2026.06.2 : Introducing Oracle Database Support

Oracle Database Support

Oracle Database joins PostgreSQL, MySQL, and Microsoft SQL Server as a connectable external data source. Connect an existing Oracle database and work with its tables through NocoDB's grids, views, fields, formulas, links, lookups, aggregations, and charts. Available as an add-on for Enterprise customers; reach out to the support team (support@nocodb.com) to enable it.

Learn more about connecting data sources →

Improvements & Fixes

• A more readable calendar. Switch cards between Compact and Expanded record heights, see several fields per card in Week view, and collapse or hide weekends straight from the calendar's view mode dropdown. Learn more →
• Circular progress for Percent fields. Percent fields can now render their progress as a Circle as well as the existing Bar, set from the field's "Progress bar shape" option. Learn more →
• Formatting options for Lookup fields. When a Lookup resolves to a number or a date, a new Formatting tab lets you set its display format (decimal, currency, percent, or date, datetime, time) independently of the source field, and it applies everywhere the lookup appears. Learn more →
• Smarter sorting. Toggle individual sort conditions on or off without deleting them, and drag to reorder your sort fields. Learn more →
• Gantt milestone guide lines and group toggles. Milestones now drop a dashed guide line up to the date header so they're easy to place at a glance, group-bys can be switched off and back on without losing their configuration, and formula fields that produce a URL render as clickable links in the sidebar. Learn more →
• More layout control in Page Designer. The Page Designer extension now supports a custom page size with your own width and height, and you can keep several named designs in one place and switch, duplicate, or rename them. Learn more →
• Weekday-prefixed date formats. New date display formats prefix the day of the week (for example "Wednesday 2026-06-10" or "Wed 10/06/2026") in cells and grid group headers, available for ISO, European, and US base formats. Learn more →
• Forms remember in-progress answers. Public shared forms now save what a respondent has typed to their own browser, so a refresh or accidental navigation no longer wipes a half-completed form. The draft clears on submit. Learn more →
• Email form responses to any base collaborator. The form's notification setting now lets you pick which base collaborators receive an email on each submission, not just the form owner. Learn more →
• Linked-record exports are complete. CSV, Excel, and JSON exports now include all linked records in a Links or Lookup cell.

Security

• OAuth and authentication hardening. OAuth refresh-token rotation is now strictly single-use under concurrent requests, access tokens can no longer be presented as session tokens, and the public OAuth client endpoint no longer returns sensitive material.
• Protection against server-side request forgery. External database connections now validate the connection host before connecting on all editions, blocking attempts to reach internal network addresses.
• Resource-exhaustion safeguards. Outgoing webhook request and response bodies, image thumbnail input sizes, and formula string output are now capped so oversized payloads and images can no longer exhaust memory and crash workers.
• Stored cross-site scripting fix. Field names shown in the AI prompt tooltip are now rendered as plain text, so a crafted field name can no longer execute script.

Self-Hosting

• Production-grade Helm chart. The Kubernetes chart was rewritten from the ground up for high availability: separate app and worker deployments each with their own autoscaling, external PostgreSQL and Redis with secret support, pod disruption budgets and anti-affinity, and sensible default resource requests of 1 vCPU and 2Gi per pod. Attachment storage is now configured in the app rather than through chart environment variables. Learn more about deploying on Kubernetes →
• Faster base and grid loads. Many internal read requests issued when opening a base or loading a grid are now coalesced into a single batched request, cutting round-trips on bases with lots of Links and Lookup fields.
• Email and password sign-in alongside SSO. Self-hosted deployments can now show the email and password form next to SSO on the sign-in page, instead of SSO replacing it entirely, with a new "Allow email & password sign-in alongside SSO" admin setting. Learn more →
• Password reset works behind a sub-path. The reset-password page now derives its base URL from your site URL, so password reset links work under sub-path and reverse-proxy deployments.
• New configuration options. NC_WEBHOOK_MAX_BODY_SIZE (default 10 MB) caps webhook payload size, NC_THUMBNAIL_MAX_INPUT_PIXELS (default 24 MP) and NC_THUMBNAIL_MAX_INPUT_PIXELS_SHRINKABLE (default 100 MP) bound thumbnail generation, and NC_FORMULA_MAX_OUTPUT_LENGTH caps formula string output. Learn more →

Availability