What ToolJet/ToolJet shipped
Written by FoxPlug from the repository's own releases; not affiliated with Tooljet. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/ToolJet/ToolJet; Tooljet did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- On the LTS line, the server now rejects edits to a released app version from non-UI clients such as API and PAT clients, instead of relying on the App Builder alone to freeze it. Pull request #18840
- The EE container entrypoint no longer overrides a user-set NODE_EXTRA_CA_CERTS, and the same fix was backported to lts-3.16. Pull request #18936
- MySQL queries no longer fail with ECONNRESET after a connection sits idle; idle pooled connections close after 60s and TCP keepalive is enabled. Pull request #18947
- Loading many apps in one query no longer exhausts the database connection pool, because the hydration hook now reuses the loading query's connection. Pull request #18884
- The dashboard now checks git-sync status first and skips the branches and git config calls when git sync is off. Pull request #18900
- The Qdrant marketplace plugin no longer fails every operation with MessagePort is not defined, because marketplace plugins now get the web globals their bundled HTTP client needs at load time. Pull request #18891
- Exporting a module or a ToolJet Database table now requires create access. Pull request #18909
- ToolJet Database SQL-mode and join queries return rows under data.results and data.result again, restoring the shape that apps binding to those keys relied on. Pull request #18886
- A Public Apps flag enabled by hand stays on after a paid Cloud renewal instead of being reset to the plan defaults each billing cycle. Pull request #18935
- The workflow editor's logs panel and sidebar now show how long a run took, what started it, what it was given, and who depends on the workflow. Pull request #18805
Why it matters
This week brings a set of fixes to connection and data handling: MySQL idle resets, app loads exhausting the DB pool, and the restored data.results shape for ToolJet Database queries. Several security and access fixes landed, including blocking edits to released app versions from non-UI clients and requiring create access to export modules and tables. The LTS line also got a fix so a user-set NODE_EXTRA_CA_CERTS is no longer overridden, which matters for private deployments.
Changelog entry
- Block edits to released app versions from non-UI clients on the LTS line. Pull request #18840
- Stop the entrypoint from overriding user-set NODE_EXTRA_CA_CERTS on lts-3.16. Pull request #18936
- Close idle MySQL pooled connections after 60s and enable TCP keepalive to stop ECONNRESET. Pull request #18947
- Reuse the loading query's connection in the app hydration hook so app loads do not exhaust the DB pool. Pull request #18884
- Restore data.results and data.result shape for ToolJet Database SQL and join queries. Pull request #18886
- Require create access to export modules and ToolJet Database tables. Pull request #18909
- Skip branches and git config calls on the dashboard when git sync is off. Pull request #18900
- Give marketplace plugins the web globals needed by the bundled HTTP client, fixing the Qdrant plugin. Pull request #18891
- Keep manually enabled Public Apps after a plan renewal. Pull request #18935
- Workflow logs panel and sidebar show run duration, trigger, inputs and dependents. Pull request #18805
- Release v3.21.94-beta. Release
- Release v3.20.256-lts. Release
This week: released app versions can no longer be edited from non-UI clients, MySQL idle resets are fixed, and loading many apps no longer exhausts the DB pool. ToolJet Database queries return data.results again, and exports now require create access.
This week's changes for ToolJet users: on the LTS line, the server now blocks edits to a released app version from non-UI clients, so the freeze no longer depends on the browser alone. The EE entrypoint no longer overrides a user-set NODE_EXTRA_CA_CERTS, which matters for private deployments. MySQL queries stop failing with ECONNRESET after idle connections, and loading many apps no longer exhausts the database pool. ToolJet Database SQL and join queries return rows under data.results and data.result again, and exporting a module or table now requires create access.
Week of October 19, 2026
What shipped
- Release v3.21.84-beta fixes an infinite loop crash when adding a page and a hidden drag ghost in the Pages panel. Release
- The Pages panel no longer auto-creates many pages and crashes the editor when adding a nav item, and the drag ghost stays visible while reordering pages. Pull request #18598
- Release v3.21.83-beta adds an environment flag that lets admins restrict ToolJet Database edits to admins. Release
- The TOOLJET_DB_DISABLE_BUILDER_EDIT switch blocks non-admin users from editing ToolJet Database across all workspaces while app queries keep working. Pull request #18511
- Release v3.21.82-beta upgrades Node.js to 22.23.4 for the October 2026 security release and fixes file permission issues. Release
- Dashboard v2 pin and bulk calls no longer cap at 50 ids, so selecting more than 50 rows does not return a 400. Pull request #18510
- Dashboard v2 bulk delete, move and folder-delete endpoints now run all-or-nothing and return only blocked ids. Pull request #18505
- Date and time widgets now ignore invalid min and max bounds, report them to the debugger, and fall back to the default format when a format is bad. Pull request #18252
- The sample data source now connects as a restricted role that ToolJet creates instead of an admin user. Pull request #18444
- Deleting a workflow that is still in use now names the apps, modules or workflows that call it. Pull request #18462
Why it matters
This week brought a stability release that fixes a Pages panel crash that could flood an app with pages, plus a new environment flag for restricting ToolJet Database edits to admins. Several releases also moved the project to Node.js 22.23.4 for the October 2026 security release and fixed file permission handling in setup scripts. Dashboard v2 bulk actions and the date and time widgets also got fixes that change how errors and large selections behave.
Changelog entry
- Fixed an infinite loop crash when adding a page and the hidden drag ghost in the Pages panel (v3.21.84-beta). Release
- Adding a nav item in the Pages panel no longer auto-creates many pages or crashes the editor. Pull request #18598
- Added an environment flag to restrict ToolJet Database edits to admins (v3.21.83-beta). Release
- TOOLJET_DB_DISABLE_BUILDER_EDIT blocks non-admin ToolJet Database edits across all workspaces; app queries still work. Pull request #18511
- Upgraded Node.js to 22.23.4 for the October 2026 security release and fixed file permission issues (v3.21.82-beta). Release
- Removed the 50-id cap on dashboard v2 pin and bulk calls. Pull request #18510
- Dashboard v2 bulk endpoints now run all-or-nothing and return only blocked ids. Pull request #18505
- Date and time widgets ignore invalid min and max bounds, report them to the debugger, and fall back to the default format. Pull request #18252
- Sample data source connects as a restricted role instead of an admin user. Pull request #18444
- Workflow delete errors now name the apps, modules or workflows that use the workflow. Pull request #18462
- Release v3.20.249-lts includes a file permission fix and Node.js 22.23.4 on LTS. Release
- Setup scripts keep the.env file readable only by its owner. Pull request #18440
New beta releases this week: a fix for the Pages panel crash when adding a page, Node.js 22.23.4 for the October 2026 security release, and a flag to restrict ToolJet Database edits to admins.
This week's releases include v3.21.84-beta, which fixes a Pages panel bug where adding a page could auto-create many pages and crash the editor, and a drag ghost that vanished while reordering. v3.21.83-beta adds TOOLJET_DB_DISABLE_BUILDER_EDIT, an environment flag that lets admins block non-admin edits to ToolJet Database across all workspaces while app queries keep working. v3.21.82-beta moves the project to Node.js 22.23.4 for the October 2026 security release and fixes file permission issues. Dashboard v2 bulk calls also no longer cap at 50 ids.
Week of October 12, 2026
What shipped
- Adds validation rules for components, layouts, events, queries, pages and version settings, wired into the save services and the import and git path. Pull request #18337
- Adds POST /api/v2/folders/bulk-delete for deleting selected folders from the dashboard bulk bar, with dry run, all or nothing and skip blocked options. Pull request #18432
- Switches the six dashboard v2 end to end specs to run on the community edition and moves the edition specific cases into the enterprise tree. Pull request #18407
- Adds POST /api/v2/folder-apps/bulk-move to move selected apps into one folder, using a new canMoveApp check that matches the single move rule. Pull request #18406
- SCIM filter queries that match nothing now return 200 with an empty ListResponse instead of 404, as RFC 7644 requires. Pull request #18378
- Fixes ToolJet Database gaps: staging and production data can still be exported after a licence lapse, tables in use can't be dropped, and the table view handles environment switches. Pull request #18430
- Fixes new rows in the Add new rows popup not being editable when all columns are of type String. Pull request #18449
- Pins app builder sidebar panel headers and tab bars so only the panel content scrolls. Pull request #17143
- Fixes Progress Bar and Circular Progress Bar widgets reappearing after a reload once deleted. Pull request #18370
- Backports v2 workspace user list, get and update metadata endpoints, so external API callers can read and replace a user's metadata. Pull request #18405
Why it matters
This week the dashboard gains bulk move and bulk delete endpoints, and app saving gets validation rules across components, pages, events and queries. ToolJet Database access after a licence lapse, SCIM filter responses and several widget fixes are corrected, along with test suite and spec updates. Users also get v2 workspace user metadata APIs on the long term support line.
Changelog entry
- Add validation rules and save call sites for components, layouts, events, queries, pages and version settings. Pull request #18337
- Add POST /api/v2/folders/bulk-delete with dry run, all or nothing and skip blocked flags. Pull request #18432
- Add POST /api/v2/folder-apps/bulk-move for moving selected apps into a folder. Pull request #18406
- Drop unused apps to root fields from dashboard v2 folder bulk delete, returning the shared bulk result. Pull request #18435
- Run dashboard v2 specs on the community edition and move enterprise only cases to the enterprise tree. Pull request #18407
- Return an empty SCIM ListResponse when a filter matches nothing instead of 404. Pull request #18378
- Fix ToolJet Database licence lapse access, table drop blocking and table view environment switches. Pull request #18430
- Fix editing new rows in the Add new rows popup when all columns are String. Pull request #18449
- Keep app builder sidebar panel headers and tab bars pinned while scrolling. Pull request #17143
- Fix Progress Bar and Circular Progress Bar widgets returning after delete and reload. Pull request #18370
- Backport v2 workspace user list, get and update metadata endpoints on lts-3.16. Pull request #18405
- Align the Cypress Workflows lane with main behaviour. Pull request #18451
This week: v2 bulk move and bulk delete endpoints for the dashboard, validation rules across components, pages, events and queries, v2 workspace user metadata APIs on LTS, and fixes for ToolJet Database access, SCIM empty results, String-only new rows, sidebar headers and progres
This week in ToolJet: dashboard v2 gets bulk move and folder and app bulk delete endpoints, with dry run, all or nothing and skip blocked options. App saving gains validation rules for components, layouts, events, queries, pages and version settings. The long term support line gets v2 workspace user metadata APIs. Fixes cover ToolJet Database access after a licence lapse and dropping tables in use, SCIM filters that match nothing now returning an empty result, new rows not editable when all columns are String, app builder sidebar headers staying pinned, and deleted Progress Bar widgets coming back after reload. Dashboard v2 specs now run on the community edition, with edition specific cases in the enterprise tree.
Week of October 5, 2026
What shipped
- Release v3.20.243-lts fixes Salesforce multi-user OAuth authentication by adding PKCE support. Release
- RunJS modal open(callback) now runs after children have mounted, so child component actions like setText work when called after open(). Pull request #18083
- The ENABLE_SIGNUP instance toggle is now enforced on the signup endpoint, blocking POST /api/onboarding/signup when sign-up is disabled on self-hosted EE instances. Pull request #18340
- Ghost components no longer vanish or get placed incorrectly when dropping a component on the canvas, including near overlays like the right sidebar and sub-canvases. Pull request #18321
- Module delete now scopes the in-use check to the current branch and shows the current app name instead of scanning every branch and the legacy apps.name column. Pull request #18330
- The website Deploy to ToolJet button now creates an app by passing the template id via URL instead of a cookie that the browser rejected. Pull request #18302
- App import/export now migrates navigation properties to styles for orientation, displayStyle, navItemSize, horizontalAlignment and verticalAlignment. Pull request #18177
- Three critical Dependabot alerts in server are cleared by upgrading simple-git to v4, pulling in the patched argv-parser, and pinning proxy-addr to its fixed release. Pull request #18295
- Retired documentation links now redirect to their current equivalents with robots rules allowing crawlers to follow, and LTS docs clarify Cloud multi-environment Enterprise scope and shared versus per-user ServiceNow OAuth identity. Pull request #18313
- Widget contract validation is back on as a label-gated CI job in main after being commented out to unblock the lts-3.16 to main merge. Pull request #18300
Why it matters
This week brings a patch release that keeps Salesforce multi-user sign-in working and closes a security gap where disabling sign-up did not block the signup endpoint. It also fixes everyday builder problems like modal children not being ready after open(), misplaced components dropped on the canvas, and module deletion that wrongly reported a module as in use. Dependency and CI work keeps releases unblocked so fixes can move forward.
Changelog entry
- Fixed Salesforce multi-user OAuth authentication by adding PKCE support. Release
- Run modal open(callback) after children have mounted so child component actions are available. Pull request #18083
- Enforced the ENABLE_SIGNUP instance toggle on the signup endpoint as a security fix. Pull request #18340
- Fixed ghost components vanishing or being placed incorrectly when dropping a component on the canvas. Pull request #18321
- Scoped the module delete in-use check to the current branch and show the current app name. Pull request #18330
- Fixed Deploy to ToolJet website templates by passing the template id via URL. Pull request #18302
- Added navigation properties to styles migration to app import/export. Pull request #18177
- Patched simple-git, argv-parser and proxy-addr vulnerabilities in server dependencies. Pull request #18295
- Restored documentation discovery with redirects and clarified deployment and AI availability docs. Pull request #18313
- Re-enabled widget contract validation as a label-gated CI job. Pull request #18300
- Skipped docs/ in dependency and release vulnerability gates. Pull request #18345
- Let the vulnerability gate see fixes already present in the PR branch. Pull request #18307
Released v3.20.243-lts with Salesforce multi-user OAuth fixed via PKCE. RunJS modal open(callback) now waits for children to mount, dropped components stay where you put them, and disabling sign-up is enforced on the signup endpoint. Module delete now checks only the current bran
This week we shipped v3.20.243-lts, which fixes Salesforce multi-user OAuth authentication by adding PKCE support. RunJS modal open(callback) now runs after children have mounted, so calls like setText on a child work after opening a modal. Dropping a component on the canvas no longer makes ghost components vanish or land in the wrong place, including near the right sidebar and sub-canvases. The ENABLE_SIGNUP instance toggle is now enforced on the signup endpoint on self-hosted EE instances. Module deletion now checks only the current branch and shows the current app name. We also cleared critical server dependency alerts and turned widget contract validation back on as a label-gated CI job.
Week of September 28, 2026
What shipped
- Bulk upload users from CSV on the workspace Users page for Enterprise editions, matching rows by email to add or update multiple users at once. Pull request #18118
- Two paginated External API v2 endpoints that show which apps a user can access and which users can access an app, along with their permissions. Pull request #18174
- Fixed bindings and nested lists not refreshing when ListView rows are removed, so deleted rows no longer appear in bound components. Pull request #18208
- Skipped redundant re-importing of git-synced app modules already pinned locally, cutting roughly 1 second per pinned module from app load time. Pull request #18200
- Upgraded Plotly to 4.1.1 to remove vulnerable MapLibre copy and clear frontend dependency alerts, with a compatibility layer for existing charts. Pull request #18206
- Fixed date widget bugs including broken icon position via fx, top-aligned labels overflowing, disabled dates blocking whole years, and builder freezes from event loops. Pull request #18116
- Fixed page duplication that lost components after Git sync, saving a version, or committing by resetting clone identity. Pull request #18046
- Fixed app theme preservation when importing into another workspace. Pull request #18180
- AI messages can now carry up to five 10 MiB file attachments with metadata stored in ToolJet and originals stored privately by the agent. Pull request #18111
- Added cut-release skill that automates creating release branches and moving feature PRs across the root repository and submodules. Pull request #18197
Why it matters
This week shipped bulk user management for Enterprise, new API endpoints for app access control, critical ListView and date widget fixes, and improvements to Git sync reliability and module loading performance. Release automation tooling was also added to streamline the release process.
Changelog entry
- Added bulk upload users feature on workspace Users page (EE) to add or update multiple users from CSV files Pull request #18118
- Added External API v2 endpoints for querying which apps a user can access and which users can access an app Pull request #18174
- Fixed bindings and nested lists not refreshing when ListView rows are pruned from store Pull request #18208
- Skipped redundant re-importing of module tag versions already present locally Pull request #18200
- Upgraded Plotly to 4.1.1 and removed vulnerable MapLibre copy with compatibility layer Pull request #18206
- Fixed date widget bugs: icon position via fx, label overflow, disabled dates blocking years, event loops causing freezes Pull request #18116
- Fixed page duplication losing components after Git sync by resetting clone identity Pull request #18046
- Fixed app theme preservation when importing into another workspace Pull request #18180
- Added AI attachment storage with up to five 10 MiB files per message, metadata in ToolJet Pull request #18111
- Updated shell-quote to 1.10.0 and websocket-driver to 0.7.5 to remediate critical dependency alerts Pull request #18176
- Added cut-release automation skill for creating release branches and moving feature PRs Pull request #18197
- Fixed git-sync hydration test for workflows with connected global data sources Pull request #18187
V3.20.236-lts and v3.21.74-beta ship bulk user uploads, ListView refresh fixes, Plotly upgrades, date widget repairs, and new API endpoints for workspace access control.
This week ToolJet shipped Enterprise bulk user uploads from CSV, new paginated API endpoints for app access queries, fixed ListView bindings that were showing deleted rows, improved Git sync for pinned modules, and resolved date widget bugs. The team also added automation for release branch management.
Week of September 21, 2026
What shipped
- V3.20.233-lts released with text input fixes in list views, TJDB row limits, and app/table limit increases across Free/Basic/Pro tiers. Release
- Workflows now support git sync like apps and modules, enabling creation, editing, versioning, and webhook triggers across feature branches. Pull request #17927
- AI chat attachments now store in PostgreSQL without requiring S3, supporting up to five files per message at 10 MiB each. Pull request #18073
- OpenRouter marketplace plugin added as a datasource, providing access to hundreds of models across providers through one credential. Pull request #18005
- TypeSafe Jev decision model added as a marketplace datasource for typed questions about records or text with probability answers. Pull request #18006
- Datasource and Marketplace catalogues now searchable together with?search= parameter support. Pull request #17988
- Custom component library core feature added for building and managing reusable custom components. Pull request #17345
- Builder chat attachments can now be uploaded and retained across saved conversations with server-side storage and management. Pull request #18009
- Autolayout mobile beta launched for responsive mobile design support. Pull request #17665
- Home composer now includes example prompts popover matching in-editor chat functionality. Pull request #18033
Why it matters
Workflows joined apps and modules with full git sync support, closing the last pinned resource type. Self-hosted deployments no longer need S3 for AI attachments. Two new marketplace datasources expanded integration options while search improvements help builders find what they need faster.
Changelog entry
- Text input inside list view no longer shows previous query data Release
- TJDB row limits added; app and table limits increased for Free/Basic/Pro tiers Release
- Workflows support git sync branching, versioning, and webhook triggers Pull request #17927
- AI attachments stored in PostgreSQL without S3 requirement Pull request #18073
- Builder chat attachments persist across saved conversations Pull request #18009
- OpenRouter marketplace plugin for hundreds of models across providers Pull request #18005
- TypeSafe Jev decision model datasource for typed text/record analysis Pull request #18006
- Unified search across datasource catalogue and Marketplace Pull request #17988
- Custom component library core for reusable components Pull request #17345
- Autolayout mobile beta for responsive design Pull request #17665
- Home composer example prompts popover Pull request #18033
- Event handler lists made scrollable in Page/Nav-item popups Pull request #18037
- Fixed intermittent 403 errors in granular folder permissions evaluation Pull request #18097
V3.20.233-lts ships with workflows supporting git sync, PostgreSQL-backed AI attachments, and increased app/table limits. Search the datasource catalogue and Marketplace together. Jev and OpenRouter now available.
Three releases this week: v3.20.232-lts, v3.20.233-lts, and v3.21.73 beta in progress. Workflows now use git sync like apps and modules. AI attachments moved from S3 to PostgreSQL for self-hosted users. New marketplace datasources for OpenRouter and TypeSafe Jev decision model. Datasource and Marketplace search now unified. Custom component library core landed. Autolayout mobile beta available.
Week of September 14, 2026
What shipped
- Released v3.20.230-lts with app title color styling, app access request support, and workspace PAT access to workflows. Release
- Navigation widget fixes resolved group flyout freezing, text overflow, popup menu behavior, and dynamic label issues. Pull request #17590
- Modal v2 widget fixes addressed invisible close icons, tooltip issues, module widget dragging, and default value persistence. Pull request #17628
- File widget fixes unified behavior across File Button, File Picker, and File Input with missing field indicators and accessibility improvements. Pull request #17653
- Popover Menu widget now closes on hover-away and supports menu width configuration. Pull request #17624
- Fixed database connection pool starvation by batching component queries when assembling app definitions. Pull request #17953
- Added data source folders feature for organizing datasources. Pull request #17968
- Workspace personal access tokens can now create, execute, and read workflows. Pull request #17979
- Added widget testing contracts and specs for DropdownV2, MultiselectV2, Cascader, Checkbox, Timeline, Spinner, Html, and TreeSelect. Pull request #17964
- Server test coverage is now enforced as a CI gate requiring 80% coverage on changed lines. Pull request #17974
Why it matters
This week brings stability improvements to core widgets and UI components, fixes infrastructure issues with database connections, and adds new organizational and API capabilities. The expanded test coverage contracts ensure widgets meet consistent engineering standards.
Changelog entry
- Add app title color style option to page menu styles Release
- Add support for requesting access to apps Release
- Enable workspace PAT access to workflows Release
- Navigation widget: fix group flyout freezing, text overflow, popup menu behavior, and dynamic labels in expandable rows Pull request #17590
- Modal v2: fix fullscreen close icon visibility, tooltip behavior, module widget dragging, and default value persistence Pull request #17628
- File widget: add missing field asterisks and accessibility improvements across File Button, Picker, and Input Pull request #17653
- Popover Menu: close on hover-away and add menu width support Pull request #17624
- Fix database connection pool starvation by batching component queries during app definition assembly Pull request #17953
- Add data source folders feature Pull request #17968
- Enable workspace PAT sessions to create, execute, and read workflows Pull request #17979
- Fix multiline {{}} bindings to resolve correctly instead of returning undefined Pull request #17972
- Enforce 80% test coverage gate on server code changes in CI Pull request #17974
- Add widget testing contracts for DropdownV2, MultiselectV2, Cascader, Checkbox, Timeline, Spinner, Html, and TreeSelect Pull request #17964
V3.20.230-lts ships with app access requests, workspace PAT workflow access, navigation/modal/file widget fixes, and data source folders. Plus 8 widgets now have testing contracts.
V3.20.230-lts is live. Navigation, Modal, File, and Popover widgets got comprehensive fixes. Database connection pooling is optimized for larger apps. Developers can now request access to apps, manage workflows via workspace PATs, and organize datasources in folders. Eight widgets have new testing contracts ensuring quality standards.