2026.10.1 : Bug Fix Release

Timestamps include milliseconds. On PostgreSQL and SQLite, date and time values in API responses, webhook payloads and CSV exports now include milliseconds (12:34:56.000+00:00). Check integrations that read dates in a fixed format.

MCP lists every tool. The MCP server at /mcp now lists every tool. If Windsurf or VS Code Copilot shows too many tools, connect it again with the /mcp-discovery URL. Learn more

Password changes sign out your apps. Changing your password deletes your API tokens and disconnects apps you authorized with OAuth. Learn more

Improvements

Classic apps on phones - Published classic apps fit phone screens, including the sidebar, toolbars, record forms, dashboard groups and pivot widgets.
Group by more field types - Classic app pages group by Links, Formula, Lookup, Rollup and link count fields, and List widgets get a group by setting. Learn more
Resize columns in classic apps - Drag a column edge in a List widget to resize it. Builders save the width for everyone. Learn more
Open records from view widgets - Calendar, Timeline and Gantt widgets on a dashboard can open a record when you click it. Learn more
Hide widget titles - Data, chart and number widgets in a classic app have a Show title switch.
Button visibility by role - Page buttons in a classic app can show only to the roles you choose. Learn more
Reorder user filter tabs - Builders drag user filter tabs into a new order. Learn more
Sort Single Select by option order - A sort on a Single Select field can follow the order of its options instead of A to Z. Learn more
Sign out of other devices - Account > Security signs you out everywhere except the current browser on NocoDB Cloud. Learn more
Templates on Home - Home and the New project page show a template gallery on NocoDB Cloud, and projects built with AI start with a few sample records. Learn more
Greek - NocoDB is now available in Greek. Learn more
MCP rate limits - MCP has its own limit per account. A client that goes over it is told how long to wait.
MCP connected apps - The list of connected apps shows when each app was last used. Learn more
OAuth consent screen - The consent screen shows where you will be sent and warns when an app is not verified by NocoDB.
Live updates - Gallery, Kanban, Map, dashboards and classic app record review refresh in place when collaborators edit.

What's Fixed

Workflows and webhooks - When record updated workflows and update webhooks run when records are linked or unlinked through the API, paste or a foreign key change. Learn more
Formulas - Formulas with ? inside text evaluate, Checkbox values act as 1 and 0 in PostgreSQL formulas, and XOR results can be filtered.
Filters - is blank filters on Rollups work, and like filters on User fields match names only.
Links - Self-linking one-to-one fields show the linked record, and duplicated projects keep their links.
Copying data - Duplicating and importing a project keeps Long Text and JSON values longer than 100,000 characters.
Classic apps - Search in the builder, link pickers in forms, Timeline labels, default page names, unhidden form fields, list scrollbars and conditional row colors behave as expected.
Sharing - The classic app Share dialog can give an existing member a higher role, and a second invite keeps the first invite link working.
Attachments - Escape and arrow keys work in the attachment preview everywhere it opens.
Tables - A new table can take a trashed table's name, even near the database name length limit.
SQL Server and Oracle - Sorts that repeat a field work on SQL Server, and on Oracle a Number field converts to Decimal and text formulas sort.
AI chat - Chat works with Claude Opus 5.5, Sonnet 5.5 and Fable 5.1 integrations.
Sign-in - Forgetting your password no longer signs you out, and sign-in errors show one message for every case.

Self-Hosting Notes

First sign-up - On a new licensed install, the first super admin gets the default workspace and organization without a restart.
License refresh - Refresh on the License page, or a restart, activates a license that shows as pending. Learn more
Secure attachments - Setting only NC_ATTACHMENT_ACCESS_CONTROL_ENABLED=true now turns on secure attachments, so /download and /dl stop serving files. Use the signed URLs that attachment responses return. Learn more
Local databases - ClickHouse on a private network, and MySQL or PostgreSQL over a Unix socket, need NC_ALLOW_LOCAL_EXTERNAL_DBS=true. Learn more
MCP tokens - MCP token secrets are stored hashed and shown only once. Tokens already in your MCP clients keep working.
Long table names - New SQL Server and Oracle table names are limited to 125 characters.
Security hardening - Sign-up, invitations, OAuth, shared views, data exports, database connections and stored secrets are hardened, and dependencies are patched.

For more details on the features introduced in 2026.10.0, see the 2026.10.0 changelog.