Cloudflare ships anonymous Worker deploys, sqlite-utils 4.0 adds migrations
Every URL the pipeline pulled into ranking for this issue — primary sources plus the supporting and contradicting findings each Researcher returned. Inline citations in the issue point back here.
Sources
Temporary Cloudflare Accounts for AI agents simonwillison.net
Temporary Cloudflare Accounts for AI agents The announcement says this is “for AI agents” but (as is pretty common these days) the AI hook isn’t really necessary, this is an interesting feature for everyone else as well. Short version: you can now create a Cloudflare Workers project and run this, without even creating a Cloudflare account: npx wrangler deploy —temporary Cloudflare will deploy the application to a new, ephemeral project which will stay live for 60 minutes. I had GPT-5.5 xhigh i…
sqlite-utils 4.0rc1 adds migrations and nested transactions simonwillison.net
sqlite-utils is my combined Python library and CLI tool for working with SQLite databases. It provides an extensive set of higher-level operations on top of Python’s default sqlite3 package , including support for complex table transformations , automatic table creation from JSON data and a whole lot more. I released sqlite-utils 4.0rc1 , the first release candidate for sqlite-utils v4. The major version bump indicates some (minor) backwards incompatible changes, so I’m interested in having peo…
sqlite-utils 4.0rc1 simonwillison.net
Release: sqlite-utils 4.0rc1 See sqlite-utils 4.0rc1 adds migrations and nested transactions . Tags: sqlite-utils
References
Hacker News thread #48608394 news.ycombinator.com
jedberg: the most valuable feature would be a guaranteed kill switch to stop traffic once a specific dollar limit is reached… others noted the irony that bots can now spin up accounts while humans remain trapped in endless Turnstile spinner loops.
Cloudflare blog — account-abuse-protection blog.cloudflare.com
The CLI requires a proof-of-work challenge before provisioning a temporary account, combined with strict rate limits on account creation and a restricted set of supported products (e.g., limited D1 database size and KV commands).
explainx.ai — Wrangler —temporary deep dive explainx.ai
Temporary workers operate under strict resource constraints equivalent to Cloudflare’s Free tier: 100,000 requests per day and a maximum CPU execution time of 10ms per invocation; deployments require programmatic acceptance of Cloudflare’s Terms of Service passed as a text flag.
Digital Applied — security analysis digitalapplied.com
A 60-minute window is sufficient for a targeted phishing strike… the Trust & Safety team’s standard review process — which can take days or weeks — is fundamentally incompatible with a one-hour attack window on the trusted workers.dev domain.
Microsoft Security blog — AutoJack disclosure microsoft.com
A hijacked AutoGen agent could be instructed via prompt injection to run wrangler deploy —temporary, using the developer’s trusted environment to launch malicious Workers — data-exfiltration proxies or C2 nodes — on Cloudflare’s global edge without an account trail.
getaibook.com — deployment walkthrough getaibook.com
If the claim link is not used within 60 minutes the account and all associated resources (Workers, KV, D1) are automatically deleted; the claim URL itself is a bearer credential that grants full ownership of the deployment.
Peewee documentation (red-dove mirror) docs.red-dove.com
The outermost call issues a BEGIN, while subsequent nested calls issue SAVEPOINT commands… with db.atomic() as nested: … nested.rollback() issues ROLLBACK TO SAVEPOINT.
Medium write-up on Django transaction.atomic medium.com
On the first call, it starts a database transaction. If called again within that block, it automatically generates a savepoint with a unique ID; if the inner block fails, Django issues a ROLLBACK TO SAVEPOINT.
Django ticket #29280 (SQLite savepoint behavior) code.djangoproject.com
Python’s sqlite3 driver historically interfered with savepoint management by implicitly committing before certain statements; Python 3.12’s new autocommit mode lets the engine handle transaction state.
daily.dev coverage of sqlite-utils 4.0rc1 daily.dev
Early feedback identified a bug related to plugin installation when using the uv tool, as uv does not bundle pip by default… ‘agentic’ bug reports where AI-driven testers identified edge cases in ambiguous data strings.
sqlite-utils changelog (datasette.io) sqlite-utils.datasette.io
Tables created by this library now wrap table and column names in “double-quotes” in the schema. Previously they would use [square-braces].
sqlite-utils GitHub releases github.com
use_old_upsert=True opt-in restores the legacy INSERT OR IGNORE + UPDATE behaviour for code that depended on the previous side effects on SQLite <3.24.
