# Grist v1.7.13

- Product: Grist (https://whatsnew.fyi/product/grist)
- Vendor: Grist Labs
- Date: 2026-04-29
- Version: v1.7.13
- Original notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.13
- Permalink: https://whatsnew.fyi/product/grist/releases/v1.7.13

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — New self-hosted installations generate a GRIST_BOOT_KEY and print it at startup, allowing login as install admin via /boot without a pre-existing account
- **added** — WebSocket connections now accept API keys, boot keys, and access tokens for console clients and out-of-page custom widgets
- **added** — Grist can restart in place to apply config changes without dropping the listening socket via GRIST_RESTART_SHELL flag
- **added** — Team site owners on self-managed installations get a Site Settings page to edit team name, domain, and logo
- **changed** — Pyodide sandbox updated from 0.23.4 to 0.28.1
- **changed** — Airtable import now updates existing rows by default when the source has an Airtable ID column
- **changed** — Airtable import brings choice colors along with imported data
- **changed** — (Bulk)AddOrUpdateRecord API now returns id, recordIds, createdRecordIds, and updatedRecordIds
- **changed** — Custom widgets receive a new linking field on InteractionOptions indicating whether they are an incoming-link target (asTarget) or used as a source by other sections (asSource)
- **changed** — Search in document now ignores accents
- **changed** — Forms scroll like a normal page, fixing Tab not appearing to work on first press in Firefox
- **changed** — Account settings split into Profile and Developer subpages
- **changed** — Webhook API ignores empty action payloads to match other endpoints
- **changed** — Number-of-suggestions badge replaced with a status dot to remove counting ambiguity
- **changed** — Per-document unsubscribe link added for row-change notifications
- **changed** — Admin Panel authentication section rebuilt with status-coded hero card and collapsible other methods list
- **fixed** — Fix wrong active section in the creator panel after duplicating a page with collapsed widgets
- **fixed** — Fix CORS handling for opaque origins, eliminating spurious 500s for https:// widgets on http:// hosted sites
- **fixed** — Fix padded checkboxes so the border and tick line up inside padded wrappers
- **fixed** — Fix SELF_HYPERLINK() returning a share-key URL when a doc was first opened via a share link
- **fixed** — Fix wrapped row height preservation after modifying a cell in suggestions

##### What's Changed

New self-hosted installations now print a **boot key** at startup that lets you log in as the install admin, with no pre-existing account needed. WebSocket connections now accept API keys, boot keys, and access tokens, not just session cookies, so consoles, scripts, and out-of-page custom widgets can talk to Grist over the same channel browsers use. The Pyodide sandbox jumped from 0.23.4 to 0.28.1. Airtable imports can update existing rows in place and bring choice colors with them. The `(Bulk)AddOrUpdateRecord` API hands back the IDs of the rows it added or updated, so upserts are easier to chain. Custom widgets now know whether they're a target or source of section linking. "Search in document" ignores accents. Team site owners on self-managed installations get a new Site Settings page for name, domain, and logo. And Grist can restart in place to apply config changes without dropping its listening socket.

###### New features

* **Boot key login**. New installations generate a `GRIST_BOOT_KEY` and print it at startup. Visit `/boot`, paste the key, and you're logged in as the install admin and ready to set the admin email. No pre-existing account needed, and no window where the server is open to the world before authentication is configured. The key (and the related `GRIST_IN_SERVICE` flag) can also be set via env vars or managed from the Admin Panel. Existing installations are unaffected. ([commit](https://github.com/gristlabs/grist-core/commit/e6a3351d))
* **Restart in place**. Grist can now apply config changes by restarting itself without dropping the listening socket. During the brief gap, `/status` keeps answering for liveness checks while readiness flips to 503. On by default for Linux under Node, off for Windows and Electron. Toggle with `GRIST_RESTART_SHELL=true/false` (#2265).
* **Site Settings page**. Team site owners on self-managed installations can edit team name, domain, and logo from a new `/site-settings` page ([commit](https://github.com/gristlabs/grist-core/commit/0fcd2e90)).
* **WebSocket auth for API keys, boot keys, and access tokens**. The WebSocket side now goes through the same identity-resolving code path as the REST API, so any auth method that works on one works on the other. Opens the door to console clients and out-of-page custom widgets. Also tidies up auth priority and unifies API rate-limiting between the two. ([commit](https://github.com/gristlabs/grist-core/commit/07c9617a))

###### Improvements

* Airtable import
  * Updates existing rows by default when the source has an Airtable ID column, and resolves references against rows already in the doc (#2216)
  * Brings Airtable choice colors along for the ride (#2199)
* API
  * `(Bulk)AddOrUpdateRecord` now returns `id` / `recordIds` / `createdRecordIds` / `updatedRecordIds`, and `BulkAddOrUpdateRecord` accepts a `record`-shaped payload that can match different columns per row (#2193)
  * Webhook API ignores empty action payloads, matching the other endpoints (#2308)
* Custom widgets
  * New `linking` field on `InteractionOptions` tells a widget whether it's an incoming-link target (`asTarget`) or used as a source by other sections (`asSource`) (#2259)
* Sandboxing
  * Pyodide updated from 0.23.4 to 0.28.1 (#1754)
* Suggestions
  * The number-of-suggestions badge is now a status dot, removing counting ambiguity ([commit](https://github.com/gristlabs/grist-core/commit/c2cdb8a1))
  * Per-document unsubscribe link for row-change notifications ([commit](https://github.com/gristlabs/grist-core/commit/e9113b8b))
* Admin Panel
  * Authentication section rebuilt with a status-coded hero card, getgrist.com Reconfigure / Deactivate, and a collapsible "other methods" list (#2227)
* UI/UX
  * "Search in document" now ignores accents (#2221)
  * Forms scroll like a normal page, fixing Tab not appearing to do anything on first press in Firefox (#2179)
  * Account settings split into Profile and Developer s

_[Truncated at 4000 characters — full notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.13]_