Skills
Datasette 1.0a40 fixes a table-permission bypass triggered by a trailing newline in the requested table name
GHSA-h547-rmjf-5m2m: a trailing newline appended to a table name in a request bypassed table permission checks and exposed private rows, patched in both 1.0a40 and 0.65.5. The failure shape is worth internalizing beyond Datasette, since any permission check that normalizes an identifier differently from the code that resolves it has the same bug. The same alpha adds a background tasks API where plugins register supervised long-lived work through .add_background_task(), launched after startup hooks with graceful shutdown, plus a POST count endpoint and a migration from httpx to httpx2 that requires plugins to update dependencies and isinstance checks.
↳ Follow the thread