v1.7.9
gristlabs/grist-corev1.7.9Jan 9, 2026by georgegevoian
AI Summary
Security release addressing a vulnerability in the pyodide sandboxing method. Also introduces new Access Rules intro screen, redesigned authentication section, and various improvements to permissions and document handling.
Key Highlights
- Security fix for pyodide sandboxing vulnerability (GHSA-7xvx-8pf2-pv5g)
- New intro screen for Access Rules with enable/disable buttons
- Restricted users who can view all data from viewing Access Rules by default
- Redesigned authentication section in Admin Panel
- Org and workspace modifications limited to owner permissions
New Features
- New Access Rules intro screen with recommended initial rules
- Restriction on viewing Access Rules for users who can view all data
- Redesigned authentication section in Admin Panel
- Document owners can now resolve/reopen/delete comments
- New API endpoints for disabling and enabling documents
- Download/copy restriction option for Access Rules viewers
Full Release Notes
## Security advisory
A security review identified a vulnerability in the "pyodide" sandboxing method that is available in Grist. You can check if you are affected in the sandboxing section of the Admin Panel of your instance. If you see "gvisor" there, then you are not affected.If you see "pyodide", then it is important to update to this version of Grist or later.
Link for advisory: https://github.com/gristlabs/grist-core/security/advisories/GHSA-7xvx-8pf2-pv5g
## Notable fixes and improvements
* New intro screen for Access Rules:
* A document without rules now shows an intro screen with an "Enable Access Rules" button:
* On confirming, it creates the initial recommended rules: namely, disable structure permission for non-owners
* There is also a "Disable Access Rules" button that's shown when there are no custom rules
* Restrict users who can view all data from viewing Access Rules by default:
* If permission to view Access Rules is enabled, then there is a new option: to restrict non-owners from downloading or copying the document
* This restriction is added by default when permission to view Access Rules is given
* Granting permission to view Access Rules and removing the restriction on downloading/copying the document approximates the previous behavior
* Redesigned authentication section in Admin Panel for configuring user authentication in self-managed Grist
* Org and workspace modifications are now limited to users with owner permissions
* Document owners can now resolve and reopen comment threads, and delete comments
* Fixes for some frontend memory leaks
* Fixes for some styling issues when printing a document
* Fix for broken enable/disable document endpoints in multi-server environments
* Optimizations to row filtering in Access Rules
* Show a "record is unavailable" message when a user opens a record card blocked by ACLs [PR #1896](https://github.com/gristlabs/grist-core/pull/1896)
* Fix how zero Date/DateTimes look to other formulas [PR #1995](https://github.com/gristlabs/grist-core/pull/1995)
* Don't force reloads when a column is added to a user attribute table [PR #2035](https://github.com/gristlabs/grist-core/pull/2035)
* Several improvements to RecordSet handling [PR #1992](https://github.com/gristlabs/grist-core/pull/1992)
* Correctly share forms with references with no display column [PR #2008](https://github.com/gristlabs/grist-core/pull/2008)
* Improve rendering of changes in suggestions [PR #1977](https://github.com/gristlabs/grist-core/pull/1977)
* Show a count of changes when making a suggestion [PR #1960](https://github.com/gristlabs/grist-core/pull/1960)
* Validate emails used to share access [PR #2016](https://github.com/gristlabs/grist-core/pull/2016)
## Contributions
* @fflorent: Bump js-yaml from 3.14.1 to 4.1.1 [PR #1961](https://github.com/gristlabs/grist-core/pull/1961)
* @fflorent: Bump Typescript to version 4.9.4 [PR #1993](https://github.com/gristlabs/grist-core/pull/1993)
* @fflorent: Eslint: Remove function appCommWaiter (dead code) [PR #2001](https://github.com/gristlabs/grist-core/pull/2001)
* @fflorent: Upgrade eslint [PR #2000](https://github.com/gristlabs/grist-core/pull/2000) [PR #2005](https://github.com/gristlabs/grist-core/pull/2005) [PR #2020](https://github.com/gristlabs/grist-core/pull/2020) [PR #2030](https://github.com/gristlabs/grist-core/pull/2030)
* @fflorent: develop.md: Simplify the paragraph detailing the coding rules [PR #2031](https://github.com/gristlabs/grist-core/pull/2031)
* @manuhabitela: Make sure a Form Submit row can't be removed with keyboard [PR #1979](https://github.com/gristlabs/grist-core/pull/1980)
* @manuhabitela: Choices text box: make sure all choice tokens are readable [PR #1982](https://github.com/gristlabs/grist-core/pull/1982)
### Translations
* @maksim2005UKR
* @hexaltation
* @h0r0m
* @winjie0618
* @audez
* @umam15
* @mirithilion
* @oliverne
* @vonbraun22
* Alexey
* Paul Janzen
**Full Changelog**: https://github.com/gristlabs/grist-core/compare/v1.7.8...v1.7.9
[Join our Discord Community](https://discord.gg/MYKpYQ3fbP) if you'd like to get into development of Grist.