Datasette 1.0a39 is an alpha security release whose fixes are documented in the Datasette blog post covering it and 0.65.4.
Datasette 1.0a39 is an alpha release in the 1.0 series that also serves as a security release. The fixed vulnerabilities are described in the 'Datasette 1.0a39 and 0.65.4 security releases' blog post. The announcement provides no CVE identifiers or further technical detail.
Datasette shipped security patches 1.0a39 and 0.65.4 fixing subtle bugs in instances mixing public and private tables, found via an AI-assisted audit.
Datasette released parallel security fixes for its current alpha series (1.0a39) and stable 0.65.x family (0.65.4), advising anyone running a Datasette instance on the public web to update, especially where public and private tables are mixed. The underlying issues were reported by Sevban Dönmez and Alex Garcia, followed by an extensive audit of the codebase using Claude Fable 5.1, GPT-5.6, and GPT-6 Astra. Fixes were developed and reviewed collaboratively over nearly a week. No CVE identifiers or observed exploitation are mentioned in the announcement.
Datasette shipped the 0.65.4 security patch release for its stable branch, with fixes documented in the blog post covering 1.0a39 and 0.65.4.
Datasette 0.65.4 is a security patch release for the 0.x stable branch of the popular data exploration tool. Details of the fixed issues are published in the 'Datasette 1.0a39 and 0.65.4 security releases' blog post. No CVE identifiers or vulnerability specifics are provided in the announcement itself.
Datasette-publish-fly 1.4 sets force_https in fly.toml, fixes a volume detection bug, and adds support for app-scoped Fly deploy tokens.
Version 1.4 of the datasette-publish-fly plugin for deploying Datasette to Fly.io has been released. It sets force_https=true in fly.toml, fixes a 'Volume could not be found' bug, and adds compatibility with app-scoped deploy tokens. No security vulnerabilities are mentioned in the release notes.
Simon Willison released datasette-mcp 0.2, changing MCP SQL results to object arrays for better small-model usability.
Datasette-mcp 0.2 changes the execute_sql 'rows' output from an array of arrays to an array of objects, helping weaker models avoid losing track of positional column mappings. The plugin now depends on mcp>=2.1.1. This is the first non-alpha release, and the author reports using it extensively.
git.kernel.org spends more CPU rendering commit pages for abusive AI-era scrapers than on all legitimate access including git clones.
Konstantin Ryabitsev reports that abusive crawler 'background radiation' at git.kernel.org consumes more CPU cycles rendering commit HTML than all legitimate access, with 14 cores across five geo-distributed nodes dedicated to scraper traffic. Simon Willison highlights the implications for crawlable web services like Datasette.
Simon Willison released commit-rewriter 0.1, a tool that rewrites git commit messages from the first edited commit, with a timestamped revert branch.
Simon Willison built commit-rewriter 0.1, a small web app for editing git commit messages, motivated by cleaning up Datasette security release commits that contained coding agent cruft and private issue IDs. It runs via 'uvx commit-rewriter path/to/repo' and creates a timestamped branch of the repo state before rewriting every commit from the first edited one to the most recent, allowing easy reversion.