Refresh stable documentation for Datasette 0.65.4

docs/changelog.rst

@@ -4,6 +4,41 @@
 Changelog
 =========
 
+.. _v0_65_4:
+
+0.65.4 (2026-09-10)
+-------------------
+
+This release includes security fixes for permissions, SQL construction and caching, backported to the stable 0.65.x branch.
+
+See `1.0a39 <https://docs.datasette.io/en/latest/changelog.html#v1-0-a39>`__ for the full set of security fixes and other improvements in the 1.0 alpha series.
+
+The Datasette blog `has more details on these releases <https://datasette.io/blog/2026/september-security-releases/>`__.
+
+Some of the security fixes include:
+
+- Table and view permission checks now take SQLite's case-insensitive names into account. See :ref:`authentication_permissions_table`.
+- Table filters using ``?_through=`` require permission to view the intermediate table.
+- Fixed SQL identifier escaping for primary-key column names from untrusted database schemas, including row lookups and pagination.
+- Full-text search index detection now uses parameterized SQL and treats wildcard characters in table names literally.
+- Private and personalized dynamic responses now use ``Cache-Control: private, no-store``. Anonymous dynamic responses vary by ``Cookie`` and ``Authorization``.
+- SQLite extension loading is disabled after extensions supplied using ``--load-extension`` have been loaded.
+
+Other improvements and fixes
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+- Backported the non-blocking write task ID fixes from :issue:`2861` by `Zain Dana Harper (HarperZ9) <https://github.com/HarperZ9>`__. ``execute_write_fn(block=False)`` now returns a unique UUID for each call, including when ``num_sql_threads=0``.
+
+.. _v0_65_3:
+
+0.65.3 (2026-08-06)
+-------------------
+
+This release fixes a **SQL injection** security issue that affects Datasette instances that serve a **mixture of public and private tables** in the same database, with access configured using the :ref:`Datasette permissions system <authentication>`.
+
+Site administrators who serve private tables in this way are advised to disable the :ref:`execute-sql permission <permissions_execute_sql>` on that database to prevent users from accessing private tables using raw SQL queries. The bug that has been fixed would have allowed users with access to any public table to execute SQL injection attacks despite that restriction, giving them read-only access to data in private tables in the same database.
+
+This fix is also available in Datasette 1.0a38.
 
 .. _v0_65_2:
 

docs/plugin_hooks.rst

@@ -484,7 +484,7 @@ This will register ``render_demo`` to be called when paths with the extension ``
 
 ``render_demo`` is a Python function. It can be a regular function or an ``async def render_demo()`` awaitable function, depending on if it needs to make any asynchronous calls.
 
-``can_render_demo`` is a Python function (or ``async def`` function) which accepts the same arguments as ``render_demo`` but just returns ``True`` or ``False``. It lets Datasette know if the current SQL query can be represented by the plugin - and hence influnce if a link to this output format is displayed in the user interface. If you omit the ``"can_render"`` key from the dictionary every query will be treated as being supported by the plugin.
+``can_render_demo`` is a Python function (or ``async def`` function) which accepts the same arguments as ``render_demo`` but just returns ``True`` or ``False``. It lets Datasette know if the current SQL query can be represented by the plugin - and hence influence if a link to this output format is displayed in the user interface. If you omit the ``"can_render"`` key from the dictionary every query will be treated as being supported by the plugin.
 
 When a request is received, the ``"render"`` callback function is called with zero or more of the following arguments. Datasette will inspect your callback function and pass arguments that match its function signature.
 

docs/settings.rst

@@ -195,6 +195,8 @@ Default HTTP caching max-age header in seconds, used for ``Cache-Control: max-ag
 
     datasette mydatabase.db --setting default_cache_ttl 60
 
+Dynamic responses for authenticated actors, requests with cookies or an ``Authorization`` header, and responses that set cookies use ``Cache-Control: private, no-store``. This takes precedence over ``default_cache_ttl`` and ``?_ttl=``, even when cache headers are otherwise disabled. Anonymous dynamic responses vary by ``Cookie`` and ``Authorization``. Static assets retain their own cache policy.
+
 .. _setting_cache_size_kb:
 
 cache_size_kb