# Grist changelog

> A modern relational spreadsheet that combines the flexibility of a spreadsheet with the robustness of a database.

- Vendor: Grist Labs
- Category: Productivity
- Official site: https://www.getgrist.com
- Tracked by: What's New (https://whatsnew.fyi/product/grist)
- Harvested from: GitHub (gristlabs/grist-core)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v1.7.17

- Date: 2026-07-29
- Version: v1.7.17
- Original notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.17
- Permalink: https://whatsnew.fyi/product/grist/releases/v1.7.17

- **added** — Add a Row numbers setting on grid widgets to choose between Numbers (position in current sort), Row IDs (bracketed format), or Hidden (collapse left-hand gutter)
- **added** — Add setup checklist in Document Settings showing which notifications, automations, invite emails, and AI assistant features are ready and what prerequisites each unfinished feature requires
- **added** — Add ability for admins to request prerequisite setup steps through an Admin Panel item
- **added** — Add button in Admin Panel and Quick Setup to switch to the full edition by downloading matching extensions, verifying SHA-256, and restarting in place
- **added** — Add optional "Help us improve" card at the end of Quick Setup to collect feedback on how users heard about Grist and their user type
- **changed** — Announce modals and popups as dialogs by screen readers and trap Tab key focus inside open modals
- **changed** — Translate temporary row IDs inside RefList values in addition to Ref values and row-ID positions to enable creating mutually-referencing rows in one bundle
- **changed** — Show Grist edition and version in left panel footer with links to compare editions and release notes
- **changed** — Make "Enable Access Rules", form reset warning, and color picker labels translatable
- **changed** — Improve OAuth apps re-authorization to pre-select previously granted resources and skip account picker when account can be identified
- **changed** — Explain how to enable OAuth apps on servers without GRIST_ENABLE_OIDC_SERVER instead of rendering UI over 404 endpoints
- **changed** — Add banner on home page and card on OAuth apps page explaining how to connect using MCP
- **changed** — Route MCP document calls through the same server forwarding as the rest of the document API to enable MCP support with Fleet
- **fixed** — Preserve "View as" for attachment previews and whole-document exports instead of resolving as document owner
- **fixed** — Fix Airtable reference columns holding single values to import as working references instead of unusable text
- **fixed** — Fix Airtable count columns to no longer error when the column they count was imported as a Ref rather than RefList
- **fixed** — Fix wrapped list items in Markdown cells at maximum row height overlapping lines below
- **fixed** — Fix server crash when a client disconnects part-way through a proxied request
- **fixed** — Fix "reachable" self-check reporting false failure when anonymous access is disabled
- **fixed** — Fix MCP clients passing a document's urlId in place of doc_id no longer receiving "Doc belongs to a different DocWorker" error

##### What's Changed

###### New features

* **Row numbers, row IDs, or neither**. A new "Row numbers" setting on grid widgets, in Grid Options and in a menu at the grid's top-left corner. Choose Numbers (position in the current sort, as before), Row IDs (bracketed like `[15]`, matching how references render), or Hidden, which collapses the left-hand gutter. Addresses #220, open since 2022, and #1927. (#2448)
* **Setup checklist for notifications and automations**. Notifications, automations, invite emails, and the AI assistant each need plumbing behind them (an email backend, a Redis queue, an AI provider, the full edition), and when a prerequisite is missing the feature simply isn't there. Document Settings now lists what's ready and what each unfinished feature is waiting on. Users can press "Ask the admin" to request a step; admins see the requests in a new Admin Panel item. ([commit](https://github.com/gristlabs/grist-core/commit/a29e94aa))
* **Switch to the full edition from the Admin Panel**. Previously this meant changing Docker image. Now it's a button, in the Admin Panel or the first step of Quick Setup: the server downloads the extensions matching its own version, checks their SHA-256, and restarts in place. Offered on release builds only, not on `main`, nightlies, or dev checkouts. `GRIST_EXT_FULL_EDITION_BASE_URL` points it at a mirror, or turns it off for air-gapped installs. (#2450)
* **"Help us improve" in Quick Setup**. First-time setup now ends with an optional card: how you heard about Grist, what kind of user you are, and a switch subscribing an email address to product and security updates. It appears during setup only, and if you leave it blank nothing is sent at all. What you fill in goes to Grist Labs, along with your installation ID. ([commit](https://github.com/gristlabs/grist-core/commit/5af0acb7))

<img width="826" height="412" alt="row-numbers" src="https://github.com/user-attachments/assets/eec0c102-ca6f-4981-b6b8-5fd340fed589" />

###### Improvements

* Accessibility
  * Modals and popups are announced as dialogs by screen readers, and Tab is trapped inside an open modal. Fixes a Mousetrap bug that let keyboard focus wander behind a modal. Contributed by @manuhabitela (#2371). Keyboard focus now works from the tooltip-style popups inside modals as well ([commit](https://github.com/gristlabs/grist-core/commit/6e175355))
* API
  * Temporary row IDs are now translated inside RefList values, not just Ref values and row-ID positions. Rows that reference each other through RefList columns can be created in one bundle (#2477)
* UI/UX
  * The Grist edition and version show in the left panel footer, with links to compare editions and to release notes. Previously visible only in the Admin Panel (#2470)
* Internationalization
  * "Enable Access Rules", the form reset warning, and the color picker's `fill` / `text` / `default` / `none` labels are now translatable. Contributed by @fflorent (#2451)
* Documentation
  * `documentation/database.md` is back in sync with the schema, with a regenerated home DB diagram. Contributed by @fflorent (#2458)
  * Freshened the comments that feed the generated reference on [support.getgrist.com](https://support.getgrist.com/), with formatting fixes and a broken link repaired (#2462)
  * The README caught up with the last several releases: accessibility, Automations, OAuth apps, the MCP server, three new environment variables, and a table of full edition feature flags (#2443)

<img width="584" height="258" alt="version-footer" src="https://github.com/user-attachments/assets/815c03b6-b9fb-4387-b281-e07305b24126" />


###### Fixes

* "View as" is preserved for attachment previews and whole-document exports, which previously resolved as the document owner (#2478)
* An Airtable reference column holding a single value imported as unusable text rather than a working reference, leaving the raw Airtable ID behind as alt text (#2446)
* Airtable count c

_[Truncated at 4000 characters — full notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.17]_

### v1.7.16

- Date: 2026-06-30
- Version: v1.7.16
- Original notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.16
- Permalink: https://whatsnew.fyi/product/grist/releases/v1.7.16

- **fixed** — Airtable imports of large schemas no longer time out by submitting ModifyColumn actions in batches of 25
- **added** — Forms can substitute the submitted record's ID into a redirect URL with {{ID}}
- **fixed** — ACL condition editors no longer render blank in Firefox at browser zoom below 100%
- **added** — Telemetry can be turned on during the Quick Setup flow
- **changed** — Quick Setup authentication step recommends getgrist.com authentication with a hero card when no other provider is configured
- **added** — New persist-data boot probe warns when documents and home DB sit on ephemeral storage and would be lost on restart
- **added** — New Outgoing requests boot probe and Security Settings entry report how user-triggered outgoing requests are gated by GRIST_PROXY_FOR_UNTRUSTED_URLS
- **changed** — Edition is now its own card in Admin Panel, legacy Enterprise toggle is gone, and switching edition clears the activation key
- **changed** — Building grist-core from source now produces the full edition by default, with yarn run set-community-edition for the previous behavior
- **fixed** — Duplicate document and Save Copy no longer fail with Unknown Host when both GRIST_PROXY_FOR_UNTRUSTED_URLS and APP_DOC_INTERNAL_URL are set
- **fixed** — Undo no longer fails for action bundles that combine a table or column rename with a column removal in the same step
- **fixed** — Locale document setting description now correctly says it affects only number formatting and the default currency, not date formatting
- **changed** — Custom widgets: reverted restriction that disallowed same-origin custom-widget URLs
- **added** — OAuth apps now support Dynamic Client Registration (RFC 7591) so OAuth and MCP clients can register without being pre-provisioned
- **changed** — Apps can manage webhooks with just the doc:webhooks permission instead of the broader doc.schema:write
- **added** — Conditional style tools are now part of the v2 AI assistant and set_table_conditional_styles is no longer destructive
- **added** — Telemetry added for MCP calls counting tool calls and unique sessions per doc and per org

##### What's Changed

Airtable imports of large schemas no longer time out. Forms can substitute the new record's ID into a redirect URL with `{{ID}}`. ACL condition editors no longer render blank in Firefox below 100% zoom. The Quick Setup flow gained a telemetry toggle and a recommendation to use getgrist.com authentication. Two new Admin Panel boot probes warn when document data may not survive a restart and report how outgoing requests are gated. Building grist-core from source now produces the full edition by default, with `yarn run set-community-edition` for the previous behavior. In the full edition, OAuth apps now support OAuth Dynamic Client Registration (RFC 7591), so OAuth and MCP (Model Context Protocol) clients can register without being pre-provisioned, and apps can manage webhooks with just the `doc:webhooks` permission instead of the broader `doc.schema:write`.

###### Improvements

* Forms
  * Redirect URLs can substitute the submitted record's ID with `{{ID}}`, so a form can send the user to a page about their own submission (#1831)
* Airtable import
  * Large schemas are imported by submitting `ModifyColumn` actions in batches of 25, avoiding gateway timeouts on bases with many columns ([commit](https://github.com/gristlabs/grist-core/commit/f8c45df3))
* Custom widgets
  * Reverted a restriction that disallowed same-origin custom-widget URLs, which had broken some unusual but legitimate setups ([commit](https://github.com/gristlabs/grist-core/commit/eb483ef5))
* Quick Setup
  * Telemetry can be turned on during the Quick Setup flow, instead of only from the Admin Panel or an environment variable (#2419)
  * The authentication step recommends getgrist.com authentication with a hero card when no other provider is configured (#2410)
* Admin Panel
  * New "persist-data" boot probe warns when documents and the home DB sit on ephemeral storage and would be lost on restart (the Docker default with no volume at `/persist`, a RAM filesystem, or the container's root mount). Shown in the Admin Panel and as a banner on the Backups page; external storage or Postgres count as durable (#2396)
  * New "Outgoing requests" boot probe and Security Settings entry report how user-triggered outgoing requests (`REQUEST()`, webhooks, Import from URL) are gated by `GRIST_PROXY_FOR_UNTRUSTED_URLS` (#2294)
  * Edition is now its own card, the legacy Enterprise toggle is gone, switching edition clears the activation key, and the trial banner links to Admin Panel / Edition ([commit](https://github.com/gristlabs/grist-core/commit/3b2ee8e8))
* Build / packaging
  * `yarn install` in grist-core now builds the full edition by default, via a post-install hook that downloads the `ext` material from grist-ee. Use `yarn run set-community-edition` to skip it (the previous behavior) or `yarn run set-full-edition` to opt in explicitly. The chosen edition is saved to `grist-edition`, `GRIST_EDITION` takes precedence, and `GRIST_SKIP_EXT_AUTOSETUP` skips the hook for contexts where extensions are installed manually (Docker builds, grist-desktop, grist-static) ([commit](https://github.com/gristlabs/grist-core/commit/b0fa5fb8))
* Internal / infrastructure
  * File uploading refactored so uploads route to the correct doc worker (doc-specific endpoints) or travel in the main request (imports), in preparation for simpler multi-server configuration ([commit](https://github.com/gristlabs/grist-core/commit/22343c37))
  * Bump `@gristlabs/node-sqlite3` (#2392)
  * Test database connection now verifies it points at the database the caller asked for, fixing `DocApiMisc` share tests that failed after certain other suites (#2402)

###### Fixes

* Duplicate document and Save Copy no longer fail with "Unknown Host" when both `GRIST_PROXY_FOR_UNTRUSTED_URLS` and `APP_DOC_INTERNAL_URL` are set, since trusted internal URLs now use a direct fetch instead of the untrusted-URL proxy (#2344)
* ACL condition editors no longer render blank in F

_[Truncated at 4000 characters — full notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.16]_

### v1.7.15

- Date: 2026-06-10
- Version: v1.7.15
- Original notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.15
- Permalink: https://whatsnew.fyi/product/grist/releases/v1.7.15

- **added** — OAuth support extended to home API endpoints including GET /orgs, GET /orgs/:oid/workspaces, POST /workspaces/:wid/docs, and GET /profile/user with resource-level filtering for scoped tokens
- **changed** — TypeScript upgraded to 5.9.3 with tsc and esbuild targets bumped to es2020
- **changed** — External storage configuration tidied with each storage backend owning its option spec and S3 bucket probing at startup for early failure detection
- **changed** — Translation keys cleaned up to unblock auto-pruning by wrapping variable calls to t() with explicit switches
- **changed** — Dependency bumped: ws from 8.18.0 to 8.20.1
- **changed** — Dependency bumped: axios from 1.15.2 to 1.16.0 with fetch adapter now enforcing maxBodyLength and maxContentLength
- **changed** — Dependency bumped: tmp from 0.2.5 to 0.2.6
- **changed** — Dependency bumped: shell-quote from 1.8.1 to 1.8.4
- **changed** — Upgraded picomatch, minimatch, glob, and serialize-javascript to clear high-severity advisories
- **security** — Harden value interpolation in server-rendered pages by escaping values embedded into inline script blocks with jsesc and canonicalizing openerOrigin to bare origin
- **security** — Require a matching authenticated session to reconnect a websocket instead of allowing clientId alone to attach to an existing session
- **security** — Disallow same-origin custom-widget URLs as defense in depth against XSS payloads being weaponized through widget URLs
- **security** — Disable triggers when a document is downloaded or copied and regenerate webhook secrets correctly when a document with webhooks is uploaded
- **security** — Sanitize link URLs from the next parameter on /welcome/select-account to be same-origin and sanitize URLs in document tours
- **security** — Close metadata leakage in GET /forms by reading table metadata through fetchMetaTables and checking that the section is actually a form
- **fixed** — Crash instead of silently failing when login middleware cannot initialize with unreachable identity provider at startup
- **fixed** — Fix card widget bugs where new card widgets no longer borrow the record card layout and cards with stale field references fall back to default layout
- **changed** — README updated for Quick setup first-run flow including boot-key login and Quick setup wizard descriptions with new GRIST_IN_SERVICE environment variable

##### What's Changed

An infrastructure release. First, an upgrade for OAuth access token authentication in Grist's REST API: a new credential framework in grist-core, with the token validator and OIDC server (including CIMD registration and MCP server tools) shipping in the Full Grist edition, where OAuth apps also move from experiment to available by default. Second, a wave of security hardening: a metadata leakage in `GET /forms` is closed, server-rendered pages get stricter value escaping, websocket reconnection now requires a matching authenticated session, custom-widget URLs can no longer be same-origin, and triggers are disabled when a document is downloaded or copied. TypeScript was upgraded to 5.9.3, and several dependencies were bumped to clear known vulnerabilities.

###### Improvements

###### API

* **OAuth support extended to home API endpoints**. `GET /orgs`, `GET /orgs/:oid/workspaces`, `POST /workspaces/:wid/docs`, and a new `GET /profile/user` now accept OAuth tokens, with resource-level filtering so a scoped token sees only the orgs and documents it was granted, and is rejected when creating documents in un-granted workspaces or orgs. ([commit](https://github.com/gristlabs/grist-core/commit/f481fd1d))

###### Internal / infrastructure

* **TypeScript upgraded to 5.9.3**, with `tsc` and `esbuild` targets bumped to es2020. ([commit](https://github.com/gristlabs/grist-core/commit/7adf2e6c))
* **External storage configuration tidied**. Each storage backend now owns its option spec, and a configured S3 bucket is probed at startup so a misconfiguration (such as a missing `AWS_REGION`) fails fast at startup rather than mid-request. ([commit](https://github.com/gristlabs/grist-core/commit/c4843f25))
* **Translation keys cleaned up to unblock auto-pruning**. Five call sites passed a variable rather than a literal to `t()`, hiding the keys from the i18next scanner; each is now wrapped in a helper with an explicit switch so every key is visible. Orphaned onboarding-choice and theme-label keys were migrated to the scopes the runtime actually looks them up under, fixing labels that previously always showed in English. (#2368)
* **Dependency bumps**. `ws` 8.18.0 to 8.20.1 (fixes an uninitialized memory disclosure in `websocket.close()`) (#2370), `axios` 1.15.2 to 1.16.0 (the fetch adapter now enforces `maxBodyLength` and `maxContentLength`) (#2375), `tmp` 0.2.5 to 0.2.6 (#2369), `shell-quote` 1.8.1 to 1.8.4 (#2386), and an upgrade of `picomatch`, `minimatch`, `glob`, and `serialize-javascript` that cuts the high-severity advisories reported by `yarn audit` (#2381).

###### Documentation

* **README updated for the Quick setup first-run flow**. Quickstart, Admin Panel, Logins, and building-from-source sections now describe the boot-key login and Quick setup wizard, with a new `GRIST_IN_SERVICE` entry in the env var table. (#2366)

###### Fixes

###### Security

* **Harden value interpolation in server-rendered pages**. Values embedded into inline `<script>` blocks in `sendAppPage` and `OAuth2Clients` are now escaped with `jsesc` and inserted without interpreting `String.replace` patterns (such as `$'` and `$&`), and `openerOrigin` is canonicalized to its bare origin. ([commit](https://github.com/gristlabs/grist-core/commit/4ced8064))
* **Require a matching authenticated session to reconnect a websocket**. A `clientId` alone is no longer enough to attach to an existing session; the new connection must belong to the same authenticated user, so a `clientId` cannot be used on its own to impersonate a user. ([commit](https://github.com/gristlabs/grist-core/commit/d5a308df))
* **Disallow same-origin custom-widget URLs**. A new `disallowCustomWidgetUrl()` helper refuses widgets whose URL is same-origin or on Grist's configured base domain, as defense in depth against an XSS payload being weaponized through a widget URL. ([commit](https://github.com/gristlabs/grist-core/commit/f579977c))
* **Disable tri

_[Truncated at 4000 characters — full notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.15]_

### v1.7.14

- Date: 2026-05-28
- Version: v1.7.14
- Original notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.14
- Permalink: https://whatsnew.fyi/product/grist/releases/v1.7.14

- **added** — Guided first-run setup wizard is now the default flow for fresh self-hosted installations
- **added** — POST /records/list API endpoint for sending large queries in the request body
- **added** — Screen-reader support in grid views
- **added** — Keyboard shortcuts to open row and column menus in grid views
- **added** — Keyboard shortcuts to open context menus when in widgets
- **added** — Page widget picker now works with keyboard and screen readers
- **added** — New date formats
- **changed** — Setup wizard now checks which formula sandboxes are available when it opens instead of waiting until that step
- **changed** — Custom CSS file configured with APP_STATIC_INCLUDE_CUSTOM_CSS is now also applied inside widgets
- **changed** — Built-in calendar widget now loads from the bundled copy instead of from GitHub
- **changed** — Install-wide default permissions can now be changed from the Admin Panel's Security Settings
- **changed** — Authentication changes in the setup wizard are now staged like other pending changes with sign-in required after changes
- **changed** — Action summaries now mark which cell values are genuinely unknown instead of replacing known values with wildcards when merging
- **changed** — Improved locale guessing and locale fallback logic
- **fixed** — Editing a document from the assistant popup now forks it first if it is a template or unsaved scratch document
- **fixed** — Fixed a case where editing through the assistant could slip past access checks while previewing as owner
- **fixed** — Prevent anonymous users from forking documents
- **fixed** — The /status health check now returns starting (HTTP 503) on first startup until the server is ready
- **fixed** — Prevent a console error when pressing ctrl+alt+o on the homepage

##### What's Changed

The first-run experience for self-hosted installations matures. The setup wizard previewed last release is now the default flow a fresh install lands on. It checks earlier which formula sandboxes are available, handles authentication changes more cleanly, and lets you edit the install-wide default permissions from the Admin Panel. Accessibility takes a big step forward too: screen-reader support and keyboard navigation now reach grid views, menus, and the page widget picker. There are also new date formats, a `POST /records/list` API endpoint for large queries, custom CSS inside widgets, and the usual dependency bumps and fixes. Two more features are under development in the full edition: **OAuth Apps** and an **MCP (Model Context Protocol) endpoint**. See "Full Grist edition extensions" below.

###### New features

* **[Guided first-run setup wizard](https://support.getgrist.com/install/first-run-setup/)**. The setup wizard previewed in v1.7.13 is now the flow fresh self-hosted installations land on. Sign in with the boot key (the `GRIST_BOOT_KEY` admin secret printed at startup), and the wizard walks you through `/admin/setup` to configure your instance. The "Quick setup" entry is now active in the admin sidebar. Refinements this release:
  * The wizard now checks which formula sandboxes are available as soon as it opens, not when you reach that step. No more waiting on a spinner (#2341)
  * Smoother entry into the wizard: cleaner redirects after an authentication change and after signing in with the boot key (#2340)
  * Set up "Sign in with getgrist.com" from the wizard, and returning from getgrist.com's registration page now brings you back into the wizard, not the main Admin Panel (#2310)
  * Signed-out and non-admin users can no longer open the Quick setup page. They get the same "unavailable" card as the Admin Panel (#2323)
  * Authentication changes are now staged like the wizard's other pending changes. Admins are sent back through sign-in after changing them (#2315, #2331)
  * The four install-wide default permissions (team sites, personal sites, anonymous access, anonymous playground) can now be changed from the Admin Panel's Security Settings, not just during the wizard (#2314)
* **`POST /records/list` endpoint**. A POST companion to the records endpoint. Large queries can be sent in the request body instead of the URL (#2321).

###### Improvements

* [Accessibility](https://support.getgrist.com/accessibility/) (contributed by @manuhabitela)
  * Screen-reader support in grid views (#2114)
  * Open the row and column menus via keyboard shortcuts in a grid view (#2230)
  * Open the context menu via keyboard shortcuts when in widgets (#2226)
  * Page widget picker now works with keyboard and screen readers (#2273)
* Custom widgets
  * A custom CSS file configured with `APP_STATIC_INCLUDE_CUSTOM_CSS` is now also applied inside widgets, not just the main app. Contributed by @manuhabitela (#2089)
  * The built-in calendar widget now loads from the copy bundled with Grist instead of the one hosted on GitHub. The GitHub copy pulled in external CDN files that ad blockers and privacy extensions sometimes blocked (#2262)
* Localization
  * New date formats (#2347)
  * Improved locale guessing and locale fallback logic (#2313)
* API
  * Action summaries (the change summaries used by features such as webhooks) now mark which cell values are genuinely unknown. Before, merging two summaries could replace a known value with a wildcard. Now it keeps the real value where it has one (#2361)
* Internal / infrastructure
  * Added a filesystem-based document storage backend for tests, enabled with `GRIST_FS_STORAGE_DIR`. It implements Grist's external storage interface, normally backed by S3-compatible object storage ([commit](https://github.com/gristlabs/grist-core/commit/a1515c26)). It also gets a (test-only) card in the Admin Panel backups section ([commit](https://github.com/grist

_[Truncated at 4000 characters — full notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.14]_

### v1.7.13

- Date: 2026-04-29
- Version: v1.7.13
- Original notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.13
- Permalink: https://whatsnew.fyi/product/grist/releases/v1.7.13

- **added** — New self-hosted installations generate a GRIST_BOOT_KEY and print it at startup, allowing login as install admin via /boot without a pre-existing account
- **added** — WebSocket connections now accept API keys, boot keys, and access tokens for console clients and out-of-page custom widgets
- **added** — Grist can restart in place to apply config changes without dropping the listening socket via GRIST_RESTART_SHELL flag
- **added** — Team site owners on self-managed installations get a Site Settings page to edit team name, domain, and logo
- **changed** — Pyodide sandbox updated from 0.23.4 to 0.28.1
- **changed** — Airtable import now updates existing rows by default when the source has an Airtable ID column
- **changed** — Airtable import brings choice colors along with imported data
- **changed** — (Bulk)AddOrUpdateRecord API now returns id, recordIds, createdRecordIds, and updatedRecordIds
- **changed** — Custom widgets receive a new linking field on InteractionOptions indicating whether they are an incoming-link target (asTarget) or used as a source by other sections (asSource)
- **changed** — Search in document now ignores accents
- **changed** — Forms scroll like a normal page, fixing Tab not appearing to work on first press in Firefox
- **changed** — Account settings split into Profile and Developer subpages
- **changed** — Webhook API ignores empty action payloads to match other endpoints
- **changed** — Number-of-suggestions badge replaced with a status dot to remove counting ambiguity
- **changed** — Per-document unsubscribe link added for row-change notifications
- **changed** — Admin Panel authentication section rebuilt with status-coded hero card and collapsible other methods list
- **fixed** — Fix wrong active section in the creator panel after duplicating a page with collapsed widgets
- **fixed** — Fix CORS handling for opaque origins, eliminating spurious 500s for https:// widgets on http:// hosted sites
- **fixed** — Fix padded checkboxes so the border and tick line up inside padded wrappers
- **fixed** — Fix SELF_HYPERLINK() returning a share-key URL when a doc was first opened via a share link
- **fixed** — Fix wrapped row height preservation after modifying a cell in suggestions

##### What's Changed

New self-hosted installations now print a **boot key** at startup that lets you log in as the install admin, with no pre-existing account needed. WebSocket connections now accept API keys, boot keys, and access tokens, not just session cookies, so consoles, scripts, and out-of-page custom widgets can talk to Grist over the same channel browsers use. The Pyodide sandbox jumped from 0.23.4 to 0.28.1. Airtable imports can update existing rows in place and bring choice colors with them. The `(Bulk)AddOrUpdateRecord` API hands back the IDs of the rows it added or updated, so upserts are easier to chain. Custom widgets now know whether they're a target or source of section linking. "Search in document" ignores accents. Team site owners on self-managed installations get a new Site Settings page for name, domain, and logo. And Grist can restart in place to apply config changes without dropping its listening socket.

###### New features

* **Boot key login**. New installations generate a `GRIST_BOOT_KEY` and print it at startup. Visit `/boot`, paste the key, and you're logged in as the install admin and ready to set the admin email. No pre-existing account needed, and no window where the server is open to the world before authentication is configured. The key (and the related `GRIST_IN_SERVICE` flag) can also be set via env vars or managed from the Admin Panel. Existing installations are unaffected. ([commit](https://github.com/gristlabs/grist-core/commit/e6a3351d))
* **Restart in place**. Grist can now apply config changes by restarting itself without dropping the listening socket. During the brief gap, `/status` keeps answering for liveness checks while readiness flips to 503. On by default for Linux under Node, off for Windows and Electron. Toggle with `GRIST_RESTART_SHELL=true/false` (#2265).
* **Site Settings page**. Team site owners on self-managed installations can edit team name, domain, and logo from a new `/site-settings` page ([commit](https://github.com/gristlabs/grist-core/commit/0fcd2e90)).
* **WebSocket auth for API keys, boot keys, and access tokens**. The WebSocket side now goes through the same identity-resolving code path as the REST API, so any auth method that works on one works on the other. Opens the door to console clients and out-of-page custom widgets. Also tidies up auth priority and unifies API rate-limiting between the two. ([commit](https://github.com/gristlabs/grist-core/commit/07c9617a))

###### Improvements

* Airtable import
  * Updates existing rows by default when the source has an Airtable ID column, and resolves references against rows already in the doc (#2216)
  * Brings Airtable choice colors along for the ride (#2199)
* API
  * `(Bulk)AddOrUpdateRecord` now returns `id` / `recordIds` / `createdRecordIds` / `updatedRecordIds`, and `BulkAddOrUpdateRecord` accepts a `record`-shaped payload that can match different columns per row (#2193)
  * Webhook API ignores empty action payloads, matching the other endpoints (#2308)
* Custom widgets
  * New `linking` field on `InteractionOptions` tells a widget whether it's an incoming-link target (`asTarget`) or used as a source by other sections (`asSource`) (#2259)
* Sandboxing
  * Pyodide updated from 0.23.4 to 0.28.1 (#1754)
* Suggestions
  * The number-of-suggestions badge is now a status dot, removing counting ambiguity ([commit](https://github.com/gristlabs/grist-core/commit/c2cdb8a1))
  * Per-document unsubscribe link for row-change notifications ([commit](https://github.com/gristlabs/grist-core/commit/e9113b8b))
* Admin Panel
  * Authentication section rebuilt with a status-coded hero card, getgrist.com Reconfigure / Deactivate, and a collapsible "other methods" list (#2227)
* UI/UX
  * "Search in document" now ignores accents (#2221)
  * Forms scroll like a normal page, fixing Tab not appearing to do anything on first press in Firefox (#2179)
  * Account settings split into Profile and Developer s

_[Truncated at 4000 characters — full notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.13]_

### v1.7.12

- Date: 2026-03-31
- Version: v1.7.12
- Original notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.12
- Permalink: https://whatsnew.fyi/product/grist/releases/v1.7.12

- **changed** — Airtable imports now land in the current workspace instead of an unexpected location
- **changed** — Airtable formula columns with field references are imported as better comments
- **changed** — Airtable single record link fields are imported as Ref columns instead of RefList
- **changed** — Airtable imports now use the /tables endpoint for better availability
- **changed** — Suggestions now show comparison highlighting automatically in suggestion mode
- **changed** — Improved compare to original feature for suggestions
- **changed** — Form select fields are now better usable with screen readers
- **changed** — SCIM user search is now faster
- **changed** — Docker image now uses gristlabs/gvisor-unprivileged for a more up-to-date version of runsc
- **added** — API now has cellFormat=typed option for REST API and Custom Widget API to provide properly typed values
- **changed** — Reduce GRIST_LOG_API_DETAILS logging to omit body and result while adding docId
- **changed** — Improve accessibility of Undo and Redo action buttons
- **added** — Add max length on text inputs in forms
- **fixed** — Fix document icon when the second word of the doc name is an emoji
- **fixed** — Fix unreadable dark mode colors in banners
- **changed** — Hide admin panel links in grist-desktop
- **removed** — Remove the ⌘⇧H / Ctrl+Shift+H shortcut from the Use as table headers command
- **changed** — Store anchor links in comments as relative URLs
- **added** — Automations tool in the left-hand panel for document owners to create trigger-driven workflows with conditions, filters, and actions
- **fixed** — Fix Row unavailable race condition

##### What's Changed

Airtable imports are now smoother, and the import lands in your current workspace instead of somewhere unexpected. Suggestions got a visual refresh with automatic comparison highlighting as you type. Forms are more accessible, and the API now has a `cellFormat=typed` option so you can get properly typed values back without guessing.

If you include [extra extensions](https://github.com/gristlabs/grist-core?tab=readme-ov-file#building-from-source) in your build, there's a new automations UI that lets you set up triggers on your data. You can define conditions on any table, then fire off email notifications or webhooks when rows match. You can send dynamic emails to different recipients based on column values, filter with Python conditions, and monitor everything from a delivery log. Automations are part of the full edition of Grist, which has a 30-day trial, and is [free for individuals and small orgs](https://www.getgrist.com/free-grist-activation-key-faq/) (under $1M annual funding). The full edition funds the development of grist-core.

###### Improvements

* Airtable import
  * Formula columns with field references are imported as better comments (#2201)
  * Single record link fields are imported as "Ref" (vs "RefList") columns (#2165)
  * Imports now use the `/tables` endpoint for better availability (#2171)
  * Import now targets the current org and workspace (#2139)
  * Show a nicer message when Airtable OAuth integration isn't configured (#2146)
* Suggestions
  * Comparison highlighting is now shown automatically in suggestion mode (#2140)
  * Improved "compare to original" feature (#2068)
  * Fix suggestion count on a copied document that has been auto-forked (#2117)
  * Fix deleting rows correctly in suggestions (#2174)
* Forms
  * Make `select` fields better usable with screen readers (#2164)
* SCIM
  * Speed up user search (#2070)
* Sandboxing
  * Use `gristlabs/gvisor-unprivileged` in the base Docker image for a more up-to-date version of runsc
* API
  * New [`cellFormat=typed`](https://github.com/gristlabs/grist-core/commit/757059da) option for both the REST API and Custom Widget API, providing consistent, self-describing values that preserve type information for Ref, RefList, Attachments, Date, and DateTime columns
  * Reduce `GRIST_LOG_API_DETAILS` logging: omit body and result, add docId (#2175)
* UI/UX
  * Improve accessibility of Undo / Redo action buttons (#2167)
  * Add max length on text inputs in forms (#2097)
  * Fix document icon when the second word of the doc name is an emoji (#2170)
  * Fix unreadable dark mode colors in banners (#2138)
  * Hide admin panel links in grist-desktop (#2181)
  * Remove the ⌘⇧H / Ctrl+Shift+H shortcut from the "Use as table headers" command
  * Store anchor links in comments as relative URLs
* Documentation
  * Rewrite grist-data-format.md to reflect actual Grist data format (#2177)
  * Freshen list of features in README.md (#2142)
* Internal / infrastructure
  * Upgrade @gristlabs/sqlite3
  * Add Storybook for documenting Grist UI components

###### Fixes

* Fix 'Row unavailable' race condition (#2156)
* Fix NumericFormatter test flakiness across ICU versions (#2176)
* Fix typo in floating menu selector (#2187)

###### Full Grist edition extensions

* [Automations](https://support.getgrist.com/automations/), a new tool in the left-hand panel for document owners to create trigger-driven workflows
  * Set conditions on any table, filter by column values, require specific columns to be filled, use custom Python filters
  * Choose when to trigger: when a row enters the filtered view, when it's newly added, or on any update
  * Actions: [send an email](https://github.com/gristlabs/grist-core/commit/2eeb4cea) (with dynamic recipients, variable placeholders, and Markdown support) or create a webhook
  * Monitor all automations from a delivery log with success/error/pending status
* Automation tool vis

_[Truncated at 4000 characters — full notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.12]_

### v1.7.11

- Date: 2026-02-27
- Version: v1.7.11
- Original notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.11
- Permalink: https://whatsnew.fyi/product/grist/releases/v1.7.11

- **added** — Add optional authentication using getgrist.com accounts for self-hosted installations
- **added** — Add ability to import Airtable bases directly into new or existing Grist documents
- **added** — Add GRIST_PERSONAL_ORGS environment variable to disable personal organizations
- **added** — Add GRIST_ORG_CREATION_ANYONE environment variable to prevent non-admins from creating new organizations
- **added** — Add configurable email notifications for suggestions
- **changed** — Allow the maximum options limit on Forms to be configured up to 1000 options, defaulting to 30
- **changed** — Limit GVisor to 8 processes by default
- **changed** — Display references and reference lists in a friendlier fashion in suggestions
- **changed** — Add confirmation dialog when a resource is being shared publicly
- **changed** — Hide the bell icon showing connection state when Grist is connected and functioning normally
- **fixed** — Correct attachment endpoints having inconsistent permissions
- **fixed** — Fix XLSX downloads when the export options don't include tableId
- **fixed** — Fix an error that would pop up when doing multiple successive imports with the Pyodide sandbox enabled
- **fixed** — Fix an error with importing when the Grist instance is hosted on Windows
- **fixed** — Fix suggestions occasionally displaying incorrectly in documents with deleted tables
- **fixed** — Fix role members having incorrect entries in SCIM
- **fixed** — Fix doubled-up overlays in filter-linked widgets that have rows blocked by access control lists
- **fixed** — Fix virtual table display and scrollbar issues on MacOS
- **fixed** — Prevent conditional formatting changes from being displayed as suggestions

##### What's Changed

###### New features

* [Optional authentication using getgrist.com accounts](https://support.getgrist.com/install/sign-in-with-grist/)
  * This provides an easy-to-use authentication option for self-hosted installations that don't want to run their own authentication servers or configure other external identity providers.
* [Import from Airtable](https://support.getgrist.com/imports/#import-from-airtable)
  * Airtable bases can be imported directly into new or existing Grist documents.
* [New environment variables](https://github.com/gristlabs/grist-core/blob/v1.7.11/README.md#environment-variables) have been added to provide better control over which users are able to access your Grist instance. `GRIST_PERSONAL_ORGS` will disable personal organizations, while `GRIST_ORG_CREATION_ANYONE` will prevent any non-admins from creating new organizations.
* [Configurable email notifications for suggestions](https://support.getgrist.com/document-settings/#notifications)

###### Improvements

* Forms
  * Allow the maximum options limit on Forms to be configured (defaults to 30 options, configurable up to 1000)
* Sandboxing / security
  * Limit GVisor to 8 process by default
* Suggestions
  * Display references and reference lists in a friendlier fashion
  * Prevent conditional formatting changes from being displayed as suggestions
* UI/UX
  * Add a confirmation dialog when a resource is being shared publicly
  * Hide the bell icon showing connection state when Grist is connected and functioning normally

###### Fixes

* API endpoints
  * Correct attachment endpoints having inconsistent permissions (#2116)
* Exports
  * Fix XLSX downloads when the export options don't include tableId (#2054)
* Import
  * Fix an error that would pop up when doing multiple successive imports with the Pyodide sandbox enabled (#2073)
  * Fix an error with importing when the Grist instance is hosted on Windows (e.g. Grist desktop) (#2064)
* Suggestions
  * Fix suggestions occasionally displaying incorrectly in documents with deleted tables (#2069)
* SCIM
  * Fix role members having incorrect entries (#2051)
* UI/UX
  * Fix doubled-up overlays in filter-linked widgets that have rows blocked by access control lists (#2056)
  * Fix virtual table display and scrollbar issues on MacOS (#2075)

##### Contributions

@fflorent 

###### Translations

@VaclavDort
@filiphanes
@qleroy
@mirithillion
@hexaltation
@alimahwer
@thuma
@audez
@vonbraun22
@umam15
@kraudio
@xabirequejo
@Artur Dabrowski
@Thanyanit-J 

**Full Changelog**: https://github.com/gristlabs/grist-core/compare/v1.7.10...v1.7.11

[Join our Discord Community](https://discord.gg/MYKpYQ3fbP) if you'd like to get into development of Grist.

### v1.7.10

- Date: 2026-01-12
- Version: v1.7.10
- Original notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.10
- Permalink: https://whatsnew.fyi/product/grist/releases/v1.7.10

- **fixed** — Restore the Grist Labs custom widget repository as the default repository that was removed in v1.7.9

##### Hotfix

grist-core 1.7.10 is a hotfix release that fixes a regression from 1.7.9 where the Grist Labs custom widget repository stopped being included as the default repository by mistake. As a result, Grist Labs and community custom widgets are no longer shown when adding a new custom widget, and any previously added Grist Labs or community custom widgets will fail to load.

##### Contributions

###### Translations

* @xabirequejo 

**Full Changelog**: https://github.com/gristlabs/grist-core/compare/v1.7.9...v1.7.10

[Join our Discord Community](https://discord.gg/MYKpYQ3fbP) if you'd like to get into development of Grist.

### v1.7.9

- Date: 2026-01-09
- Version: v1.7.9
- Original notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.9
- Permalink: https://whatsnew.fyi/product/grist/releases/v1.7.9

- **security** — Fix vulnerability in pyodide sandboxing method
- **added** — New intro screen for Access Rules with Enable Access Rules button that creates initial recommended rules
- **added** — Add Disable Access Rules button shown when there are no custom rules
- **added** — New option to restrict non-owners from downloading or copying the document when permission to view Access Rules is enabled
- **added** — Document owners can now resolve and reopen comment threads
- **added** — Document owners can now delete comments
- **changed** — Restrict users who can view all data from viewing Access Rules by default
- **changed** — Redesigned authentication section in Admin Panel for configuring user authentication in self-managed Grist
- **changed** — Org and workspace modifications are now limited to users with owner permissions
- **changed** — Show a record is unavailable message when a user opens a record card blocked by ACLs
- **changed** — Improve rendering of changes in suggestions
- **changed** — Show a count of changes when making a suggestion
- **fixed** — Fix frontend memory leaks
- **fixed** — Fix styling issues when printing a document
- **fixed** — Fix broken enable/disable document endpoints in multi-server environments
- **fixed** — Fix how zero Date/DateTimes look to other formulas
- **fixed** — Don't force reloads when a column is added to a user attribute table
- **fixed** — Fix form sharing with references with no display column
- **fixed** — Validate emails used to share access
- **changed** — Optimize row filtering in Access Rules

##### Security advisory

A security review identified a vulnerability in the "pyodide" sandboxing method that is available in Grist. You can check if you are affected in the sandboxing section of the Admin Panel of your instance. If you see "gvisor" there, then you are not affected.If you see "pyodide", then it is important to update to this version of Grist or later.

Link for advisory: https://github.com/gristlabs/grist-core/security/advisories/GHSA-7xvx-8pf2-pv5g

##### Notable fixes and improvements

* New intro screen for Access Rules:
  * A document without rules now shows an intro screen with an "Enable Access Rules" button:
    * On confirming, it creates the initial recommended rules: namely, disable structure permission for non-owners
  * There is also a "Disable Access Rules" button that's shown when there are no custom rules
* Restrict users who can view all data from viewing Access Rules by default:
  * If permission to view Access Rules is enabled, then there is a new option: to restrict non-owners from downloading or copying the document
  * This restriction is added by default when permission to view Access Rules is given
  * Granting permission to view Access Rules and removing the restriction on downloading/copying the document approximates the previous behavior
* Redesigned authentication section in Admin Panel for configuring user authentication in self-managed Grist
* Org and workspace modifications are now limited to users with owner permissions
* Document owners can now resolve and reopen comment threads, and delete comments
* Fixes for some frontend memory leaks
* Fixes for some styling issues when printing a document
* Fix for broken enable/disable document endpoints in multi-server environments
* Optimizations to row filtering in Access Rules
* Show a "record is unavailable" message when a user opens a record card blocked by ACLs [PR #1896](https://github.com/gristlabs/grist-core/pull/1896)
* Fix how zero Date/DateTimes look to other formulas [PR #1995](https://github.com/gristlabs/grist-core/pull/1995)
* Don't force reloads when a column is added to a user attribute table [PR #2035](https://github.com/gristlabs/grist-core/pull/2035)
* Several improvements to RecordSet handling [PR #1992](https://github.com/gristlabs/grist-core/pull/1992)
* Correctly share forms with references with no display column [PR #2008](https://github.com/gristlabs/grist-core/pull/2008)
* Improve rendering of changes in suggestions [PR #1977](https://github.com/gristlabs/grist-core/pull/1977)
* Show a count of changes when making a suggestion [PR #1960](https://github.com/gristlabs/grist-core/pull/1960)
* Validate emails used to share access [PR #2016](https://github.com/gristlabs/grist-core/pull/2016)

##### Contributions

* @fflorent: Bump js-yaml from 3.14.1 to 4.1.1 [PR #1961](https://github.com/gristlabs/grist-core/pull/1961)
* @fflorent: Bump Typescript to version 4.9.4 [PR #1993](https://github.com/gristlabs/grist-core/pull/1993)
* @fflorent: Eslint: Remove function appCommWaiter (dead code) [PR #2001](https://github.com/gristlabs/grist-core/pull/2001)
* @fflorent: Upgrade eslint [PR #2000](https://github.com/gristlabs/grist-core/pull/2000) [PR #2005](https://github.com/gristlabs/grist-core/pull/2005) [PR #2020](https://github.com/gristlabs/grist-core/pull/2020) [PR #2030](https://github.com/gristlabs/grist-core/pull/2030)
* @fflorent: develop.md: Simplify the paragraph detailing the coding rules [PR #2031](https://github.com/gristlabs/grist-core/pull/2031)
* @manuhabitela: Make sure a Form Submit row can't be removed with keyboard [PR #1979](https://github.com/gristlabs/grist-core/pull/1980)
* @manuhabitela: Choices text box: make sure all choice tokens are readable [PR #1982](https://github.com/gristlabs/grist-core/pull/1982)

###### Translations

* @maksim2005UKR
* @hexaltation
* @h0r0m
* @winjie0618
* @audez
* @umam15
* @mirithilion
* @oliverne
* @vonbraun22
* Ale

_[Truncated at 4000 characters — full notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.9]_

### v1.7.8

- Date: 2025-11-26
- Version: v1.7.8
- Original notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.8
- Permalink: https://whatsnew.fyi/product/grist/releases/v1.7.8

- **added** — New API endpoints for disabling documents
- **added** — New API endpoints for enabling documents
- **fixed** — Miscellaneous bug fixes

##### What's Changed
* There are new API endpoints for [disabling](https://support.getgrist.com/api/#tag/docs/operation/disableDoc) and [enabling](https://support.getgrist.com/api/#tag/docs/operation/enableDoc) documents
* Miscellaneous bug fixes and translations

**Full Changelog**: https://github.com/gristlabs/grist-core/compare/v1.7.7...v1.7.8
[Join our Discord Community](https://discord.gg/MYKpYQ3fbP) if you'd like to get into development of Grist.