Release v2.6.0 🌈

⚠️ For EE users, before upgrading to v2.6.0 finish existing Temporal workflow runs on v2.5.1

Appsmith is moving to a new workflow engine. Runs that started on the old Temporal engine cannot be relied on to resume or finish after upgrading to v2.6.0.

A run is one execution of a workflow. This includes executions waiting for a person to approve a request, even when they are not actively processing anything.

What to do before upgrading:

1. Upgrade to v2.5.1 first if you are on an earlier version.
2. Let all runs on Temporal finish, including any waiting for approval. Stop a run only if you are willing to abandon its remaining work.
3. In Admin Settings → Instance → Admin central, review and acknowledge the v2.5.0 · Workflow Engine Transition checkpoint. Follow the workflow engine transition guide.
4. Upgrade to v2.6.0.

Possible downtime: the upgrade check can prevent the entire Appsmith server from starting if it finds pending approval requests from the old engine. Complete the steps above before upgrading; do not rely on the startup check to find every unfinished run.

If startup is blocked by this checkpoint, return to v2.5.1, finish or deliberately stop the affected runs, complete the checkpoint, and retry the upgrade.

🔐 Brotli security fix (CVE-2026-111497):

Appsmith v2.6.0 includes the fix for a vulnerability in the Node.js Brotli decoder. Processing maliciously crafted Brotli-compressed data can corrupt memory and potentially cause a service crash, expose process memory, or allow remote code execution. Self-hosted customers should upgrade to v2.6.0 to receive the fix. See the Node.js security advisory for details.

⚠️ Important Upgrade Notes

• Customized docker.env files must contain resolved literal values. Shell expressions stop startup with a redacted diagnostic. Move JVM options from docker.env to Docker Compose or Helm environment configuration before upgrading. OTEL_* names, including the documented trace exporter endpoints, are now accepted. Generated defaults and Admin Settings values need no changes. (#42225, #42422)
• Redis queries must use a static command name. A binding in the command name returns a query configuration error. Binding values stay inside a single argument. (#42465)
• The DynamoDB plugin now uses AWS SDK for Java 2.55.9. A region must contain only letters, digits, and hyphens, and be at most 63 characters. Responses can include additional keys; existing keys and values stay the same. If the server sets AWS_ENDPOINT_URL, AWS_ENDPOINT_URL_DYNAMODB, AWS_USE_FIPS_ENDPOINT, or AWS_USE_DUALSTACK_ENDPOINT, the plugin now honors them. (#42346)

🔐 Security

• Updated bundled dependencies to address reported vulnerabilities. (#42444, #42449, #42466, #42475, #42492)
• Editor-mode page and layout reads now require edit permission and return the draft. View mode still requires read permission and returns the published page. (#42425)
• Updating an application or datasource now keeps the workspace it was created in. (#42462)
• Creating a workspace now ignores a client-supplied id, policies, and permission groups. The server generates them. (#42478)
• Redis query bindings stay inside one command argument, so a bound value cannot add extra arguments. (#42465)

🛠️ Reliability

• Public apps again receive the configured Google Maps key, so Map widgets work for anonymous viewers. (#42440)
• Saving datasource credentials now drops that datasource's cached connection on every server pod. (#42430)
• Closing an evicted datasource connection no longer runs on the shared request thread, so one hung database no longer stalls health checks. (#42450)
• Page views are recorded when a page is opened, not when the editor loads layout DSL. (#42429)
• Nested DynamoDB request objects, including transaction items and index settings, are now built the same way every time. (#42346)

✨ New Features & Enhancements

• MCP structured SQL filters can test isNull and notNull. (#42491)
• MCP structured SQL filters can group conditions with anyOf, which compiles to OR and is combined with the other filters. (#42495)
• MCP structured SQL like can match contains, prefix, suffix, or exact text. PostgreSQL queries can use ilike. (#42496)

🎨 UI & Widget Improvements

• In App Settings → Navigation, Show logo and Show application title no longer switch themselves while a save is in progress. (#42488)

🔧 Git, Deployment & Configuration

• docker.env now accepts OTEL_* names, including the documented OpenTelemetry trace exporter endpoints. An externally set OTEL_* value still overrides the file on restart. (#42422)
• Browser telemetry is now sent for builders only. Anonymous visitors and end users of published apps are no longer tracked in the browser. (#42353)