3.40.1

ShenhanQian/VHAP3.40.1Jul 22, 2026by calexiou

AI Summary

This patch release focuses on security enhancements, bug fixes, and dependency updates, including fixes for MongoDB TLS path forwarding and MySQL injection.

Key Highlights

Security fixes for MongoDB TLS file path forwarding and MySQL injection
New support for MSSQL history on tables
Nesting support for document list files
Enforced same-origin check for REST datasource requests

New Features

MSSQL history support on tables
Nested document list files
Guidelines on choosing a license

Full Release Notes

## What's Changed
* chore(deps): bump js-yaml from 5.2.0 to 5.2.1 in the all-non-major-security group across 1 directory by @dependabot[bot] in https://github.com/Budibase/budibase/pull/19235
* chore(deps): bump protobufjs from 7.6.4 to 7.6.5 by @dependabot[bot] in https://github.com/Budibase/budibase/pull/19242
* Support MSSQL history on tables by @adrinr in https://github.com/Budibase/budibase/pull/19222
* guidelines on choosing a license by @mjashanks in https://github.com/Budibase/budibase/pull/19243
* Relax Vouch requirements for pull requests by @melohagan in https://github.com/Budibase/budibase/pull/19247
* feat: nest document list files by @Dakuan in https://github.com/Budibase/budibase/pull/19233
* [VULN-118] Stop forwarding MongoDB TLS file paths on Cloud by @jvcalderon in https://github.com/Budibase/budibase/pull/19244
* [GHSA-mqhr-6j6h-74p5] Enforce same-origin check for REST datasource requests by @jvcalderon in https://github.com/Budibase/budibase/pull/19239
* [VULN-119] Add regression test showing MySQL injection report does not reproduce by @jvcalderon in https://github.com/Budibase/budibase/pull/19250
* improve workspace home project data resources by @andz-bb in https://github.com/Budibase/budibase/pull/19153


**Full Changelog**: https://github.com/Budibase/budibase/compare/3.40.0...3.40.1