sections: changelog:id2
This data as json
| id | page | ref | title | content | breadcrumbs | references |
|---|---|---|---|---|---|---|
| changelog:id2 | changelog | id2 | 0.65.4 (2026-09-10) | This release includes security fixes for permissions, SQL construction and caching, backported to the stable 0.65.x branch. See 1.0a39 for the full set of security fixes and other improvements in the 1.0 alpha series. The Datasette blog has more details on these releases . Some of the security fixes include: Table and view permission checks now take SQLite's case-insensitive names into account. See Controlling access to specific tables and views . Table filters using ?_through= require permission to view the intermediate table. Fixed SQL identifier escaping for primary-key column names from untrusted database schemas, including row lookups and pagination. Full-text search index detection now uses parameterized SQL and treats wildcard characters in table names literally. Private and personalized dynamic responses now use Cache-Control: private, no-store . Anonymous dynamic responses vary by Cookie and Authorization . SQLite extension loading is disabled after extensions supplied using --load-extension have been loaded. | ["Changelog"] | [{"href": "https://docs.datasette.io/en/latest/changelog.html#v1-0-a39", "label": "1.0a39"}, {"href": "https://datasette.io/blog/2026/september-security-releases/", "label": "has more details on these releases"}] |