# Grist v1.7.15 - Product: Grist (https://whatsnew.fyi/product/grist) - Vendor: Grist Labs - Date: 2026-06-10 - Version: v1.7.15 - Original notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.15 - Permalink: https://whatsnew.fyi/product/grist/releases/v1.7.15 What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. --- - **added** — OAuth support extended to home API endpoints including GET /orgs, GET /orgs/:oid/workspaces, POST /workspaces/:wid/docs, and GET /profile/user with resource-level filtering for scoped tokens - **changed** — TypeScript upgraded to 5.9.3 with tsc and esbuild targets bumped to es2020 - **changed** — External storage configuration tidied with each storage backend owning its option spec and S3 bucket probing at startup for early failure detection - **changed** — Translation keys cleaned up to unblock auto-pruning by wrapping variable calls to t() with explicit switches - **changed** — Dependency bumped: ws from 8.18.0 to 8.20.1 - **changed** — Dependency bumped: axios from 1.15.2 to 1.16.0 with fetch adapter now enforcing maxBodyLength and maxContentLength - **changed** — Dependency bumped: tmp from 0.2.5 to 0.2.6 - **changed** — Dependency bumped: shell-quote from 1.8.1 to 1.8.4 - **changed** — Upgraded picomatch, minimatch, glob, and serialize-javascript to clear high-severity advisories - **security** — Harden value interpolation in server-rendered pages by escaping values embedded into inline script blocks with jsesc and canonicalizing openerOrigin to bare origin - **security** — Require a matching authenticated session to reconnect a websocket instead of allowing clientId alone to attach to an existing session - **security** — Disallow same-origin custom-widget URLs as defense in depth against XSS payloads being weaponized through widget URLs - **security** — Disable triggers when a document is downloaded or copied and regenerate webhook secrets correctly when a document with webhooks is uploaded - **security** — Sanitize link URLs from the next parameter on /welcome/select-account to be same-origin and sanitize URLs in document tours - **security** — Close metadata leakage in GET /forms by reading table metadata through fetchMetaTables and checking that the section is actually a form - **fixed** — Crash instead of silently failing when login middleware cannot initialize with unreachable identity provider at startup - **fixed** — Fix card widget bugs where new card widgets no longer borrow the record card layout and cards with stale field references fall back to default layout - **changed** — README updated for Quick setup first-run flow including boot-key login and Quick setup wizard descriptions with new GRIST_IN_SERVICE environment variable ##### What's Changed An infrastructure release. First, an upgrade for OAuth access token authentication in Grist's REST API: a new credential framework in grist-core, with the token validator and OIDC server (including CIMD registration and MCP server tools) shipping in the Full Grist edition, where OAuth apps also move from experiment to available by default. Second, a wave of security hardening: a metadata leakage in `GET /forms` is closed, server-rendered pages get stricter value escaping, websocket reconnection now requires a matching authenticated session, custom-widget URLs can no longer be same-origin, and triggers are disabled when a document is downloaded or copied. TypeScript was upgraded to 5.9.3, and several dependencies were bumped to clear known vulnerabilities. ###### Improvements ###### API * **OAuth support extended to home API endpoints**. `GET /orgs`, `GET /orgs/:oid/workspaces`, `POST /workspaces/:wid/docs`, and a new `GET /profile/user` now accept OAuth tokens, with resource-level filtering so a scoped token sees only the orgs and documents it was granted, and is rejected when creating documents in un-granted workspaces or orgs. ([commit](https://github.com/gristlabs/grist-core/commit/f481fd1d)) ###### Internal / infrastructure * **TypeScript upgraded to 5.9.3**, with `tsc` and `esbuild` targets bumped to es2020. ([commit](https://github.com/gristlabs/grist-core/commit/7adf2e6c)) * **External storage configuration tidied**. Each storage backend now owns its option spec, and a configured S3 bucket is probed at startup so a misconfiguration (such as a missing `AWS_REGION`) fails fast at startup rather than mid-request. ([commit](https://github.com/gristlabs/grist-core/commit/c4843f25)) * **Translation keys cleaned up to unblock auto-pruning**. Five call sites passed a variable rather than a literal to `t()`, hiding the keys from the i18next scanner; each is now wrapped in a helper with an explicit switch so every key is visible. Orphaned onboarding-choice and theme-label keys were migrated to the scopes the runtime actually looks them up under, fixing labels that previously always showed in English. (#2368) * **Dependency bumps**. `ws` 8.18.0 to 8.20.1 (fixes an uninitialized memory disclosure in `websocket.close()`) (#2370), `axios` 1.15.2 to 1.16.0 (the fetch adapter now enforces `maxBodyLength` and `maxContentLength`) (#2375), `tmp` 0.2.5 to 0.2.6 (#2369), `shell-quote` 1.8.1 to 1.8.4 (#2386), and an upgrade of `picomatch`, `minimatch`, `glob`, and `serialize-javascript` that cuts the high-severity advisories reported by `yarn audit` (#2381). ###### Documentation * **README updated for the Quick setup first-run flow**. Quickstart, Admin Panel, Logins, and building-from-source sections now describe the boot-key login and Quick setup wizard, with a new `GRIST_IN_SERVICE` entry in the env var table. (#2366) ###### Fixes ###### Security * **Harden value interpolation in server-rendered pages**. Values embedded into inline `