Datasette Patches a SQL Injection Hole in Mixed Public/Private Tables
Datasette 1.0a38 and the backported 0.65.3 fix a SQL injection vulnerability affecting instances that serve a mixture of public and private tables in the same database with permission-based access control.
What it is
Datasette 1.0a38 and Datasette 0.65.3 are security-fix releases for Simon Willison's open-source tool for exploring and publishing SQLite databases.
What it does
Both releases patch a SQL injection issue that affects Datasette instances serving a mix of public and private tables from the same database when access is configured through the Datasette permissions system. 0.65.3 backports the same fix from 1.0a38 so users on the older stable branch don't have to jump to the alpha series to get it.
Why it matters
This is a real vulnerability, not a routine bugfix: any Datasette deployment mixing public and private tables under permission-based access should treat this as urgent, since SQL injection in that setup could expose private data through a public-facing table.
How to use it
Upgrade to Datasette 1.0a38 or 0.65.3 immediately if you serve a mix of public and private tables using the permissions system; Anthropic's own advisory recommends disabling affected features until you can patch.
datasette-agent 0.4a0 Lets Agent Tools Run JavaScript in Your Browser
Datasette Agent 0.4a0 adds a browser_task mechanism that lets agent plugin tools execute custom JavaScript directly in the user's browser instead of on the server.
Datasette 1.0a39 and 0.65.4: Another Security Release, Apply It Now
Datasette 1.0a39 and 0.65.4 are security patch releases that Datasette's team recommends applying immediately on any instance running on the public web.
Graham Dumpleton Is Writing a Wrapture Tutorial Almost Every Day
Graham Dumpleton has been publishing near-daily tutorials for wrapture, his Python function-wrapping library, since its August 31st release, expanding beyond the original announcement.