megachangelog
Announcement2.4.1

Release v2.4.1

Appsmith v2.4.1 includes security hardening for Databricks JDBC connections, netty dependency updates to address CVE-2026-75595, SQL injection prevention in UQI filtering, and reliability improvements to prevent AI plugin failures and Redis corruption. New features include non-interactive appsmithctl restore and UI improvements for responsive applications.

🔐 Security

  • Databricks JDBC connections — Validated Databricks datasource URLs and connected through the Databricks driver directly, so non-Databricks JDBC URLs are rejected. (#42244)
  • Updated netty-handler from 4.1.136 to 4.1.137 to address CVE-2026-75595. (#42217)
  • Validated WHERE-clause column names in UQI filtering so untrusted identifiers cannot be used as SQL column names. (#42224)
  • Used the hardened WebClient builder in AI and Google Sheets plugins. (#42177)
  • Updated client and server dependencies to address reported vulnerabilities. (#42214, #42173, #42218)

🛠️ Reliability

  • Prevented OpenAI, Anthropic, and Google AI plugins from loading a conflicting spring-webflux copy. That failure could take down AI queries and corrupt the shared Redis connection. (#42240)
  • Reduced redundant Segment API calls. (#42216)

✨ New Features & Enhancements

  • Added non-interactive appsmithctl restore for automation. (#42147)

🎨 UI & Widget Improvements

  • Stopped filing Anvil applications under “AI Agents” and renamed them “responsive”. (#42219)

🔧 Git, Deployment & Configuration

  • MCP server now prefers APPSMITH_DB_URL over APPSMITH_MONGODB_URI when both are set. (#42239)
  • Made base-image apt installs resilient to transient mirror failures. (#42221)
securityreliabilityapiai-pluginsdeployment

Source: original entry ↗