NocoDB Files

Availability

Interfaces

Interfaces let you build custom, easy-to-use apps on top of your base data. Instead of giving everyone access to the full base with all its tables, views, and configuration options, you design focused pages that surface exactly the data and actions each audience needs: a review queue for approvers, a dashboard for leadership, a form for field teams, or a full internal tool that combines all of them. Your base remains the single source of truth; what changes is how each group experiences it. Interfaces (beta) are available on NocoDB Cloud (Plus plan and above) and licensed self-hosted deployments (Business plan and above).

Learn more about Interfaces →

Improvements & Fixes

• Dynamic conditions in Record-Level Security. A policy can now reference whoever is viewing the data, such as the current user, their email, or their teams, so a single policy like "Assignee is the current user" covers the whole workspace. Policies can also filter on system fields such as Created by and Last modified by. Available on NocoDB Cloud (Scale plan and above) and self-hosted Scale and Enterprise plans. Learn more →
• New WEEKNUM formula function. WEEKNUM(date, [startDayOfWeek]) returns the week of the year a date falls in, matching how spreadsheets calculate it. Weeks start on Sunday by default, and an optional second argument picks a different first day of the week. Learn more →
• Select a range of rows with Shift+click. Hold Shift while clicking a row's checkbox in the grid to select every row between it and the last row you clicked, the same way spreadsheets work.
• v3 link updates stay scoped to the requested records. Updating a link field through the v3 records API no longer removes those linked records from other rows.
• Delete select options by title in API v3. The field options delete endpoint now accepts option titles instead of ids and ignores titles that do not exist. Update existing v3 integrations accordingly.
• Behaviour change in API v1: user updates no longer change workspace access. PATCH /api/v1/users/{userId} no longer changes default workspace access. To grant access to a specific base, use POST /api/v3/meta/bases/{baseId}/members with { email, base_role }. To allow base creation and workspace-wide access, use POST /api/v3/meta/workspaces/{workspaceId}/members with { email, workspace_role }.
• Grouped views stay put while editing. Grids grouped by a link, user, JSON, or attachment field no longer blank out and reload on every cell edit.
• No more duplicate rows while scrolling. When a record dropped out of a filtered or sorted grid, an in-flight fetch could render it a second time further down the view.
• Duplicating a record no longer moves linked records. Copying every link verbatim could silently detach has-many and one-to-one linked records from the original. These links are now skipped on the copy, with a notice listing the fields that were not carried over.
• Faster views with QR codes. QR code cells no longer generate full-size codes for every row, which could freeze views with many records.
• Snapshot reliability. Snapshots now work on bases with restricted permissions and in workspaces that have reached their base limit.
• Smart Text fixes. A failed initial load no longer lets autosave clear the cell's content, Backspace works again in the expanded editor, and tables show persistent bars for adding rows and columns.
• Rollup fields validate their target. Creating a rollup over a field that cannot be aggregated, such as a Link, Lookup, or Button field, is rejected with a clear error instead of breaking every read of the table.
• Server-side scripts create records with data. createRecordsAsync in scripts run by workflows and automations no longer creates blank records.
• Image viewer works in forms. Opening an image attachment from a form no longer throws an error.
• List views load on external data sources on NocoDB Cloud.
• Postgres imports keep auto-increment in sync. After importing or migrating a base into Postgres, creating the first record no longer fails with a duplicate-key error.
• SQLite schema changes with indexes. Deleting or modifying an indexed field on a connected SQLite database no longer fails.
• Sandbox feedback. Creating a sandbox now confirms with a message instead of silently switching you over, and creating a document, which a sandbox does not support, is disabled with an explanation rather than failing on click.
• Tidier field visibility controls. The fields panel in table details now uses an eye toggle to show or hide fields in the current view.
• Assorted stability fixes. Right-clicking empty space on a Kanban board no longer shows another card's actions, and several crashes in select cells and the canvas grid were fixed.

Security

• Input handling. Stronger validation of filter expressions, redirect targets, connection configurations, and OAuth parameters across the platform.
• Data access controls. Public share links, exports, and nested data now consistently honour view filters and hidden fields, and record-level security conditions are applied uniformly across data, realtime, and cached paths.
• Authentication and sessions. Hardened session token rotation and OAuth authorization flows, and sign-in via identity providers now honours the provider's email verification status.
• Embedding protection. NocoDB pages now send frame-protection headers, so only public share links can be embedded in other sites.
• Dependency updates. Dependencies were updated against recently published advisories.

Self-Hosting

• Change your license plan yourself. Each license under Account → Self-hosted licenses on nocodb.com gets a detail page with its plan, billing period, editor count, renewal date, and invoices, plus a Change plan flow. Upgrades apply immediately with prorated billing; downgrades take effect at the end of the current billing period and can be reverted until then. Learn more →
• Hide paid features on unlicensed instances. A new Show only community edition features preference under Account → Profile hides paid feature badges, upgrade prompts, and controls that only lead to an upgrade screen, so an instance running without a license shows just what it can actually do. The option appears only on unlicensed self-hosted instances.
• New configuration options. Three NC_AI_* variables tune the AI assistant's token budgets: NC_AI_TURN_TOKEN_BUDGET, NC_AI_INRUN_MICROCOMPACT_MIN_TOKENS, and NC_AI_TOOL_OUTPUT_SPILL_MAX_ENTRIES. Learn more →

Closed issues

• [closed] Missing standalone binary assets in releases (2026.06.2 and 2026.07.0) #14325
• [closed] Latest versions missing from npmjs #14317
• [closed] Can I make a video for nocodb docs? #14315
• [closed] 🐛 Bug: sync database no allowed #14311
• [closed] 🐛 Bug: Search filter not working on Link To Another Record (LTAR) fields #14286
• [closed] 🐛 Bug: xlsx import date field fails #14275
• [closed] 🐛 Bug: import excel column name with dot fails #14200
• [closed] 🐛 Bug: Date field silently fails on unpadded input (typing) and wipes data on paste #14194
• [closed] 🔦 Feature: SUM, AVG and other math functions on the formula field in Charts #13032
• [closed] 🔦 Feature: Allow for localized date format #12545
• [🔦 Type: Feature] 🔦 Feature: Add webhook trigger when adding a comment #4558