AI

datasette-leaflet 0.3

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 14/11/2026, 00:12:24 UTC.

Briefings

Datasette-leaflet 0.3 was released on November 13, 2026, to fix a security issue where OpenStreetMap tile servers were violating the Referrer-Policy: no-referrer directive. The plugin now enforces strict-origin-when-cross-origin for tile requests, ensuring plugins loading bundled Leaflet tiles comply with the policy. This change prevents unauthorized access to tile server headers and improves security for users of the datasette ecosystem.

Key points

• Datasette-leaflet 0.3 was released on November 13, 2026, to fix a security issue where OpenStreetMap tile servers were violating the Referrer-Policy: no-referrer directive.
• The plugin now enforces strict-origin-when-cross-origin for tile requests, ensuring plugins loading bundled Leaflet tiles comply with the policy.

Context

Datasette is a Python library for querying OpenStreetMap data, and OpenStreetMap requires tile servers to send a referrer header when responding to requests. The previous version of datasette-leaflet did not enforce this policy, causing plugins that loaded tiles to violate the policy. This release addresses that specific security vulnerability.

Limitations

The evidence is limited to the specific security fix for tile requests in datasette-leaflet 0.3. No information is provided regarding the impact on other plugins, user adoption rates, or the scope of the OpenStreetMap policy violation beyond the specific header issue.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 14/11/2026, 01:11:34 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeigwawantfhocqbffuqgpmllm53hiw6iv3g6s7255jmaim225e7364