datasette

• Fixed a bug with datasette publish cloudrun where deploys all used the same Docker image tag. This was mostly inconsequential as the service is deployed as soon as the image has been pushed to the registry, but could result in the incorrect image being deployed if two different deploys for two separate services ran at exactly the same time. #2036

• Documentation now links to a current source of information for installing Python 3. (#1987)
• Incorrectly calling the Datasette constructor using Datasette("path/to/data.db") instead of Datasette(["path/to/data.db"]) now returns a useful error message. (#1985)

• Datasette now strongly recommends against allowing arbitrary SQL queries if you are using SpatiaLite. SpatiaLite includes SQL functions that could cause the Datasette server to crash. See SpatiaLite for more details.
• New default_allow_sql setting, providing an easier way to disable all arbitrary SQL execution by end users: datasette --setting default_allow_sql off. See also Controlling the ability to execute arbitrary SQL. (#1409)
• Building a location to time zone API with SpatiaLite is a new Datasette tutorial showing how to safely use SpatiaLite to create a location to time zone API.
• New documentation about how to debug problems loading SQLite extensions. The error message shown when an extension cannot be loaded has also been improved. (#1979)
• Fixed an accessibility issue: the <select> elements in the table filter form now show an outline when they are currently focused. (#1771)

• Fixed a bug where datasette --root, when running in Docker, would only output the URL to sign in as root when the server shut down, not when it started up. (#1958)
• You no longer need to ensure await datasette.invoke_startup() has been called in order for Datasette to start correctly serving requests - this is now handled automatically the first time the server receives a request. This fixes a bug experienced when Datasette is served directly by an ASGI application server such as Uvicorn or Gunicorn. It also fixes a bug with the datasette-gunicorn plugin. (#1955)

The third Datasette 1.0 alpha release adds upsert support to the JSON API, plus the ability to specify finely grained permissions when creating an API token.

See Datasette 1.0a2: Upserts and finely grained permissions for an extended, annotated version of these release notes.

• New /db/table/-/upsert API, documented here. upsert is an update-or-insert: existing rows will have specified keys updated, but if no row matches the incoming primary key a brand new row will be inserted instead. (#1878)
• New register_permissions(datasette) plugin hook. Plugins can now register named permissions, which will then be listed in various interfaces that show available permissions. (#1940)
• The /db/-/create API for creating a table now accepts "ignore": true and "replace": true options when called with the "rows" property that creates a new table based on an example set of rows. This means the API can be called multiple times with different rows, setting rules for what should happen if a primary key collides with an existing row. (#1927)
• Arbitrary permissions can now be configured at the instance, database and resource (table, SQL view or canned query) level in Datasette's Metadata JSON and YAML files. The new "permissions" key can be used to specify which actors should have which permissions. See Other permissions in metadata for details. (#1636)
• The /-/create-token page can now be used to create API tokens which are restricted to just a subset of actions, including against specific databases or resources. See API Tokens for details. (#1947)
• Likewise, the datasette create-token CLI command can now create tokens with a subset of permissions. (#1855)
• New datasette.create_token() API method <datasette_create_token>` for programmatically creating signed API tokens. (#1951)
• /db/-/create API now requires actor to have insert-row permission in order to use the "row" or "rows" properties. (#1937)

• Write APIs now serve correct CORS headers if Datasette is started in --cors mode. See the full list of CORS headers in the documentation. (#1922)
• Fixed a bug where the _memory database could be written to even though writes were not persisted. (#1917)
• The https://latest.datasette.io/ demo instance now includes an ephemeral database which can be used to test Datasette's write APIs, using the new datasette-ephemeral-tables plugin to drop any created tables after five minutes. This database is only available if you sign in as the root user using the link on the homepage. (#1915)
• Fixed a bug where hitting the write endpoints with a GET request returned a 500 error. It now returns a 405 (method not allowed) error instead. (#1916)
• The list of endpoints in the API explorer now lists mutable databases first. (#1918)
• The "ignore": true and "replace": true options for the insert API are now documented. (#1924)

This first alpha release of Datasette 1.0 introduces a brand new collection of APIs for writing to the database (#1850), as well as a new API token mechanism baked into Datasette core. Previously, API tokens have only been supported by installing additional plugins.

This is very much a preview: expect many more backwards incompatible API changes prior to the full 1.0 release.

Feedback enthusiastically welcomed, either through issue comments or via the Datasette Discord community.

Signed API tokens

• New /-/create-token page allowing authenticated users to create signed API tokens that can act on their behalf, see API Tokens. (#1852)
• New datasette create-token command for creating tokens from the command line: datasette create-token.
• New allow_signed_tokens setting which can be used to turn off signed token support. (#1856)
• New max_signed_tokens_ttl setting for restricting the maximum allowed duration of a signed token. (#1858)

Write API

• New API explorer at /-/api for trying out the API. (#1871)
• /db/-/create API for Creating a table. (#1882)
• /db/table/-/insert API for Inserting rows. (#1851)
• /db/table/-/drop API for Dropping tables. (#1874)
• /db/table/pk/-/update API for Updating a row. (#1863)
• /db/table/pk/-/delete API for Deleting a row. (#1864)

• Fixed a bug in datasette publish heroku where deployments failed due to an older version of Python being requested. (#1905)
• New datasette publish heroku --generate-dir <dir> option for generating a Heroku deployment directory without deploying it.

• Fixed a bug where Datasette's table filter form would not redirect correctly when run behind a proxy using the base_url setting. (#1883)
• SQL query is now shown wrapped in a <textarea> if a query exceeds a time limit. (#1876)
• Fixed an intermittent "Too many open files" error while running the test suite. (#1843)
• New db.close() internal method.

See Datasette 0.63: The annotated release notes for more background on the changes in this release.

Features

• Now tested against Python 3.11. Docker containers used by datasette publish and datasette package both now use that version of Python. (#1853)
• --load-extension option now supports entrypoints. Thanks, Alex Garcia. (#1789)
• Facet size can now be set per-table with the new facet_size table metadata option. (#1804)
• The truncate_cells_html setting now also affects long URLs in columns. (#1805)
• The non-JavaScript SQL editor textarea now increases height to fit the SQL query. (#1786)
• Facets are now displayed with better line-breaks in long values. Thanks, Daniel Rech. (#1794)
• The settings.json file used in Configuration directory mode is now validated on startup. (#1816)
• SQL queries can now include leading SQL comments, using /* ... */ or -- ... syntax. Thanks, Charles Nepote. (#1860)
• SQL query is now re-displayed when terminated with a time limit error. (#1819)
• The inspect data mechanism is now used to speed up server startup - thanks, Forest Gregg. (#1834)
• In Configuration directory mode databases with filenames ending in .sqlite or .sqlite3 are now automatically added to the Datasette instance. (#1646)
• Breadcrumb navigation display now respects the current user's permissions. (#1831)

Plugin hooks and internals

• The prepare_jinja2_environment(env, datasette) plugin hook now accepts an optional datasette argument. Hook implementations can also now return an async function which will be awaited automatically. (#1809)
• Database(is_mutable=) now defaults to True. (#1808)
• The datasette.check_visibility() method now accepts an optional permissions= list, allowing it to take multiple permissions into account at once when deciding if something should be shown as public or private. This has been used to correctly display padlock icons in more places in the Datasette interface. (#1829)
• Datasette no longer enforces upper bounds on its dependencies. (#1800)

Documentation

• New tutorial: Cleaning data with sqlite-utils and Datasette.
• Screenshots in the documentation are now maintained using shot-scraper, as described in Automating screenshots for the Datasette documentation using shot-scraper. (#1844)
• More detailed command descriptions on the CLI reference page. (#1787)
• New documentation on Running Datasette using OpenRC - thanks, Adam Simpson. (#1825)

• SQL query is now re-displayed when terminated with a time limit error. (#1819)
• New documentation on Running Datasette using OpenRC - thanks, Adam Simpson. (#1825)
• The inspect data mechanism is now used to speed up server startup - thanks, Forest Gregg. (#1834)
• In Configuration directory mode databases with filenames ending in .sqlite or .sqlite3 are now automatically added to the Datasette instance. (#1646)
• Breadcrumb navigation display now respects the current user's permissions. (#1831)
• Screenshots in the documentation are now maintained using shot-scraper, as described in Automating screenshots for the Datasette documentation using shot-scraper. (#1844)
• The datasette.check_visibility() method now accepts an optional permissions= list, allowing it to take multiple permissions into account at once when deciding if something should be shown as public or private. This has been used to correctly display padlock icons in more places in the Datasette interface. (#1829)

• The prepare_jinja2_environment(env, datasette) plugin hook now accepts an optional datasette argument. Hook implementations can also now return an async function which will be awaited automatically. (#1809)
• --load-extension option now supports entrypoints. Thanks, Alex Garcia. (#1789)
• New tutorial: Cleaning data with sqlite-utils and Datasette.
• Facet size can now be set per-table with the new facet_size table metadata option. (#1804)
• truncate_cells_html setting now also affects long URLs in columns. (#1805)
• Database(is_mutable=) now defaults to True. (#1808)
• Non-JavaScript textarea now increases height to fit the SQL query. (#1786)
• More detailed command descriptions on the CLI reference page. (#1787)
• Datasette no longer enforces upper bounds on its depenedencies. (#1800)
• Facets are now displayed with better line-breaks in long values. Thanks, Daniel Rech. (#1794)
• The settings.json file used in Configuration directory mode is now validated on startup. (#1816)

Datasette can now run entirely in your browser using WebAssembly. Try out Datasette Lite, take a look at the code or read more about it in Datasette Lite: a server-side Python web application running in a browser.

Datasette now has a Discord community for questions and discussions about Datasette and its ecosystem of projects.

Features

• Datasette is now compatible with Pyodide. This is the enabling technology behind Datasette Lite. (#1733)
• Database file downloads now implement conditional GET using ETags. (#1739)
• HTML for facet results and suggested results has been extracted out into new templates _facet_results.html and _suggested_facets.html. Thanks, M. Nasimul Haque. (#1759)
• Datasette now runs some SQL queries in parallel. This has limited impact on performance, see this research issue for details.
• New --nolock option for ignoring file locks when opening read-only databases. (#1744)
• Spaces in the database names in URLs are now encoded as + rather than ~20. (#1701)
• <Binary: 2427344 bytes> is now displayed as <Binary: 2,427,344 bytes> and is accompanied by tooltip showing "2.3MB". (#1712)
• The base Docker image used by datasette publish cloudrun, datasette package and the official Datasette image has been upgraded to 3.10.6-slim-bullseye. (#1768)
• Canned writable queries against immutable databases now show a warning message. (#1728)
• datasette publish cloudrun has a new --timeout option which can be used to increase the time limit applied by the Google Cloud build environment. Thanks, Tim Sherratt. (#1717)
• datasette publish cloudrun has new --min-instances and --max-instances options. (#1779)

Plugin hooks

• New plugin hook: handle_exception(), for custom handling of exceptions caught by Datasette. (#1770)
• The render_cell() plugin hook is now also passed a row argument, representing the sqlite3.Row object that is being rendered. (#1300)
• The configuration directory is now stored in datasette.config_dir, making it available to plugins. Thanks, Chris Amico. (#1766)

Bug fixes

• Don't show the facet option in the cog menu if faceting is not allowed. (#1683)
• ?_sort and ?_sort_desc now work if the column that is being sorted has been excluded from the query using ?_col= or ?_nocol=. (#1773)
• Fixed bug where ?_sort_desc was duplicated in the URL every time the Apply button was clicked. (#1738)

Documentation

• Examples in the documentation now include a copy-to-clipboard button. (#1748)
• Documentation now uses the Furo Sphinx theme. (#1746)
• Code examples in the documentation are now all formatted using Black. (#1718)
• Request.fake() method is now documented, see Request object.
• New documentation for plugin authors: Registering a plugin for the duration of a test. (#903)

• New plugin hook: handle_exception(), for custom handling of exceptions caught by Datasette. (#1770)
• The render_cell() plugin hook is now also passed a row argument, representing the sqlite3.Row object that is being rendered. (#1300)
• New --nolock option for ignoring file locks when opening read-only databases. (#1744)
• Documentation now uses the Furo Sphinx theme. (#1746)
• Datasette now has a Discord community.
• Database file downloads now implement conditional GET using ETags. (#1739)
• Examples in the documentation now include a copy-to-clipboard button. (#1748)
• HTML for facet results and suggested results has been extracted out into new templates _facet_results.html and _suggested_facets.html. Thanks, M. Nasimul Haque. (#1759)

• Datasette now runs some SQL queries in parallel. This has limited impact on performance, see this research issue for details.
• Datasette should now be compatible with Pyodide. (#1733)
• datasette publish cloudrun has a new --timeout option which can be used to increase the time limit applied by the Google Cloud build environment. Thanks, Tim Sherratt. (#1717)
• Spaces in database names are now encoded as + rather than ~20. (#1701)
• <Binary: 2427344 bytes> is now displayed as <Binary: 2,427,344 bytes> and is accompanied by tooltip showing "2.3MB". (#1712)
• Don't show the facet option in the cog menu if faceting is not allowed. (#1683)
• Code examples in the documentation are now all formatted using Black. (#1718)
• Request.fake() method is now documented, see Request object.

• Fixed a bug where databases with a different route from their name (as used by the datasette-hashed-urls plugin) returned errors when executing custom SQL queries. (#1682)

In preparation for Datasette 1.0, this release includes two potentially backwards-incompatible changes. Hashed URL mode has been moved to a separate plugin, and the way Datasette generates URLs to databases and tables with special characters in their name such as / and . has changed.

Datasette also now requires Python 3.7 or higher.

See also the annotated release notes.

• URLs within Datasette now use a different encoding scheme for tables or databases that include "special" characters outside of the range of a-zA-Z0-9_-. This scheme is explained here: Tilde encoding. (#1657)
• Removed hashed URL mode from Datasette. The new datasette-hashed-urls plugin can be used to achieve the same result, see datasette-hashed-urls for details. (#1661)
• Databases can now have a custom path within the Datasette instance that is independent of the database name, using the db.route property. (#1668)
• Datasette is now covered by a Code of Conduct. (#1654)
• Python 3.6 is no longer supported. (#1577)
• Tests now run against Python 3.11-dev. (#1621)
• New datasette.ensure_permissions(actor, permissions) internal method for checking multiple permissions at once. (#1675)
• New datasette.check_visibility(actor, action, resource=None) internal method for checking if a user can see a resource that would otherwise be invisible to unauthenticated users. (#1678)
• Table and row HTML pages now include a <link rel="alternate" type="application/json+datasette" href="..."> element and return a Link: URL; rel="alternate"; type="application/json+datasette" HTTP header pointing to the JSON version of those pages. (#1533)
• Access-Control-Expose-Headers: Link is now added to the CORS headers, allowing remote JavaScript to access that header.
• Canned queries are now shown at the top of the database page, directly below the SQL editor. Previously they were shown at the bottom, below the list of tables. (#1612)
• Datasette now has a default favicon. (#1603)
• sqlite_stat tables are now hidden by default. (#1587)
• SpatiaLite tables data_licenses, KNN and KNN2 are now hidden by default. (#1601)
• SQL query tracing mechanism now works for queries executed in asyncio sub-tasks, such as those created by asyncio.gather(). (#1576)
• datasette.tracer mechanism is now documented.
• Common Datasette symbols can now be imported directly from the top-level datasette package, see Import shortcuts. Those symbols are Response, Forbidden, NotFound, hookimpl, actor_matches_allow. (#957)
• /-/versions page now returns additional details for libraries used by SpatiaLite. (#1607)
• Documentation now links to the Datasette Tutorials.
• Datasette will now also look for SpatiaLite in /opt/homebrew - thanks, Dan Peterson. (#1649)
• Fixed bug where custom pages did not work on Windows. Thanks, Robert Christie. (#1545)
• Fixed error caused when a table had a column named n. (#1228)

• Removed hashed URL mode from Datasette. The new datasette-hashed-urls plugin can be used to achieve the same result, see datasette-hashed-urls for details. (#1661)
• Databases can now have a custom path within the Datasette instance that is indpendent of the database name, using the db.route property. (#1668)
• URLs within Datasette now use a different encoding scheme for tables or databases that include "special" characters outside of the range of a-zA-Z0-9_-. This scheme is explained here: Tilde encoding. (#1657)
• Table and row HTML pages now include a <link rel="alternate" type="application/json+datasette" href="..."> element and return a Link: URL; rel="alternate"; type="application/json+datasette" HTTP header pointing to the JSON version of those pages. (#1533)
• Access-Control-Expose-Headers: Link is now added to the CORS headers, allowing remote JavaScript to access that header.
• Canned queries are now shown at the top of the database page, directly below the SQL editor. Previously they were shown at the bottom, below the list of tables. (#1612)
• Datasette now has a default favicon. (#1603)
• sqlite_stat tables are now hidden by default. (#1587)
• SpatiaLite tables data_licenses, KNN and KNN2 are now hidden by default. (#1601)
• Python 3.6 is no longer supported. (#1577)
• Tests now run against Python 3.11-dev. (#1621)
• Fixed bug where custom pages did not work on Windows. Thanks, Robert Christie. (#1545)
• SQL query tracing mechanism now works for queries executed in asyncio sub-tasks, such as those created by asyncio.gather(). (#1576)
• datasette.tracer mechanism is now documented.
• Common Datasette symbols can now be imported directly from the top-level datasette package, see Import shortcuts. Those symbols are Response, Forbidden, NotFound, hookimpl, actor_matches_allow. (#957)
• /-/versions page now returns additional details for libraries used by SpatiaLite. (#1607)
• Documentation now links to the Datasette Tutorials.
• Datasette will now also look for SpatiaLite in /opt/homebrew - thanks, Dan Peterson. (#1649)
• Datasette is now covered by a Code of Conduct. (#1654)

• Fixed a bug where Datasette would open the same file twice with two different database names if you ran datasette file.db file.db. (#1632)

• Fixed a bug where installation on Python 3.6 stopped working due to a change to an underlying dependency. This release can now be installed on Python 3.6, but is the last release of Datasette that will support anything less than Python 3.7. (#1609)