Datasette 1.0a40 patches permissions bypass that leaked private rows via trailing newline
JeremyCMorgan · x · 2026-09-26
Datasette 1.0a40 is out with a security fix: a trailing newline in a requested table name could bypass table permissions and expose private rows (GHSA-h547-rmjf-5m2m). Upgrades are urged for anyone serving private data.
The release also adds a background task system for plugins:
- New .addbackgroundtask(func, name=None) API lets plugins register supervised long-lived background tasks, typically from a startup hook; tasks get a five-second grace period on shutdown.
- A new /-/tasks JSON debug endpoint lists every supervised task and its state (requires permissions-debug).
- New shutdown(datasette) plugin hook fires during graceful shutdown (Ctrl-C/SIGTERM) before tasks are cancelled.
Also included: an endpoint for counting matching rows and a batch of bug fixes.
More from coding & agent
- Reasonable Team Publishes TLA+ Tutorial: Not a Silver Bullet, AI Agents Could Change That — fhuszar · 2026-09-26
- Using Opus 5.5 to make a video explaining Algorithm W and Hindley-Milner type inference — ctjlewis · 2026-09-26
- Runway MCP brings Gen-4.5 video and image generation into Claude chats — runwayml · 2026-09-26
- One 'Harmless' Agent Permission Turned Into a Backdoor for Everyone — Adorable-Algae6903 · 2026-09-26
- DEV·TV: a single-HTML-file TV playing Hugging Face models and AI papers hits Product Hunt — TradingCardGirl · 2026-09-26
- MCP Wallet Agents Need Boring Permission Rules Before Going Agentic — Any-Sir-7622 · 2026-09-26