Affects
Teams that manage Reporter data sources, paginate report lists, or render template previews.
What changed
Reporter manages a persisted PostgreSQL and MongoDB data-source registry through the API. Passwords are write-only and encrypted at rest with
DATASOURCE_CRED_ENC_KEY; live templates prevent a referenced data source from being deleted. Single-tenant deployments can seed entries at startup, while multi-tenant deployments create them through the API.
Report lists use keyset pagination with nextCursor and prevCursor. Template previews have a synchronous concurrency limit controlled by PREVIEW_MAX_CONCURRENT (default 4); exhausted capacity returns HTTP 429 with RPT-0108, and a render refusal returns RPT-0107.
This corrects documentation of implemented contracts. It does not announce a runtime release.
Impact
Classification: Action required. Existing data-source automation, secret management, report pagination, and preview retry handling may rely on retired assumptions.
What you need to do
1
Set one persistent valid
DATASOURCE_CRED_ENC_KEY for every Reporter runtime that reads the registry.2
Use the data-source API lifecycle and account for soft-delete refusal while live templates reference a source.
3
Follow
nextCursor and prevCursor for report lists instead of using page numbers.4
Handle
RPT-0107 as a render refusal and retry RPT-0108 after capacity becomes available.