Update from code changes: custom app dependencies + kill-switch#971
Open
mintlify[bot] wants to merge 3 commits into
Open
Update from code changes: custom app dependencies + kill-switch#971mintlify[bot] wants to merge 3 commits into
mintlify[bot] wants to merge 3 commits into
Conversation
Contributor
Author
|
Preview deployment for your docs. Learn more about Mintlify Previews.
|
Contributor
🤖 Documentation Bot✅ All checks passed! No issues found. |
Contributor
🤖 Documentation Bot✅ All checks passed! No issues found. |
Contributor
Author
|
Update from code changes updated this PR. Documented the org feature flag, admin-only scope, and OSV malware and release-age upload checks for data app dependencies. Source PRs
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Documents the custom-dependencies feature for data apps end-to-end: local authoring, the instance kill-switch, the layered org/scope gates, upload-time security screens, and the CSP change that unblocks blob-URL workers.
Changes
guides/data-apps.mdx: new Declared dependencies section coveringpnpm add, lockfile requirement,.npmrcignore-scripts=true,@lightdash/query-sdkrelease-age exemption, upload validation rules, the CSP now allowingblob:inscript-src/worker-src/child-src, and the three-layer upload gate (instance flag, per-org feature flag, admin-onlymanage:DataAppDependencyscope). Iterating section calls out the package chip that appears in the version timeline for versions with custom deps. Replaced the "Fixed dependency set" constraint with a pointer to the new section.guides/data-apps/self-hosting.mdx: new Custom dependencies subsection documentingLIGHTDASH_APP_CUSTOM_DEPENDENCIES_ENABLED,LIGHTDASH_APP_DEPENDENCY_REGISTRY_HOSTS, andLIGHTDASH_APP_DEPENDENCY_INSTALL_TIMEOUT_MS, and noting that the enable flag is a full kill-switch (also blocks builds/AI iterations/restores of previously-approved dep sets). New Upload-time dependency checks subsection for the OSV malware screen (LIGHTDASH_APP_DEPENDENCY_MALWARE_CHECK_ENABLED, default on, fails closed) and the optional minimum release-age guard (LIGHTDASH_APP_DEPENDENCY_MIN_RELEASE_AGE_DAYS). Permissions section calls outmanage:DataAppDependencyas an admin-only scope required to declare custom dependencies.self-host/customize-deployment/environment-variables.mdx: the five custom-dependency env vars added to the Data apps runtime reference table.Context
Source PRs:
Update history
manage:DataAppDependencyscope, OSV malware screen and minimum release-age guard env vars.