id,page,ref,title,content,breadcrumbs,references changelog:id31,changelog,id31,0.56.1 (2021-06-05),"This release fixes a reflected cross-site scripting security hole with the ?_trace=1 feature. You should upgrade to this version, or to Datasette 0.57, as soon as possible. ( #1360 )","[""Changelog""]","[{""href"": ""https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks"", ""label"": ""reflected cross-site scripting""}, {""href"": ""https://github.com/simonw/datasette/issues/1360"", ""label"": ""#1360""}]" changelog:id30,changelog,id30,0.57 (2021-06-05),"This release fixes a reflected cross-site scripting security hole with the ?_trace=1 feature. You should upgrade to this version, or to Datasette 0.56.1, as soon as possible. ( #1360 ) In addition to the security fix, this release includes ?_col= and ?_nocol= options for controlling which columns are displayed for a table, ?_facet_size= for increasing the number of facet results returned, re-display of your SQL query should an error occur and numerous bug fixes.","[""Changelog""]","[{""href"": ""https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks"", ""label"": ""reflected cross-site scripting""}, {""href"": ""https://github.com/simonw/datasette/issues/1360"", ""label"": ""#1360""}]" changelog:id29,changelog,id29,0.57.1 (2021-06-08),"Fixed visual display glitch with global navigation menu. ( #1367 ) No longer truncates the list of table columns displayed on the /database page. ( #1364 )","[""Changelog""]","[{""href"": ""https://github.com/simonw/datasette/issues/1367"", ""label"": ""#1367""}, {""href"": ""https://github.com/simonw/datasette/issues/1364"", ""label"": ""#1364""}]" changelog:id28,changelog,id28,0.58 (2021-07-14),"New datasette --uds /tmp/datasette.sock option for binding Datasette to a Unix domain socket, see proxy documentation ( #1388 ) ""searchmode"": ""raw"" table metadata option for defaulting a table to executing SQLite full-text search syntax without first escaping it, see Advanced SQLite search queries . ( #1389 ) New plugin hook: get_metadata(datasette, key, database, table) , for returning custom metadata for an instance, database or table. Thanks, Brandon Roberts! ( #1384 ) New plugin hook: skip_csrf(datasette, scope) , for opting out of CSRF protection based on the incoming request. ( #1377 ) The menu_links() , table_actions() and database_actions() plugin hooks all gained a new optional request argument providing access to the current request. ( #1371 ) Major performance improvement for Datasette faceting. ( #1394 ) Improved documentation for Running Datasette behind a proxy to recommend using ProxyPreservehost On with Apache. ( #1387 ) POST requests to endpoints that do not support that HTTP verb now return a 405 error. db.path can now be provided as a pathlib.Path object, useful when writing unit tests for plugins. Thanks, Chris Amico. ( #1365 )","[""Changelog""]","[{""href"": ""https://github.com/simonw/datasette/issues/1388"", ""label"": ""#1388""}, {""href"": ""https://github.com/simonw/datasette/issues/1389"", ""label"": ""#1389""}, {""href"": ""https://github.com/simonw/datasette/issues/1384"", ""label"": ""#1384""}, {""href"": ""https://github.com/simonw/datasette/issues/1377"", ""label"": ""#1377""}, {""href"": ""https://github.com/simonw/datasette/issues/1371"", ""label"": ""#1371""}, {""href"": ""https://github.com/simonw/datasette/issues/1394"", ""label"": ""#1394""}, {""href"": ""https://github.com/simonw/datasette/issues/1387"", ""label"": ""#1387""}, {""href"": ""https://github.com/simonw/datasette/issues/1365"", ""label"": ""#1365""}]" changelog:id27,changelog,id27,0.58.1 (2021-07-16),Fix for an intermittent race condition caused by the refresh_schemas() internal function. ( #1231 ),"[""Changelog""]","[{""href"": ""https://github.com/simonw/datasette/issues/1231"", ""label"": ""#1231""}]" changelog:id26,changelog,id26,0.59 (2021-10-14),"Columns can now have associated metadata descriptions in metadata.json , see Column descriptions . ( #942 ) New register_commands() plugin hook allows plugins to register additional Datasette CLI commands, e.g. datasette mycommand file.db . ( #1449 ) Adding ?_facet_size=max to a table page now shows the number of unique values in each facet. ( #1423 ) Upgraded dependency httpx 0.20 - the undocumented allow_redirects= parameter to datasette.client is now follow_redirects= , and defaults to False where it previously defaulted to True . ( #1488 ) The --cors option now causes Datasette to return the Access-Control-Allow-Headers: Authorization header, in addition to Access-Control-Allow-Origin: * . ( #1467 ) Code that figures out which named parameters a SQL query takes in order to display form fields for them is no longer confused by strings that contain colon characters. ( #1421 ) Renamed --help-config option to --help-settings . ( #1431 ) datasette.databases property is now a documented API. ( #1443 ) The base.html template now wraps everything other than the