Datasette 0.65.5 and 1.0a40 patch table permission bypass tracked as GHSA-h547-rmjf-5m2m

Datasette 0.65.5 fixes a security issue (GHSA-h547-rmjf-5m2m) in which a trailing newline in a requested table name bypassed table permission checks and could expose private rows; the same fix ships in the 1.0a40 alpha, which also adds a background task…

On 2026-09-16, Simon Willison released Datasette 0.65.5 to address GHSA-h547-rmjf-5m2m, a permission bypass in which a trailing newline in a requested table name bypassed table permission checks and could expose private rows on affected Datasette instances. The flaw was reported by dpfkdlemtp. The same security fix is included in Datasette 1.0a40, an alpha on the road to a stable 1.0 release. Beyond the security fix, 1.0a40 introduces a datasette.add_background_task() method letting plugins launch and manage background tasks, migrates to httpx2 powering internal client methods such as datasette.client.get(), and carries many bug fixes resulting from issue triage ahead of the 1.0 stable release.