Release v2.2 🌈

Features

• Added support for copying APIs, queries, and JavaScript objects between applications. (#41919) (#41920)
• Prevented Community Edition from starting when connected to a database previously used by Enterprise Edition. (#41906)

---

Fixes

• Blocked Redis datasource connections to the internal Appsmith Redis instance. (GHSA-qhfj-g87x-m39w) (#41921)
• Fixed Storybook issues by removing an overly broad minimatch resolution, allowing glob v10/v11 to correctly support GLOBSTAR. (#41949)
• Applied a batch of dependency updates to address 17 security vulnerabilities identified during release image scans. (#41947)
• Upgraded Spring Boot to 3.5.14 and Netty to 4.1.135 to address multiple CVEs. (#41928)
• Improved Git error handling by distinguishing a missing default branch from an SSH key misconfiguration. (#41940)
• Applied dependency updates to address 1 additional security vulnerability. (#41942)
• Ensured cloned pages generate unique widget IDs, preventing widget conflicts. (#41762)
• Applied dependency updates to address 15 additional security vulnerabilities. (#41913)
• Upgraded joi to 18.2.1 to address CVE-2026-48038. (GHSA-q7cg-457f-vx79) (#41891)
• Added validation to ensure pages belong to the correct application during partial exports. (GHSA-9xfc-9f97-x524) (#41832)
• Improved test stability by wrapping the PropertyPaneTitle F2 assertion in waitFor. (#41888)
• Fixed an issue where SSO login redirects landed on /applications instead of the originally requested application. (#41820)
• Replaced innerHTML and dangerouslySetInnerHTML with safer alternatives to improve security. (#41836)

Breaking changes

• The hardcoded IN_DOCKER environment variable in the published image has been removed. It has been replaced with a new environment variable APPSMITH_DISABLE_SSRF_FILTER which can be used in local development to reach local HTTP and Redis datasources. (#41921)

Release v2.1 🌈

Features

• Replaced Intercom with Pylon across the platform. (#41722)
• Added memory-analysis.sh to help with memory sizing and diagnostic analysis. (#41816)

---

Fixes

• Applied a comprehensive non-routable IP address filter on WebClient to strengthen SSRF protection. (GHSA-v49v-673j-g4vj, GHSA-m23h-pvf3-2m7p) (#41849)
• Built MongoDB database tools from source using patched x/crypto and x/net dependencies. (#41850)
• Restricted the Caddy admin interface to a local socket. (GHSA-8jvv-gwqg-6vjc) (#41847)
• Added path traversal validation to widget save paths. (GHSA-r553-q33m-v7pf) (#41834)
• Removed the unused Supervisord admin port. (GHSA-v49v-673j-g4vj) (#41837)
• Updated the Husky pre-commit hook to correctly stage server files from the worktree root. (#41835)
• Added a non-root user to the Cypress snapshot Dockerfile. (#41823)
• Enforced MANAGE_PAGES permission checks when updating the dependency map. (GHSA-q4p7-j55w-5mjm) (#41828)
• Updated Helm charts to allow numeric CPU values in resources.requests. (#41824)

Release v2.0 🌈

⚠️

Important / Critical - DO NOT UPGRADE WITHOUT READING

If you are upgrading from a version earlier than v1.96, you must first upgrade to version v1.99 before upgrading to 2.0+.

This requirement is especially important for instances using the built-in MongoDB. Appsmith 2.0 bundles MongoDB 7, and versions v1.96 through v1.99 include the required migration changes needed to support this upgrade path.

Skipping this intermediate upgrade will cause the upgrade to 2.0+ to fail, including installations using an external MongoDB instance. Completing this step is required for all deployments.

If you already attempted the upgrade and encountered a failure, no data loss or destructive changes will occur. Simply upgrade to version v1.99 first. Once the instance is successfully running on v1.99, you can proceed with upgrading to 2.0+.

For detailed upgrade instructions, see:

https://docs.appsmith.com/getting-started/setup/instance-management/update-appsmith

Features

• Added a documentation link tooltip for the Appsmith Base URL setting and implemented trailing-slash normalization. (#41782)
• Added support for the MongoDB Operator in Helm deployments. (#41733)
• Added Ask AI CE stubs and shared file wiring support. (#41692)

---

Fixes

• Validated request origins before persisting invited users. [APP-15239] (#41826)
• Preserved Redis credentials during appsmithctl restore. (#41827)
• Upgraded postgresql-jdbc to 42.7.11 to remediate CVE-2026-42198. (#41812)
• Added validation for Git repository URLs. (#41819)
• Prevented unauthenticated access to full OpenAPI documentation. (GHSA-v6jh-fx3m-7xhw) (#41803)
• Fixed a path traversal vulnerability. (GHSA-m4hv-9p7g-56vm) (#41790)
• Upgraded arangodb-java-driver to 7.25.0 to remediate CVE-2025-52999. (#41789)
• Replaced generic “Response not valid” messages with more actionable error messages for improved observability. (#41769)
• Failed closed for token-bearing emails when APPSMITH_BASE_URL is unset. (GHSA-j9gf-vw2f-9hrw) (#41767)
• Updated Helm charts to use documented image values instead of the undocumented _image key. (#41765)
• Fixed a datasource configuration leak in Appsmith App Viewer imports. (GHSA-93mf-9h52-gfxp) (#41764)
• Prevented stored XSS via SQL autocomplete. (GHSA-vjfq-fvfc-3vjw) (#41760)
• Stripped identity fields from imported JSON before persistence. (#41761)
• Prevented HTML entity decoding from corrupting binary file uploads in multipart form data. (#41742)
• Pinned protobufjs to ^7.5.5 to address GHSA-xq3m-2v4x-88gg. (#41745)
• Upgraded axios to 1.15.0 to address GHSA-3p68-rc4w-qgx5. (#41739)
• Upgraded bundled Mongo to 7.x
• Upgraded backend JAVA to 25.x
• Upgraded backed Node to 24.x
• Upgraded bundled MongoDB to 7.x

Release v1.99 🌈

Fixes

• Prevented imports from corrupting published layoutOnLoadActions. (#41737)
• Prevented automatic semicolon insertion (ASI) in wrapCode from causing refactoring failures. (#41727)
• Removed an extra nfs field from the persistentVolume object. (#41724)
• Updated BetterBugs recording links to use the new package URLs. (#41667)
• Replaced PAT with GITHUB_TOKEN in the cleanup-dp workflow. (#41699)
• Fixed styling issues with scrollbar select widgets. (#41656)
• Prevented a super user creation race condition. (GHSA-9wcp-79g5-5c3c) (#41681)
• Blocked SSRF via send-test-email SMTP host validation. (GHSA-vvxf-f8q9-86gh) (#41666)
• Fixed critical CVE-2025-70952. (#41673)
• Upgraded handlebars to 4.7.9 to resolve CVE-2026-33937. (#41672)
• Mitigated CVE-2026-22732, where Spring Security HTTP headers were not being written. (#41669)
• Fixed an issue where datasource queries did not fail when the createdAt field was missing. (#41665)
• Normalized user emails on save to remove invisible Unicode characters. (#41664)
• Enforced ACL permission checks in OAuth2 callback datasource lookup. (GHSA-rg2x-4v4h-g78w) (#41640)
• Validated the filter temp table name before DROP TABLE. (#41642)
• Prevented AQL injection in the ArangoDB plugin caused by unsafe string concatenation. (#41641)
• Expanded the metadata denylist to strengthen SSRF protection. (GHSA-9m89-5jw7-q5cr) (#41643)
• Hardened admin environment value escaping. (#41637)
• Sanitized URLs in ManualUpgrades to prevent reflected XSS. (#41636)
• Enforced edit permissions for application snapshot deletion. (GHSA-g2hc-wmw2-32jr) (#41624)

Release v1.98 🌈

Features

• Added TLS (SSL mode) support for the Redis datasource in both the backend and datasource UI. (#41587)

Fixes

• Enforced edit permissions for application snapshot deletion. (GHSA-g2hc-wmw2-32jr) (#41624)
• Added a red asterisk to required fields. (#41609)
• Prevented unauthenticated disclosure of instance metadata. [APP-14994] (#41598)
• Prevented SQL injection in UQI filter service projection and sortBy columns. (#41594)
• Restricted draft action execution to editors only. (#41614)
• Upgraded simple-git to 3.32.3 to resolve critical CVE-2026-28292. (#41613)
• Upgraded fast-xml-parser to 4.5.4 to resolve critical CVE-2026-25896. (#41595)
• Increased the client class API timeout for the consolidated API from 20 seconds to 60 seconds. (#41591)

Release v1.97 🌈

Features

• Enabled on-the-fly response compression in Caddy. (#41577)
• Added BetterBugs recording links with support for air-gapped environments and disable options. (#41576)
• Introduced Favorite Applications (V2). (#41555)
• Added new style properties to TableWidgetV2: headerRowColor, oddRowColor, and evenRowColor. (#41551)

---

Fixes

• Stabilized the app deletion flow to prevent resource spikes and server restarts. (#41584)
• Moved the cookie sameSite initializer to the constructor to prevent an OverflowError. (#41575)
• Prevented open redirects in login and OAuth2 redirect flows. (#41550)

Release v1.96 🌈

Features

• Added Betterbugs SDK support. (#41532)
• Added a Tooltip property for the Checkbox widget. (#41483)

---

Fixes

• Fixed an arbitrary file write vulnerability that allowed writes outside the repository scope. (#41565)
• Added a getTextFromHTML fallback and normalized search keys to properly handle HTML content. (#41553)
• Fixed an XSS vulnerability in Table HTML cells. (#41539)
• Closed InputStreams after StreamUtils.copyToString to prevent resource leaks. (#41516)
• Fixed an issue where stale actions could not read contents. (#41533)
• Updated MongoDB feature compatibility version (FCV) to 6. (#41534)
• Fixed an OS command injection vulnerability when in-memory Git is enabled. (#41525)

Release v1.95 🌈

Features

• Added extraVolumes and extraVolumeMounts configuration options to the Helm chart. (#41515)
• Show a security warning message when ps is turned off. (#41486)
• Display user display names on workspace members page (#8545)

---

Fixes

• Fixed an issue where anonymous users could execute unpublished actions. (#41517)
• Updated Helm charts to use the Appsmith-built MongoDB image by default. (#41506)
• Switched to OIDC trust for depot in the base image workflow. (#41497)

Release v1.94 🌈

Features

• Added a Redeploy button to allow users to sync the latest changes to App view mode. (#41459)
• Displayed workspace logos in the sidebar navigation. (#41377)

Fixes

• Fixed an issue where git pull created a sync commit, resulting in lost changes. (#41467)
• Updated Helm charts to support deployments with zero replicas. (#41444)
• Temporarily disabled the precompressed directive. (#41365)

Release v1.93 🌈

Features

• Static URL Support for Applications and Pages. (#41312)
• Added support for Custom GraphQL Actions for integrations using GraphQL. (#41404)
• Added formatting for GraphQL body in the query editor. (#41425)
• Added a setValue method for the Radio Group widget. (#41402)
• Enabled specifying deployments in the Helm chart without requiring autoscaling. (#41397)

Fixes

• Simplified the isChecked update logic by removing unnecessary parameters. (#41430)
• Improved authentication by validating the Origin header against APPSMITH_BASE_URL. (#41426)
• Corrected placeholder text in the GraphQL action editor. (#41423)
• Resolved an issue where partial exports of custom libraries resulted in zero libraries being exported. (#41416)
• Updated Gemini model options in the Google AI datasource to ensure compatibility with the generate command. (#41415)
• Made the horizontal scrollbar thicker for better visibility in tables. (#41370)