From b0b2750757f2cf4ca6bf74fee4c6c12ea80ec658 Mon Sep 17 00:00:00 2001
From: Simon Willison <swillison@gmail.com>
Date: Thu, 10 Sep 2026 16:36:50 -0700
Subject: [PATCH] Release 0.65.4

---
 datasette/version.py |  2 +-
 docs/changelog.rst   | 24 ++++++++++++++++++++++--
 2 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/datasette/version.py b/datasette/version.py
index e5d973c1..0d033694 100644
--- a/datasette/version.py
+++ b/datasette/version.py
@@ -1,2 +1,2 @@
-__version__ = "0.65.3"
+__version__ = "0.65.4"
 __version_info__ = tuple(__version__.split("."))
diff --git a/docs/changelog.rst b/docs/changelog.rst
index 9cac5297..7d37fcef 100644
--- a/docs/changelog.rst
+++ b/docs/changelog.rst
@@ -4,10 +4,30 @@
 Changelog
 =========
 
-0.65.x (unreleased)
+.. _v0_65_4:
+
+0.65.4 (2026-09-10)
 -------------------
 
-* Backported the non-blocking write task ID fixes from :issue:`2861` by `Zain Dana Harper (HarperZ9) <https://github.com/HarperZ9>`__. ``execute_write_fn(block=False)`` now returns a unique UUID for each call, including when ``num_sql_threads=0``.
+This release includes security fixes for permissions, SQL construction and caching, backported to the stable 0.65.x branch.
+
+See `1.0a39 <https://docs.datasette.io/en/latest/changelog.html#v1-0-a39>`__ for the full set of security fixes and other improvements in the 1.0 alpha series.
+
+The Datasette blog `has more details on these releases <https://datasette.io/blog/2026/september-security-releases/>`__.
+
+Some of the security fixes include:
+
+- Table and view permission checks now take SQLite's case-insensitive names into account. See :ref:`authentication_permissions_table`.
+- Table filters using ``?_through=`` require permission to view the intermediate table.
+- Fixed SQL identifier escaping for primary-key column names from untrusted database schemas, including row lookups and pagination.
+- Full-text search index detection now uses parameterized SQL and treats wildcard characters in table names literally.
+- Private and personalized dynamic responses now use ``Cache-Control: private, no-store``. Anonymous dynamic responses vary by ``Cookie`` and ``Authorization``.
+- SQLite extension loading is disabled after extensions supplied using ``--load-extension`` have been loaded.
+
+Other improvements and fixes
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+- Backported the non-blocking write task ID fixes from :issue:`2861` by `Zain Dana Harper (HarperZ9) <https://github.com/HarperZ9>`__. ``execute_write_fn(block=False)`` now returns a unique UUID for each call, including when ``num_sql_threads=0``.
 
 .. _v0_65_3: