Update datasette requirement from >=0.65.2 to >=0.65.3 in /v2

[dependabot]

Updates the requirements on datasette to permit the latest version.

Release notes

Sourced from datasette's releases.

0.65.3

This release fixes a SQL injection security issue that affects Datasette instances that serve a mixture of public and private tables in the same database, with access configured using the Datasette permissions system.

Site administrators who serve private tables in this way are advised to disable the execute-sql permission on that database to prevent users from accessing private tables using raw SQL queries. The bug that has been fixed would have allowed users with access to any public table to execute SQL injection attacks despite that restriction, giving them read-only access to data in private tables in the same database.

This fix is also available in Datasette 1.0a38.

Changelog

Sourced from datasette's changelog.

.. _changelog:

========= Changelog

.. _v1_0_a38:

1.0a38 (2026-08-06)

This release fixes a SQL injection security issue that affects Datasette instances that serve a mixture of public and private tables in the same database, with access configured using the :ref:Datasette permissions system <authentication>.

Site administrators who serve private tables in this way are advised to disable the :ref:execute-sql permission <actions_execute_sql> on that database to prevent users from accessing private tables using raw SQL queries. The bug that has been fixed would have allowed users with access to any public table to execute SQL injection attacks despite that restriction, giving them read-only access to data in private tables in the same database.

This fix is also available in Datasette 0.65.3.

.. _v1_0_a37:

1.0a37 (2026-07-14)

Performance improvement for SQL-backed permission checks, plus an improved permission debugging interface.

• SQL used to resolve permission checks now aggregates permission rules before joining them to resources, improving performance on instances with large schemas. (:issue:2832)
• The :ref:PermissionCheckView permission debugger now explains why a decision was allowed or denied, including the matching rules. The interactive form can also test a hypothetical actor supplied as JSON, and the :ref:permissions documentation <authentication_permissions_explained> now describes resolution rules in more detail. (:issue:2841)
• :ref:db.execute_write(sql, ..., transaction=True) <database_execute_write> has a new transaction= parameter, which can be set to False for statements such as VACUUM that cannot run inside a transaction. Write tasks now start their transactions using BEGIN IMMEDIATE, which also ensures that writes are rolled back if the task fails. (:issue:2831)
• Refreshing a database's schema in Datasette's internal catalog is now performed as a single atomic operation. (:issue:2831)
• Fixed schema introspection, table pages, facets and table counts for tables with names containing a ] character. Thanks, TowyTowy <https://github.com/TowyTowy>__. (:issue:2431, :pr:2846)
• /-/plugins.json once again returns a top-level JSON array of plugin objects, reverting the object envelope introduced in 1.0a36. This should fix a large number of trivial test failures in existing plugins. (:issue:2842, :pr:2843)

.. _v1_0_a36:

1.0a36 (2026-07-07)

The signature features of this alpha are new UIs for inserting multiple rows at once (from TSV, CSV or JSON) and for creating a table from rows, plus a large number of small JSON API consistency fixes in preparation for a 1.0 stable release.

• Table pages now offer an "Insert multiple rows" mode in the row insertion dialog. This accepts pasted TSV, CSV or JSON, previews the parsed rows before inserting them, validates unknown columns as data is pasted and displays omitted auto integer primary keys as auto in the preview. (:pr:2813)
• The bulk insert UI can skip rows with existing primary keys, or update existing rows and insert new rows using the existing /<database>/<table>/-/upsert API when the actor has both :ref:insert-row <actions_insert_row> and :ref:update-row <actions_update_row> permissions. (:pr:2813)
• The "Create table" dialog now includes a "Create table from data" mode. Paste TSV, CSV or JSON rows to preview inferred columns and types, choose the table name and primary key, then create the table and insert those rows in one step. (:pr:2813)
• Datasette's JSON APIs now consistently encode every BLOB value using the documented :ref:binary value JSON format <binary_json_format>, even when the bytes could be decoded as UTF-8 text. (:issue:2806, :pr:2822)
• The insert and edit row dialogs now provide a dedicated control for BLOB values. Existing binary values are shown by byte size, image values under 10MB are previewed as thumbnails, and replacements can be attached, dropped or pasted into the control. (:issue:2806, :pr:2822)
• The table and row JSON APIs now support ?_extra=column_details for returning SQLite schema details for columns, including declared type, SQLite affinity, primary key, NOT NULL, default and hidden-column metadata.
• POST bodies that Datasette reads fully into memory - such as JSON submitted to the write API - are now capped by the new :ref:setting_max_post_body_bytes setting, defaulting to 2MB. Oversized requests are rejected with an HTTP 413 error as soon as the limit is exceeded, protecting smaller servers from memory exhaustion. File uploads are unaffected - request.form() streams those to disk and has its own separate limits. (:issue:2823)
• Row pages for tables with compound primary keys now return a 400 error instead of a 500 error when the URL row identifier does not contain the correct number of primary key values. Thanks, Zain Dana Harper <https://github.com/HarperZ9>__. (:issue:2811, :pr:2815)
• The :ref:execute-write-sql <actions_execute_write_sql> interface now supports CREATE VIEW and DROP VIEW statements, gated by the new :ref:create-view <actions_create_view> and :ref:drop-view <actions_drop_view> permissions. (:issue:2819, :pr:2818)
• Saved-query SQL analysis now handles recursive CTEs, fixing a bug where storing a valid read-only recursive query could be disabled by SQLite's internal SQLITE_RECURSIVE authorizer callback. (:issue:2809, :pr:2812)
• named_parameters() now correctly ignores SQLite comment markers that appear inside string literals, so query forms no longer drop later :named parameters from SQL such as select '--' || :name. Thanks, JSap0914 <https://github.com/JSap0914>__. (:pr:2783)
• Datasette's internal database schema is now managed using sqlite-utils migrations <https://sqlite-utils.datasette.io/en/stable/python-api.html#migrations>__, using the new dependency on sqlite-utils>=4.0. (:issue:2827)

... (truncated)

Commits

• fddbef8 Release 0.65.3
• c43d893 Fix for SQL injection issue in table filters, refs #2868
• 1d68d86 Removed broken refs to Glitch, closes #2503
• 0b68705 Replace Glitch with Codespaces, closes #2488
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)