This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+7 more
Affected surfaces
ReleasePort's take
Light signalThe release blocks V1βV2 link upgrades when the source schema is readβonly and rejects /auth/user/me with 401 for invalid JWTs, while adding several UI enhancements.
Why it matters: Blocks risky upgrades from readβonly schemas; enforces auth by returning 401 on bad JWTs β critical for data integrity and security.
Summary
AI summaryBroad release touches π Closed Issues, nc-gui, nocodb, and fix.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Allow AutoNumber columns as display value in forms/tables. Allow AutoNumber columns as display value in forms/tables. Source: llm_adapter@2026-06-01 Confidence: high |
β |
| Feature | Low |
Add persistent alphabetize toggle for select field options in GUI. Add persistent alphabetize toggle for select field options in GUI. Source: llm_adapter@2026-06-01 Confidence: high |
β |
| Feature | Low |
Introduce org admin role assignment capability. Introduce org admin role assignment capability. Source: llm_adapter@2026-06-01 Confidence: high |
β |
| Feature | Low |
Add v3 timeline Gantt chart component (issue 9067). Add v3 timeline Gantt chart component (issue 9067). Source: llm_adapter@2026-06-01 Confidence: high |
β |
| Feature | Low |
Add per-group enable/disable toggle for groupβby feature. Add per-group enable/disable toggle for groupβby feature. Source: granite4.1:30b@2026-06-01-audit Confidence: low |
β |
| Feature | Low |
Add docs revision history functionality. Add docs revision history functionality. Source: granite4.1:30b@2026-06-01-audit Confidence: low |
β |
| Feature | Low |
Introduce API separator enum for v3 APIs. Introduce API separator enum for v3 APIs. Source: granite4.1:30b@2026-06-01-audit Confidence: low |
β |
| Dependency | Low |
Patch remaining Dependabot advisories via pnpm overrides. Patch remaining Dependabot advisories via pnpm overrides. Source: granite4.1:30b@2026-06-01-audit Confidence: low |
β |
| Bugfix | Medium |
Preserve column order in CSV export after UI rearrangement. Preserve column order in CSV export after UI rearrangement. Source: llm_adapter@2026-06-01 Confidence: high |
β |
| Bugfix | Medium |
Block V1βV2 link upgrade when source schema is readβonly. Block V1βV2 link upgrade when source schema is readβonly. Source: llm_adapter@2026-06-01 Confidence: low |
β |
| Bugfix | Medium |
Reject /auth/user/me with 401 when supplied JWT is invalid. Reject /auth/user/me with 401 when supplied JWT is invalid. Source: llm_adapter@2026-06-01 Confidence: low |
β |
| Bugfix | Medium |
Autoβlink new record to parent when using V2 LTAR "+" button. Autoβlink new record to parent when using V2 LTAR "+" button. Source: llm_adapter@2026-06-01 Confidence: low |
β |
| Bugfix | Low |
Fix arrowβkey navigation in link/unlink record modals. Fix arrowβkey navigation in link/unlink record modals. Source: granite4.1:30b@2026-06-01-audit Confidence: low |
β |
| Bugfix | Low |
Sync missing Community Edition build files. Sync missing Community Edition build files. Source: granite4.1:30b@2026-06-01-audit Confidence: low |
β |
| Bugfix | Low |
Fix groupβby binding mismatch when subGroup column contains '?' characters. Fix groupβby binding mismatch when subGroup column contains '?' characters. Source: granite4.1:30b@2026-06-01-audit Confidence: low |
β |
| Bugfix | Low |
Reβalign view search dropdown when toolbar width changes. Reβalign view search dropdown when toolbar width changes. Source: granite4.1:30b@2026-06-01-audit Confidence: low |
β |
| Bugfix | Low |
Fix duplicate record grid rendering issue. Fix duplicate record grid rendering issue. Source: granite4.1:30b@2026-06-01-audit Confidence: low |
β |
| Bugfix | Low |
Correct link and user field rendering in form/record emails. Correct link and user field rendering in form/record emails. Source: granite4.1:30b@2026-06-01-audit Confidence: low |
β |
| Bugfix | Low |
Show SQLite data source onβprem installations. Show SQLite data source onβprem installations. Source: granite4.1:30b@2026-06-01-audit Confidence: low |
β |
Full changelog
π Closed Issues
- [closed] π¦ Feature: Restore webpage favicon and static title of webpage in Community Edition 2026.05.2 #13928
- [closed] π Bug: V1 -> V2 link upgrade changed schema while 'Allow schema change' is disabled #13911
- [closed] π¦ Feature: Custom subject line for form submission notification emails #13891
- [closed] π¦ Feature: Plain-text option for form submission notification emails #13890
- [closed] π¦ Feature: group by switch on / off #13851
- [closed] Enhancement: add bulk record update with CSV import for all table types #13841
- [closed] Nocodb Docs public sharing? #13819
- [closed] π Bug: Updating linked field doesn't display change in a GUI #13798
- [closed] π Bug: V2 Link β creating record from Has Many "+" button does not auto-link to parent #13770
- [closed] π Bug: CSV export does not reflect the column order after rearranging columns in the UI #13768
- [closed] π Bug: Multiple foreign key columns within Table B, pointing to the same column in Table A, have misrepresented values #13759
- [closed] π Bug: API Key cannot access v2 API endpoints - 403 "Forbidden - Unauthorized access" #13734
- [closed] π Bug: Newly created account shows "1 hour ago" in user list (timezone offset issue) #13464
- [closed] Error fetching data on all views after upgrading from 0.265.1 to 0.301.5 (MySQL 9.0.1) #13404
- [closed] π Bug: [External DB - PostgreSQL] Many-to-many relationship on same table adds unwanted links and generates partially wrong or missing linked records. #13349
- [closed] π Bug: In Webhook Settings the Action Input/Modification field is broken. ? #13110
- [closed] π Bug: Linking between tables not working #13092
What's Changed
- Nc fix: block link v1βv2 upgrade when source schema is read-only by @rameshmane7218 in https://github.com/nocodb/nocodb/pull/13923
- feat(group-by): per-group enable/disable toggle by @rameshmane7218 in https://github.com/nocodb/nocodb/pull/13921
- Nc fix(nc-gui): arrow-key navigation in link/unlink record modals by @rameshmane7218 in https://github.com/nocodb/nocodb/pull/13927
- Nc feat : docs rev history by @rameshmane7218 in https://github.com/nocodb/nocodb/pull/13919
- Nc fix/sync missing ce build files by @pranavxc in https://github.com/nocodb/nocodb/pull/13932
- fix(nocodb): reject /auth/user/me with 401 when supplied JWT is invalid by @pranavxc in https://github.com/nocodb/nocodb/pull/13933
- Allow AutoNumber columns as display value by @pranavxc in https://github.com/nocodb/nocodb/pull/13934
- Nc nocodb sync by @DarkPhoenix2704 in https://github.com/nocodb/nocodb/pull/13884
- fix: groupby binding mismatch when subGroup column has literal '?' chars by @fendy3002 in https://github.com/nocodb/nocodb/pull/13936
- Nc fix/cal support issues by @dstala in https://github.com/nocodb/nocodb/pull/13935
- feat(nc-gui): persistent alphabetize toggle for select field options by @dstala in https://github.com/nocodb/nocodb/pull/13924
- Nc fix(nc-gui): re-align view search dropdown when toolbar width changes by @rameshmane7218 in https://github.com/nocodb/nocodb/pull/13937
- docs: stub intent comments by @mertmit in https://github.com/nocodb/nocodb/pull/13940
- Nc feat/org admin role assignment by @pranavxc in https://github.com/nocodb/nocodb/pull/13946
- Nc fix/duplicate record grid by @pranavxc in https://github.com/nocodb/nocodb/pull/13944
- chore(deps): patch remaining Dependabot advisories via pnpm overrides by @pranavxc in https://github.com/nocodb/nocodb/pull/13929
- fix: preserve column order in csv export by @aakashgautam-git in https://github.com/nocodb/nocodb/pull/13918
- Nc fix/delbypk column name undefined by @pranavxc in https://github.com/nocodb/nocodb/pull/13941
- Nc fix(nocodb): correct link & user field rendering in form/record emails by @rameshmane7218 in https://github.com/nocodb/nocodb/pull/13956
- Nc fix(nc-gui): V2 LTAR "+" button now auto-links new record to parent by @rameshmane7218 in https://github.com/nocodb/nocodb/pull/13954
- Nc feat/v3 timeline gantt 9067 by @fendy3002 in https://github.com/nocodb/nocodb/pull/13960
- Nc feat/v3 api separator enum by @fendy3002 in https://github.com/nocodb/nocodb/pull/13959
- Nc fix/sqlite data source hidden onprem by @pranavxc in https://github.com/nocodb/nocodb/pull/13963
Full Changelog: https://github.com/nocodb/nocodb/compare/2026.05.2...2026.05.3
Breaking Changes
- Block V1βV2 link upgrade when source schema is readβonly
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Earlier breaking changes
- v2026.05.1 `NC_PUBLIC_URL` environment variable renamed to `NC_SITE_URL` and is now mandatory for self-hosted instances.
Beta — feedback welcome: [email protected]