Datasette 1.0a39 and 0.65.4 are new security patch releases for the current alpha series and the stable 0.65.x family. The updates address security fixes that are important for public-facing Datasette instances, especially those that mix public and private tables. The patches were developed after an extensive audit using advanced AI models and collaborative review, and the process will be incorporated into future development work.
Posted by Mónica Ribero Díaz, Research Scientist, Google Research Differential privacy (DP) is a property of randomized mechanisms that limit the influence of any individual user’s information while processing and analyzing data. DP offers a robust solution to address growing concerns about data protection, enabling technologies across industries and government applications (e.
The article announces the release of Datasette version 1.0a39, noting that it includes security updates. It references the Datasette blog for details on the 1.0a39 release and the 0.65.4 security releases. The release is tagged with security and datasette.
The article announces the release of Datasette version 0.65.4, noting that it includes security updates. It references the Datasette blog for more details on the 1.0a39 and 0.65.4 security releases. The release is tagged as a security update for the Datasette project.
The article announces the release of Datasette 1.0a40, which includes a security fix identical to that in version 0.65.5, new features such as the ability for plugins to launch and manage background tasks via the datasette.add_background_task() method, and a migration to httpx2 to support features like datasette.client.get(). The update also contains numerous bug fixes, many of which were addressed during a recent triage effort for the upcoming 1.0 stable release.
The article reports that rumors of bugs in open‑source projects now trigger rapid security exploits, with automated agents probing for vulnerabilities within minutes of a patch being discussed. Anil Madhavapeddy demonstrates how modern coding agents can exploit even minimal hints, and rclone maintainer Nick Craig‑Wood notes a dramatic spike in security disclosures and delayed CVE assignments. The post highlights the need for new processes to protect open‑source communities from swift exploitation.
The article describes how the author used Parseable, an observability platform, with Datasette to handle OpenTelemetry traces. Parseable offers an open‑source Rust implementation and an enterprise version, while Datasette 1.0a41 added OpenTelemetry support. The author demonstrates the setup and shows a screenshot of a Datasette trace displayed in Parseable’s local web interface.
The paper introduces a claim‑anchored execution contract that binds a tool‑using agent’s emitted claim to its exact source span, the ordered execution prefix that produced it, and the source version and access state observed. Each receipt contains deterministic anchors, source identifiers, offsets, hashes, quotes, and a domain‑separated execution commitment, allowing a verifier to reconstruct these bindings before semantic or task labels are joined. The contract defines seven independently testable properties and demonstrates high detection rates against cross‑object attacks, with strong performance on conflict‑aware support guard evaluations.
Release: alchemy-utils 0. 1a0 I've long pondered what a database agnostic version of my sqlite-utils Python library and CLI utility might look like.
The paper introduces BUGSTONE‑E2E, a framework that converts vulnerability history into executable detection rules and validates them. It mines reusable rules from fixing commits, organizes them by CWE and language, and applies a funnel‑shaped pipeline that starts with lightweight analysis and culminates in LLM‑guided inspection, runtime verification, and patch generation. Using 19,325 high‑severity CVEs, the system identified 2,710 fixing commits, created 1,033 detection rules across 56 CWE families, and produced runtime evidence for 644 findings in 14 programs.
The release of datasette-llm 0.1a9 introduces a small user‑experience improvement: the plugin now automatically detects the default LLM model, eliminating the need for users to manually configure a default model when running Datasette Agent. This change simplifies the setup process for users who previously had to specify a model with the `-s plugins.datasette-agent.default_model` option.
The release of llm 0.36 introduces new OpenAI models gpt-6-sol and gpt-6-luna, and adds support for model plugins to declare that they do not support conversations via supports_conversation = False. When such models receive assistant or tool history, llm raises a ConversationNotSupported error and the chat interface rejects them before starting a session. Additional changes include wrapping reasoning traces in Markdown output with <details> tags and bug fixes from five contributors.
arXiv:2510. 15476v3 Announce Type: replace-cross Abstract: Large Language Models (LLMs) are increasingly used as interfaces to information, code, and real-world services, making prompt-level security failures a practical concern.