datasette 0.65.3

A single security patch moves from the 1.0 alpha series into the stable 0.65.x line. The release note does not describe the vulnerability, but the back-port implies it is severe enough to warrant an out-of-band update. Engineers who rely on Datasette for data exploration or publishing should treat this as a mandatory upgrade, even if they are not yet testing the 1.0 alphas.

The cost of adoption is minimal. Because only the security fix is back-ported, no database migrations, API changes, or configuration updates are required. Teams can upgrade in place and restart their Datasette instances without additional testing beyond verifying that the patch does not break existing queries. The absence of other changes also means that downstream plugins or custom templates are unlikely to be affected.

Where the fix stops working is not documented, but the phrasing suggests it is specific to the SQL query parser in Datasette. If an application uses raw SQL strings constructed from untrusted input outside of Datasette’s query interface, the vulnerability may still be present. Engineers should audit any custom query-building logic that bypasses Datasette’s built-in parameterization.

The event is only reported by one feed, so corroboration is absent. This limits confidence in the scope of the vulnerability or the urgency of the patch. However, the back-port itself signals that the maintainer considers the issue serious enough to warrant a stable-branch release. Teams should prioritize the upgrade but may want to monitor the project’s issue tracker or changelog for further details.