improved | Improved API documentation by correcting the Retool version information for access lists with types resources, workflows, and agents. [#63347] |
| improved | Improved performance for multipage apps by optimizing dependency graph calculations. [#63975] |
| changed | Changed workflow permissions to now require owner permissions. [#62246] |
| changed | Changed "Preview" button text to "Test". [#62525] |
| changed | Changed access restrictions for public apps in use by organizations that downgraded. [#60595] |
| changed | Removed VM2 dependency. Running workflows and Firebase Raw mode queries now require the Code Executor service to be deployed to work properly. [#63529] |
| changed | Changed the default access permission when creating Google Sheets resources to read only. [#61415] |
| changed | Upgraded CircleCI API dependencies. [#59632] |
| changed | Changed SQL editor behavior by removing ambiguous preview functionality to prevent accidental query execution. [#61507] |
| changed | Removed GUI Mode from the Agent Resource Query configuration. [#62316] |
| changed | Changed public app creation to require verified email addresses. [#63722] |
| changed | Updated Retool API to use the OpenAPI 3.0.4 spec. [#61704] |
| removed | Removed the Connect resource button from demo resource queries. [#61984] |
| added | Added a Modules tab to the Add component popover. [#61994] |
| changed | Changed MySQL resources to use the improved MySQL Connector by default. Changed Databricks resources to consistently use the Java DB connector for better performance and reliability. V1 Connectors for MySQL and Databricks are deprecated and cannot be used anymore. [#62865] |
| security fix | Patched a security vulnerability in the node-bitbucket library that could expose authentication details in error responses. [#63273] |
| security fix | Patched a security vulnerability in the passwordless login system. [#62168] |
| 190 changes | |