¶Upgrading

Packages are versioned together, so a single tag moves the server package, the three clients and the protocol at once. Upgrade them as a set.

composer update elyra/datagrid-server elyra/datagrid-livewire elyra/datagrid-js elyra/datagrid-protocol
npm update @elyra/datagrid-client-core @elyra/datagrid-vue @elyra/datagrid-svelte @elyra/datagrid-theme

¶0.4.x → 0.5.0

A security and hardening release. Most of it is invisible, but four changes tighten defaults and can reject requests that used to succeed. Work through the checklist below; each item tells you how to tell whether it affects you.

¶1. The natural-language assistant is off until you enable it

ELYRA_DATAGRID_ASSISTANT was documented as the way to switch the assistant on, but nothing ever read it. A component with public bool $assistant = true; therefore worked with no env var set — and, less comfortably, ask() was reachable even on grids that had left the assistant off, since only the UI was hidden.

The flag is now enforced server-side. If you use the assistant:

ELYRA_DATAGRID_ASSISTANT=true

Questions are now also bounded, because each one is a billed LLM call:

Callers are metered per authenticated user (falling back to IP) and per grid. Set attempts to 0 to disable metering. The limiter fails closed: if its cache store is unavailable, translation stops rather than running unmetered.

Affects you if any grid sets $assistant = true or calls GridDefinition::ask().

¶2. Exporting a keyless grid needs an explicit cap

A grid with no ->key(...) cannot be paginated — there is no stable order to page by — so its export read the entire result set into PHP memory. With max_export_rows defaulting to null that was an OOM waiting to happen, so export() now refuses rather than risking it.

Pick one:

// Preferred: give the grid a key, and the export streams in bounded batches.
GridDefinition::table('sales')->key('id')->columns([...]);

// Or accept a bounded export. config/datagrid.php:
'limits' => ['max_export_rows' => 100_000],
// or ELYRA_DATAGRID_MAX_EXPORT_ROWS=100000

Affects you if a grid that omits ->key(...) is exportable.

¶3. Facets and grouping now respect filterable: false

Both emit a column's distinct values, which is exactly what the flag withholds — but neither checked it, so a column marked unfilterable could still have every value in it enumerated through facets. Both now throw a GridException.

If a grid faceted or grouped such a column on purpose, declare it filterable:

->column('region', filterable: true)

Facet lists are also bounded now: a request that omits top gets GridLimits::maxFacetValues (1000) instead of every distinct value.

Affects you if a grid facets or groups a column declared filterable: false.

¶4. Requests are bounded by breadth, not just depth

maxFilterDepth capped nesting, but nothing capped width — a shallow request with thousands of conditions, or dozens of group levels (one query each), was a DoS lever on any grid with anonymous read access.

All live under datagrid.limits and are overridable per grid via GridDefinition::limits().

Affects you if a grid nests more than five group levels, or builds filters with more than 200 conditions. max_group_levels is the one most likely to bite.

¶Also worth knowing

• Mutation responses now carry only the grid's declared columns. create/update previously returned the row via SELECT *, handing the client every column in the table — password hashes, tokens, internal flags. If a client read something else out of a mutation response, declare that column.
• Grouping now works on PostgreSQL. It raised a syntax error on every PostgreSQL install because the grouping query hardcoded MySQL-style backtick quoting. No action needed; grouping simply starts working.
• Pinned rows no longer break copy and paste. Row order had two definitions — one for rendering, one for index-based operations — so with a row pinned, a paste wrote to the wrong records. No action needed.
• .npmrc is now gitignored. If you keep a registry token in a project-local .npmrc, confirm it is not already committed: git log --all --oneline -- .npmrc.

¶Republishing config

Several new keys were added to config/datagrid.php. Laravel merges package defaults, so an unpublished config keeps working. If you have published it, re-publish or merge by hand:

php artisan vendor:publish --tag=elyra-datagrid-config --force

¶Earlier versions

See the changelog. The one earlier upgrade note worth repeating: 0.4.0 made writes and exports secure-by-default, so mutate(), mutateBatch() and export() throw unless the grid declares either ->authorize(...) or ->withoutAuthorization().