18/03/2026 - Promotion by btsgh · Pull Request #41631 · appsmithorg/appsmith

btsgh · 2026-03-18T08:10:17Z

Description

Tip

Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team).

Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR.

Fixes #Issue Number
or
Fixes Issue URL

Warning

If no issue exists, please create an issue first, and check with the maintainers if the issue is valid.

Automation

/ok-to-test tags=""

🔍 Cypress test results

Caution

If you modify the content in this section, you are likely to disrupt the CI result for your PR.

Communication

Should the DevRel and Marketing teams inform users about this change?

Yes
No

…ource UI (#41587)

…41573) ## Description > [!TIP] > _Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team)._ > > _Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR._ - Changed the return type of `updateActionCollectionBody` in `ActionCollectionControllerCE` to return `Mono<ResponseDTO<ActionCollectionDTO>>` instead of `Mono<ResponseDTO<Integer>>`. - Updated `updateUnpublishedActionCollectionBody` method signature in `LayoutCollectionServiceCE` and its implementation to return `Mono<ActionCollectionDTO>`. - Refactored the handling of the action collection body update to ensure the correct data is returned and processed. This refactor improves type safety and ensures that the updated action collection data is correctly handled across the application. Fixes #`Issue Number` _or_ Fixes `Issue URL` > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /ok-to-test tags="@tag.All" ### 🔍 Cypress test results  > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/22323250400> > Commit: f94f109 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=22323250400&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Mon, 23 Feb 2026 21:32:46 UTC  ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No  ## Summary by CodeRabbit * **Bug Fixes** * More reliable action collection body updates with consistent merging of server responses and preserved local flags. * Fixed state handling to avoid unintended local mutations during save. * **Improvements** * API now returns full action collection details after updates, improving data accuracy and visibility. * Update flow now returns the populated, permission-aware collection so the client receives the updated view.

… seconds from 20 (#41591) ## Description > [!TIP] > _Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team)._ > > _Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR._ Fixes #`Issue Number` _or_ Fixes `Issue URL` > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /ok-to-test tags="@tag.Sanity" ### 🔍 Cypress test results  > [!IMPORTANT] > 🟣 🟣 🟣 Your tests are running. > Tests running at: <https://github.com/appsmithorg/appsmith/actions/runs/22662866220> > Commit: 1f6aead > Workflow: `PR Automation test suite` > Tags: `@tag.Sanity` > Spec: `` > <hr>Wed, 04 Mar 2026 09:18:28 UTC  ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No  ## Summary by CodeRabbit * **Bug Fixes** * Enhanced application stability by implementing timeout protection for consolidated page load operations. View and edit page load API requests now enforce a 60-second timeout limit, preventing indefinite request hangs and ensuring improved responsiveness when retrieving page data. This helps maintain a consistently smooth user experience during data loading operations.

(#41595) ## Description Fixes a **critical** security vulnerability (CVE-2026-25896, CVSS 9.3) in `fast-xml-parser` — an entity encoding bypass via regex injection in DOCTYPE entity names that allows XSS and injection attacks when parsed XML output is rendered. This also resolves a **high-severity** DoS vulnerability (Dependabot alert #510) — DoS through entity expansion in DOCTYPE with no expansion limit. **Vulnerable range**: `>= 4.1.3, < 4.5.4` **Fix version**: `4.5.4` ### Changes - **`package.json`**: Added `"fast-xml-parser": "4.5.4"` to Yarn `resolutions` to override the transitive dependency (via `@smithy/core` → `@aws-sdk/client-s3`) - **`recommendedLibraries.ts`**: Updated CDN URL from cdnjs `4.3.2` to jsdelivr `4.5.4` (cdnjs does not yet host 4.5.4) - **`Library_spec.ts`**: Updated Cypress E2E test CDN URLs from `4.2.7` to `4.5.4` - **`yarn.lock`**: Regenerated with `fast-xml-parser@4.5.4` resolution ### Note on v3.17.5 (legacy xmlParser) The legacy `xmlParser` v3.17.5 referenced in `ApplicationConstants.java` and test fixtures is **not affected** by this CVE (vulnerable range starts at 4.1.3). It is already documented as deprecated for backward compatibility. Fixes Dependabot alert #511 (critical) Fixes Dependabot alert #510 (high) Fixes https://linear.app/appsmith/issue/APP-14993/fix-upgrade-fast-xml-parser-to-454-to-resolve-critical-cve-2026-25896 ## Automation /ok-to-test tags="@tag.All" ### 🔍 Cypress test results  > [!IMPORTANT] > 🟣 🟣 🟣 Your tests are running. > Tests running at: <https://github.com/appsmithorg/appsmith/actions/runs/22780449068> > Commit: 707048a > Workflow: `PR Automation test suite` > Tags: `@tag.All` > Spec: `` > <hr>Fri, 06 Mar 2026 20:20:26 UTC  ## Communication Should the DevRel and Marketing teams inform users about this change? - [x] Yes - [ ] No  ## Summary by CodeRabbit * **Chores** * Updated fast-xml-parser library to version 4.5.4 across the application.

## Description > [!TIP] > _Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team)._ > > _Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR._ Fixes #`Issue Number` _or_ Fixes `Issue URL` > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /ok-to-test tags="" ### 🔍 Cypress test results  > [!CAUTION] > If you modify the content in this section, you are likely to disrupt the CI result for your PR.  ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No  ## Summary by CodeRabbit * **Chores** * Enhanced deployment reliability by implementing graceful service shutdown before cleanup operations in the recreation flow. * Updated ingress controller configuration and removed SSL certificate annotation from load balancer settings.

## Description This PR adds workflow dispatch to some of the existing flows ### Motivation We are upgrading the server codebase to Java 25 and Spring Boot 3.x in a separate branch (`build/java-update`). The CI workflows triggered via `repository_dispatch` (e.g. `/ok-to-test`, `/ci-test-limit`, `/build-deploy-preview`) always load workflow YAML from the **default branch**, not the PR branch. This means the upgrade PR's slash-command-triggered builds will fail — they'll attempt to compile Java 25 code with JDK 17. By adding these changes, the workflows could be triggered directly from the actions tab to verify the fixes. Fixes #`Issue Number` ## Automation /ok-to-test tags="" ### 🔍 Cypress test results  > [!WARNING] > Tests have not run on the HEAD 3d5c5e2 yet > <hr>Tue, 10 Mar 2026 09:52:11 UTC  ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No  ## Summary by CodeRabbit * **Chores** * Added manual on‑demand workflow triggers and inputs to support explicit PR selection and a PostgreSQL build flag. * Introduced a param resolution step so on‑demand jobs consistently use the chosen PR number. * Updated server build checks to accept Java 17 or Java 25 (error if neither detected).

…patches (#41610) ## Description > [!TIP] > _Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team)._ > > _Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR._ Fixes #`Issue Number` _or_ Fixes `Issue URL` > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /ok-to-test tags="" ### 🔍 Cypress test results  > [!CAUTION] > If you modify the content in this section, you are likely to disrupt the CI result for your PR.  ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No  ## Summary by CodeRabbit * **Chores** * Improved deployment preview workflow configuration for enhanced reliability.

## Description > [!TIP] > _Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team)._ > > _Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR._ Fixes https://linear.app/appsmith/issue/APP-14995/fix-flaky-tree-select2-spects-cypress-test ## Automation /ok-to-test tags="@tag.All" ### 🔍 Cypress test results  > [!IMPORTANT] > 🟣 🟣 🟣 Your tests are running. > Tests running at: <https://github.com/appsmithorg/appsmith/actions/runs/22919877135> > Commit: 70b4e4a > Workflow: `PR Automation test suite` > Tags: `@tag.All` > Spec: `` > <hr>Tue, 10 Mar 2026 19:12:42 UTC  ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No  ## Summary by CodeRabbit * **Tests** * Improved TreeSelect widget test reliability by targeting the visible tree-select element, standardizing selection paths, adding explicit waits for widget appearance/disappearance (replacing fixed sleeps), and adding assertions to confirm the tree title is visible after deployment.

## Description XATA lite has been discontinued, causing the **"Get latest flaky tests"** step in the `ci-test-result` job of the PR Cypress workflow to fail unconditionally on every PR run, blocking all PR merges. This is a minimal, temporary fix: the `curl` call to the XATA endpoint is replaced with `touch ~/knownfailures`, which creates an empty file so all downstream steps (flaky test comparison, PR status comments) continue to work correctly — they will just treat the known-failures list as empty for now. The check will be re-enabled once @yatin-chaubal migrates the flaky list to Cypress DB and shares the credentials. Fixes https://linear.app/appsmith/issue/APP-15007/task-disable-ci-test-result-step-as-xata-lite-is-discontinued ## Automation /ok-to-test tags="@tag.Sanity" ### 🔍 Cypress test results  > [!IMPORTANT] > 🟣 🟣 🟣 Your tests are running. > Tests running at: <https://github.com/appsmithorg/appsmith/actions/runs/22955958490> > Commit: aeb6088 > Workflow: `PR Automation test suite` > Tags: `@tag.Sanity` > Spec: `` > <hr>Wed, 11 Mar 2026 13:51:54 UTC  ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No  ## Summary by CodeRabbit * **Chores** * Updated CI/CD test workflow configuration to modify how known test failures are processed during pipeline execution.

## Description > [!TIP] > _Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team)._ > > _Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR._ Fixes #`Issue Number` _or_ Fixes `Issue URL` > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /ok-to-test tags="" ### 🔍 Cypress test results  > [!CAUTION] > If you modify the content in this section, you are likely to disrupt the CI result for your PR.  ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No  ## Summary by CodeRabbit * **Chores** * Streamlined CI/CD Java environment setup by implementing automatic version detection from project configuration files across all build workflows. * Enhanced deployment configuration to support dynamic Docker image repository and tag selection through environment variables, with fallback values for backward compatibility.

…41613) ## Summary - Bump `simple-git` from `^3.27.0` to `^3.32.3` (resolves to `3.33.0`) in `app/client/packages/rts/package.json` - Resolves [Dependabot alert #523](https://github.com/appsmithorg/appsmith/security/dependabot/523) — **CVE-2026-28292** (CVSS 9.8, critical RCE) ## Details The `blockUnsafeOperationsPlugin` in `simple-git` uses a case-sensitive regex to block `-c protocol.allow=always` arguments. Git treats config keys case-insensitively, so uppercase variants like `PROTOCOL.ALLOW=always` bypass the check entirely, enabling arbitrary command execution via the `ext::` protocol. Version `3.32.3` adds the `/i` flag to the regex, closing the bypass. No breaking API changes exist between 3.27.0 and 3.33.0 — the APIs used by Appsmith (`simpleGit()`, `ResetMode`, `git.reset()`, `git.clean()`) are unchanged. Fixes https://linear.app/appsmith/issue/APP-15006/critical-vulnerability-simple-git-has-blockunsafeoperationsplugin ## Automation /ok-to-test tags="@tag.All" ### 🔍 Cypress test results  > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/22991205090> > Commit: ed84899 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=22991205090&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Thu, 12 Mar 2026 08:56:46 UTC  ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No  --- > [!NOTE] > **Low Risk** > Low-risk dependency bump intended to patch a security issue; main risk is subtle behavior changes in `simple-git` affecting `gitService` reset/clean operations. > > **Overview** > Upgrades the `appsmith-rts` dependency on `simple-git` from `^3.27.0` to `^3.32.3` (resolving to `3.33.0`) to address the critical RCE vulnerability **CVE-2026-28292**. > > Updates `yarn.lock` accordingly, including `simple-git`’s transitive dependency bump to `debug@^4.4.0`; no application code changes beyond the dependency version update. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit ed84899. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>   ## Summary by CodeRabbit * **Chores** * Updated internal dependencies to incorporate latest improvements and stability enhancements.

## Description > [!TIP] > _Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team)._ > > _Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR._ Upgrades the embedded Redis package to 7.4 and moves off the Ubuntu-managed packages. Latest is 8.x, but we have some out-of-date client libraries still, so sticking with 7.x for now which is still supported. Fixes #`Issue Number` _or_ Fixes `Issue URL` > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /ok-to-test tags="" ### 🔍 Cypress test results  > [!CAUTION] > If you modify the content in this section, you are likely to disrupt the CI result for your PR.  ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No  ## Summary by CodeRabbit * **Chores** * Updated Docker deployment environment to utilize Redis 7.4 with enhanced package management and repository configuration for improved build consistency. * Maintained PostgreSQL 14 and MongoDB 6.0 database versions to ensure compatibility across the deployment stack.

## Description ### 1. `ad-hoc-docker-image.yml` — Configurable base image tag Added a new optional `base-image-tag` workflow dispatch input (default: `nightly`) so the base image tag used in the Docker build is no longer hardcoded. The `BASE` build-arg now references `inputs.base-image-tag` instead of the previously hardcoded `:nightly` tag. Backward-compatible since the default preserves existing behavior. ### 2. `on-demand-build-docker-image-deploy-preview.yml` — Configurable base image tag for deploy previews Added a new optional `base_image_tag` workflow dispatch input and support for a `--base-image-tag` slash command arg. The `set_base_tag` step now checks for this explicit override first; if not provided, it falls back to the existing branch-based logic (`pg` for the pg branch, `release` otherwise). The chosen tag is also logged in the PR notification comment for visibility. Fixes #`Issue Number` _or_ Fixes `Issue URL` > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /ok-to-test tags="" ### 🔍 Cypress test results  > [!CAUTION] > If you modify the content in this section, you are likely to disrupt the CI result for your PR.  ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No  ## Summary by CodeRabbit * **Chores** * Updated Docker build workflows to accept base image tag inputs for ad-hoc and on-demand deployment builds. * Workflow configurations now support flexible base image selection during deployment operations.

## Description **TL;DR:** Authenticated viewers can bypass the editor/publish boundary by sending `viewMode=false` in the action execute request, causing the server to run unpublished draft actions. This fix requires `MANAGE_ACTIONS` (edit) permission for draft execution instead of `EXECUTE_ACTIONS`. ### Root Cause The action execution path (`getValidActionForExecution`, `populateAndExecuteAction`) only checks `EXECUTE_ACTIONS` permission regardless of `viewMode`. Since viewers inherit `EXECUTE_ACTIONS` via `READ_APPLICATIONS → READ_PAGES → EXECUTE_ACTIONS`, any authenticated viewer can set `viewMode=false` and execute unpublished draft actions. Only anonymous users were blocked. ### Fix Introduced `getActionExecutionPermission()` helper that returns: - `MANAGE_ACTIONS` (edit permission) when `viewMode=false` (draft execution) - `EXECUTE_ACTIONS` (execute permission) when `viewMode=true` (published execution) Editors retain `MANAGE_ACTIONS` via the `MANAGE_PAGES → MANAGE_ACTIONS` hierarchy and continue working normally. Viewers only have `EXECUTE_ACTIONS` and are now blocked from draft execution. ### Regression Tests - `testViewerCannotExecuteUnpublishedAction` — viewer with `viewMode=false` is rejected - `testViewerCanExecutePublishedAction` — viewer with `viewMode=true` succeeds - `testEditorCanExecuteUnpublishedAction` — editor with `viewMode=false` succeeds Fixes https://linear.app/appsmith/issue/APP-15010/vulnerability-authenticated-viewers-can-execute-unpublished-draft ## Automation /ok-to-test tags="@tag.All" ### 🔍 Cypress test results  > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/23017716243> > Commit: ed2b421 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=23017716243&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Thu, 12 Mar 2026 19:57:26 UTC  ## Communication Should the DevRel and Marketing teams inform users about this change? - [x] Yes - [ ] No  ## Summary by CodeRabbit * **Bug Fixes** * Centralized permission decision for action execution so viewers can run published actions but cannot run unpublished ones; aligns draft (editor) vs published (viewer) behavior. * **Tests** * Added role- and publication-state tests covering viewer/editor execution paths, invitation/role setup, and ACL enforcement for published and unpublished actions.

…nd sortBy columns (#41594) ## Description **TL;DR:** Fix a High-severity SQL injection vulnerability (GHSA-7634-7vm9-xg5q, CVSS 7.7) in `FilterDataServiceCE` where unsanitized projection and sortBy column names allow arbitrary SQL injection into the H2 in-memory database, enabling server-side file reads via `FILE_READ()` and cross-user data exposure. ### Root Cause `addProjectionCondition()` and `addSortCondition()` in `FilterDataServiceCE` construct SQL queries by wrapping user-supplied column names in backticks without escaping backtick characters within the input. An authenticated attacker with developer-level workspace access can break out of the backtick quoting and inject arbitrary SQL expressions into the H2 in-memory database. The WHERE clause was already protected via schema validation (`validConditionList()`), but this same validation was never applied to projection or sortBy column names — an inconsistency that this fix addresses. ### Fix (Defense in Depth — 3 Layers) 1. **Schema validation (primary fix):** Added `validateProjectionColumns()` and `validateSortByColumns()` methods that whitelist column names against the data schema before any SQL is constructed. This eliminates the entire class of identifier injection — any column name not present in the actual data is rejected with an `AppsmithPluginException`. 2. **Backtick escaping (defense in depth):** Added `escapeBacktickIdentifier()` that escapes backtick characters (`` ` `` → ```` `` ````) in `addProjectionCondition` and `addSortCondition`, preventing breakout even if Layer 1 were bypassed. 3. **Schema generation hardening:** Extended the existing quote rejection in `generateSchema()` to also reject backtick characters in data column names, preventing the attack character from entering the system via the data source itself. ### Affected Plugins - **Google Sheets** (`RowsGetMethod`) — uses both projection and sortBy from formData - **Amazon S3** (`AmazonS3Plugin`) — uses sortBy from formData (projection is null) ### Test Coverage Added 8 new unit tests covering: - Invalid column names in projection and sortBy (rejected) - SQL injection payloads via backtick breakout in projection and sortBy (rejected) - SQL expression injection via projection (rejected) - Backtick characters in data column names via schema generation (rejected) - Valid projection and sortBy still work correctly (regression tests) All 29 tests pass (21 existing + 8 new). Fixes https://github.com/appsmithorg/appsmith/security/advisories/GHSA-7634-7vm9-xg5q Fixes https://linear.app/appsmith/issue/APP-14992/bug-prevent-sql-injection-in-uqi-filter-service-projection-and-sortby ## Automation /ok-to-test tags="@tag.All" ### 🔍 Cypress test results  > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/23039906046> > Commit: 38e0451 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=23039906046&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Fri, 13 Mar 2026 08:10:43 UTC  ## Communication Should the DevRel and Marketing teams inform users about this change? - [x] Yes - [ ] No  ## Summary by CodeRabbit * **Bug Fixes** * Pre-validate projection and sort inputs against generated schema to catch invalid columns early. * Reject column names containing backticks and consistently quote identifiers to prevent injection. * Ensure temporary resources are always cleaned up after queries and improve error messages for invalid query configs. * **Tests** * Expanded coverage for projection/sort validation, backtick and SQL-injection protection, sort-order errors, and cleanup behavior.

## Description > [!TIP] > _Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team)._ > > _Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR._ Even with newer packages from the Redis project, container scanners are showing false positives for vulnerabilities. Switching to use the upstream Redis built docker images instead. This bypasses scanners that look for dpkg metadata about packages, but I'm enabling docker dependency updates here via Dependabot to keep this up-to-date. Fixes #`Issue Number` _or_ Fixes `Issue URL` > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /ok-to-test tags="" ### 🔍 Cypress test results  > [!WARNING] > Tests have not run on the HEAD edb91ff yet > <hr>Fri, 13 Mar 2026 16:04:48 UTC  ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No  ## Summary by CodeRabbit * **Chores** * Added automated dependency updates for Docker images. * Updated Docker build to source Redis binaries from an upstream image instead of installing them during build. * Adjusted Redis runtime configuration to remove an explicit working-directory setting.

…a [APP-14994] (#41598) ## Summary Fixes APP-14994: three API endpoints were accessible without authentication and exposed sensitive instance metadata to any unauthenticated caller. - **`/api/v1/users/features`** — removed from `permitAll()` in `SecurityConfig`; now returns **401** for unauthenticated requests. Feature flags are per-user data and must not be disclosed to anonymous callers. - **`/api/v1/tenants/current`** — kept accessible without authentication (the login page uses it to discover enabled auth providers), but `instanceId` and `adminEmailDomainHash` are now **suppressed** from the response when the caller is anonymous. This eliminates exposure of the unsalted SHA-256 admin-email-domain hash and the instance UUID. - **`/api/v1/consolidated-api/view`** — kept accessible without authentication (required for public/published apps), but the embedded `organizationConfig` no longer contains `instanceId` or `adminEmailDomainHash` for anonymous callers (same service-layer fix as above). ## Changes | File | Change | |------|--------| | `SecurityConfig.java` | Remove `GET /api/v1/users/features` from `permitAll()` | | `OrganizationServiceCEImpl.java` | Check `ReactiveSecurityContextHolder` in `getOrganizationConfiguration()`; skip setting `instanceId` / `adminEmailDomainHash` for anonymous principals | | `OrganizationServiceCETest.java` | Add two tests: anonymous caller gets `null` for sensitive fields; authenticated caller gets non-null values | | `AuthGuardTest.java` | New controller-level test: `GET /api/v1/users/features` returns 401 for unauthenticated requests; `GET /api/v1/tenants/current` remains accessible | ## Test plan - [x] `OrganizationServiceCETest#getOrganizationConfig_AnonymousUser_DoesNotExposeInstanceMetadata` — asserts `instanceId` and `adminEmailDomainHash` are `null` for anonymous callers - [x] `OrganizationServiceCETest#getOrganizationConfig_AuthenticatedUser_ExposesInstanceMetadata` — asserts both fields are non-null for authenticated callers - [x] `AuthGuardTest#featureFlagsEndpoint_unauthenticated_returns401` — HTTP 401 for unauthenticated `GET /api/v1/users/features` - [x] `AuthGuardTest#tenantCurrentEndpoint_unauthenticated_isAccessible` — `GET /api/v1/tenants/current` still returns 200 without auth - [x] All 15 existing `OrganizationServiceCETest` tests pass (1 pre-existing disabled test skipped) 🤖 Generated with [Claude Code](https://claude.com/claude-code)  ## Summary by CodeRabbit * **Bug Fixes** * The user features endpoint now requires authentication. * Organization instance metadata (instanceId, adminEmailDomainHash) is concealed for unauthenticated requests; tenant/current remains accessible but without sensitive fields. * **Tests** * Added tests validating authentication for the features endpoint and that anonymous vs. authenticated users receive appropriately filtered organization metadata.  ## Automation /ok-to-test tags="@tag.All" ### 🔍 Cypress test results  > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/22959284307> > Commit: 1bcf565 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=22959284307&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Wed, 11 Mar 2026 16:17:45 UTC  --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix Mark Required - Add isRequired prop to LabelWithTooltip component - Display red asterisk (*) next to label when isRequired is true - Pass isRequired from BaseInputWidget, InputWidget, and InputWidgetV2 to components - Fixes enterprise customer request for required field indicator in Form widget Made-with: Cursor ## Description > [!TIP] > _Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team)._ > > _Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR._ Fixes #41608 _or_ Fixes APP-15005 > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /ok-to-test tags="@tag.All" ### 🔍 Cypress test results  > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/23160366665> > Commit: 125732e > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=23160366665&attempt=2" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Tue, 17 Mar 2026 04:27:01 UTC  ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No  ## Summary by CodeRabbit * **New Features** * Form labels now show a red asterisk for required fields for clearer required-field indication. * Required-state support added across input widgets so the required marker appears consistently in forms and custom inputs.  --------- Co-authored-by: subratadeypappu <subrata@appsmith.com>

## Description ### Feature flag rename: release_static_url_enabled → license_static_url_enabled - FeatureFlag.ts (enum key, string value, default) - FeatureFlagEnum.java (enum constant) - StaticUrlServiceImpl.java (annotations and javadoc references) - ConsolidatedAPIServiceImplTest.java (test mocks) - PageSettings.tsx and GeneralSettings.tsx (feature flag checks) - FeatureFlags.ts (cypress feature flag override) Note: this breaks EE compilation Fixes #`Issue Number` _or_ Fixes `Issue URL` > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /ok-to-test tags="@tag.Settings" ### 🔍 Cypress test results  > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/23185762854> > Commit: 893224c > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=23185762854&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Settings` > Spec: > <hr>Tue, 17 Mar 2026 09:12:10 UTC  ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No  ## Summary by CodeRabbit * **Refactor** * The Static URL feature flag has been renamed and the app now uses a license-based flag to control Static URL availability. * Settings pages, server checks, and tests updated so the Static URL UI and behavior are gated by the new license-based flag.

coderabbitai · 2026-03-18T08:10:26Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

pg
release

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: e552f4d5-3889-4fac-ab28-c1c23045a50c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch release

📝 Coding Plan

Generate coding plan for human review comments

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Tip

CodeRabbit can scan for known vulnerabilities in your dependencies using OSV Scanner.

OSV Scanner will automatically detect and report security vulnerabilities in your project's dependencies. No additional configuration is required.

mohanarpit and others added 19 commits March 3, 2026 13:51

feat: Redis datasource: add TLS (SSL mode) support in backend + datas…

7086d6a

…ource UI (#41587)

btsgh requested a review from shadabbuchh March 18, 2026 08:10

btsgh requested review from a team, riodeuno and sharat87 as code owners March 18, 2026 08:10

btsgh requested review from vivek-appsmith and removed request for a team March 18, 2026 08:10

shadabbuchh approved these changes Mar 18, 2026

View reviewed changes

btsgh merged commit 7d704f6 into master Mar 18, 2026
516 of 532 checks passed

Navigation Menu

Uh oh!

18/03/2026 - Promotion - #41631

18/03/2026 - Promotion#41631
btsgh merged 19 commits into
masterfrom
release

btsgh commented Mar 18, 2026

Uh oh!

coderabbitai Bot commented Mar 18, 2026

Review skipped

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Uh oh!

Conversation

btsgh commented Mar 18, 2026

Description

Automation

🔍 Cypress test results

Communication

Uh oh!

coderabbitai Bot commented Mar 18, 2026

Review skipped

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants