Release 3.3.0

Connecting to your database should be the easy part, and for a long time it wasn't. You had to tell Graph Explorer where its own server lived, tick a "Using Proxy-Server" checkbox that never explained itself, and make sure two different URLs lined up. Release 3.3.0 removes all of that. Graph Explorer now finds its own server, so a new connection is just a name, a database URL, and a query language.

The rest of the release builds on that. Other tools can now send you a link that opens Graph Explorer already pointed at your data. One Docker image serves every deployment, SageMaker notebooks included. Edge discovery finishes on the largest Neptune graphs, and error messages now tell you what went wrong and what to do about it.

Simpler Connections

• No more proxy endpoint. The "Public or Proxy Endpoint" field and the "Using Proxy-Server" checkbox are gone. The "Graph Connection URL" field is now called Database URL, and it's the only address you enter. Your existing connections carry over unchanged.
• Choose how you connect. Two cards make the choice plain. Through the Graph Explorer server is recommended for every database, including Amazon Neptune. Directly from your browser is for databases that accept queries from web pages, such as a public SPARQL endpoint. AWS IAM authentication sits below the cards and works with the server option.
• Advanced options out of the way. The fetch timeout and neighbor expansion limit now live in a collapsible Advanced options section, with names and descriptions that say what each one does. If a connection already overrides one of them, the section opens on its own so nothing is hidden.
• Any query language for Neptune Analytics. Choosing Neptune Analytics used to force openCypher, and unchecking IAM hid the control that caused it, leaving no way to undo it. The service type and query language are now independent.
• Direct connections to Gremlin Server. These now work. Before, Gremlin Server turned away the browser's preflight check, so the query was never sent and schema sync failed.
• Exports that older versions can read. Connection files you export from 3.3.0 import into older versions of Graph Explorer, so you can share them with teammates who haven't upgraded yet.

Connection Links

If you build tools around your graph, you can now hand people a link that opens Graph Explorer already pointed at the right database. Nobody has to copy URLs or walk through the connection form.

https://<graph-explorer-host>/explorer/#/connect?graphDbUrl=https%3A%2F%2Fmy-cluster.us-east-1.neptune.amazonaws.com%3A8182&queryEngine=gremlin&awsRegion=us-east-1&serviceType=neptune-db&name=My%20Database

• It matches what you have. If the link matches an existing connection, Graph Explorer switches to it.
• It asks before adding. If nothing matches, a prefilled connection form opens. Nothing is saved until you click Add Connection.
• It explains what's wrong. If a parameter is invalid, a card lists each problem and the link is ignored.

See Connection Links for the parameters and matching rules.

One Docker Image

There used to be two Docker images, one for SageMaker notebooks and one for everything else. Now there's one.

• One image for every deployment. The same image serves standalone, SageMaker, and reverse proxy deployments at any path prefix, with no build-time configuration. The sagemaker-* tags are still published as aliases of the standard image.
• A runtime notebook preset. NEPTUNE_NOTEBOOK=true now sets port 9250, CloudWatch logs, and HTTP when the container starts.
• Reverse proxies keep you in the app. Behind a path prefix, visiting /explorer without a trailing slash no longer redirects you to the proxy's root.

Large Graphs

Release 3.2.2 was about scale, and this release keeps going.

• Edge discovery that finishes. A Gremlin graph with three edge types and nearly 20 million edges used to run Neptune out of memory in about 30 seconds. Each edge type is now sampled with its own limit, 10 types per request.
• No wasted requests. When one schema sync request fails, Graph Explorer stops sending the rest of the batch.
• Pickers that keep up. The node type and attribute pickers in the Data Explorer and the search sidebar open instantly on schemas with thousands of types, and filter as you type (thanks @mjuarros!).

Layouts Per Tab

Release 3.2.0 gave each browser tab its own connection. Layouts now follow the same rule.

• Each tab keeps its own layout. Graph View and Schema View layouts, such as the active sidebar tab and its width, belong to the tab you set them in, so one tab no longer overwrites another's. A new tab starts from the layout you used most recently.
• The Schema View remembers your layout algorithm (thanks @mjuarros!).

Proxy Server Safeguards

The proxy server sits between your browser and your database, so it checks where it sends requests and says what it's doing.

• Link-local addresses are refused. The proxy server refuses database URLs whose host is a link-local address, whether or not an allowlist is set.
• Credentials in URLs are rejected. Database URLs that contain a username or password never worked. They now fail up front with a clear error.
• The allowlist is easier to find. The first time the proxy server signs a request with IAM and no PROXY_SERVER_ALLOWED_DB_ORIGINS is set, it logs a warning. A request to an origin outside the allowlist now gets an error that names the setting.
• Startup problems say why. The container refuses to start, and explains itself, when NEPTUNE_NOTEBOOK and PROXY_SERVER_HTTPS_CONNECTION are both true, or when it can't write to its configuration folder. Before, these failed with a misleading error.
• Invalid settings name the fix. An invalid boolean environment variable now lists the accepted values.

Clearer Error Messages

An error message is only useful if it points you toward the fix.

• Two kinds of timeout. A fetch timeout and a database query timeout now show different messages, "Fetch timeout exceeded" and "Database query timed out", because you fix one in the connection and the other in the database.
• Unreachable databases. An unresolvable hostname or a timed-out connection through the proxy server now shows "Database unreachable" instead of a generic "Network Response 500".
• Direct connection failures. A direct connection that fails shows "Database not reachable from the browser" or "Insecure database URL", along with what to change.
• Cancel means cancel. Cancelling a query no longer brings back the previous query's error.

Bug Fixes

• Non-square custom icons now scale to fit instead of being stretched into a square (thanks @mjuarros!).
• The code viewer no longer appears with a white theme the first time it opens (thanks @mjuarros!).
• URLs in the error details and raw response viewers are no longer clickable links (thanks @mjuarros!).
• Error details no longer fail to render in browsers that lack Error.isError (thanks @mjuarros!).
• The Graph View and Data Explorer show "Connection: none" instead of "Connection: undefined" when no connection is active.

Documentation

Graph Explorer has no sign-in of its own, so the docs now put access control up front.

• Access control comes first. The security reference opens with a new Access Control section. Graph Explorer performs no authentication or authorization, so never make it publicly reachable without an access control layer in front of it. Every deployment guide now says so.
• Guidance for self-hosted databases. New sections cover self-hosted Gremlin Server and using the Database Origin Allowlist on hosts with AWS credentials.
• Tighter deployment guides. The EC2, ECS, Docker, and SageMaker guides now restrict who can reach the container. The sample SageMaker lifecycle script binds to loopback and sets the allowlist to the notebook's cluster.
• A styled sample. The air_routes sample now includes a styles file and a styling reference, so you can see styling at work right away (thanks @mjuarros!).

Upgrade Notes

Existing deployments need no configuration change. PUBLIC_OR_PROXY_ENDPOINT and USING_PROXY_SERVER are still honored. A few things do behave differently:

• The Graph Explorer server must serve the UI. Graph Explorer finds its server at the parent of its own /explorer path, so hosting the UI on a different origin from the proxy server no longer works. A reverse proxy must forward the /explorer segment intact; renaming it shows "Reverse proxy misconfigured".
• The sagemaker-* tags no longer bake in notebook defaults. Pass NEPTUNE_NOTEBOOK=true to keep port 9250 and CloudWatch logs. The SageMaker lifecycle script already does. On the standard image, NEPTUNE_NOTEBOOK=true now applies the same preset, so set PROXY_SERVER_HTTP_PORT if you want a different port.
• Downgrading after editing connections isn't supported. Older versions can't read the new stored connection shape. Exported connection files still import into older versions.
• Remote icon URLs are no longer supported. A stored icon that isn't a built-in icon or an uploaded image falls back to the default icon.
• Minimum browser versions are now Chrome and Edge 123, Firefox 124, and Safari 17.4.
• The proxy server's /gremlin route reads gremlin from the request body instead of query. Reload any browser tab left open across the upgrade. Anything else that posts to this route needs the same change.

All Changes

• Make safeSessionStorage fallback test independent of Node version by @mjuarros in #2148
• Update dependencies and base image by @kmcginnes in #2156
• Add sample styles file and documentation for air_routes sample by @mjuarros in #2132
• Upgrade the Oxc toolchain and resolve #2150 lint findings by @mjuarros in #2162
• Move core-js to production dependencies by @mjuarros in #2167
• Apply the Monaco theme before the editor mounts by @mjuarros in #2133
• Bump base image and trim the Docker build context by @kmcginnes in #2183
• Update pnpm to 12.4.2 by @kmcginnes in #2178
• Update Vitest to version 5 by @mjuarros in #2166
• Update jotai to 3 by @mjuarros in #2175
• Disable Monaco link detection in code viewers by @mjuarros in #2189
• Virtualized Combobox component and keyword-search node-type picker migration by @mjuarros in #2131
• Dedupe the lockfile and fail CI on drift by @mjuarros in #2205
• Add Dependabot configuration for docker, GitHub Actions, and npm by @mjuarros in #2206
• Bump vitest from 5.0.0 to 5.0.1 in the vitest group by @dependabot[bot] in #2208
• Bump amazonlinux/amazonlinux from 2023.12.20260914.0 to 2023.12.20260918.0 by @dependabot[bot] in #2207
• Bump the actions group with 7 updates by @dependabot[bot] in #2210
• Bump dotenv from 17.4.2 to 18.0.1 by @dependabot[bot] in #2215
• Remove unused https dependency from the proxy server by @danielvanza in #2197
• Remove unused Babel preset devDependencies by @kmcginnes in #2229
• Stop flaky assertions in proxy server and schema sync tests by @kmcginnes in #2220
• Stop Dependabot reopening the @babel/core major bump by @kmcginnes in #2230
• Remove unused dependencies by @kmcginnes in #2231
• Move babel-plugin-react-compiler to devDependencies by @kmcginnes in #2232
• Replace Error.isError with instanceof Error in createErrorDetails by @mjuarros in #2192
• Ignore @types/node majors and cva bumps in Dependabot by @kmcginnes in #2238
• Share one test environment factory across the proxy server tests by @kmcginnes in #2248
• Bump the minor-and-patch group across 1 directory with 24 updates by @dependabot[bot] in #2241
• Exclude local secrets and build output from Docker build context by @kmcginnes in #2243
• Reject database URLs carrying embedded credentials at the proxy boundary by @kmcginnes in #2255
• Carry the errno through the proxy server's error payload by @kmcginnes in #2249
• Make the static mount's trailing-slash redirect relative by @kmcginnes in #2251
• Speed up test setup by skipping the utils barrel by @kmcginnes in #2257
• Drop coverage thresholds and stop collecting coverage in CI by @kmcginnes in #2258
• Give TestProvider a router by @kmcginnes in #2260
• Extract connection activation into a shared hook by @kmcginnes in #2261
• Shard unit tests across four CI jobs by @kmcginnes in #2259
• Let the create connection form start from prefilled values by @kmcginnes in #2262
• Move type, lint, and format checks into their own workflow by @kmcginnes in #2263
• Skip unit tests and the Docker test build for docs-only changes by @kmcginnes in #2264
• Name the accepted values in the boolean env var validation error by @kmcginnes in #2266
• Distinguish fetch timeouts from database query timeouts by @kmcginnes in #2268
• Cache the pnpm store in CI by @kmcginnes in #2271
• Scan the published Docker image after the publish workflow finishes by @kmcginnes in #2270
• Revert pnpm store caching in CI by @kmcginnes in #2273
• Fix the broken safari pinned tab icon path by @kmcginnes in #2276
• Fall back to "none" for the connection subtitle by @kmcginnes in #2274
• Name the NEPTUNE_NOTEBOOK/HTTPS conflict instead of blaming missing certs by @kmcginnes in #2252
• Label the expansion limit field Neighbor Expansion Limit by @kmcginnes in #2275
• Refuse to start when the container can't write its .env file by @kmcginnes in #2267
• Stop the request pool pulling new work after a failure by @kmcginnes in #2281
• Stop hard-wrapping Markdown prose by @kmcginnes in #2288
• Put the advanced connection settings behind a disclosure by @kmcginnes in #2278
• Sample each edge type with its own limit, 10 types per request by @kmcginnes in #2279
• Unify Docker image by removing SageMaker variant by @kmcginnes in #1773
• Bump amazonlinux/amazonlinux from 2023.12.20260918.0 to 2023.12.20260928.0 by @dependabot[bot] in #2300
• Bump github/codeql-action/upload-sarif from 4.38.1 to 4.38.2 in the actions group by @dependabot[bot] in #2292
• Add connection links via a dedicated #/connect route by @kmcginnes in #1828
• Replace .nvmrc with .node-version by @kmcginnes in #2302
• Connections refactor, phase A (1/4): pin the active-connection selectors with tests by @mjuarros in #2301
• Import vitest APIs explicitly instead of using globals by @kmcginnes in #2304
• Connections refactor, phase A (2/4): golden-file tests for the Exported Connection File by @mjuarros in #2308
• Connections refactor, phase A (3/4): pin the stored connection shapes by @mjuarros in #2311
• Remove test coverage tooling by @kmcginnes in #2309
• Connections refactor, phase A (4/4): delete the unused ConfigurationWithConnection type by @mjuarros in #2316
• Sync mattpocock skills to latest upstream by @kmcginnes in #2331
• Upgrade pnpm to 12.8.1 by @kmcginnes in #2327
• Enable pnpm autoDedupe by @kmcginnes in #2328
• Combine checks and unit tests into one unsharded CI job by @kmcginnes in #2329
• Run dependency review only when dependency manifests change by @kmcginnes in #2333
• Add REVIEW.md and point code reviews at it by @kmcginnes in #2336
• Bump amazonlinux/amazonlinux from 2023.12.20260928.0 to 2023.12.20260930.0 by @dependabot[bot] in #2337
• Replace CodeQL default setup with advanced setup by @kmcginnes in #2334
• Correct documented settings that do not work as described by @kmcginnes in #2324
• Move render-time Date calls into lazy state initializers by @kmcginnes in #2339
• Bump the minor-and-patch group across 1 directory with 21 updates by @dependabot[bot] in #2342
• Keep exported connection files importable by older versions by @kmcginnes in #2317
• Connections refactor, phase B (5/10): move connection types into src/connections/ by @mjuarros in #2332
• Share the export-to-text helper across connection file tests by @kmcginnes in #2340
• Fix SelectField ignoring disabled and aria-label in its default layout by @kmcginnes in #2319
• Document the deployer's responsibility for access control by @kmcginnes in #2343
• Explain why url wins over graphDbUrl on legacy direct connections by @kmcginnes in #2345
• Connections refactor, phase B (6/10): move normalization and legacy migration into src/connections/ by @mjuarros in #2344
• Correct access control docs and widen the docs review rule by @kmcginnes in #2346
• Connections refactor, phase B (7/10): move active-connection selectors into src/connections/ by @mjuarros in #2348
• State that Graph Explorer enforces no permissions by @kmcginnes in #2347
• Connections refactor, phase B (8/10): move exported connection file code into src/connections/ by @mjuarros in #2349
• Connections refactor, phase B (9/10): move default connection and lifecycle hooks into src/connections/ by @mjuarros in #2350
• Stop using Iterator helpers and other above-floor APIs so core-js can be removed by @mjuarros in #2245
• Show invalid connection links in a card on the connect page by @kmcginnes in #2352
• Extract the connection form model into a pure module by @kmcginnes in #2320
• Scope graph-view and schema-view layouts to the browser tab by @kmcginnes in #1894
• Connections refactor, phase B (10/10): rehome schema leftovers and delete ConfigurationProvider by @mjuarros in #2351
• Fix non-square icons squashed instead of scaled to fit by @mjuarros in #2142
• Finish the access control docs by @kmcginnes in #2355
• Connections refactor, phase C (11/13): rename legacy Configuration symbols to Connection by @mjuarros in #2357
• Bump the minor-and-patch group with 11 updates by @dependabot[bot] in #2358
• Bump motion from 13.4.6 to 14.0.0 by @dependabot[bot] in #2359
• Help operators limit which databases the proxy's AWS identity can reach by @kmcginnes in #2363
• Persist schema view layout selection by @mjuarros in #2144
• Stop locking the query language when Neptune Analytics is chosen by @kmcginnes in #2365
• Keep an explicit query language in Neptune Analytics connection links by @kmcginnes in #2366
• Move Query Language below Database URL and relabel the IAM checkbox by @kmcginnes in #2367
• Stop marking direct connections in the connection list and details by @kmcginnes in #2368
• Stop describing direct connections as deprecated by @kmcginnes in #2369
• Refresh dependencies by @kmcginnes in #2371
• Update package versions by @kmcginnes in #2372
• Choose the connection method with a radio group of choice cards by @kmcginnes in #2364
• Replace pr skill with local version and add issue skill by @kmcginnes in #2376
• Connections refactor, phase C (12/13): rename Configuration atoms to Connection by @mjuarros in #2361
• Add deployment guidance for self-hosted Gremlin Server by @kmcginnes in #2381
• Bind the notebook sample's container to loopback and restrict its database origins by @kmcginnes in #2382
• Bump version to 3.3.0 by @kmcginnes in #2384
• Bind the Gremlin Server walkthrough to loopback and name its connection method by @kmcginnes in #2386
• Make direct Gremlin connections work with Gremlin Server by @kmcginnes in #2387
• Reject link-local addresses as database origins by @kmcginnes in #2388
• Pin the browser floor to Baseline Widely available through browserslist by @kmcginnes in #2394
• Reword the connection method cards and move IAM below them by @kmcginnes in #2397
• Tighten warnMissingIds types and drop redundant Set values() calls by @kmcginnes in #2395
• Fix agent docs that drifted from the connections refactor by @kmcginnes in #2391
• Warn that the ECS guide deploys publicly and require a source range by @kmcginnes in #2375
• Typecheck packages/shared on its own by @kmcginnes in #2396
• Report a fetch timeout only when the timeout fired by @kmcginnes in #2392
• Use native String.prototype.isWellFormed by @kmcginnes in #2398
• Shorten the advanced option titles and say what each one does by @kmcginnes in #2400
• Tighten test fidelity in connection, proxy, and session storage tests by @kmcginnes in #2389

New Contributors

Welcome and thank you to our first-time contributors!

• @mjuarros made their first contribution in #2148
• @danielvanza made their first contribution in #2197

Full Changelog: v3.2.2...v3.3.0