Datasette 1.0a39 and 0.65.4 are new security patch releases for the current alpha series and the stable 0.65.x family. The updates address security fixes that are important for public-facing Datasette instances, especially those that mix public and private tables. The patches were developed after an extensive audit using advanced AI models and collaborative review, and the process will be incorporated into future development work.
Posted by Mónica Ribero Díaz, Research Scientist, Google Research Differential privacy (DP) is a property of randomized mechanisms that limit the influence of any individual user’s information while processing and analyzing data. DP offers a robust solution to address growing concerns about data protection, enabling technologies across industries and government applications (e.
The article announces the release of Datasette version 1.0a39, noting that it includes security updates. It references the Datasette blog for details on the 1.0a39 release and the 0.65.4 security releases. The release is tagged with security and datasette.
The article announces the release of Datasette version 0.65.4, noting that it includes security updates. It references the Datasette blog for more details on the 1.0a39 and 0.65.4 security releases. The release is tagged as a security update for the Datasette project.
The article announces the release of Datasette 1.0a40, which includes a security fix identical to that in version 0.65.5, new features such as the ability for plugins to launch and manage background tasks via the datasette.add_background_task() method, and a migration to httpx2 to support features like datasette.client.get(). The update also contains numerous bug fixes, many of which were addressed during a recent triage effort for the upcoming 1.0 stable release.
The article reports that rumors of bugs in open‑source projects now trigger rapid security exploits, with automated agents probing for vulnerabilities within minutes of a patch being discussed. Anil Madhavapeddy demonstrates how modern coding agents can exploit even minimal hints, and rclone maintainer Nick Craig‑Wood notes a dramatic spike in security disclosures and delayed CVE assignments. The post highlights the need for new processes to protect open‑source communities from swift exploitation.
Release: alchemy-utils 0. 1a0 I've long pondered what a database agnostic version of my sqlite-utils Python library and CLI utility might look like.
The paper introduces BUGSTONE‑E2E, a framework that converts vulnerability history into executable detection rules and validates them. It mines reusable rules from fixing commits, organizes them by CWE and language, and applies a funnel‑shaped pipeline that starts with lightweight analysis and culminates in LLM‑guided inspection, runtime verification, and patch generation. Using 19,325 high‑severity CVEs, the system identified 2,710 fixing commits, created 1,033 detection rules across 56 CWE families, and produced runtime evidence for 644 findings in 14 programs.
The release of llm 0.36 introduces new OpenAI models gpt-6-sol and gpt-6-luna, and adds support for model plugins to declare that they do not support conversations via supports_conversation = False. When such models receive assistant or tool history, llm raises a ConversationNotSupported error and the chat interface rejects them before starting a session. Additional changes include wrapping reasoning traces in Markdown output with <details> tags and bug fixes from five contributors.
arXiv:2510. 15476v3 Announce Type: replace-cross Abstract: Large Language Models (LLMs) are increasingly used as interfaces to information, code, and real-world services, making prompt-level security failures a practical concern.
The article announces the release of datasette-explain version 0.2.2, noting that the plugin’s plan explanations now work on read‑only stored‑query pages. The author upgraded the demo site to Datasette 1.0a40, which motivated the new plugin version. The release is tagged for sqlite and datasette users.
arXiv:2607. 19449v1 Announce Type: cross Abstract: Evaluation frameworks for tool-augmented LLM agents focus overwhelmingly on capability metrics or explicit tool crashes, leaving silent infrastructure failures and HTTP 200 responses with empty, null, or malformed payloads largely unaudited.
arXiv:2605. 24248v2 Announce Type: replace-cross Abstract: The Model Context Protocol (MCP) standardizes how a large-language-model (LLM) agent and an external tool server exchange messages, but not trust: a host reads a server's self-declared tool list and dispatches calls, with no notion of which servers it may use, at what sensitivity, or which of a server's tools are in bounds.