# Grist v1.7.18

- Product: Grist (https://whatsnew.fyi/product/grist)
- Vendor: Grist Labs
- Date: 2026-08-28
- Version: v1.7.18
- Original notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.18
- Permalink: https://whatsnew.fyi/product/grist/releases/v1.7.18

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **changed** — Lookups and summary tables now use 30% less memory in the Python data engine
- **changed** — Access rule memos now show only when relevant to the block being accessed, marked with a lock or lightbulb, and follow the same precedence as permissions
- **changed** — Markdown cells cut off by max row height now show an ellipsis over a fade in the bottom right corner
- **changed** — Custom widgets can now declare required columns in their manifest, not only in grist.ready(), and mapColumnNames() returns the record without the unmapped field instead of null
- **changed** — Admin Panel Authentication and Sandboxing sections now present each option as a card with recommendations in the setup wizard
- **changed** — Server edition (community or full) is now recorded in the home database as GRIST_SERVER_EDITION instead of in config.json, with one-time migration for existing installations
- **added** — New GRIST_ACTIVEDOC_TIMEOUT_SECONDS environment variable sets how long a document stays open after the last client disconnects
- **changed** — jQuery updated to 3.7.1 and jQuery-UI moved from unmaintained components-jqueryui package to jquery-ui 1.14.2
- **security** — shell-quote updated to 1.10.0 to fix a denial of service vulnerability in parse (GHSA-395f-4hp3-45gv)
- **fixed** — A browser tab whose network dropped after laptop sleep now reopens the document instead of showing Error
- **fixed** — Documents with multi-line f-string formulas became unusable on Python 3.12 and later, reporting KeyError or missing attribute errors
- **fixed** — Renaming a table or column could break formulas depending on it, failing with AssertionError or leaving them silently not recalculating
- **fixed** — Grist could not open documents on Windows with the pyodide sandbox when Python packages failed to install
- **fixed** — Importing a file on Windows failed with a sandbox permission error on the temporary file under some path conditions
- **fixed** — Downloading a document at an old schema version failed with a SQLite error
- **fixed** — Renaming an attachment failed in any document with access rules
- **fixed** — A dialog appeared before taking keyboard focus, causing key presses to go to the previously focused element
- **fixed** — Hiding fields on a card widget threw JavaScript errors for some column types such as Choice List
- **fixed** — Detaching a summary table grouped by a RefList column produced TypeError cells
- **fixed** — Clearing sessions never worked on installs using Redis, leaving old logins in place after authentication changes

##### What's Changed

###### Improvements

* Performance
  * Lookups and summary tables now cost the Python data engine far less memory. Measured at 30% less on a large document ([commit](https://github.com/gristlabs/grist-core/commit/18653743))
* Access rules
  * A memo now shows only when it bears on the block you hit, either as the reason for it or as a remedy that would grant access, and is marked with a lock or a lightbulb accordingly. Memos follow the same precedence as permissions. Access itself is unchanged, only the explanation (#2479)
* UI/UX
  * A Markdown cell cut off by a max row height now shows an ellipsis over a fade in its bottom right corner, as other cell types already did (#2502)
* Custom widgets
  * A widget can declare the columns it needs in its manifest, not only in `grist.ready()`. What `grist.ready()` sends still wins when both are set. `mapColumnNames()` now returns the record without the unmapped field rather than `null`, and the `columns` option is gone from `mapColumnNames()` and `mapColumnNamesBack()`. See the [plugin API reference](https://support.getgrist.com/code/modules/grist_plugin_api/) ([commit](https://github.com/gristlabs/grist-core/commit/dadcb247))
* Admin Panel
  * The Authentication and Sandboxing sections now present each option as a card. In the setup wizard they lead with a recommendation and the Continue button stays disabled until you pick one; in the Admin Panel they show what the server is currently using and pre-select nothing. The OIDC and SAML cards are marked "Requires activation key", and clicking one opens a request for that key. Sandboxing keeps the option you picked, including "No sandboxing", and switching to "No auth" always asks for confirmation ([commit](https://github.com/gristlabs/grist-core/commit/43e1e9af))
  * The edition (community or full) is now recorded in the home database rather than in `config.json`, under the name `GRIST_SERVER_EDITION`, with a one-time migration for existing installations. `GRIST_FORCE_ENABLE_ENTERPRISE` still takes precedence ([commit](https://github.com/gristlabs/grist-core/commit/da352571))
* Internal / infrastructure
  * New `GRIST_ACTIVEDOC_TIMEOUT_SECONDS` sets how long a document stays open after the last client disconnects. Contributed by @fflorent (#2505)
  * jQuery moves to 3.7.1, and jQuery-UI from the unmaintained `components-jqueryui` package to `jquery-ui` 1.14.2, so dependabot can keep it updated. Contributed by @fflorent (#2476)
  * Dependency bumps: `shell-quote` 1.10.0 (fixes a denial of service in `parse`, GHSA-395f-4hp3-45gv) (#2525), `axios` 1.18.0 (#2472), `undici` 6.28.0 (#2510), `dompurify` 3.4.13 (#2516), `engine.io` 6.6.7 (#2475), `typeorm` 0.3.31 (#2484), `morgan` 1.11.0 (#2460), `js-yaml` 4.3.1 (#2519), `tar` 7.5.21 (#2491), `postcss` 8.5.25 (#2500), `fast-uri` 3.1.5 (#2511), `linkify-it` 5.0.2 (#2488), `svgo` 3.3.4 (#2485), `webpack-dev-server` 5.2.6 (#2486), `websocket-driver` 0.7.5 (#2469)
* Documentation
  * The reference for `NOW()` and `TODAY()` now explains when Grist recalculates them. See [Function reference](https://support.getgrist.com/functions/) ([commit](https://github.com/gristlabs/grist-core/commit/8bd355eb))

###### Fixes

* A browser tab whose network dropped, such as after a laptop wakes from sleep, showed "Error" and asked for a reload. It now reopens the document. Reconnect attempts also back off against a server that accepts connections and immediately drops them (#2501)
* Documents containing a multi-line f-string formula became unusable on Python 3.12 and later, reporting `KeyError` or "'DocModel' object has no attribute 'tables'" for every action. That has affected the pyodide sandbox since v1.7.13, and source installs with a recent python3 (#2518)
* Renaming a table or column could break the formulas that depend on it, either failing them with an AssertionError or leaving them silently no longer recalculating. Affects formulas returning a record or list of

_[Truncated at 4000 characters — full notes: https://github.com/gristlabs/grist-core/releases/tag/v1.7.18]_