Simon Willison released version 1.0 of datasette-auth-github, a plugin that lets a Datasette instance authenticate users through their GitHub account, according to his blog. He said he is working through his older plugins and promoting the mature, stable ones to 1.0 releases.
The release fixes a bug in which the plugin set its authentication cookie without a Max-Age parameter, so the cookie expired at the end of a browser session instead of persisting, Willison wrote. The effect was especially harsh on Mobile Safari, where a session-only cookie can vanish in minutes. He found the bug while running the plugin on his own agent.datasette.io demo site and fixed it by giving the cookie an explicit expiration.
Willison said the plugin is now tested against both the current stable Datasette 0.65.x line and the upcoming Datasette 1.0 alpha releases, which he treats as the bar for calling a plugin done rather than perpetually in progress.
A cookie missing one parameter is a small bug with an outsized blast radius: it does not throw an error, does not fail a test that does not specifically check cookie lifetime, and just quietly logs out a subset of users depending on which browser they picked. Anyone shipping a login flow for internal tools or agent-facing services has the same failure mode sitting somewhere in their session handling until something forces them to look.