From 12b25affb55c124da21d0b1ee58bba2f00b9bcb3 Mon Sep 17 00:00:00 2001 From: Simon Willison Date: Thu, 6 Aug 2026 11:20:25 -0700 Subject: [PATCH] Release 1.0a38 Refs #2868 --- datasette/version.py | 2 +- docs/changelog.rst | 11 +++++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/datasette/version.py b/datasette/version.py index 8e238ab5..2ec12fd2 100644 --- a/datasette/version.py +++ b/datasette/version.py @@ -1,2 +1,2 @@ -__version__ = "1.0a37" +__version__ = "1.0a38" __version_info__ = tuple(__version__.split(".")) diff --git a/docs/changelog.rst b/docs/changelog.rst index 670166bb..66a7caab 100644 --- a/docs/changelog.rst +++ b/docs/changelog.rst @@ -4,6 +4,17 @@ Changelog ========= +.. _v1_0_a38: + +1.0a38 (2026-08-06) +------------------- + +This release fixes a **SQL injection** security issue that affects Datasette instances that serve a **mixture of public and private tables** in the same database, with access configured using the :ref:`Datasette permissions system `. + +Site administrators who serve private tables in this way are advised to disable the :ref:`execute-sql permission ` on that database to prevent users from accessing private tables using raw SQL queries. The bug that has been fixed would have allowed users with access to any public table to execute SQL injection attacks despite that restriction, giving them read-only access to data in private tables in the same database. + +This fix is also available in Datasette 0.65.3. + .. _v1_0_a37: 1.0a37 (2026-07-14)