Datasette 0.65.5 and 1.0a40 are out, with a security fix for a table permisisons bypass. Datasette 1.0a40 also adds a mechanism for plugins to run background tasks.

Here's a new TIL on using SQL functions in Google Sheets to fetch data from Datasette.

Datasette 1.0a27 changes how CSRF protection works in a way that simplifies form and API integration, and introduces a new RenameTableEvent for when a table is renamed by a SQL query.

Datasette 1.0a26 adds a column_types system allowing columns to carry additional type information such as email or url, or extra types defined by plugins. This alpha also adds a UI for selecting and sorting visible columns on a table page.

Datasette 1.0a25 adds write_wrapper() and register_token_handler() plugin hooks.

Datasette 1.0a24 introduces a new await request.form(files=True) method for accepting file uploads, plus various other changes.

Datasette 0.65.2 and Datasette 1.0a21 have been released with a security fix for an open redirect error, see this advisory. The latest Datasette alphas also include a breaking change to Datasette's permission system, described in detail in A new SQL-powered permissions system in Datasette 1.0a20.

Datasette 1.0a17 is the latest Datasette 1.0 alpha release, with bug fixes and small feature improvements from the last few months.

• Compatible with Datasette>1.0a41

OpenTelemetry support, a new JavaScript API for creating modal dialogs, and several smaller bug fixes.

OpenTelemetry

Datasette now supports OpenTelemetry traces and metrics for monitoring application performance. Thanks, Alex Garcia. (#1730, #2867)

• Traces cover HTTP requests, database queries and startup, including time spent waiting for SQL threads and queued writes.
• Metrics report query latency, time-limit interruptions, SQL thread usage, write queues and open connections.
• New tools for plugin authors help plugins add their own traces and metrics, with shared registry classes and pytest helpers.

To collect telemetry, configure an OpenTelemetry SDK and exporter, then run Datasette using opentelemetry-instrument. See OpenTelemetry for setup instructions.

Other features

• New DatasetteModal JavaScript API for plugins to create dialogs with Datasette's shared styles, keyboard behavior and focus handling. Datasette's built-in dialogs use the same API. (#2790, #2948)

Bug fixes

• Table pages now show measured query timings instead of always displaying 1.2ms. (#2446)
• Facet loading now ignores unrelated query parameters such as ?_facets=x, instead of returning a 500 error. Thanks, Peng Boyu. (#2949)
• Foreign key values no longer link to tables that do not exist. Thanks, Dipak Chaudhari. (#1515, #2952)
• Fixed missing punctuation between table and view counts on the homepage, such as 0 tables1view. Thanks, Dipak Chaudhari. (#2012, #2951)
• The sort menu now excludes primary keys that are not included in sortable_columns. Thanks, Sanjay Santhanam. (#1980, #2858)

New features:

• New OpenAI models: gpt-6-sol for GPT-6 Sol and gpt-6-luna for GPT-6 Luna. #1702
• Model plugins can now declare supports_conversation = False for models that only accept single-turn prompts. LLM raises llm.ConversationNotSupported when these models receive assistant or tool history, and llm chat rejects them before starting a session. See Models that do not support conversations. The first plugin to use this is llm-typesafe. #1692
• Reasoning traces in the Markdown output of llm logs are now wrapped in <details><summary> tags. #1701

Bug fixes:

• Fixed llm logs -t crashing with KeyError: 'options_json' when displaying truncated logs with options or schemas. Thanks, rdslw. #1656
• Fixed AsyncResponse.log_to_db() raising sqlite3.ProgrammingError after a response had been awaited. Structured messages and provider metadata are also preserved when logging restored async responses. Thanks, Roli Bosch. #1668
• Tool parameters and nested model fields named title are now preserved in generated input schemas. Thanks, Christopher Pruijsen. #1679, #1680
• Constructing llm.Prompt directly without options now initializes the model's default Options object, fixing errors in providers that access option attributes. Thanks, Jane Li. #1028, #1663
• Closing an asynchronous response.astream_events() stream before completion now closes the underlying provider generator, allowing it to release streaming connections and other resources. Thanks, Shunsuke. #1659
• SQLite connections opened by CLI commands are now closed when the command finishes, including on errors, avoiding unclosed-connection warnings.

Documentation:

• Corrected the structured output example in the advanced model plugins documentation to use supports_schema = True. Thanks, Ethan Stoner. #1686

• Explain plans now work on read-only stored-query pages.

• Cookies are no longer browser session cookies, they now last login_max_age seconds, which defaults to 30 days. #80

A security fix, a new set of APIs providing background tasks for plugins, an endpoint for counting matching rows, and a collection of bug fixes.

Security fix

• Fixed a security issue where a trailing newline in a requested table name could bypass table permissions and expose private rows. Thanks for the report, dpfkdlemtp. GHSA-h547-rmjf-5m2m

Background tasks

Datasette plugins can now use background tasks to run code independent of the Datasette request/response cycle. - New .add_background_task(func, name=None) API: plugins register supervised, long-lived background work - typically from a startup hook - and these will be launched after every startuphook has run. Tasks are cancelled (with a five-second grace period) on shutdown. - New /-/tasks JSON debug endpoint lists every supervised background task and its state, in the style of /-/threads. See /-/tasks. It requires the permissions-debug permission. - New shutdown(datasette) plugin hook, called during graceful shutdown (Ctrl-C, SIGTERM) before background tasks are cancelled and before database connections are closed. It is not called on a hard kill (SIGKILL). - Plugin asgi_wrapper middleware now always runs after startup has completed. - If your plugin uses asgi_wrapper to start background tasks on the first incoming request, you should migrate to datasette.add_background_task() instead. datasette-cron and datasette-enrichments are being migrated to this pattern.

Other features

• New POST count endpoint for counting filtered table rows, now used by the count all button. (#2914)
• Datasette now uses httpx2, the Pydantic-maintained continuation of httpx, in place of httpx. The public API is the same, but responses returned by datasette.client are now httpx2.Responseobjects rather than httpx.Response. Plugins that use isinstance() checks against httpx.Response should be updated to use httpx2. Plugins that use httpx without explicitly depending on it will need to add an explicit dependency or switch to httpx2.

Bug fixes

• Column facets now show the remove-filter link for filters using column__exact=value, as well as column=value. (#1695)
• The alter-table API now rolls back schema changes when a write_wrapper raises after the write. (#2924, #2925)
• The extra_template_vars() plugin hook can now return a function or awaitable that resolves to None when no extra variables are needed. (#2005)
• request.headers now supports case-insensitive header lookups, so request.headers.get("Content-Type") works as well as request.headers.get("content-type"). (#1861)
• CSV endpoints now return plain-text error messages for SQL errors. (#2129)
• The render_cell() plugin hook now receives an empty pks list when rendering SQL views in HTML, matching the JSON ?_extra=render_cell behavior. (#2639)
• Numeric comparison filters now correctly handle decimal values, negative numbers and scientific notation when filtering computed columns and SQL views. Thanks, Rami Abdelrazzaq. (#1681, #2876)
• Fixed CSV streaming with ?_stream=on on SQL views repeating the second page of results until the CSV size limit was reached. Thanks, Ankita Advitot. (#2902, #2903)

• Fixed a security issue where a trailing newline in a requested table name could bypass table permissions and expose private rows. Thanks for the report, dpfkdlemtp. GHSA-h547-rmjf-5m2m

• WebP support, including different quality settings e.g. shot-scraper http://www.example.com/ -o shot.webp --quality 80. WebP filesizes should be significantly smaller than both JPEG and PNG for many web pages. #209
• Fix local file URI handling for WebKit. Thanks, Xi Qin. #208

• Improved release assets using https://github.com/asg017/sqlite-dist
• Fix for https://github.com/asg017/sqlite-http/issues/35 , thank you @ephraimstevens!