Datasette 0.65.5 fixes a critical security vulnerability.
datasette
32 tracked signals on datasette.
Datasette releases security patches addressing critical vulnerabilities.
“We'll be incorporating security audits by frontier models into all of our development work going forward.”
Abusive web crawlers consume more CPU than legitimate access on Git.
“we spend more CPU cycles rendering commits for scrapers than we spend on all other kinds of legitimate access, including git clones.”
Datasette 1.0a40 introduces new features and fixes security issues.
Simon Willison used Claude Code (Opus 4.8) and Codex (GPT-5.5) to convert MDN's browser-compat-data into a CDN-hosted SQLite database.
“I decided to try converting their comprehensive mdn/browser-compat-data repository full of browser compatibility data into a SQLite database.”
datasette-agent 0.2a0 adds mid-execution user questions and human-approved query saving.
“Tools that declare a context parameter receive a ToolContext object, and await context.ask_user(...) can ask a yes/no, multiple-choice (options=[...]) or free-text (free_text=True) question.”
Simon Willison demos Datasette agent, an LLM-powered plugin for querying data, model-agnostic and offline-capable.
“the hello world of programming in 2026 is to build an agent”
Datasette Agent gets a MicroPython sandbox for safe AI-generated code execution
“GPT-5.5 has so far failed to break out of the sandbox!”
Simon Willison ran Python ASGI apps in-browser via Pyodide and Service Workers, fixing prior JavaScript execution limits.
“of figuring out how to run Python ASGI apps in Pyodide using Service Workers instead, and it seems to work!”
Simon Willison launches Datasette Agent, merging his LLM library with Datasette for conversational data querying.
“Datasette Agent represents the moment that LLM and Datasette finally come together.”
Datasette Agent can now invisibly test apps via sandboxed iframe JavaScript execution
Simon Willison used Claude Code (Opus 4.8) to find methods mapping SQLite result columns back to their source table.column.
“I decided to set Claude Code (Opus 4.8, since Fable is currently banned by the US government) on the problem.”
Datasette 1.0a33 extends the ?_extra= API pattern to queries and rows on the road to 1.0.
“Because API explorer tools are almost free to build now”
datasette-agent adds inline agent chat accessible via keyboard shortcut in Datasette UI
Simon Willison integrates Parseable observability platform with Datasette OpenTelemetry traces using Codex.
Datasette 1.0a41 adds OpenTelemetry support and refactors modal dialogs into a reusable Web Component.
“Alec Garcia added support for OpenTelemetry to Datasette in this release.”
Datasette patches SQL injection flaw exposing private tables to public users
“The bug that has been fixed would have allowed users with access to any public table to execute SQL injection attacks despite that restriction, giving them read-only access to data in private tables in the same database.”
Simon Willison built a browser playground testing whether OPFS can let Pyodide edit persistent local SQLite files.
“I've been pondering if Datasette Lite - the Python Datasette application run entirely in the browser using Pyodide and WebAssembly - might be able to edit persistent SQLite files stored on the user's computer.”
Simon Willison released datasette-agent-edit, a base plugin implementing core agentic text-editing tools for Datasette Agent.
“Agentic editing of text is a little tricky to get right.”
Datasette 1.0a31 adds write query execution and stored queries for permissioned users.
“Datasette now offers users with the necessary permissions the ability to both execute write queries against their database and to save stored queries (renamed from "canned queries") both privately and for use by other members of their Datasette instance.”
Datasette releases agent plugin for sandboxed command execution via Fly Sprites
datasette-agent-charts releases version 0.1a2 with SQL query visibility feature
Datasette Agent 0.1a3 adds SQL query visibility and improved truncation handling
datasette-agent-charts adds color schemes, tooltips, and permission checks in alpha release
datasette-explain 0.2.2 adds explain plan support on read-only stored-query pages.
“Explain plans now work on read-only stored-query pages.”
Simon Willison released datasette-auth-github 1.0, fixing a session cookie expiration bug.
“I'm trying to get better at promoting stable plugins to 1.0.”
Datasette 0.65.3 back-ports a SQL injection security fix from 1.0a38
A bugfix release loosens datasette-export-database's version pin from ==1.0a27 to >=1.0a27 to restore compatibility.
“An embarrassingly tiny release.”
Datasette 1.0a32 is a minor bugfix release fixing write-query and base_url issues.
“A minor bugfix release.”
Datasette 1.0a30 adds a customizable keyboard-driven Jump to menu with plugin extensibility
Datasette releases fixtures plugin enabling zero-install database testing via uvx
datasette-atom 0.11a0 released for compatibility with latest Datasette alphas