Datasette closes a table-permission bypass
A Datasette security fix blocks requests that could expose private rows by putting a trailing newline in a requested table name. That malformed name could bypass the table-permission check, so operators should update before relying on those permissions to protect private data. The release identifies the issue as GHSA-h547-rmjf-5m2m and credits dpfkdlemtp for reporting it.