v1.7.13

What's Changed

New self-hosted installations now print a boot key at startup that lets you log in as the install admin, with no pre-existing account needed. WebSocket connections now accept API keys, boot keys, and access tokens, not just session cookies, so consoles, scripts, and out-of-page custom widgets can talk to Grist over the same channel browsers use. The Pyodide sandbox jumped from 0.23.4 to 0.28.1. Airtable imports can update existing rows in place and bring choice colors with them. The (Bulk)AddOrUpdateRecord API hands back the IDs of the rows it added or updated, so upserts are easier to chain. Custom widgets now know whether they're a target or source of section linking. "Search in document" ignores accents. Team site owners on self-managed installations get a new Site Settings page for name, domain, and logo. And Grist can restart in place to apply config changes without dropping its listening socket.

New features

• Boot key login. New installations generate a GRIST_BOOT_KEY and print it at startup. Visit /boot, paste the key, and you're logged in as the install admin and ready to set the admin email. No pre-existing account needed, and no window where the server is open to the world before authentication is configured. The key (and the related GRIST_IN_SERVICE flag) can also be set via env vars or managed from the Admin Panel. Existing installations are unaffected. (commit)
• Restart in place. Grist can now apply config changes by restarting itself without dropping the listening socket. During the brief gap, /status keeps answering for liveness checks while readiness flips to 503. On by default for Linux under Node, off for Windows and Electron. Toggle with GRIST_RESTART_SHELL=true/false (#2265).
• Site Settings page. Team site owners on self-managed installations can edit team name, domain, and logo from a new /site-settings page (commit).
• WebSocket auth for API keys, boot keys, and access tokens. The WebSocket side now goes through the same identity-resolving code path as the REST API, so any auth method that works on one works on the other. Opens the door to console clients and out-of-page custom widgets. Also tidies up auth priority and unifies API rate-limiting between the two. (commit)

Improvements

• Airtable import
  • Updates existing rows by default when the source has an Airtable ID column, and resolves references against rows already in the doc (#2216)
  • Brings Airtable choice colors along for the ride (#2199)
• API
  • (Bulk)AddOrUpdateRecord now returns id / recordIds / createdRecordIds / updatedRecordIds, and BulkAddOrUpdateRecord accepts a record-shaped payload that can match different columns per row (#2193)
  • Webhook API ignores empty action payloads, matching the other endpoints (#2308)
• Custom widgets
  • New linking field on InteractionOptions tells a widget whether it's an incoming-link target (asTarget) or used as a source by other sections (asSource) (#2259)
• Sandboxing
  • Pyodide updated from 0.23.4 to 0.28.1 (#1754)
• Suggestions
  • The number-of-suggestions badge is now a status dot, removing counting ambiguity (commit)
  • Per-document unsubscribe link for row-change notifications (commit)
• Admin Panel
  • Authentication section rebuilt with a status-coded hero card, getgrist.com Reconfigure / Deactivate, and a collapsible "other methods" list (#2227)
• UI/UX
  • "Search in document" now ignores accents (#2221)
  • Forms scroll like a normal page, fixing Tab not appearing to do anything on first press in Firefox (#2179)
  • Account settings split into Profile and Developer subpages, in preparation for OAuth Apps (commit)
  • Clearer error messages when personal orgs are disabled (#2285)
• Internal / infrastructure
  • New eslint rule makes sure makeT(...) calls match their filename, with autofix (#2237)
  • Rebalanced nbrowser CI groups and added guards so silently skipped tests don't sneak through (#2267)
• Documentation
  • Cleaned up style inconsistencies in the README (#2200)

Fixes

• Fix wrong active section in the creator panel after duplicating a page with collapsed widgets (#2298)
• Fix CORS handling for opaque ("null") origins, eliminating spurious 500s for https:// widgets on http:// hosted sites (#2299)
• Fix padded checkboxes so the border and tick line up inside padded wrappers (#2300)
• Fix SELF_HYPERLINK() returning a share-key URL when a doc was first opened via a share link (commit)
• Wrapped row height is preserved after modifying a cell in suggestions, removing a flicker from unwrapped to wrapped (commit)
• Airtable import UI translations are picked up properly (#2236)
• Bump handlebars from 4.7.7 to 4.7.9 (#2208)

In progress: admin setup wizard

Work is under way on a new /admin/setup page, a guided first-run flow for self-hosted operators covering sandbox choice, base URL and edition, authentication, default permissions, and backups. It is not wired up by default this release, but the building blocks are in and you can preview by visiting /admin/setup directly. We expect this to be the official first-run experience next release.

Landed so far:

• Sandbox setup card that auto-detects available sandbox flavors and recommends one (#2272)
• Server section with a Test-URL-then-Confirm flow for the base URL, plus an edition picker (#2280)
• Backups section that shows external storage status and lists how to enable each backend (#2283)
• Final step with three permission presets (Locked, Recommended, Open) for GRIST_ORG_CREATION_ANYONE, GRIST_PERSONAL_ORGS, GRIST_FORCE_LOGIN, GRIST_ANON_PLAYGROUND (#2293)
• Harmonized card styling, headers, and apply-and-restart flow across the steps (#2307)
• Several Grist server settings (APP_HOME_URL, GRIST_SANDBOX_FLAVOR, GRIST_FORCE_LOGIN, GRIST_ANON_PLAYGROUND, GRIST_ORG_CREATION_ANYONE, GRIST_PERSONAL_ORGS, GRIST_BOOT_KEY, GRIST_IN_SERVICE, GRIST_ADMIN_EMAIL, GRIST_DEFAULT_EMAIL) can now be read from the home DB as well as the environment, so they can be edited from the browser during setup (commit)
• Placeholder setup page and stepper component (commit)

Full Grist edition extensions

• Automations
  • Emails are now grouped by action ID rather than subject (so test runs that reuse a subject still send each email). Padding restored on the automation page, name preserved when created with Enter, description converted to a text area, and scroll issues in the action log fixed (commit)

Contributions

• fflorent: server tests for session-store API key isolation (#2246), eslint rule enforcing makeT filename match (#2237), Airtable import UI translation fix (#2236), test fixes (#2232, #2248)
• OdysseyOfTheDragons: accent-insensitive search in document (#2221)
• manuhabitela: form page scrolling fix for Firefox Tab navigation (#2179), flaky form view test (#2276)

Translations

• Barna Kovács
• Grégoire Cutzach
• Igor Freire Rodrigues
• Markus Spitzer
• Martin Harari Thuresson
• Renato Portela
• Theo Heller
• Xavi Montero
• xabirequejo

Full Changelog: v1.7.12...v1.7.13

Join our Discord Community if you'd like to get into development of Grist.

v1.7.12

What's Changed

Airtable imports are now smoother, and the import lands in your current workspace instead of somewhere unexpected. Suggestions got a visual refresh with automatic comparison highlighting as you type. Forms are more accessible, and the API now has a cellFormat=typed option so you can get properly typed values back without guessing.

If you include extra extensions in your build, there's a new automations UI that lets you set up triggers on your data. You can define conditions on any table, then fire off email notifications or webhooks when rows match. You can send dynamic emails to different recipients based on column values, filter with Python conditions, and monitor everything from a delivery log. Automations are part of the full edition of Grist, which has a 30-day trial, and is free for individuals and small orgs (under $1M annual funding). The full edition funds the development of grist-core.

Improvements

• Airtable import
  • Formula columns with field references are imported as better comments (#2201)
  • Single record link fields are imported as "Ref" (vs "RefList") columns (#2165)
  • Imports now use the /tables endpoint for better availability (#2171)
  • Import now targets the current org and workspace (#2139)
  • Show a nicer message when Airtable OAuth integration isn't configured (#2146)
• Suggestions
  • Comparison highlighting is now shown automatically in suggestion mode (#2140)
  • Improved "compare to original" feature (#2068)
  • Fix suggestion count on a copied document that has been auto-forked (#2117)
  • Fix deleting rows correctly in suggestions (#2174)
• Forms
  • Make select fields better usable with screen readers (#2164)
• SCIM
  • Speed up user search (#2070)
• Sandboxing
  • Use gristlabs/gvisor-unprivileged in the base Docker image for a more up-to-date version of runsc
• API
  • New cellFormat=typed option for both the REST API and Custom Widget API, providing consistent, self-describing values that preserve type information for Ref, RefList, Attachments, Date, and DateTime columns
  • Reduce GRIST_LOG_API_DETAILS logging: omit body and result, add docId (#2175)
• UI/UX
  • Improve accessibility of Undo / Redo action buttons (#2167)
  • Add max length on text inputs in forms (#2097)
  • Fix document icon when the second word of the doc name is an emoji (#2170)
  • Fix unreadable dark mode colors in banners (#2138)
  • Hide admin panel links in grist-desktop (#2181)
  • Remove the ⌘⇧H / Ctrl+Shift+H shortcut from the "Use as table headers" command
  • Store anchor links in comments as relative URLs
• Documentation
  • Rewrite grist-data-format.md to reflect actual Grist data format (#2177)
  • Freshen list of features in README.md (#2142)
• Internal / infrastructure
  • Upgrade @gristlabs/sqlite3
  • Add Storybook for documenting Grist UI components

Fixes

• Fix 'Row unavailable' race condition (#2156)
• Fix NumericFormatter test flakiness across ICU versions (#2176)
• Fix typo in floating menu selector (#2187)

Full Grist edition extensions

• Automations, a new tool in the left-hand panel for document owners to create trigger-driven workflows
  • Set conditions on any table, filter by column values, require specific columns to be filled, use custom Python filters
  • Choose when to trigger: when a row enters the filtered view, when it's newly added, or on any update
  • Actions: send an email (with dynamic recipients, variable placeholders, and Markdown support) or create a webhook
  • Monitor all automations from a delivery log with success/error/pending status
• Automation tool visibility can be controlled via GRIST_HIDE_UI_ELEMENTS and GRIST_UI_FEATURES

Contributions

• @fflorent: Speed up SCIM user search (#2070), improve Undo/Redo accessibility (#2167), fix document icon emoji handling (#2170), floating menu typo fix (#2187), bump axios (#2163), bump chrome driver (#2093), bump mocha-webdriver (#2198)
• @manuhabitela: Make form select fields better usable with screen readers (#2164), add missing translation strings in themes selection (#2205)
• @imagoiq: Add "still working..." to translatable strings (#2188)
• @Vortezz: Add max length on text inputs (#2097)
• @webash: Fix formatting for Advanced Admin Controls in README (#2161)

Translations

• audus
• Barna Kovács
• Grégoire Cutzach
• imagoiq
• Martin Harari Thuresson
• Philip Steffan
• RapidShade
• ssantos
• xabirequejo
• Zaim Ali Karim
• தமிழ்நேரம்

Full Changelog: v1.7.11...v1.7.12

Join our Discord Community if you'd like to get into development of Grist.

v1.7.11

What's Changed

New features

• Optional authentication using getgrist.com accounts
  • This provides an easy-to-use authentication option for self-hosted installations that don't want to run their own authentication servers or configure other external identity providers.
• Import from Airtable
  • Airtable bases can be imported directly into new or existing Grist documents.
• New environment variables have been added to provide better control over which users are able to access your Grist instance. GRIST_PERSONAL_ORGS will disable personal organizations, while GRIST_ORG_CREATION_ANYONE will prevent any non-admins from creating new organizations.
• Configurable email notifications for suggestions

Improvements

• Forms
  • Allow the maximum options limit on Forms to be configured (defaults to 30 options, configurable up to 1000)
• Sandboxing / security
  • Limit GVisor to 8 process by default
• Suggestions
  • Display references and reference lists in a friendlier fashion
  • Prevent conditional formatting changes from being displayed as suggestions
• UI/UX
  • Add a confirmation dialog when a resource is being shared publicly
  • Hide the bell icon showing connection state when Grist is connected and functioning normally

Fixes

• API endpoints
  • Correct attachment endpoints having inconsistent permissions (#2116)
• Exports
  • Fix XLSX downloads when the export options don't include tableId (#2054)
• Import
  • Fix an error that would pop up when doing multiple successive imports with the Pyodide sandbox enabled (#2073)
  • Fix an error with importing when the Grist instance is hosted on Windows (e.g. Grist desktop) (#2064)
• Suggestions
  • Fix suggestions occasionally displaying incorrectly in documents with deleted tables (#2069)
• SCIM
  • Fix role members having incorrect entries (#2051)
• UI/UX
  • Fix doubled-up overlays in filter-linked widgets that have rows blocked by access control lists (#2056)
  • Fix virtual table display and scrollbar issues on MacOS (#2075)

Contributions

@fflorent

Translations

@VaclavDort
@filiphanes
@qleroy
@mirithillion
@hexaltation
@alimahwer
@thuma
@audez
@vonbraun22
@umam15
@kraudio
@xabirequejo
@artur Dabrowski
@Thanyanit-J

Full Changelog: v1.7.10...v1.7.11

Join our Discord Community if you'd like to get into development of Grist.

v1.7.10

Hotfix

grist-core 1.7.10 is a hotfix release that fixes a regression from 1.7.9 where the Grist Labs custom widget repository stopped being included as the default repository by mistake. As a result, Grist Labs and community custom widgets are no longer shown when adding a new custom widget, and any previously added Grist Labs or community custom widgets will fail to load.

Contributions

Translations

• @xabirequejo

Full Changelog: v1.7.9...v1.7.10

Join our Discord Community if you'd like to get into development of Grist.

v1.7.9

Security advisory

A security review identified a vulnerability in the "pyodide" sandboxing method that is available in Grist. You can check if you are affected in the sandboxing section of the Admin Panel of your instance. If you see "gvisor" there, then you are not affected.If you see "pyodide", then it is important to update to this version of Grist or later.

Link for advisory: GHSA-7xvx-8pf2-pv5g

Notable fixes and improvements

• New intro screen for Access Rules:
  • A document without rules now shows an intro screen with an "Enable Access Rules" button:
    • On confirming, it creates the initial recommended rules: namely, disable structure permission for non-owners
  • There is also a "Disable Access Rules" button that's shown when there are no custom rules
• Restrict users who can view all data from viewing Access Rules by default:
  • If permission to view Access Rules is enabled, then there is a new option: to restrict non-owners from downloading or copying the document
  • This restriction is added by default when permission to view Access Rules is given
  • Granting permission to view Access Rules and removing the restriction on downloading/copying the document approximates the previous behavior
• Redesigned authentication section in Admin Panel for configuring user authentication in self-managed Grist
• Org and workspace modifications are now limited to users with owner permissions
• Document owners can now resolve and reopen comment threads, and delete comments
• Fixes for some frontend memory leaks
• Fixes for some styling issues when printing a document
• Fix for broken enable/disable document endpoints in multi-server environments
• Optimizations to row filtering in Access Rules
• Show a "record is unavailable" message when a user opens a record card blocked by ACLs PR #1896
• Fix how zero Date/DateTimes look to other formulas PR #1995
• Don't force reloads when a column is added to a user attribute table PR #2035
• Several improvements to RecordSet handling PR #1992
• Correctly share forms with references with no display column PR #2008
• Improve rendering of changes in suggestions PR #1977
• Show a count of changes when making a suggestion PR #1960
• Validate emails used to share access PR #2016

Contributions

• @fflorent: Bump js-yaml from 3.14.1 to 4.1.1 PR #1961
• @fflorent: Bump Typescript to version 4.9.4 PR #1993
• @fflorent: Eslint: Remove function appCommWaiter (dead code) PR #2001
• @fflorent: Upgrade eslint PR #2000 PR #2005 PR #2020 PR #2030
• @fflorent: develop.md: Simplify the paragraph detailing the coding rules PR #2031
• @manuhabitela: Make sure a Form Submit row can't be removed with keyboard PR #1979
• @manuhabitela: Choices text box: make sure all choice tokens are readable PR #1982

Translations

• @maksim2005UKR
• @hexaltation
• @h0r0m
• @winjie0618
• @audez
• @umam15
• @mirithilion
• @oliverne
• @vonbraun22
• Alexey
• Paul Janzen

Full Changelog: v1.7.8...v1.7.9

Join our Discord Community if you'd like to get into development of Grist.

v1.7.8

What's Changed

• There are new API endpoints for disabling and enabling documents
• Miscellaneous bug fixes and translations

Full Changelog: v1.7.7...v1.7.8
Join our Discord Community if you'd like to get into development of Grist.

v1.7.7

Security advisory

Two vulnerabilities found in Grist by a private bug bounty program funded by DINUM (the Interministerial Digital Directorate of the French government) have been addressed.

• Using the fetch URL feature, a user could execute a request to an external server with privileged network access.
  • Mitigation: ensure that network requests go through a trusted proxy.
• Users could use the /compare endpoint to get document history to parts of a document that they might not have read access to.
  • Mitigation: the /compare endpoint is now restricted to users that have full read access.

Versions prior to 1.7.6 are known to be vulnerable. Please upgrade.

These advisories are also documented in our security advisory page.

What's Changed

• There was a missing login in Service Accounts API responses. Thanks to DINUM, this has now been fixed, which is important in order to make this feature usable.
• The admin panel now displays information about who is currently assigned the installation admin role.
• All form submissions are now treated as if they were made anonymously.
• Miscellaneous bug fixes and translations.

Grist Enterprise

• We have streamlined the procedure and instructions for building Grist with Enterprise Edition extensions. This is now documented in our README.

Join our Discord Community if you'd like to get into development of Grist.

Full Changelog: v1.7.5...v1.7.7

v1.7.5

What's Changed

New features

• Inspired by source control workflows, there is a new suggestions feature for crowd-sourcing data. Anyone can suggest a change to a document that the document editors can review then approve or reject.

API improvements

• Behind the GRIST_ENABLE_SERVICE_ACCOUNTS environment variable, there is a new API api/service-accounts for enabling, configuring, and using service accounts. A service account is intended for controlling and fine-tuning the scope and access of multiple API keys associated to a login user. Thanks to Grégoire Cutzach of DINUM for the hard work they poured into this feature.
• There are new API endpoints user/{id}/disable and user/{id}/enable accessible only to admin accounts for enabling/disabling a user, without deleting the user.
• The /data/delete API endpoint has been deprecated in favour of records/delete.

Self-hosting configuration

• In order to better allow long uploads or downloads, there are three new environment variables: GRIST_REQUEST_TIMEOUT_MS, GRIST_KEEP_ALIVE_TIMEOUT_MS, and GRIST_HEADERS_TIMEOUT_MS.

UI improvements

• When creating forms, it is now possible to set fields as hidden, as well as pre-populating those fields via a URL query parameter.
• There are new shortcuts in the add column menu for adding various kinds of parts of dates to a table that already contains a date.
• Copy-pasting into attachment columns now works.
• There is now a download menu option in the document list

Accessibility

• The search bar and the creator panel now have better keyboard navigation
• Long lists in a form have better navigation
• The descriptions of keyboard shortcut descriptions are now translated
• Pie charts have been made more visually pleasing
• The colors for selected buttons in the creator panel are now easier to read

Other

• Miscellaneous bug fixes and translations

Full Changelog: v1.7.4...v1.7.5

Join our Discord Community if you'd like to get into development of Grist.

v1.7.4

What's Changed

• BREAKING CHANGE: the deprecated DELETE /api/orgs/:orgId endpoint is now disabled by default. Instead use DELETE /api/orgs/:orgId/:name or set the environment variable GRIST_ALLOW_DEPRECATED_BARE_ORG_DELETE=true to keep using the deprecated endpoint.
• The groups API for SCIM is now available.
• The document comparison feature is no longer in beta.
• External storage for attachments is now enabled by default, if a Grist installation is using external storage for documents (e.g. S3, MinIO, Azure). This is equivalent to the environment variable GRIST_EXTERNAL_ATTACHMENTS_MODE=snapshots
• A new user presence feature is now available. Users concurrently viewing the same document appear at the top of the document.
• Miscellaneous bug fixes and translations.

Grist Enterprise

• The AI Assistant can now explain access rules used in a document.

New Contributors

• @ohemelaar made their first contribution in #1830

Full Changelog: v1.7.3...v1.7.4

Join our Discord Community if you'd like to get into development of Grist.

v1.7.3

What's Changed

• After a period of development, comments were improved and enabled.
• User presence is in development, and available behind the GRIST_ENABLE_USER_PRESENCE feature flag.
• A significant db optimization for large sites using postgres happened. An extra minor optimization can be enabled using GRIST_POSTGRES_USE_PREPARED_STATEMENTS (not on by default since some connection poolers may need upgrades to handle prepared statements).
• Common URLs can now be customized by GRIST_CUSTOM_COMMON_URLS (thanks @fflorent)

Grist Enterprise

• Notifications for comments, document changes, and user invites are now all available to enterprise users.

Full Changelog: v1.7.2...v1.7.3

Join our Discord Community if you'd like to get into development of Grist.