Release 3.3.0

[kmcginnes]

Connecting to your database should be the easy part, and for a long time it wasn't. You had to tell Graph Explorer where its own server lived, tick a "Using Proxy-Server" checkbox that never explained itself, and make sure two different URLs lined up. Release 3.3.0 removes all of that. Graph Explorer now finds its own server, so a new connection is just a name, a database URL, and a query language.

The rest of the release builds on that. Other tools can now send you a link that opens Graph Explorer already pointed at your data. One Docker image serves every deployment, SageMaker notebooks included. Edge discovery finishes on the largest Neptune graphs, and error messages now tell you what went wrong and what to do about it.

Simpler Connections

• No more proxy endpoint. The "Public or Proxy Endpoint" field and the "Using Proxy-Server" checkbox are gone. The "Graph Connection URL" field is now called Database URL, and it's the only address you enter. Your existing connections carry over unchanged.
• Choose how you connect. Two cards make the choice plain. Through the Graph Explorer server is recommended for every database, including Amazon Neptune. Directly from your browser is for databases that accept queries from web pages, such as a public SPARQL endpoint. AWS IAM authentication sits below the cards and works with the server option.
• Advanced options out of the way. The fetch timeout and neighbor expansion limit now live in a collapsible Advanced options section, with names and descriptions that say what each one does. If a connection already overrides one of them, the section opens on its own so nothing is hidden.
• Any query language for Neptune Analytics. Choosing Neptune Analytics used to force openCypher, and unchecking IAM hid the control that caused it, leaving no way to undo it. The service type and query language are now independent.
• Direct connections to Gremlin Server. These now work. Before, Gremlin Server turned away the browser's preflight check, so the query was never sent and schema sync failed.
• Exports that older versions can read. Connection files you export from 3.3.0 import into older versions of Graph Explorer, so you can share them with teammates who haven't upgraded yet.

Connection Links

If you build tools around your graph, you can now hand people a link that opens Graph Explorer already pointed at the right database. Nobody has to copy URLs or walk through the connection form.

https://<graph-explorer-host>/explorer/#/connect?graphDbUrl=https%3A%2F%2Fmy-cluster.us-east-1.neptune.amazonaws.com%3A8182&queryEngine=gremlin&awsRegion=us-east-1&serviceType=neptune-db&name=My%20Database

• It matches what you have. If the link matches an existing connection, Graph Explorer switches to it.
• It asks before adding. If nothing matches, a prefilled connection form opens. Nothing is saved until you click Add Connection.
• It explains what's wrong. If a parameter is invalid, a card lists each problem and the link is ignored.

See Connection Links for the parameters and matching rules.

One Docker Image

There used to be two Docker images, one for SageMaker notebooks and one for everything else. Now there's one.

• One image for every deployment. The same image serves standalone, SageMaker, and reverse proxy deployments at any path prefix, with no build-time configuration. The sagemaker-* tags are still published as aliases of the standard image.
• A runtime notebook preset. NEPTUNE_NOTEBOOK=true now sets port 9250, CloudWatch logs, and HTTP when the container starts.
• Reverse proxies keep you in the app. Behind a path prefix, visiting /explorer without a trailing slash no longer redirects you to the proxy's root.

Large Graphs

Release 3.2.2 was about scale, and this release keeps going.

• Edge discovery that finishes. A Gremlin graph with three edge types and nearly 20 million edges used to run Neptune out of memory in about 30 seconds. Each edge type is now sampled with its own limit, 10 types per request.
• No wasted requests. When one schema sync request fails, Graph Explorer stops sending the rest of the batch.
• Pickers that keep up. The node type and attribute pickers in the Data Explorer and the search sidebar open instantly on schemas with thousands of types, and filter as you type (thanks @mjuarros!).

Layouts Per Tab

Release 3.2.0 gave each browser tab its own connection. Layouts now follow the same rule.

• Each tab keeps its own layout. Graph View and Schema View layouts, such as the active sidebar tab and its width, belong to the tab you set them in, so one tab no longer overwrites another's. A new tab starts from the layout you used most recently.
• The Schema View remembers your layout algorithm (thanks @mjuarros!).

Proxy Server Safeguards

The proxy server sits between your browser and your database, so it checks where it sends requests and says what it's doing.

• Link-local addresses are refused. The proxy server refuses database URLs whose host is a link-local address, whether or not an allowlist is set.
• Credentials in URLs are rejected. Database URLs that contain a username or password never worked. They now fail up front with a clear error.
• The allowlist is easier to find. The first time the proxy server signs a request with IAM and no PROXY_SERVER_ALLOWED_DB_ORIGINS is set, it logs a warning. A request to an origin outside the allowlist now gets an error that names the setting.
• Startup problems say why. The container refuses to start, and explains itself, when NEPTUNE_NOTEBOOK and PROXY_SERVER_HTTPS_CONNECTION are both true, or when it can't write to its configuration folder. Before, these failed with a misleading error.
• Invalid settings name the fix. An invalid boolean environment variable now lists the accepted values.

Clearer Error Messages

An error message is only useful if it points you toward the fix.

• Two kinds of timeout. A fetch timeout and a database query timeout now show different messages, "Fetch timeout exceeded" and "Database query timed out", because you fix one in the connection and the other in the database.
• Unreachable databases. An unresolvable hostname or a timed-out connection through the proxy server now shows "Database unreachable" instead of a generic "Network Response 500".
• Direct connection failures. A direct connection that fails shows "Database not reachable from the browser" or "Insecure database URL", along with what to change.
• Cancel means cancel. Cancelling a query no longer brings back the previous query's error.

Bug Fixes

• Non-square custom icons now scale to fit instead of being stretched into a square (thanks @mjuarros!).
• The code viewer no longer appears with a white theme the first time it opens (thanks @mjuarros!).
• URLs in the error details and raw response viewers are no longer clickable links (thanks @mjuarros!).
• Error details no longer fail to render in browsers that lack Error.isError (thanks @mjuarros!).
• The Graph View and Data Explorer show "Connection: none" instead of "Connection: undefined" when no connection is active.

Documentation

Graph Explorer has no sign-in of its own, so the docs now put access control up front.

• Access control comes first. The security reference opens with a new Access Control section. Graph Explorer performs no authentication or authorization, so never make it publicly reachable without an access control layer in front of it. Every deployment guide now says so.
• Guidance for self-hosted databases. New sections cover self-hosted Gremlin Server and using the Database Origin Allowlist on hosts with AWS credentials.
• Tighter deployment guides. The EC2, ECS, Docker, and SageMaker guides now restrict who can reach the container. The sample SageMaker lifecycle script binds to loopback and sets the allowlist to the notebook's cluster.
• A styled sample. The air_routes sample now includes a styles file and a styling reference, so you can see styling at work right away (thanks @mjuarros!).

Upgrade Notes

Existing deployments need no configuration change. PUBLIC_OR_PROXY_ENDPOINT and USING_PROXY_SERVER are still honored. A few things do behave differently:

• The Graph Explorer server must serve the UI. Graph Explorer finds its server at the parent of its own /explorer path, so hosting the UI on a different origin from the proxy server no longer works. A reverse proxy must forward the /explorer segment intact; renaming it shows "Reverse proxy misconfigured".
• The sagemaker-* tags no longer bake in notebook defaults. Pass NEPTUNE_NOTEBOOK=true to keep port 9250 and CloudWatch logs. The SageMaker lifecycle script already does. On the standard image, NEPTUNE_NOTEBOOK=true now applies the same preset, so set PROXY_SERVER_HTTP_PORT if you want a different port.
• Downgrading after editing connections isn't supported. Older versions can't read the new stored connection shape. Exported connection files still import into older versions.
• Remote icon URLs are no longer supported. A stored icon that isn't a built-in icon or an uploaded image falls back to the default icon.
• Minimum browser versions are now Chrome and Edge 123, Firefox 124, and Safari 17.4.
• The proxy server's /gremlin route reads gremlin from the request body instead of query. Reload any browser tab left open across the upgrade. Anything else that posts to this route needs the same change.

All Changes

• Make safeSessionStorage fallback test independent of Node version by @mjuarros in Make safeSessionStorage fallback test independent of Node version #2148
• Update dependencies and base image by @kmcginnes in Update dependencies and base image #2156
• Add sample styles file and documentation for air_routes sample by @mjuarros in Add sample styles file and documentation for air_routes sample #2132
• Upgrade the Oxc toolchain and resolve Update the oxc toolchain (oxlint, oxfmt, oxlint-tsgolint) #2150 lint findings by @mjuarros in Upgrade the Oxc toolchain and resolve #2150 lint findings #2162
• Move core-js to production dependencies by @mjuarros in Move core-js to production dependencies #2167
• Apply the Monaco theme before the editor mounts by @mjuarros in Apply the Monaco theme before the editor mounts #2133
• Bump base image and trim the Docker build context by @kmcginnes in Bump base image and trim the Docker build context #2183
• Update pnpm to 12.4.2 by @kmcginnes in Update pnpm to 12.4.2 #2178
• Update Vitest to version 5 by @mjuarros in Update Vitest to version 5 #2166
• Update jotai to 3 by @mjuarros in Update jotai to 3 #2175
• Disable Monaco link detection in code viewers by @mjuarros in Disable Monaco link detection in code viewers #2189
• Virtualized Combobox component and keyword-search node-type picker migration by @mjuarros in Virtualized Combobox component and keyword-search node-type picker migration #2131
• Dedupe the lockfile and fail CI on drift by @mjuarros in Dedupe the lockfile and fail CI on drift #2205
• Add Dependabot configuration for docker, GitHub Actions, and npm by @mjuarros in Add Dependabot configuration for docker, GitHub Actions, and npm #2206
• Bump vitest from 5.0.0 to 5.0.1 in the vitest group by @dependabot[bot] in Bump vitest from 5.0.0 to 5.0.1 in the vitest group #2208
• Bump amazonlinux/amazonlinux from 2023.12.20260914.0 to 2023.12.20260918.0 by @dependabot[bot] in Bump amazonlinux/amazonlinux from 2023.12.20260914.0 to 2023.12.20260918.0 #2207
• Bump the actions group with 7 updates by @dependabot[bot] in Bump the actions group with 7 updates #2210
• Bump dotenv from 17.4.2 to 18.0.1 by @dependabot[bot] in Bump dotenv from 17.4.2 to 18.0.1 #2215
• Remove unused https dependency from the proxy server by @danielvanza in Remove unused https dependency from the proxy server #2197
• Remove unused Babel preset devDependencies by @kmcginnes in Remove unused Babel preset devDependencies #2229
• Stop flaky assertions in proxy server and schema sync tests by @kmcginnes in Stop flaky assertions in proxy server and schema sync tests #2220
• Stop Dependabot reopening the @babel/core major bump by @kmcginnes in Stop Dependabot reopening the @babel/core major bump #2230
• Remove unused dependencies by @kmcginnes in Remove unused dependencies #2231
• Move babel-plugin-react-compiler to devDependencies by @kmcginnes in Move babel-plugin-react-compiler to devDependencies #2232
• Replace Error.isError with instanceof Error in createErrorDetails by @mjuarros in Replace Error.isError with instanceof Error in createErrorDetails #2192
• Ignore @types/node majors and cva bumps in Dependabot by @kmcginnes in Ignore @types/node majors and cva bumps in Dependabot #2238
• Share one test environment factory across the proxy server tests by @kmcginnes in Share one test environment factory across the proxy server tests #2248
• Bump the minor-and-patch group across 1 directory with 24 updates by @dependabot[bot] in Bump the minor-and-patch group across 1 directory with 24 updates #2241
• Exclude local secrets and build output from Docker build context by @kmcginnes in Exclude local secrets and build output from Docker build context #2243
• Reject database URLs carrying embedded credentials at the proxy boundary by @kmcginnes in Reject database URLs carrying embedded credentials at the proxy boundary #2255
• Carry the errno through the proxy server's error payload by @kmcginnes in Carry the errno through the proxy server's error payload #2249
• Make the static mount's trailing-slash redirect relative by @kmcginnes in Make the static mount's trailing-slash redirect relative #2251
• Speed up test setup by skipping the utils barrel by @kmcginnes in Speed up test setup by skipping the utils barrel #2257
• Drop coverage thresholds and stop collecting coverage in CI by @kmcginnes in Drop coverage thresholds and stop collecting coverage in CI #2258
• Give TestProvider a router by @kmcginnes in Give TestProvider a router #2260
• Extract connection activation into a shared hook by @kmcginnes in Extract connection activation into a shared hook #2261
• Shard unit tests across four CI jobs by @kmcginnes in Shard unit tests across four CI jobs #2259
• Let the create connection form start from prefilled values by @kmcginnes in Let the create connection form start from prefilled values #2262
• Move type, lint, and format checks into their own workflow by @kmcginnes in Move type, lint, and format checks into their own workflow #2263
• Skip unit tests and the Docker test build for docs-only changes by @kmcginnes in Skip unit tests and the Docker test build for docs-only changes #2264
• Name the accepted values in the boolean env var validation error by @kmcginnes in Name the accepted values in the boolean env var validation error #2266
• Distinguish fetch timeouts from database query timeouts by @kmcginnes in Distinguish fetch timeouts from database query timeouts #2268
• Cache the pnpm store in CI by @kmcginnes in Cache the pnpm store in CI #2271
• Scan the published Docker image after the publish workflow finishes by @kmcginnes in Scan the published Docker image after the publish workflow finishes #2270
• Revert pnpm store caching in CI by @kmcginnes in Revert pnpm store caching in CI #2273
• Fix the broken safari pinned tab icon path by @kmcginnes in Fix the broken safari pinned tab icon path #2276
• Fall back to "none" for the connection subtitle by @kmcginnes in Fall back to "none" for the connection subtitle #2274
• Name the NEPTUNE_NOTEBOOK/HTTPS conflict instead of blaming missing certs by @kmcginnes in Name the NEPTUNE_NOTEBOOK/HTTPS conflict instead of blaming missing certs #2252
• Label the expansion limit field Neighbor Expansion Limit by @kmcginnes in Label the expansion limit field Neighbor Expansion Limit #2275
• Refuse to start when the container can't write its .env file by @kmcginnes in Refuse to start when the container can't write its .env file #2267
• Stop the request pool pulling new work after a failure by @kmcginnes in Stop the request pool pulling new work after a failure #2281
• Stop hard-wrapping Markdown prose by @kmcginnes in Stop hard-wrapping Markdown prose #2288
• Put the advanced connection settings behind a disclosure by @kmcginnes in Put the advanced connection settings behind a disclosure #2278
• Sample each edge type with its own limit, 10 types per request by @kmcginnes in Sample each edge type with its own limit, 10 types per request #2279
• Unify Docker image by removing SageMaker variant by @kmcginnes in Unify Docker image by removing SageMaker variant #1773
• Bump amazonlinux/amazonlinux from 2023.12.20260918.0 to 2023.12.20260928.0 by @dependabot[bot] in Bump amazonlinux/amazonlinux from 2023.12.20260918.0 to 2023.12.20260928.0 #2300
• Bump github/codeql-action/upload-sarif from 4.38.1 to 4.38.2 in the actions group by @dependabot[bot] in Bump github/codeql-action/upload-sarif from 4.38.1 to 4.38.2 in the actions group #2292
• Add connection links via a dedicated #/connect route by @kmcginnes in Add connection links via a dedicated #/connect route #1828
• Replace .nvmrc with .node-version by @kmcginnes in Replace .nvmrc with .node-version #2302
• Connections refactor, phase A (1/4): pin the active-connection selectors with tests by @mjuarros in Connections refactor, phase A (1/4): pin the active-connection selectors with tests #2301
• Import vitest APIs explicitly instead of using globals by @kmcginnes in Import vitest APIs explicitly instead of using globals #2304
• Connections refactor, phase A (2/4): golden-file tests for the Exported Connection File by @mjuarros in Connections refactor, phase A (2/4): golden-file tests for the Exported Connection File #2308
• Connections refactor, phase A (3/4): pin the stored connection shapes by @mjuarros in Connections refactor, phase A (3/4): pin the stored connection shapes #2311
• Remove test coverage tooling by @kmcginnes in Remove test coverage tooling #2309
• Connections refactor, phase A (4/4): delete the unused ConfigurationWithConnection type by @mjuarros in Connections refactor, phase A (4/4): delete the unused ConfigurationWithConnection type #2316
• Sync mattpocock skills to latest upstream by @kmcginnes in Sync mattpocock skills to latest upstream #2331
• Upgrade pnpm to 12.8.1 by @kmcginnes in Upgrade pnpm to 12.8.1 #2327
• Enable pnpm autoDedupe by @kmcginnes in Enable pnpm autoDedupe #2328
• Combine checks and unit tests into one unsharded CI job by @kmcginnes in Combine checks and unit tests into one unsharded CI job #2329
• Run dependency review only when dependency manifests change by @kmcginnes in Run dependency review only when dependency manifests change #2333
• Add REVIEW.md and point code reviews at it by @kmcginnes in Add REVIEW.md and point code reviews at it #2336
• Bump amazonlinux/amazonlinux from 2023.12.20260928.0 to 2023.12.20260930.0 by @dependabot[bot] in Bump amazonlinux/amazonlinux from 2023.12.20260928.0 to 2023.12.20260930.0 #2337
• Replace CodeQL default setup with advanced setup by @kmcginnes in Replace CodeQL default setup with advanced setup #2334
• Correct documented settings that do not work as described by @kmcginnes in Correct documented settings that do not work as described #2324
• Move render-time Date calls into lazy state initializers by @kmcginnes in Move render-time Date calls into lazy state initializers #2339
• Bump the minor-and-patch group across 1 directory with 21 updates by @dependabot[bot] in Bump the minor-and-patch group across 1 directory with 21 updates #2342
• Keep exported connection files importable by older versions by @kmcginnes in Keep exported connection files importable by older versions #2317
• Connections refactor, phase B (5/10): move connection types into src/connections/ by @mjuarros in Connections refactor, phase B (5/10): move connection types into src/connections/ #2332
• Share the export-to-text helper across connection file tests by @kmcginnes in Share the export-to-text helper across connection file tests #2340
• Fix SelectField ignoring disabled and aria-label in its default layout by @kmcginnes in Fix SelectField ignoring disabled and aria-label in its default layout #2319
• Document the deployer's responsibility for access control by @kmcginnes in Document the deployer's responsibility for access control #2343
• Explain why url wins over graphDbUrl on legacy direct connections by @kmcginnes in Explain why url wins over graphDbUrl on legacy direct connections #2345
• Connections refactor, phase B (6/10): move normalization and legacy migration into src/connections/ by @mjuarros in Connections refactor, phase B (6/10): move normalization and legacy migration into src/connections/ #2344
• Correct access control docs and widen the docs review rule by @kmcginnes in Correct access control docs and widen the docs review rule #2346
• Connections refactor, phase B (7/10): move active-connection selectors into src/connections/ by @mjuarros in Connections refactor, phase B (7/10): move active-connection selectors into src/connections/ #2348
• State that Graph Explorer enforces no permissions by @kmcginnes in State that Graph Explorer enforces no permissions #2347
• Connections refactor, phase B (8/10): move exported connection file code into src/connections/ by @mjuarros in Connections refactor, phase B (8/10): move exported connection file code into src/connections/ #2349
• Connections refactor, phase B (9/10): move default connection and lifecycle hooks into src/connections/ by @mjuarros in Connections refactor, phase B (9/10): move default connection and lifecycle hooks into src/connections/ #2350
• Stop using Iterator helpers and other above-floor APIs so core-js can be removed by @mjuarros in Stop using Iterator helpers and other above-floor APIs so core-js can be removed #2245
• Show invalid connection links in a card on the connect page by @kmcginnes in Show invalid connection links in a card on the connect page #2352
• Extract the connection form model into a pure module by @kmcginnes in Extract the connection form model into a pure module #2320
• Scope graph-view and schema-view layouts to the browser tab by @kmcginnes in Scope graph-view and schema-view layouts to the browser tab #1894
• Connections refactor, phase B (10/10): rehome schema leftovers and delete ConfigurationProvider by @mjuarros in Connections refactor, phase B (10/10): rehome schema leftovers and delete ConfigurationProvider #2351
• Fix non-square icons squashed instead of scaled to fit by @mjuarros in Fix non-square icons squashed instead of scaled to fit #2142
• Finish the access control docs by @kmcginnes in Finish the access control docs #2355
• Connections refactor, phase C (11/13): rename legacy Configuration symbols to Connection by @mjuarros in Connections refactor, phase C (11/13): rename legacy Configuration symbols to Connection #2357
• Bump the minor-and-patch group with 11 updates by @dependabot[bot] in Bump the minor-and-patch group with 11 updates #2358
• Bump motion from 13.4.6 to 14.0.0 by @dependabot[bot] in Bump motion from 13.4.6 to 14.0.0 #2359
• Help operators limit which databases the proxy's AWS identity can reach by @kmcginnes in Help operators limit which databases the proxy's AWS identity can reach #2363
• Persist schema view layout selection by @mjuarros in Persist schema view layout selection #2144
• Stop locking the query language when Neptune Analytics is chosen by @kmcginnes in Stop locking the query language when Neptune Analytics is chosen #2365
• Keep an explicit query language in Neptune Analytics connection links by @kmcginnes in Keep an explicit query language in Neptune Analytics connection links #2366
• Move Query Language below Database URL and relabel the IAM checkbox by @kmcginnes in Move Query Language below Database URL and relabel the IAM checkbox #2367
• Stop marking direct connections in the connection list and details by @kmcginnes in Stop marking direct connections in the connection list and details #2368
• Stop describing direct connections as deprecated by @kmcginnes in Stop describing direct connections as deprecated #2369
• Refresh dependencies by @kmcginnes in Refresh dependencies #2371
• Update package versions by @kmcginnes in Update package versions #2372
• Choose the connection method with a radio group of choice cards by @kmcginnes in Choose the connection method with a radio group of choice cards #2364
• Replace pr skill with local version and add issue skill by @kmcginnes in Replace pr skill with local version and add issue skill #2376
• Connections refactor, phase C (12/13): rename Configuration atoms to Connection by @mjuarros in Connections refactor, phase C (12/13): rename Configuration atoms to Connection #2361
• Add deployment guidance for self-hosted Gremlin Server by @kmcginnes in Add deployment guidance for self-hosted Gremlin Server #2381
• Bind the notebook sample's container to loopback and restrict its database origins by @kmcginnes in Bind the notebook sample's container to loopback and restrict its database origins #2382
• Bump version to 3.3.0 by @kmcginnes in Bump version to 3.3.0 #2384
• Bind the Gremlin Server walkthrough to loopback and name its connection method by @kmcginnes in Bind the Gremlin Server walkthrough to loopback and name its connection method #2386
• Make direct Gremlin connections work with Gremlin Server by @kmcginnes in Make direct Gremlin connections work with Gremlin Server #2387
• Reject link-local addresses as database origins by @kmcginnes in Reject link-local addresses as database origins #2388
• Pin the browser floor to Baseline Widely available through browserslist by @kmcginnes in Pin the browser floor to Baseline Widely available through browserslist #2394
• Reword the connection method cards and move IAM below them by @kmcginnes in Reword the connection method cards and move IAM below them #2397
• Tighten warnMissingIds types and drop redundant Set values() calls by @kmcginnes in Tighten warnMissingIds types and drop redundant Set values() calls #2395
• Fix agent docs that drifted from the connections refactor by @kmcginnes in Fix agent docs that drifted from the connections refactor #2391
• Warn that the ECS guide deploys publicly and require a source range by @kmcginnes in Warn that the ECS guide deploys publicly and require a source range #2375
• Typecheck packages/shared on its own by @kmcginnes in Typecheck packages/shared on its own #2396
• Report a fetch timeout only when the timeout fired by @kmcginnes in Report a fetch timeout only when the timeout fired #2392
• Use native String.prototype.isWellFormed by @kmcginnes in Use native String.prototype.isWellFormed #2398
• Shorten the advanced option titles and say what each one does by @kmcginnes in Shorten the advanced option titles and say what each one does #2400
• Tighten test fidelity in connection, proxy, and session storage tests by @kmcginnes in Tighten test fidelity in connection, proxy, and session storage tests #2389

New Contributors

Welcome and thank you to our first-time contributors!

• @mjuarros made their first contribution in Make safeSessionStorage fallback test independent of Node version #2148
• @danielvanza made their first contribution in Remove unused https dependency from the proxy server #2197

Full Changelog: v3.2.2...v3.3.0

---

This discussion was created from the release Release 3.3.0.