Datasette 1.0a40 Released: Security Fix and Background Task Support

Datasette is an open-source data exploration and publishing tool developed by Simon Willison, widely used to quickly transform SQLite databases into interactive web interfaces and JSON APIs. The latest 1.0a40 pre-release includes the same security fix shipped in 0.65.5, along with plugin background task support, a migration to the httpx2 HTTP client, and a wave of bug fixes paving the way toward a stable 1.0 release.

Key Security Fix

This release carries forward the same security fix introduced in 0.65.5. For anyone running Datasette in production — especially instances serving public data — this kind of fix deserves immediate attention, as upgrading promptly can prevent potential security exposure.

While the official release notes don't go into technical detail about the vulnerability, the fact that the patch has been backported to the 1.0 alpha branch signals that the maintainers are treating security as a top priority even as new features land. Deployments still running older versions should evaluate their upgrade path.

Plugins Can Now Manage Background Tasks

The most notable new capability in this release is that plugins can now launch and manage background tasks via the new datasette.add_background_task() method. This feature was contributed by Alex Garcia.

For plugin developers, this means it's now possible to run long-running operations — such as periodic data syncs, index rebuilds, cache warming, or async data processing — without blocking the main request-handling flow. Previously, these use cases typically required developers to wire up external schedulers or separate processes on their own. A built-in background task API meaningfully expands the boundaries of what the plugin ecosystem can do.

The addition of this API also reflects a broader shift: Datasette is gradually evolving from a primarily "read-only data publishing" tool into a platform capable of supporting more complex runtime behavior.

datasette.add_background_task() is typically implemented on top of Python's asyncio event loop, registering a coroutine as a background asyncio.Task so it runs concurrently with request handling without blocking it. This is fundamentally different from traditional task queue solutions like Celery or APScheduler — those require additional message brokers (e.g., Redis, RabbitMQ) and worker processes, significantly increasing deployment complexity. The built-in background task approach is lightweight by design: no extra infrastructure needed, and task lifecycles are managed entirely within the Datasette process. The trade-off is that task state won't survive process restarts, making this best suited for lightweight async operations where persistence isn't critical, rather than mission-critical jobs.

Migration to httpx2

This release migrates Datasette to httpx2 to support functionality such as the internal datasette.client.get() method.

httpx2 is a next-generation HTTP client library. For plugins and integrations that rely on Datasette's internal client to make requests, this underlying switch should bring better feature support and long-term maintainability. Developers upgrading should verify whether any calls to datasette.client in their own code behave differently after the migration.

httpx2 is developed by the Pydantic team as a redesigned successor to the popular httpx library. httpx itself is a modern Python HTTP client that supports both sync and async usage, designed as a requests-style API with native async/await support. httpx2 builds on that foundation with an improved internal architecture, tighter integration with the Pydantic ecosystem, and enhanced connection pool management and type safety. Datasette's move to httpx2 keeps it aligned with the direction of the Python HTTP client ecosystem while reducing long-term maintenance burden — particularly important as Python's async ecosystem (asyncio) continues to mature, making the choice of actively maintained, modern dependencies increasingly consequential.

Extensive Fixes Targeting 1.0 Stability

Beyond the new features, 1.0a40 includes a large number of bug fixes, many of which stem from a recent round of issue triage the maintainers undertook specifically in preparation for the stable 1.0 release.

The signal is clear: Datasette is systematically working through outstanding issues and steadily closing in on the long-promised 1.0 release. For teams evaluating whether to adopt Datasette in critical projects, the approaching stable release means a stronger commitment to API stability and a more mature ecosystem foundation.

Upgrade Recommendations

• Production users should take note of the security fix and evaluate upgrading to a version that includes the patch.
• Plugin developers can start experimenting with the new background task API for async and scheduled task use cases.
• Integrations using datasette.client should verify compatibility after the httpx2 migration.

As an alpha release, 1.0a40 is best suited for development and testing environments. For the full list of changes, refer to the official changelog and GitHub Releases page.