From fddbef822a7feff45dcb78ef25de007b2c71ef3c Mon Sep 17 00:00:00 2001 From: Simon Willison Date: Thu, 6 Aug 2026 11:17:17 -0700 Subject: [PATCH] Release 0.65.3 Refs #2868 --- datasette/version.py | 2 +- docs/changelog.rst | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/datasette/version.py b/datasette/version.py index 18d3cd80..e5d973c1 100644 --- a/datasette/version.py +++ b/datasette/version.py @@ -1,2 +1,2 @@ -__version__ = "0.65.2" +__version__ = "0.65.3" __version_info__ = tuple(__version__.split(".")) diff --git a/docs/changelog.rst b/docs/changelog.rst index f0485b4f..56d1952b 100644 --- a/docs/changelog.rst +++ b/docs/changelog.rst @@ -4,6 +4,16 @@ Changelog ========= +.. _v0_65_3: + +0.65.3 (2026-08-06) +------------------- + +This release fixes a **SQL injection** security issue that affects Datasette instances that serve a **mixture of public and private tables** in the same database, with access configured using the :ref:`Datasette permissions system `. + +Site administrators who serve private tables in this way are advised to disable the :ref:`execute-sql permission ` on that database to prevent users from accessing private tables using raw SQL queries. The bug that has been fixed would have allowed users with access to any public table to execute SQL injection attacks despite that restriction, giving them read-only access to data in private tables in the same database. + +This fix is also available in Datasette 1.0a38. .. _v0_65_2: