Search
Got 4,819 results, sorted by newest / oldest
Release: datasette 1.0a40
A security fix, a new set of APIs providing background tasks for plugins, an endpoint for counting matching rows, and a collection of bug fixes. Security fix Fixed a security issue where a trailing newline in a requested table name could bypass table permissions and expose private rows. Thanks for the report, dpfkdlemtp. GHSA-h547-rmjf-5m2m Background tasks Datasette plugins can now use backgrou...
Released 2026-09-16T23:51:43Z
Blog: datasette 1.0a40
Release: datasette 1.0a40 Same security fix as 0.65.5, plus some neat new features and bug fixes: Plugins can now launch and manage background tasks using the new datasette.add_background_task() method. Thanks, Alex Garcia. I've migrated Datasette to httpx2 for features like the internal datasette.client.get() method. A whole lot of bug fixes, many of them stemming from a recent effort to...
Published 2026-09-16T23:51:43+00:00
Release: datasette 0.65.5
Fixed a security issue where a trailing newline in a requested table name could bypass table permissions and expose private rows. Thanks for the report, dpfkdlemtp. GHSA-h547-rmjf-5m2m
Released 2026-09-16T23:51:08Z
Blog: datasette 0.65.5
Release: datasette 0.65.5 Security fix for an issue where a trailing newline in a requested table name could bypass table permissions and expose private rows, reported by dpfkdlemtp in GHSA-h547-rmjf-5m2m. Tags: security, datasette
Published 2026-09-16T23:51:08+00:00
Datasette News: 2026-09-16
Datasette 0.65.5 and 1.0a40 are out, with a security fix for a table permisisons bypass. Datasette 1.0a40 also adds a mechanism for plugins to run background tasks.
Release: shot-scraper 1.12
WebP support, including different quality settings e.g. shot-scraper http://www.example.com/ -o shot.webp --quality 80. WebP filesizes should be significantly smaller than both JPEG and PNG for many web pages. #209 Fix local file URI handling for WebKit. Thanks, Xi Qin. #208
Released 2026-09-13T23:58:14Z
Release: sqlite-http v0.1.2
Improved release assets using https://github.com/asg017/sqlite-dist Fix for https://github.com/asg017/sqlite-http/issues/35 , thank you @ephraimstevens!
Released 2026-09-12T20:40:18Z
Release: sqlite-http v0.1.2-alpha.4
Released 2026-09-12T20:27:35Z
Release: sqlite-http v0.1.2-alpha.3
Released 2026-09-12T20:10:25Z
Release: sqlite-http v0.1.2-alpha.2
Released 2026-09-12T20:02:21Z
Release: sqlite-http v0.1.2-alpha.1
Released 2026-09-12T17:26:00Z
Blog: Datasette 1.0a39 and 0.65.4 security releases
Datasette 1.0a39 and 0.65.4 security releases Today we're releasing two new security patch versions of Datasette: 1.0a39 and 0.65.4 - one for the current alpha series and one for the stable 0.65.x family. These are security fixes which you should apply if you are running a Datasette instance on the public web - in particular if that instance mixes both public and private tables. Following issues r...
Published 2026-09-11T03:27:16+00:00
Release: datasette-publish-fly 1.4
Sets force_https=true in fly.toml. #31 Fix for Volume could not be found bug. #32 Compatible with app-scoped deploy tokens. #34
Released 2026-09-11T02:58:52Z
Release: github-to-sqlite 2.9.1
Fix for compatibility with sqlite-utils 4.x. #85
Released 2026-09-11T00:28:39Z
Release: datasette 0.65.4
This release includes security fixes for permissions, SQL construction and caching, backported to the stable 0.65.x branch. See 1.0a39 for the full set of security fixes and other improvements in the 1.0 alpha series. The Datasette blog has more details on these releases. Some of the security fixes include: Table and view permission checks now take SQLite's case-insensitive names into account. Se...
Released 2026-09-11T00:06:55Z
Release: datasette 1.0a39
See 0.65.4 for fixes that have been backported to the stable 0.65.x branch. The Datasette blog has more details on these releases. Some of the security fixes include: Table and view permission checks now take SQLite's case-insensitive names into account. See How permissions are resolved. Viewing a full-text search index table now checks you have permission to view the table from which it draws ...
Released 2026-09-11T00:05:54Z
Blog: Datasette 1.0a39 and 0.65.4 security releases
We have two big security updates for Datasette today - one for the 1.0 alpha series and another for the 0.65.x stable release:
Blog: Creepy crawlies
Creepy crawlies Konstantin Ryabitsev discusses how bad the "background radiation" of abusive crawlers has become from the perspective of git.kernel.org, the official Git repository for the Linux kernel: TL;DR: we spend more CPU cycles rendering commits for scrapers than we spend on all other kinds of legitimate access, including git clones. At any one time, across 5 geo-distributed nodes, there a...
Published 2026-09-07T23:08:58+00:00
Release: llm 0.34
New features: llm logs --usage Markdown output now includes the response duration in milliseconds and as a human-readable duration. llm logs --short includes a new duration_ms field. #1653 Bug fixes: Significantly improved the performance of llm logs for long conversations by caching repeated message and model lookups. #1654 Dynamically generated OpenAI options classes are now cached, avoiding ...
Released 2026-09-02T19:23:52Z
Blog: datasette-mcp 0.2
Release: datasette-mcp 0.2 "rows" from execute_sql is now an array of objects. Previously it was an array of arrays. This should help weaker models avoid losing track of which positional array element maps to which column. #1 Now depends on mcp>=2.1.1. This is the first non-alpha release of the plugin. I'm confident it's ready as I've been using it quite a bit myself. ...
Published 2026-09-01T15:30:12+00:00
Release: llm 0.33
New features: Upgraded to the OpenAI Python library 3.x and switched the HTTP client dependency from httpx to httpx2. #1608, #1631 llm embed and llm embed-multi now accept --key. The Python EmbeddingModel.embed(), EmbeddingModel.embed_multi(), Collection.embed() and Collection.embed_multi() methods accept key= too, passing the resolved per-call key to embedding plugins without changing shared mod...
Released 2026-08-22T17:01:16Z
Release: llm 0.32.1
This version pins LLM to use OpenAI Python versions less than v3.0.0, ensuring fresh LLM installations work without needing to also install an extra httpx dependency. #1630
Released 2026-08-21T17:16:13Z
Release: sqlite-utils 4.2.1
Fix for No module named 'typing_extensions' crashing bug accidentally shipped in version 4.2. #842
Released 2026-08-13T23:53:47Z
Release: sqlite-utils 4.2
New table.checks, table.column_checks and table.table_checks introspection properties expose column-level and table-level CHECK constraints. (#834) New sqlite_utils.ANY marker type for creating and introspecting SQLite ANY columns. The Python API and CLI can create, add and transform these columns, and table.transform() and table.extract() now preserve ANY columns and their values in STRICT table...
Released 2026-08-13T20:11:29Z
Release: datasette-upload-dbs 0.5a0
Documented API for uploading files. #2 No longer depends on Starlette for file uploads. #13 Fixed a bug where a corrupt SQLite database could still be swapped in.
Released 2026-08-11T20:35:13Z
Blog: datasette-upload-dbs 0.5a0
Release: datasette-upload-dbs 0.5a0 This plugin has been around for a while - it lets users upload a brand new SQLite database to a hosted Datasette instance, at which point that database will start being served by that instance. It can also be used to atomically swap a database with a more recent version. The uploaded database is saved to a file, verified, then swapped in so /name starts ...
Published 2026-08-11T20:35:13+00:00
Release: datasette-public 0.4a2
Upgraded for compatability with Datasette 1.0a37.
Released 2026-08-11T20:08:26Z
Release: datasette-auth-tokens 0.4a13
Fix for sqlite-utils 4.0. Thanks, Alex Garcia. #44
Released 2026-08-06T23:07:47Z
Blog: datasette-auth-tokens 0.4a13
Release: datasette-auth-tokens 0.4a13 Upgraded for compatibility with `sqlite-utils 4. Tags: datasette
Published 2026-08-06T23:07:47+00:00
Release: datasette 1.0a38
This release fixes a SQL injection security issue that affects Datasette instances that serve a mixture of public and private tables in the same database, with access configured using the Datasette permissions system. Site administrators who serve private tables in this way are advised to disable the execute-sql permission permission on that database to prevent users from accessing private tables ...
Released 2026-08-06T18:24:34Z
Blog: datasette 1.0a38
Release: datasette 1.0a38 This release fixes a SQL injection security issue that affects Datasette instances that serve a mixture of public and private tables in the same database, with access configured using the Datasette permissions system. Site administrators who serve private tables in this way are advised to disable the execute-sql permission on that database to prevent users from a...
Published 2026-08-06T18:24:34+00:00
Release: datasette 0.65.3
This release fixes a SQL injection security issue that affects Datasette instances that serve a mixture of public and private tables in the same database, with access configured using the Datasette permissions system. Site administrators who serve private tables in this way are advised to disable the execute-sql permission on that database to prevent users from accessing private tables using raw S...
Released 2026-08-06T18:22:07Z
Blog: datasette 0.65.3
Release: datasette 0.65.3 Back-ported the SQL Injection security fix from 1.0a38. Tags: datasette
Published 2026-08-06T18:22:07+00:00
Release: llm 0.32
LLM 0.32 is a major, backwards-compatible update to the way prompts, responses, tools and logs are represented. It adds structured messages and parts throughout the Python API, adopts the OpenAI Responses API for reasoning-capable models, substantially expands control over pausable and resumable tool loops and introduces a new content-addressed SQLite logging schema. Reasoning traces are now displ...
Released 2026-08-04T17:15:33Z
Blog: datasette-apps 0.2a0
Release: datasette-apps 0.2a0 Changes that improve Datasette Apps when created and edited using Datasette Agent: New app_debug() tool allowing agent to open an app (invisibly) and test it using JavaScript. #33 New app_list() tool for listing apps the user has permission to edit, so the agent can edit them. #36 The app_debug() tool is pretty neat: it works by displaying the app in a opa...
Published 2026-08-01T21:23:56+00:00
Blog: Stateless MCP has recaptured my interest (and inspired mcp-explorer and datasette-mcp)
Tuesday was Stateless MCP day - the rollout of MCP 2.0, or the 2026-07-28 Model Context Protocol specification to use the more formal but less memorable name. This is the most significant change to the MCP spec since it first launched, and has also served to reignite my personal interest in the protocol. For background: MCP is the Model Context Protocol, which describes a standard way to expose ne...
Published 2026-07-31T23:13:22+00:00
Blog: datasette-agent 0.4a0
Release: datasette-agent 0.4a0 New await context.browser_task() mechanism allowing agent tools to run code directly in the user's browser. #33 This is an exciting new capability: it makes it easy for Datasette Agent plugins to provide tools that execute custom JavaScript in the user's browser. I used this to add a debug loop to Datasette Apps in datasette-apps 0.2a0. ...
Published 2026-07-31T14:14:23+00:00
Release: llm 0.32rc2
The default model for users who have not set their own default is now GPT-5.6 Luna. It was previously GPT-4o mini. Luna is a much better and more recent model, albeit slightly more expensive - $0.20 per million input tokens and $1.20 per million output tokens, compared to $0.15/$0.60 for 4o mini. You can switch back to 4o mini using llm models default gpt-4o-mini, or switch to GPT-5 nano, an even...
Released 2026-07-30T22:52:06Z
Release: llm 0.32rc1
This release candidate for 0.32 introduces a new database schema for logging prompts and responses that captures full details of the interaction with the underlying LLM, and de-duplicates those records using a content-addressed message store. Upgrading to this RC will create those new tables and start logging to them. Existing data in the responses table will be left unaffected, and the logs comma...
Released 2026-07-30T15:30:20Z