Repository navigation
🗑️ Feature Removal Reminder
Appsmith AI reached end of life on September 30, 2026.
You can no longer add new Appsmith AI datasource connections or queries. Existing queries have stopped working, whether or not you have upgraded.
Migrate remaining Appsmith AI queries to a direct provider datasource, such as OpenAI, Anthropic, or Google AI.
⚠️ Important Upgrade Notes
- Customized
docker.envfiles must now contain resolved literal values. Shell expressions stop startup with a redacted diagnostic. Move JVM options fromdocker.envto Docker Compose or Helm environment configuration before upgrading. Generated defaults and Admin Settings values need no changes. (#42225) - Form-based self-serve signup is now limited to 20 requests per client IP every 24 hours. Instances behind a custom proxy should ensure it sets
X-Forwarded-For; otherwise signups can share the proxy's rate-limit bucket. Invites and super-user setup are unaffected. (#42351)
🔐 Security
- Updated bundled dependencies to address reported vulnerabilities. (#42343, #42398)
- MongoDB smart substitution now processes large and malformed inputs in linear time while preserving valid special-type values. (#42380)
- Application theme lists now require edit permission. Published applications continue to render with their current theme. (#42392)
- SMTP datasource connections now enforce the restricted-host policy when testing and sending email. Existing datasources that point to blocked destinations stop connecting after upgrade. (#42399)
- Docker environment configuration is now validated and loaded as data instead of shell code. (#42225)
- MCP-authenticated Git requests can no longer check out remote branches or tags. Local branch workflows continue to work. (#42414)
- Self-serve signup now has a per-client-IP rate limit. (#42351)
🛠️ Reliability
- Ask AI now authorizes widget property bindings against the application instead of treating widget IDs as action IDs. (#42383)
- Creating JS action collections concurrently no longer drops actions or fails because of a shared-list race. (#42408)
- MCP governance audit tools can now obtain the caller's organization scope from the user profile. (#42412)
- MCP branch creation now waits up to 120 seconds and returns the existing branch's application ID and editor URL when a retry finds that branch. (#42413)
✨ New Features & Enhancements
- MCP structured SQL queries can skip empty filter values and use list-valued PostgreSQL filters. A new filter-bar recipe explains how to combine controls, queries, and events safely. (#42373, #42376)
- The editor now recognizes supported worker APIs such as
Blob,File,FormData,URL, and text encoders without false undefined-variable errors. (#42381)
🎨 UI & Widget Improvements
- Phone Input and JSON Form phone fields now keep the correct country and flag when countries share a dial code. Dial-code data for Guyana, the Cayman Islands, and Vatican City was also corrected. (#42372)
- Legacy widgets with a Required toggle now show a required marker consistently. (#42379)