megachangelog
Announcement2.2

Release v2.2

Appsmith v2.2 adds support for copying APIs and queries across applications, fixes critical security vulnerabilities across dependencies, and improves Git error handling and page cloning. This release also removes the IN_DOCKER environment variable in favor of a new APPSMITH_DISABLE_SSRF_FILTER for local development.

Features

  • Added support for copying APIs, queries, and JavaScript objects between applications. (#41919) (#41920)
  • Prevented Community Edition from starting when connected to a database previously used by Enterprise Edition. (#41906)

Fixes

  • Blocked Redis datasource connections to the internal Appsmith Redis instance. (GHSA-qhfj-g87x-m39w) (#41921)
  • Fixed Storybook issues by removing an overly broad minimatch resolution, allowing glob v10/v11 to correctly support GLOBSTAR. (#41949)
  • Applied a batch of dependency updates to address 17 security vulnerabilities identified during release image scans. (#41947)
  • Upgraded Spring Boot to 3.5.14 and Netty to 4.1.135 to address multiple CVEs. (#41928)
  • Improved Git error handling by distinguishing a missing default branch from an SSH key misconfiguration. (#41940)
  • Applied dependency updates to address 1 additional security vulnerability. (#41942)
  • Ensured cloned pages generate unique widget IDs, preventing widget conflicts. (#41762)
  • Applied dependency updates to address 15 additional security vulnerabilities. (#41913)
  • Upgraded joi to 18.2.1 to address CVE-2026-48038. (GHSA-q7cg-457f-vx79) (#41891)
  • Added validation to ensure pages belong to the correct application during partial exports. (GHSA-9xfc-9f97-x524) (#41832)
  • Improved test stability by wrapping the PropertyPaneTitle F2 assertion in waitFor. (#41888)
  • Fixed an issue where SSO login redirects landed on /applications instead of the originally requested application. (#41820)
  • Replaced innerHTML and dangerouslySetInnerHTML with safer alternatives to improve security. (#41836)

Breaking changes

  • The hardcoded IN_DOCKER environment variable in the published image has been removed. It has been replaced with a new environment variable APPSMITH_DISABLE_SSRF_FILTER which can be used in local development to reach local HTTP and Redis datasources. (#41921)
securityapigitssrfbreaking

Source: original entry ↗

More from Appsmith

Follow Appsmith to get its new changes in your feed and email digest.

Announcement2.5.0

Release v2.5.0

Appsmith v2.5.0 includes security patches for bundled dependencies, stricter datasource credential handling and permission checks, schema updates for Git-connected applications with potential breaking changes to Elasticsearch bindings, and new features like application descriptions, list widget selection controls, and enhanced table column formatting. Appsmith AI reached end-of-life on September 30, 2026 and can no longer be used.

securitybreakingdatasourceschemagit
Announcement2.4.3

Release v2.4.3

Appsmith v2.4.3 includes end-of-life notice for Appsmith AI (September 30, 2026), security updates for bundled dependencies, improved error message handling in action executions, and UI enhancements like font controls in Rich Text Editor and restored search/filtering in Table widgets.

securityreliabilityui-widgetsdeprecationconfiguration
Announcement2.4.2

Release v2.4.2

Appsmith v2.4.2 includes security updates for bundled dependencies including Bouncy Castle, fixes for page cloning performance to prevent memory exhaustion, improved UI consistency for Ask AI and OAuth2 fields, and enhancements to Git and deployment tools. Appsmith AI reaches end-of-life on September 30, 2026, and users must migrate to direct provider datasources.

securityperformanceuireliabilitydeployment
See all Appsmith changes →