TableCraft v0.2.27 — Grouping, Tree Adapters and Secure Exports

TableCraft v0.2.27 — Grouping, Tree Adapters and Secure Exports

PR #38 lands the next milestone of @tablecraft/table with row grouping, full static and lazy tree support, source-safe tenant switching, and a hardened export pipeline. @tablecraft/adapter-next ships a tighter Next.js compatibility floor that excludes versions affected by recent security advisories.

Highlights

• Row grouping — controlled and imperative expansion APIs for grouped tables.
• Static and lazy tree adapters — useStaticAdapter and useTreeAdapter cover both pre-loaded and on-demand hierarchies.
• Source-safe tenant switching — lazy-tree sourceKey lifecycle handling cancels stale fetches when the source changes.
• Cross-page selection and export — selections persist across paginated views and into CSV/JSON/Excel exports.
• Secure CSV handling — formula injection protection neutralizes =, +, -, @, tab, and carriage-return prefixes.
• Toolbar placement APIs — toolbar and toolbarPlacement options for header/footer/start customization.
• Retail hierarchy example — new demo and PostgreSQL integration test suite in apps/hono-example.
• Next.js security floors — @tablecraft/adapter-next now requires >=15.5.18 <16 or >=16.2.6, excluding releases affected by GHSA-gx5p-jg67-6x7h and GHSA-26hh-7cqf-hhc6.

Packages published

Package	Version
@tablecraft/table	0.2.27
@tablecraft/adapter-next	0.1.7

Migration and compatibility notes

• @tablecraft/adapter-next no longer accepts Next.js versions below 15.5.18 or in the 16.0.0–16.2.5 range.
• The lazy-tree adapter now keeps a stable identity across renders — call sites that previously keyed on adapter.version should rely on the bumpVersion API instead.
• Group rows are excluded from selection and row-action handlers; consumers that previously selected group rows must explicitly opt in via the new grouping API.

See PR #38 for the full change set.