datasette

• Column action menu now shows the column type. (#993)
• Column action sort links now correctly link to the first page of sorted results. (#989)
• Publishing to Google Cloud Run documentation now covers Google Cloud SDK options. Thanks, Geoffrey Hing. (#995)

• New column action menu - table columns now show a cog icon which provides a contextual menu for that column. (#981)
• New datasette -o option which opens your browser as soon as Datasette starts up. (#970
• sqlite3.enable_callback_tracebacks(True) so errors in custom SQL functions will now display tracebacks. (#891)
• Fixed two rendering bugs with column headers in portrait mobile view. (#978, #980)

• Fixed a bug with writable canned queries that use magic parameters but accept no non-magic arguments. (#967)

• Writable canned queries now expose a JSON API, see JSON API for writable canned queries. (#880)
• New mechanism for defining page templates with custom path parameters - a template file called pages/about/{slug}.html will be used to render any requests to /about/something. See Path parameters for pages. (#944)
• register_output_renderer() render functions can now return a Response. (#953)
• New --upgrade option for datasette install. (#945)
• New datasette --pdb option. (#962)
• datasette --get exit code now reflects the internal HTTP status code. (#947)
• New raise_404() template function for returning 404 errors. (#964)
• datasette publish heroku now deploys using Python 3.8.5
• Upgraded CodeMirror to 5.57.0. (#948)
• Upgraded code style to Black 20.8b1. (#958)
• Fixed bug where selected facets were not correctly persisted in hidden form fields on the table page. (#963)
• Renamed the default error template from 500.html to error.html.
• Custom error pages are now documented, see Custom error pages. (#965)

• Upgraded CodeMirror to 5.57.0. (#948)
• Upgraded code style to Black 20.8b1. (#958)
• New datasette --pdb option. (#962)
• datasette --get exit code now reflects the internal HTTP status code. (#947)
• Fixed bug where selected facets were not correctly persisted in hidden form fields on the table page. (#963)
• New mechanism for defining page templates with custom path parameters. (#944)

• register_output_renderer() render functions can now return a Response. (#953)
• New --upgrade option for datasette install. (#945)
• datasette publish heroku now deploys using Python 3.8.5

• Datasette documentation now lives at docs.datasette.io.
• db.is_mutable property is now documented and tested, see Database introspection.
• The extra_template_vars, extra_css_urls, extra_js_urls and extra_body_script plugin hooks now all accept the same arguments. See extra_template_vars(template, database, table, columns, view_name, request, datasette) for details. (#939)
• Those hooks now accept a new columns argument detailing the table columns that will be rendered on that page. (#938)
• Fixed bug where plugins calling db.execute_write_fn() could hang Datasette if the connection failed. (#935)
• Fixed bug with the ?_nl=on output option and binary data. (#914)

• The datasette --get command-line mechanism now ensures any plugins using the startup() hook are correctly executed. (#934)

• Fixed an issue with the Docker image published to Docker Hub. (#931)

• Fixed a bug where the sdist distribution of Datasette was not correctly including the template files. (#930)

• Datasette now has a GitHub discussions forum for conversations about the project that go beyond just bug reports and issues.
• Datasette can now be installed on macOS using Homebrew! Run brew install simonw/datasette/datasette. See Using Homebrew. (#335)
• Two new commands: datasette install name-of-plugin and datasette uninstall name-of-plugin. These are equivalent to pip install and pip uninstall but automatically run in the same virtual environment as Datasette, so users don't have to figure out where that virtual environment is - useful for installations created using Homebrew or pipx. See Installing plugins. (#925)
• A new command-line option, datasette --get, accepts a path to a URL within the Datasette instance. It will run that request through Datasette (without starting a web server) and print out the repsonse. See datasette --get for an example. (#926)

Warning: This release contains a security fix related to authenticated writable canned queries. If you are using this feature you should upgrade as soon as possible.

• Security fix: CSRF tokens were incorrectly included in read-only canned query forms, which could allow them to be leaked to a sophisticated attacker. See issue 918 for details.
• Datasette now supports GraphQL via the new datasette-graphql plugin - see GraphQL in Datasette with the new datasette-graphql plugin.
• Principle git branch has been renamed from master to main. (#849)
• New debugging tool: /-/allow-debug tool (demo here) helps test allow blocks against actors, as described in Defining permissions with "allow" blocks. (#908)
• New logo for the documentation, and a new project tagline: "An open source multi-tool for exploring and publishing data".
• Whitespace in column values is now respected on display, using white-space: pre-wrap. (#896)
• New await request.post_body() method for accessing the raw POST body, see Request object. (#897)
• Database file downloads now include a content-length HTTP header, enabling download progress bars. (#905)
• File downloads now also correctly set the suggested file name using a content-disposition HTTP header. (#909)
• tests are now excluded from the Datasette package properly - thanks, abeyerpath. (#456)
• The Datasette package published to PyPI now includes sdist as well as bdist_wheel.
• Better titles for canned query pages. (#887)
• Now only loads Python files from a directory passed using the --plugins-dir option - thanks, Amjith Ramanujam. (#890)
• New documentation section on Publishing to Vercel.

Magic parameters for canned queries, a log out feature, improved plugin documentation and four new plugin hooks.

Magic parameters for canned queries

Canned queries now support Magic parameters, which can be used to insert or select automatically generated values. For example:

insert into logs
  (user_id, timestamp)
values
  (:_actor_id, :_now_datetime_utc)

This inserts the currently authenticated actor ID and the current datetime. (#842)

Log out

The ds_actor cookie can be used by plugins (or by Datasette's --root mechanism) to authenticate users. The new /-/logout page provides a way to clear that cookie.

A "Log out" button now shows in the global navigation provided the user is authenticated using the ds_actor cookie. (#840)

Better plugin documentation

The plugin documentation has been re-arranged into four sections, including a brand new section on testing plugins. (#687)

• Plugins introduces Datasette's plugin system and describes how to install and configure plugins.
• Writing plugins describes how to author plugins, from simple one-off plugins to packaged plugins that can be published to PyPI. It also describes how to start a plugin using the new datasette-plugin cookiecutter template.
• Plugin hooks is a full list of detailed documentation for every Datasette plugin hook.
• Testing plugins describes how to write tests for Datasette plugins, using pytest and HTTPX.

New plugin hooks

• register_magic_parameters(datasette) can be used to define new types of magic canned query parameters.
• startup(datasette) can run custom code when Datasette first starts up. datasette-init is a new plugin that uses this hook to create database tables and views on startup if they have not yet been created. (#834)
• canned_queries(datasette, database, actor) lets plugins provide additional canned queries beyond those defined in Datasette's metadata. See datasette-saved-queries for an example of this hook in action. (#852)
• forbidden(datasette, request, message) is a hook for customizing how Datasette responds to 403 forbidden errors. (#812)

Smaller changes

• Cascading view permissons - so if a user has view-table they can view the table page even if they do not have view-database or view-instance. (#832)
• CSRF protection no longer applies to Authentication: Bearer token requests or requests without cookies. (#835)
• datasette.add_message() now works inside plugins. (#864)
• Workaround for "Too many open files" error in test runs. (#846)
• Respect existing scope["actor"] if already set by ASGI middleware. (#854)
• New process for shipping Alpha and beta releases. (#807)
• {{ csrftoken() }} now works when plugins render a template using datasette.render_template(..., request=request). (#863)
• Datasette now creates a single Request object and uses it throughout the lifetime of the current HTTP request. (#870)

Authentication and permissions, writable canned queries, flash messages, new plugin hooks and more. Full release notes. See also Datasette 0.44: the annotated release notes.