Datasette 1.0a39 and 0.65.4 security releases
Datasette 1.0a39 and 0.65.4 security releases Today we're releasing two new security patch versions of Datasette: 1.0a39 and 0.65.4 - one for the current alpha series and one for the stable 0.65.x family. These are security fixes which you should apply if you are running a Datasette instance on the public web - in particular if that instance mixes both public and private tables. Following issues…
Datasette, a web application designed for querying SQLite databases, has released two new security patch versions: 1.0a39 for its alpha series and 0.65.4 for its stable 0.65.x family. These updates address critical vulnerabilities, particularly for instances that handle both public and private tables. The security fixes were discovered following a thorough audit performed by Sevban Dönmez and Alex Garcia, using advanced AI models such as Claude Fable 5.1, GPT-5.6, and GPT-6 Astra.
The audit process involved extensive collaboration between the developers, ensuring a comprehensive review of the identified bugs. The developers plan to integrate such security audits using frontier models into their development workflow moving forward. This release marks a significant step in enhancing the security of Datasette instances, especially for those exposed to the public web.
Written by urgent.news from Simon Willison's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
