Datasette 0.65.5 and 1.0a40 are out, with a security fix for a table permisisons bypass. Datasette 1.0a40 also adds a mechanism for plugins to run background tasks.

Here's a new TIL on using SQL functions in Google Sheets to fetch data from Datasette.

Datasette 1.0a27 changes how CSRF protection works in a way that simplifies form and API integration, and introduces a new RenameTableEvent for when a table is renamed by a SQL query.

Datasette 1.0a26 adds a column_types system allowing columns to carry additional type information such as email or url, or extra types defined by plugins. This alpha also adds a UI for selecting and sorting visible columns on a table page.

Datasette 1.0a25 adds write_wrapper() and register_token_handler() plugin hooks.

Datasette 1.0a24 introduces a new await request.form(files=True) method for accepting file uploads, plus various other changes.

Datasette 0.65.2 and Datasette 1.0a21 have been released with a security fix for an open redirect error, see this advisory. The latest Datasette alphas also include a breaking change to Datasette's permission system, described in detail in A new SQL-powered permissions system in Datasette 1.0a20.

Datasette 1.0a17 is the latest Datasette 1.0 alpha release, with bug fixes and small feature improvements from the last few months.

A security fix, a new set of APIs providing background tasks for plugins, an endpoint for counting matching rows, and a collection of bug fixes.

Security fix

• Fixed a security issue where a trailing newline in a requested table name could bypass table permissions and expose private rows. Thanks for the report, dpfkdlemtp. GHSA-h547-rmjf-5m2m

Background tasks

Datasette plugins can now use background tasks to run code independent of the Datasette request/response cycle. - New .add_background_task(func, name=None) API: plugins register supervised, long-lived background work - typically from a startup hook - and these will be launched after every startuphook has run. Tasks are cancelled (with a five-second grace period) on shutdown. - New /-/tasks JSON debug endpoint lists every supervised background task and its state, in the style of /-/threads. See /-/tasks. It requires the permissions-debug permission. - New shutdown(datasette) plugin hook, called during graceful shutdown (Ctrl-C, SIGTERM) before background tasks are cancelled and before database connections are closed. It is not called on a hard kill (SIGKILL). - Plugin asgi_wrapper middleware now always runs after startup has completed. - If your plugin uses asgi_wrapper to start background tasks on the first incoming request, you should migrate to datasette.add_background_task() instead. datasette-cron and datasette-enrichments are being migrated to this pattern.

Other features

• New POST count endpoint for counting filtered table rows, now used by the count all button. (#2914)
• Datasette now uses httpx2, the Pydantic-maintained continuation of httpx, in place of httpx. The public API is the same, but responses returned by datasette.client are now httpx2.Responseobjects rather than httpx.Response. Plugins that use isinstance() checks against httpx.Response should be updated to use httpx2. Plugins that use httpx without explicitly depending on it will need to add an explicit dependency or switch to httpx2.

Bug fixes

• Column facets now show the remove-filter link for filters using column__exact=value, as well as column=value. (#1695)
• The alter-table API now rolls back schema changes when a write_wrapper raises after the write. (#2924, #2925)
• The extra_template_vars() plugin hook can now return a function or awaitable that resolves to None when no extra variables are needed. (#2005)
• request.headers now supports case-insensitive header lookups, so request.headers.get("Content-Type") works as well as request.headers.get("content-type"). (#1861)
• CSV endpoints now return plain-text error messages for SQL errors. (#2129)
• The render_cell() plugin hook now receives an empty pks list when rendering SQL views in HTML, matching the JSON ?_extra=render_cell behavior. (#2639)
• Numeric comparison filters now correctly handle decimal values, negative numbers and scientific notation when filtering computed columns and SQL views. Thanks, Rami Abdelrazzaq. (#1681, #2876)
• Fixed CSV streaming with ?_stream=on on SQL views repeating the second page of results until the CSV size limit was reached. Thanks, Ankita Advitot. (#2902, #2903)

• Fixed a security issue where a trailing newline in a requested table name could bypass table permissions and expose private rows. Thanks for the report, dpfkdlemtp. GHSA-h547-rmjf-5m2m

• WebP support, including different quality settings e.g. shot-scraper http://www.example.com/ -o shot.webp --quality 80. WebP filesizes should be significantly smaller than both JPEG and PNG for many web pages. #209
• Fix local file URI handling for WebKit. Thanks, Xi Qin. #208

• Improved release assets using https://github.com/asg017/sqlite-dist
• Fix for https://github.com/asg017/sqlite-http/issues/35 , thank you @ephraimstevens!

• Sets force_https=true in fly.toml. #31
• Fix for Volume could not be found bug. #32
• Compatible with app-scoped deploy tokens. #34

• Fix for compatibility with sqlite-utils 4.x. #85