# datasette 1,542 Published articles for datasette 1,542. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Datasette 1.0a39 and 0.65.4 security releases DevFeed: [Datasette 1.0a39 and 0.65.4 security releases]() Original publisher: [Read original article]() Author: Simon Willison Published: 2026-09-11T03:27:16Z Content type: release Language: en Sources: [Simon Willison's Weblog]() Topics: [releases](), [Security](), [audit](), [AI-assisted coding](), [ai security](), [agentic-engineering](), [Generative AI](), [Large Language Model](), [Claude](), [gpt-6-astra]() Tags: [agentic-engineering](), [agentic-engineering-63](), [ai](), [ai-2-236](), [ai-security-research](), [ai-security-research-42](), [coding-agents](), [datasette](), [datasette-1-542](), [generative-ai](), [generative-ai-1-982](), [llms](), [llms-1-948](), [releases](), [releases-31](), [security](), [security-634](), [tests]() ### AI overview Datasette 1.0a39 and 0.65.4 are security patch releases for the alpha and stable series. They address issues found during an extensive audit, including instances that mix public and private tables. The audit used Claude Fable 5.1, GPT-5.6, and GPT-6 Astra alongside human review and automated tests. ### Source excerpt Datasette 1.0a39 and 0.65.4 security releases Today we're releasing two new security patch versions of Datasette: 1.0a39 and 0.65.4 - one for the current alpha series and one for the stable 0.65.x family. These are security fixes which you should apply if you are running a Datasette instance on the public web - in particular if that instance mixes both public and private tables. Following issues reported by Sevban Dönmez, Alex Garcia and I ran an extensive audit of Datasette using Claude Fable 5.1, GPT-5.6, and GPT-6 Astra. We then spent almost a week collaborating on and reviewing the fixes. They helped find some very subtle bugs. We'll be incorporating security audits by frontier models into all of our development work going forward. Alex came up with a way of splitting the work which I found extremely productive: Alex Garcia and I worked together running and then responding to the audit, working in a shared private repository. For most of the issues we split the work: one of us would create the automated tests highlighting the issue, then the other would implement the fix. This ensured that two separate humans had eyes on each of the issues, in addition to our coding agents running different models. Tags: releases, security, ai, datasette, generative-ai, llms, agentic-engineering, ai-security-research ## datasette-publish-fly 1.4 DevFeed: [datasette-publish-fly 1.4]() Original publisher: [Read original article]() Author: Simon Willison Published: 2026-09-11T02:58:52Z Content type: release Language: en Sources: [Simon Willison's Weblog]() Topics: [fly](), [App](), [bug]() Tags: [bug](), [datasette](), [datasette-1-542](), [deploy](), [fly](), [fly-40](), [https](), [release](), [volume]() ### AI overview Release notes for datasette-publish-fly 1.4. The release sets force_https=true in fly.toml, fixes a volume lookup bug, and adds compatibility with app-scoped deploy tokens. ### Source excerpt Release: datasette-publish-fly 1.4 Sets force_https=true in fly.toml. #31 Fix for Volume could not be found bug. #32 Compatible with app-scoped deploy tokens. #34 Tags: datasette, fly ## datasette 0.65.4 DevFeed: [datasette 0.65.4]() Original publisher: [Read original article]() Author: Simon Willison Published: 2026-09-11T00:06:55Z Content type: release Language: en Sources: [Simon Willison's Weblog]() Topics: [releases](), [Security]() Tags: [datasette](), [datasette-1-542](), [release](), [security](), [security-634]() ### AI overview A release notice for Datasette 0.65.4, pointing to the Datasette 1.0a39 and 0.65.4 security releases on the Datasette blog. ### Source excerpt Release: datasette 0.65.4 See Datasette 1.0a39 and 0.65.4 security releases on the Datasette blog. Tags: security, datasette ## datasette 1.0a39 DevFeed: [datasette 1.0a39]() Original publisher: [Read original article]() Author: Simon Willison Published: 2026-09-11T00:05:54Z Content type: release Language: en Sources: [Simon Willison's Weblog]() Topics: [releases](), [Security]() Tags: [datasette](), [datasette-1-542](), [release](), [security](), [security-634]() ### AI overview A release announcement for datasette 1.0a39, also referencing Datasette 1.0a39 and 0.65.4 security releases on the Datasette blog. ### Source excerpt Release: datasette 1.0a39 See Datasette 1.0a39 and 0.65.4 security releases on the Datasette blog. Tags: security, datasette ## Stateless MCP has recaptured my interest (and inspired mcp-explorer and datasette-mcp) DevFeed: [Stateless MCP has recaptured my interest (and inspired mcp-explorer and datasette-mcp)]() Original publisher: [Read original article]() Author: Simon Willison Published: 2026-07-31T23:13:22Z Content type: article Language: en Sources: [Simon Willison]() Topics: [Model Context Protocol](), [Large Language Model](), [anthropic](), [HTTP](), [Command-line interface](), [JSON](), [Python](), [web applications]() Tags: [2026](), [agent](), [ai](), [ai-2-235](), [anthropic](), [anthropic-336](), [cli](), [codex](), [context](), [curl](), [datasette](), [datasette-1-542](), [generative-ai](), [generative-ai-1-981](), [http](), [json](), [llm](), [llm-631](), [llms](), [llms-1-947](), [mcp](), [mermaid](), [mermaid-5](), [model-context-protocol](), [model-context-protocol-35](), [projects](), [projects-553](), [shell](), [stateless](), [terminal]() ### AI overview This commentary examines the 2026-07-28 stateless Model Context Protocol specification. It argues that stateless MCP simplifies client and server implementation, improves auditability and control compared with shell-based agent access, and better supports scalable web applications by removing session state and session-affinity requirements. The article also introduces the mcp-explorer CLI tool and mentions datasette-mcp. ### Source excerpt Tuesday was Stateless MCP day - the rollout of MCP 2.0, or the 2026-07-28 Model Context Protocol specification to use the more formal but less memorable name. This is the most significant change to the MCP spec since it first launched, and has also served to reignite my personal interest in the protocol. For background: MCP is the Model Context Protocol, which describes a standard way to expose new tools to LLM-powered agent frameworks. It was introduced by Anthropic back in November 2024, had a huge spike of interest through much of 2025, and then became somewhat eclipsed by Skills (another Anthropic invention) when it became apparent that an agent harness with access to a terminal and curl could do most of what MCP did in a more flexible way. I wrote about that in my review of 2025. I'm coming back around to MCP now. Giving an agent a shell environment with the ability to access the internet is fraught with risk, and requires a strong model that is capable of effectively driving such an environment. MCP tools are easier to audit and control, and simple enough that smaller models that run on a laptop can still drive them reasonably well. The new stateless MCP specification also greatly decreases the complexity of implementing both clients and servers for the protocol. I built three of those this week! What's easier with stateless MCP The best demonstration of the difference between stateful and stateless MCP is in this May 21st blog post that introduced the RC for the new specification. It included a clear before-and-after example. The older stateful MCP (I'm going to call it "legacy MCP") required two HTTP requests - the first to initialize a session and obtain a Mcp-Session-Id, and the second to actually call the tool: POST /mcp HTTP/1.1 Content-Type: application/json { "jsonrpc": "2.0", "id": 1, "method": "initialize", "params": { "protocolVersion": "2025-11-25", "capabilities": { }, "clientInfo": { "name": "my-app", "version": "1.0" } } } POST /mcp HTTP/1.1 Mcp