Datasette 1.0a40 fixes a private-data leak, adds background tasks
A trailing newline slipped past table permissions on public instances; the release also ships a plugin task API and an httpx2 swap, as Vercel adds memory.
Copy markdown
The bug: a trailing newline leaked private rows
On public instances that give authenticated users access to private data, a trailing newline in a table name slipped past table permissions and returned rows meant to be hidden (advisory GHSA-h547-rmjf-5m2m). If you self-host Datasette behind an auth plugin, upgrade to 1.0a40 or the 0.65.x line now.
Background tasks land for plugin authors
New `datasette.add_background_task(func, name=None)` registers supervised, long-lived work, usually started from a startup hook, alongside a `shutdown(datasette)` hook and a `/-/tasks` debug endpoint. That means in-process pollers, cache warmers, and sync jobs without standing up a separate worker.
httpx2 swap — audit your plugins
Datasette now runs on httpx2, the Pydantic-maintained continuation of httpx. The public API is unchanged, but responses are `httpx2.Response` objects, so any plugin doing `isinstance()` checks on httpx types needs updating (or an explicit httpx dependency) before it works on 1.0a40.
Second security release in a week
1.0a40 follows the Sept 11 1.0a39 and 0.65.4 fixes, which came out of an AI-assisted audit using Claude Fable 5.1, GPT-5.6 Sol, and GPT-6 Astra plus outside researcher reports. Two hardening releases in seven days: pin the newest build and don't skip it.
Elsewhere: memory and faster builds on Vercel
Vercel added Mem0 as a native Marketplace integration, giving AI apps drop-in persistent memory, and made Secure Compute and Static IP builds start 64% faster (6.7s to 2.4s) via prewarmed containers. GitHub also let its AI Scan run on pull requests without CodeQL default setup (public preview, needs Advanced Security).