Appsmith Files

🔐 Security

• Databricks JDBC connections — Validated Databricks datasource URLs and connected through the Databricks driver directly, so non-Databricks JDBC URLs are rejected. (#42244)
• Updated netty-handler from 4.1.136 to 4.1.137 to address CVE-2026-75595. (#42217)
• Validated WHERE-clause column names in UQI filtering so untrusted identifiers cannot be used as SQL column names. (#42224)
• Used the hardened WebClient builder in AI and Google Sheets plugins. (#42177)
• Updated client and server dependencies to address reported vulnerabilities. (#42214, #42173, #42218)

🛠️ Reliability

• Prevented OpenAI, Anthropic, and Google AI plugins from loading a conflicting spring-webflux copy. That failure could take down AI queries and corrupt the shared Redis connection. (#42240)
• Reduced redundant Segment API calls. (#42216)

✨ New Features & Enhancements

• Added non-interactive appsmithctl restore for automation. (#42147)

🎨 UI & Widget Improvements

• Stopped filing Anvil applications under “AI Agents” and renamed them “responsive”. (#42219)

🔧 Git, Deployment & Configuration

• MCP server now prefers APPSMITH_DB_URL over APPSMITH_MONGODB_URI when both are set. (#42239)
• Made base-image apt installs resilient to transient mirror failures. (#42221)