appsmith

🗑️ Feature Removal Reminder

Appsmith AI reached end of life on September 30, 2026.

You can no longer add new Appsmith AI datasource connections or queries. Existing queries have stopped working, whether or not you have upgraded.

Migrate remaining Appsmith AI queries to a direct provider datasource, such as OpenAI, Anthropic, or Google AI.

⚠️ Important Upgrade Notes

• Customized docker.env files must now contain resolved literal values. Shell expressions stop startup with a redacted diagnostic. Move JVM options from docker.env to Docker Compose or Helm environment configuration before upgrading. Generated defaults and Admin Settings values need no changes. (#42225)
• Form-based self-serve signup is now limited to 20 requests per client IP every 24 hours. Instances behind a custom proxy should ensure it sets X-Forwarded-For; otherwise signups can share the proxy's rate-limit bucket. Invites and super-user setup are unaffected. (#42351)

🔐 Security

• Updated bundled dependencies to address reported vulnerabilities. (#42343, #42398)
• MongoDB smart substitution now processes large and malformed inputs in linear time while preserving valid special-type values. (#42380)
• Application theme lists now require edit permission. Published applications continue to render with their current theme. (#42392)
• SMTP datasource connections now enforce the restricted-host policy when testing and sending email. Existing datasources that point to blocked destinations stop connecting after upgrade. (#42399)
• Docker environment configuration is now validated and loaded as data instead of shell code. (#42225)
• MCP-authenticated Git requests can no longer check out remote branches or tags. Local branch workflows continue to work. (#42414)
• Self-serve signup now has a per-client-IP rate limit. (#42351)

🛠️ Reliability

• Ask AI now authorizes widget property bindings against the application instead of treating widget IDs as action IDs. (#42383)
• Creating JS action collections concurrently no longer drops actions or fails because of a shared-list race. (#42408)
• MCP governance audit tools can now obtain the caller's organization scope from the user profile. (#42412)
• MCP branch creation now waits up to 120 seconds and returns the existing branch's application ID and editor URL when a retry finds that branch. (#42413)

✨ New Features & Enhancements

• MCP structured SQL queries can skip empty filter values and use list-valued PostgreSQL filters. A new filter-bar recipe explains how to combine controls, queries, and events safely. (#42373, #42376)
• The editor now recognizes supported worker APIs such as Blob, File, FormData, URL, and text encoders without false undefined-variable errors. (#42381)

🎨 UI & Widget Improvements

• Phone Input and JSON Form phone fields now keep the correct country and flag when countries share a dial code. Dial-code data for Guyana, the Cayman Islands, and Vatican City was also corrected. ([#42372](https://github.com/appsmithorg/appsmit

🗑️ Feature Removal Reminder - September 30, 2026 - EOL

Appsmith AI reached end of life on September 30, 2026.

You can no longer add new Appsmith AI datasource connections or queries. Existing queries have stopped working, whether or not you have upgraded.

Migrate remaining Appsmith AI queries to a direct provider datasource, such as OpenAI, Anthropic, or Google AI.

⚠️ Important Upgrade Notes

• Git-connected applications update to server schema 13 when they are next opened. This can create a one-time system commit. Applications exported from this release cannot be imported into an older server that supports only schema 12. (#42322)
• When you change a datasource connection setting, you must enter the credentials again for the active authentication, TLS, and SSH settings. Unchanged connections can continue to use saved credentials. (#42339)
• Elasticsearch body bindings now use typed JSON substitution. Review queries that insert serialized JSON, build part of a JSON string, or construct dynamic paths. Invalid bindings now return a query error. (#42342)

🔐 Security

• Updated bundled dependencies to address reported vulnerabilities. (#42314, #42324, #42331)
• Datasource credential reuse is now tied to the saved connection configuration, and datasource test, structure, and trigger requests use stricter permission checks. (#42339)
• Requests from the evaluation environment now keep the credential-omission guard even if the global request constructor changes. (#42355)
• Login rate limits now use the same normalized account identity as authentication. (#42337)
• Datasource updates now preserve the identity of the datasource selected by the request. (#42356)
• Elasticsearch queries now validate substituted JSON and dynamic path values before execution. (#42342)

🛠️ Reliability

• Prepared MySQL stored procedure calls can now run with a trailing query and keep bound values as data. (#42329)
• Failed OAuth2 and SSO logins now return users to the instance login page. (#42330)
• Zones in cards, tabs, sheets, and list items now use the full available width instead of collapsing into a narrow column. (#42364)
• MCP datasource creation now lets the server select the correct environment. (#42341)

✨ New Features & Enhancements

• Applications can now have an optional description that appears on application cards. (#42312)
• List widgets now have a Disable selection option for apps that do not need row selection or item-click behavior. (#42261)
• MCP can now create and update structured JS objects, use more MongoDB filter types, patch more widget settings, wire JS function calls, and detect common layout issues. (#42311)

🎨 UI & Widget Improvements

• Table columns now have an optional Header wrapping setting for long column titles. (#42354)
• Table headers now support configurable font weight, italic text, and underlining. ([#42323](https://github.com/appsmith

🗑️ Feature Removal Reminder - September 30, 2026 - EOL

Appsmith AI reaches end of life on September 30th, 2026.

As announced in v2.3 and v2.4, you can no longer add new Appsmith AI datasource connections or queries. Existing ones stop working on that date — whether or not you have upgraded.

Migrate remaining Appsmith AI queries to a direct provider datasource (OpenAI, Anthropic, or Google AI) before September 30th.

⚠️ Important Upgrade Notes

• MCP sessions now use the Redis configured by APPSMITH_REDIS_URL. Standard Docker and Helm deployments require no configuration change. If your external Redis uses restricted ACLs, allow read/write access to appsmith:mcp:* and PUBLISH/SUBSCRIBE on appsmith:mcp:relay:*; otherwise the MCP process will not start. (#42279)

🔐 Security

• Updated bundled dependencies to address reported vulnerabilities. (#42307, #42309)

🛠️ Reliability

• Action executions now preserve useful timeout, network, gateway, and server-provided error messages instead of replacing them with client-side errors. (#42277, #42280)
• Hashed static assets now use a separate, higher-capacity rate-limit zone, preventing cold editor loads from failing with HTTP 429 while preserving the existing limit for dynamic requests. (#42286)

🎨 UI & Widget Improvements

• Added a font-family control to the Rich Text Editor toolbar, including a Default option and web-safe font choices. (#42215)
• Browser Back and Forward navigation now refreshes appsmith.URL and URL-driven widget values when query parameters change. (#42301)
• Restored search, filtering, and sorting for plain-text values in Table widget HTML columns. (#42271)

🔧 Configuration

• MCP sessions are now shared across replicas through Redis and survive MCP process restarts, preventing requests routed to another replica from returning 404. (#42279)

🗑️ Feature Removal Reminder - September 30, 2026 - EOL

Appsmith AI reaches end of life on September 30th, 2026.

As announced in v2.3 and v2.4, you can no longer add new Appsmith AI datasource connections or queries. Existing ones stop working on that date — whether or not you have upgraded.

Migrate remaining Appsmith AI queries to a direct provider datasource (OpenAI, Anthropic, or Google AI) before September 30th.

🔐 Security

• Updated bundled dependencies to address reported vulnerabilities, including Bouncy Castle. (#42265)

🛠️ Reliability

• Cloning a page with many actions no longer loads the page document once per action, which could exhaust server memory. (#42228)
• Used fixed Segment user IDs for instance-start and Redis-compile events so those calls no longer inflate Monthly Tracked Users. (#42246)

🎨 UI & Widget Improvements

• Restored Ask AI visibility for Developer-role users. (#42274)
• Moved the OAuth2 “Authorization expires in” field next to Scope(s) on authenticated API datasources. (#42191)

🔧 Git, Deployment & Configuration

• appsmithctl enable-form-login now passes the full Redis URL (auth, port, and TLS) when evicting the cached organization. (#42235)