appsmithorg/appsmith v2.6.0

Release v2.6.0 🌈

on GitHub

🔐 Brotli security fix (CVE-2026-111497): Appsmith v2.6.0 includes the fix for a vulnerability in the Node.js Brotli decoder. Processing maliciously crafted Brotli-compressed data can corrupt memory and potentially cause a service crash, expose process memory, or allow remote code execution. Self-hosted customers should upgrade to v2.6.0 to receive the fix. See the Node.js security advisory for details.

⚠️ Important Upgrade Notes

• Customized docker.env files must contain resolved literal values. Shell expressions stop startup with a redacted diagnostic. Move JVM options from docker.env to Docker Compose or Helm environment configuration before upgrading. OTEL_* names, including the documented trace exporter endpoints, are now accepted. Generated defaults and Admin Settings values need no changes. (#42225, #42422)
• Redis queries must use a static command name. A binding in the command name returns a query configuration error. Binding values stay inside a single argument. (#42465)
• The DynamoDB plugin now uses AWS SDK for Java 2.55.9. A region must contain only letters, digits, and hyphens, and be at most 63 characters. Responses can include additional keys; existing keys and values stay the same. If the server sets AWS_ENDPOINT_URL, AWS_ENDPOINT_URL_DYNAMODB, AWS_USE_FIPS_ENDPOINT, or AWS_USE_DUALSTACK_ENDPOINT, the plugin now honors them. (#42346)

🔐 Security

• Updated bundled dependencies to address reported vulnerabilities. (#42444, #42449, #42466, #42475, #42492)
• Editor-mode page and layout reads now require edit permission and return the draft. View mode still requires read permission and returns the published page. (#42425)
• Updating an application or datasource now keeps the workspace it was created in. (#42462)
• Creating a workspace now ignores a client-supplied id, policies, and permission groups. The server generates them. (#42478)
• Redis query bindings stay inside one command argument, so a bound value cannot add extra arguments. (#42465)

🛠️ Reliability

• Public apps again receive the configured Google Maps key, so Map widgets work for anonymous viewers. (#42440)
• Saving datasource credentials now drops that datasource's cached connection on every server pod. (#42430)
• Closing an evicted datasource connection no longer runs on the shared request thread, so one hung database no longer stalls health checks. (#42450)
• Page views are recorded when a page is opened, not when the editor loads layout DSL. (#42429)
• Nested DynamoDB request objects, including transaction items and index settings, are now built the same way every time. (#42346)

✨ New Features & Enhancements

• MCP structured SQL filters can test isNull and notNull. (#42491)
• MCP structured SQL filters can group conditions with anyOf, which compiles to OR and is combined with the other filters. (#42495)
• MCP structured SQL like can match contains, prefix, suffix, or exact text. PostgreSQL queries can use ilike. (#42496)

🎨 UI & Widget Improvements

• In App Settings → Navigation, Show logo and Show application title no longer switch themselves while a save is in progress. (#42488)

🔧 Git, Deployment & Configuration

• docker.env now accepts OTEL_* names, including the documented OpenTelemetry trace exporter endpoints. An externally set OTEL_* value still overrides the file on restart. (#42422)
• Browser telemetry is now sent for builders only. Anonymous visitors and end users of published apps are no longer tracked in the browser. (#42353)