3.38.1

Budibase/budibase3.38.1May 12, 2026by calexiou

AI Summary

A maintenance release featuring significant security hardening, including prototype pollution fixes and strict access controls for view scopes and datasources. It also includes UI refinements like per-app themes.

Key Highlights

Security: Fixed prototype pollution bypass and hardened REST datasource redirect handling.
Access Control: Enforced view scope for row action triggers and required builder access for datasource updates.
UI/UX: Themes are now per-app rather than per-workspace, with default font adjustments.
New Controls: Added increment and decrement controls for number input fields.

New Features

Increment decrement controls for number input fields
Themes per-app rather than per-workspace
Display usage for queries in automations

Full Release Notes

## What's Changed
* Stop processing attachments on workspace update by @deanhannigan in https://github.com/Budibase/budibase/pull/18724
* fix: mime type display in agent knowledge builder by @Dakuan in https://github.com/Budibase/budibase/pull/18746
* Feat/recover exited sqs in single image by @calexiou in https://github.com/Budibase/budibase/pull/18728
* Display usage for queries in automations by @devin-ai-integration[bot] in https://github.com/Budibase/budibase/pull/18627
* Bump hono from 4.12.14 to 4.12.18 in the all-non-major-security group across 1 directory by @dependabot[bot] in https://github.com/Budibase/budibase/pull/18737
* build(deps): bump the all-non-major-security group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/Budibase/budibase/pull/18756
* Fix prototype pollution bypass in view calculation validation by @cubic-dev-ai[bot] in https://github.com/Budibase/budibase/pull/18759
* State variables searchable state selector by @ConorWebb96 in https://github.com/Budibase/budibase/pull/18758
* feat: handle sharepoint file delete by @Dakuan in https://github.com/Budibase/budibase/pull/18721
* make themes per-app rather than per-workspace, adjust default fonts and allow app font selection by @andz-bb in https://github.com/Budibase/budibase/pull/18743
* Emit error events for action failures by @jvcalderon in https://github.com/Budibase/budibase/pull/18757
* [Security] Remove unused global user onboarding endpoint by @PClmnt in https://github.com/Budibase/budibase/pull/18752
* Add increment decrement controls for number input fields by @ConorWebb96 in https://github.com/Budibase/budibase/pull/18734
* [Security] Enforce view scope for row action triggers by @PClmnt in https://github.com/Budibase/budibase/pull/18754
* [Security] Require builder access for datasource updates by @PClmnt in https://github.com/Budibase/budibase/pull/18753
* [Security] Validate legacy view calculations by @PClmnt in https://github.com/Budibase/budibase/pull/18755
* [Security] Harden REST datasource redirect handling by @PClmnt in https://github.com/Budibase/budibase/pull/18751

## New Contributors
* @devin-ai-integration[bot] made their first contribution in https://github.com/Budibase/budibase/pull/18627

**Full Changelog**: https://github.com/Budibase/budibase/compare/3.38.0...3.38.1