To update the prebuilt executable you can run ./pocketbase update. Fixed migration deadlock if a logs db write happens to run while the migration is still executing (#7836). app.ResetBootstrapState() was soft-deprecated in favour of app.ClearBootstrap(). Additionally a new app.OnBootstrapClear() hook was added to allow clearing custom allocated OnBootstrap resources in case the app uses a non-stan…
To update the prebuilt executable you can run ./pocketbase update. Write the status header for JSON responses only if the fields picker succeed or has acceptable fallback. This is to allow custom response status code for failed json writes. Fixes for various minor bugs spammed by 2 LLM users (bots?): Fixed collection index validator to allow expressions with parenthesis in the optional WHERE claus…
(Backported from v0.40.3) Fixed collection index validator to allow expressions with parenthesis in the optional WHERE clause. (Backported from v0.40.3) Fixed nested cascade delete of self-referenced relation records. (Backported from v0.40.3) Bumped golang.org/x/* dependencies to silence security scanners (#7829).
To update the prebuilt executable you can run ./pocketbase update. Return an error when filter params fallback fails to json serialize and optimized params replacement to execute in a single pass. Fixed collection index parsing error for indexes with missing name. Minor UI autocomplete optimizations (prefix match, autocomplete debounce, etc.). Fixed linter warnings and comment typos. Bumped goja a…
(Backported from v0.40.2) Bumped goja and its related dependencies (regex unescaped dash error fix and base64 optimizations). (Backported from v0.40.2) Return an error when filter params fallback fails to json serialize and optimized params replacement to execute in a single pass. (Backported from v0.40.2) Bumped the min Go GitHub action version to 1.27.1 as it includes some minor database/sql and…
To update the prebuilt executable you can run ./pocketbase update. Fixes for some reported regressions related to the encoding/json/v2 update: allow mangling invalid UTF8 characters when serializing json data (#7814) fixed OAuth2 providers config merge incorrectly replacing the entire slice (#7815)
To update the prebuilt executable you can run ./pocketbase update. Propagate console command errors and recovered panics to app.Start() so that the program can exit with non-zero code while still ensuring that app.OnTerminate hook was triggered (responsible for the app graceful shutdown handling). ⚠️ Note that this could be a slight breaking change in case you are chaining PocketBase commands and…
Workaround encoding/json infinite recursion when used with Go 1.27.0 (#7808).
To update the prebuilt executable you can run ./pocketbase update. Fixed "API preview" examples (#7782, #7785). Other minor UI improvements (fixed sortable dragend event handling, allow ESC to workaround TAB trap for the rule fields, allow new duplicated collection to edit the collection of relation fields, updated shablon, updated npm dev dependencies, etc.). Bumped golang.org/x/* deps and the mi…
(Backported from v0.39.11) Bumped golang.org/x/* deps and the min Go GitHub action version to 1.26.6 because it comes with some minor bug and security fixes.
To update the prebuilt executable you can run ./pocketbase update. Reverted the auto panic recover handling for the cli commands to preserve the old behavior and allow panic to force exit with non-zero code (#7781). Proper command non-zero exit support will be available with the next v0.40/v0.41 release. Minor UI improvements (added placeholder loader for the logs chart, npm dev deps update, etc.)…
(Backported from v0.39.10) Reverted the auto panic recover handling for the cli commands to preserve the old behavior and allow panic to force exit with non-zero code (#7781).
To update the prebuilt executable you can run ./pocketbase update. Fixed Shift + Click range bulk selection not working in Firefox (#7771) Updated goja and its related dependencies (fixes for TypedArray and regexp2 dep regression for the reported empty string match with lookahead patterns). Minor filter (fexpr) improvements (optimization for large string literals and fix for control characters han…
(Backported from v0.39.9) Bumped goja, fexpr and their related deps.
To update the prebuilt executable you can run ./pocketbase update. Properly reset JSVM global $app overwrite so that pooled executors always get a clean state. Minor UI improvements: prevent resetting number inputs with leading 0 while still typing (normalized in onchange) added support for Shift + Click range bulk selection (#7759) Bumped golang.org/x/* indirect dependencies as there are some min…
(Backported from v0.39.8) Bumped golang.org/x/* indirect dependencies as there are some minor security fixes. (Backported from v0.39.8) Updated modernc.org/sqlite to v1.54.0 (SQLite 3.53.3).
To update the prebuilt executable you can run ./pocketbase update. ImportantThis release includes a security fix related to #7762. Replaced github.com/go-ozzo/ozzo-validation with the fork github.com/pocketbase/ozzo-validation since the original library has recently changed ownership and the new maintainer cannot be trusted. There are plans to create eventually a new validation library from scratc…
(Backported from v0.39.7) Replaced github.com/go-ozzo/ozzo-validation with the fork github.com/pocketbase/ozzo-validation since the original library has recently changed ownership and the new maintainer cannot be trusted. (Backported from v0.39.7) Fixed View collection * validator and added more friendly error messages (#7761). (Backported from v0.39.7) ⚠️ Security fix for unhandled panic in inter…
To update the prebuilt executable you can run ./pocketbase update. Added Cc and Bcc recipients to the dev sendmail command for consistency with the SMTP mailer. Added extra hardening options to the Microsoft OAuth2 provider allowing developers to specify the preferred safe email extraction method (#7756). Updated goja and the related golang.org/x/* dependencies (WeakMap regression fixes). Bumped t…
(Backported from v0.39.6) Bumped the min Go GitHub action version to 1.26.5 as it includes some minor security fixes.
To update the prebuilt executable you can run ./pocketbase update. Limit with ellipsis long url field values. Readded the "fullscreen" editor field option and preloaded the TinyMCE component for slightly faster initial rendering (#7746). Updated goja (TypedArray fixes).
To update the prebuilt executable you can run ./pocketbase update. Removed redirectURL required validator from the code->token exchange endpoint (aka. authWithOAuth2Code()) (#7734). Note that OAuth2 providers have their own validations and whether it is allowed to be empty or not could depend on the configured OAuth2 app (in most cases it is required and the redirect address must match with the in…
To update the prebuilt executable you can run ./pocketbase update. Fixed JS error on file settings maxSelect change (#7731). Apply the Ctrl+S record panel save shortcut only if it is the current top open modal. Fixed number settings validator to not ignore 0 max value. Normalized field settings validation error messages and tooltips.
To update the prebuilt executable you can run ./pocketbase update. Fixed records list UI sorting (#7724). Don't clear the date input on invalid value while still typing (#7726). Return filepath.SkipDir in the pb_hooks dirs watcher to avoid unnecessary iterating over node_modules and .* prefixed hidden dirs (.DS_Store, .git, etc.). Show the "Affected rows" SQL console message only if non-empty to a…
To update the prebuilt executable you can run ./pocketbase update. Fixed multiple select options wrapping (#7720). Return the hidden record data fields for superusers realtime subscribers (#7721). Added default panic-recover handling for the cron jobs to avoid terminating the server on panic. Bumped the min Go GitHub action version to 1.26.4 as it includes some minor security fixes.
(Backported from v0.39.1) Bumped the min Go GitHub action version to 1.26.4 as it includes some minor security fixes.
To update the prebuilt executable you can run ./pocketbase update. Added new "SQL console" section under Settings > Debug allowing executing any raw SQL query from the UI (#2236; #7638). Note that this is intended for one-off analytic queries, the occasional VACUUM/PRAGMA optimize or debug purposes and not as the primary interface for interacting with your PocketBase data because it can break your…
To update the prebuilt executable you can run ./pocketbase update. Added RealtimeConnectRequestEvent.MaxTimeout field to specify the absolute max duration a realtime connection can remain open (default to 30mins). This is in addition to the IdeTimeout of 5mins in order to prevent misuse and to allow the GC to run more regularly. Added extra checks for the connected user IP in the realtime APIs to…
(Backported from v0.38.2) Updated all golang.org/x/ packages to cover the recent security fixes (none of them should be a critical issue in PocketBase but nonetheless it is advised to update).
To update the prebuilt executable you can run ./pocketbase update. Silenced the superuser IPs confirmation if there is no change. Updated the experimental UI extensions APIs to allow top-level await in the initialization script. Force unset the auth state of existing realtime connections on user password, collection secret, etc. changes. This is not strictly necessary because the realtime connecti…