v0.47.0

SQLPage 0.47: click a chart, open the details

Add a link to a chart row and let people open the records behind the numbers. SQLPage 0.47 also adds icons and units to select fields, fixes several SQL Server problems, and includes security fixes for protected pages.

Important

If you use OIDC login, upgrade for the authentication fixes below. If you use the downloadable Mac archive on an Intel Mac, read the installation notes before upgrading.

From the dashboard to the details

Click “Paid” to see the paid orders. Click a project’s timeline bar to open its page. Each chart row can now supply its own destination through link.

select 'chart' as component, 'Orders by status' as title,
       'bar' as type, 'cyan' as color, true as labels,
       false as toolbar, false as show_legend;

select 'Orders' as series, 'Pending' as label, 12 as value,
       'orders.sql?status=pending' as link;
select 'Orders' as series, 'Paid' as label, 28 as value,
       'orders.sql?status=paid' as link;
select 'Orders' as series, 'Shipped' as label, 46 as value,
       'orders.sql?status=shipped' as link;

Both the chart point and its tooltip value open the link. Text labels in tooltip titles link too, and the tooltip stays open while you move the pointer onto it.

Your destination page handles the selected filter as usual. Chart documentation →

Give dropdowns a little more context

Select fields now support the same prefix, prefix_icon, and suffix options as text inputs. Put the unit beside the choice, or add an icon that helps people recognize the field.

select 'form' as component, '' as validate;

select 'retention' as name, 'Activity log' as label,
       'select' as type,
       'history' as prefix_icon,
       'Keep for' as prefix, 'days' as suffix,
       '[{"label":"7","value":"7"},
         {"label":"30","value":"30"},
         {"label":"90","value":"90"}]' as options,
       '30' as value;

Form documentation →

Fixes you may notice in existing apps

• SQL Server defaults work when a parameter is missing. Expressions such as ISNULL($missing, 'default') no longer truncate the fallback text or fail when the fallback is a date.
• SQL Server’s JSON_OBJECT('key': value) syntax is accepted, including inside SET statements and nested sqlpage.* calls.
• Loading embedded card content no longer makes existing forms submit more than once. It also avoids repeatedly attaching file-validation handlers.
• Apps that store SQL pages in the database handle busy periods better. SQLPage can check whether one page has changed without making unrelated requests wait for that check.

Security fixes

OIDC protection now follows the SQL file a URL actually resolves to. Alternate spellings and clean URLs can no longer bypass protection configured for that file. Nonce verification also rejects unexpected hashing parameters before performing expensive work.

SQL files with mixed-case extensions, such as .SQL, execute as SQL instead of being served as source text. Ambiguous paths, including certain Windows filename aliases, are rejected to prevent source disclosure.

A new home for SQLPage

The SQLPage website has been rebuilt, with live examples beside their SQL, an interactive database sculpture, and clearer routes to documentation and deployment guides.

Try sorting a table, switching components, or submitting the example form. The examples run in SQLPage, so you can see what the query produces before adapting it for your app.

Before you upgrade

Mac downloads: sqlpage-macos.tgz now runs natively on Apple silicon and is signed with a Developer ID certificate and notarized by Apple. macOS may still ask for confirmation the first time you open it.

The archive no longer runs on Intel Macs. Use Homebrew:

brew install sqlpage

For an existing Homebrew installation, run brew update followed by brew upgrade sqlpage. If you’re switching from the archive, open Terminal in your existing website folder and run sqlpage instead of ./sqlpage.bin. Keep your SQL files, database, and configuration folder in place. Some Intel installations build from source and take longer; see the Mac installation guide.

Custom JavaScript: SQLPage no longer provides window.bootstrap or window.tabler. Scripts using those globals need to load their own Bootstrap library.

Building from source: published crates include the browser assets, removing separate browser-library downloads during compilation. For a Git checkout, npm run build:rust installs dependencies and builds both the frontend and SQLPage. The startup message also reports the address and port the server actually opened.

Special thanks to @81reap for his contributions to this release.

All changes since v0.46.3