To update the prebuilt executable you can run ./pocketbase update. Replaced the GitHub update command with update from the new host in relation to #7841. ⚠️ Note that this will be most likely the last release here on GitHub. The next time when you run update, new releases will be fetched from https://ganigeorgiev.com (there is nothing there yet). Additional fileblob bucket escape checks for just i…
(Backported from v0.40.6) Added a global restriction for the max WxH pixels size when generating a thumb to reduce the risk of excessive memory usage. The default limit is pretty generous and currently set to max 250<<20 (262144000) pixels and can be changed with the env PB_THUMBS_MAX_SOURCE_PIXELS. (Backported from v0.40.6) Bumped golang.org/x/ dependencies (#7865). (Backported from v0.40.6) Bump…
To update the prebuilt executable you can run ./pocketbase update. Minor improvements for the JSVM migration error handling: Included the recovered panic stack trace of routine.SafeWrap in the returned error (max 2KB). Wrapped the individual up/down JSVM migration arguments in routine.SafeWrap so that in case of panic we can still print the failed js migration filename. Updated modernc.org/sqlite…
(Backported from v0.40.5) Bumped the min Go GitHub action version to 1.27.2 as it includes several net/http security fixes. One of the fixes is for a DoS that could potentially affect PocketBase applications and it is advised to update.
To update the prebuilt executable you can run ./pocketbase update. Fixed migration deadlock if a logs db write happens to run while the migration is still executing (#7836). app.ResetBootstrapState() was soft-deprecated in favour of app.ClearBootstrap(). Additionally a new app.OnBootstrapClear() hook was added to allow clearing custom allocated OnBootstrap resources in case the app uses a non-stan…
To update the prebuilt executable you can run ./pocketbase update. Write the status header for JSON responses only if the fields picker succeed or has acceptable fallback. This is to allow custom response status code for failed json writes. Fixes for various minor bugs spammed by 2 LLM users (bots?): Fixed collection index validator to allow expressions with parenthesis in the optional WHERE claus…
(Backported from v0.40.3) Fixed collection index validator to allow expressions with parenthesis in the optional WHERE clause. (Backported from v0.40.3) Fixed nested cascade delete of self-referenced relation records. (Backported from v0.40.3) Bumped golang.org/x/* dependencies to silence security scanners (#7829).
To update the prebuilt executable you can run ./pocketbase update. Return an error when filter params fallback fails to json serialize and optimized params replacement to execute in a single pass. Fixed collection index parsing error for indexes with missing name. Minor UI autocomplete optimizations (prefix match, autocomplete debounce, etc.). Fixed linter warnings and comment typos. Bumped goja a…
(Backported from v0.40.2) Bumped goja and its related dependencies (regex unescaped dash error fix and base64 optimizations). (Backported from v0.40.2) Return an error when filter params fallback fails to json serialize and optimized params replacement to execute in a single pass. (Backported from v0.40.2) Bumped the min Go GitHub action version to 1.27.1 as it includes some minor database/sql and…
To update the prebuilt executable you can run ./pocketbase update. Fixes for some reported regressions related to the encoding/json/v2 update: allow mangling invalid UTF8 characters when serializing json data (#7814) fixed OAuth2 providers config merge incorrectly replacing the entire slice (#7815)
To update the prebuilt executable you can run ./pocketbase update. Propagate console command errors and recovered panics to app.Start() so that the program can exit with non-zero code while still ensuring that app.OnTerminate hook was triggered (responsible for the app graceful shutdown handling). ⚠️ Note that this could be a slight breaking change in case you are chaining PocketBase commands and…
Workaround encoding/json infinite recursion when used with Go 1.27.0 (#7808).
To update the prebuilt executable you can run ./pocketbase update. Fixed "API preview" examples (#7782, #7785). Other minor UI improvements (fixed sortable dragend event handling, allow ESC to workaround TAB trap for the rule fields, allow new duplicated collection to edit the collection of relation fields, updated shablon, updated npm dev dependencies, etc.). Bumped golang.org/x/* deps and the mi…
(Backported from v0.39.11) Bumped golang.org/x/* deps and the min Go GitHub action version to 1.26.6 because it comes with some minor bug and security fixes.
To update the prebuilt executable you can run ./pocketbase update. Reverted the auto panic recover handling for the cli commands to preserve the old behavior and allow panic to force exit with non-zero code (#7781). Proper command non-zero exit support will be available with the next v0.40/v0.41 release. Minor UI improvements (added placeholder loader for the logs chart, npm dev deps update, etc.)…
(Backported from v0.39.10) Reverted the auto panic recover handling for the cli commands to preserve the old behavior and allow panic to force exit with non-zero code (#7781).
To update the prebuilt executable you can run ./pocketbase update. Fixed Shift + Click range bulk selection not working in Firefox (#7771) Updated goja and its related dependencies (fixes for TypedArray and regexp2 dep regression for the reported empty string match with lookahead patterns). Minor filter (fexpr) improvements (optimization for large string literals and fix for control characters han…
(Backported from v0.39.9) Bumped goja, fexpr and their related deps.
To update the prebuilt executable you can run ./pocketbase update. Properly reset JSVM global $app overwrite so that pooled executors always get a clean state. Minor UI improvements: prevent resetting number inputs with leading 0 while still typing (normalized in onchange) added support for Shift + Click range bulk selection (#7759) Bumped golang.org/x/* indirect dependencies as there are some min…
(Backported from v0.39.8) Bumped golang.org/x/* indirect dependencies as there are some minor security fixes. (Backported from v0.39.8) Updated modernc.org/sqlite to v1.54.0 (SQLite 3.53.3).
To update the prebuilt executable you can run ./pocketbase update. ImportantThis release includes a security fix related to #7762. Replaced github.com/go-ozzo/ozzo-validation with the fork github.com/pocketbase/ozzo-validation since the original library has recently changed ownership and the new maintainer cannot be trusted. There are plans to create eventually a new validation library from scratc…
(Backported from v0.39.7) Replaced github.com/go-ozzo/ozzo-validation with the fork github.com/pocketbase/ozzo-validation since the original library has recently changed ownership and the new maintainer cannot be trusted. (Backported from v0.39.7) Fixed View collection * validator and added more friendly error messages (#7761). (Backported from v0.39.7) ⚠️ Security fix for unhandled panic in inter…
To update the prebuilt executable you can run ./pocketbase update. Added Cc and Bcc recipients to the dev sendmail command for consistency with the SMTP mailer. Added extra hardening options to the Microsoft OAuth2 provider allowing developers to specify the preferred safe email extraction method (#7756). Updated goja and the related golang.org/x/* dependencies (WeakMap regression fixes). Bumped t…
(Backported from v0.39.6) Bumped the min Go GitHub action version to 1.26.5 as it includes some minor security fixes.
To update the prebuilt executable you can run ./pocketbase update. Limit with ellipsis long url field values. Readded the "fullscreen" editor field option and preloaded the TinyMCE component for slightly faster initial rendering (#7746). Updated goja (TypedArray fixes).
To update the prebuilt executable you can run ./pocketbase update. Removed redirectURL required validator from the code->token exchange endpoint (aka. authWithOAuth2Code()) (#7734). Note that OAuth2 providers have their own validations and whether it is allowed to be empty or not could depend on the configured OAuth2 app (in most cases it is required and the redirect address must match with the in…
To update the prebuilt executable you can run ./pocketbase update. Fixed JS error on file settings maxSelect change (#7731). Apply the Ctrl+S record panel save shortcut only if it is the current top open modal. Fixed number settings validator to not ignore 0 max value. Normalized field settings validation error messages and tooltips.
To update the prebuilt executable you can run ./pocketbase update. Fixed records list UI sorting (#7724). Don't clear the date input on invalid value while still typing (#7726). Return filepath.SkipDir in the pb_hooks dirs watcher to avoid unnecessary iterating over node_modules and .* prefixed hidden dirs (.DS_Store, .git, etc.). Show the "Affected rows" SQL console message only if non-empty to a…
To update the prebuilt executable you can run ./pocketbase update. Fixed multiple select options wrapping (#7720). Return the hidden record data fields for superusers realtime subscribers (#7721). Added default panic-recover handling for the cron jobs to avoid terminating the server on panic. Bumped the min Go GitHub action version to 1.26.4 as it includes some minor security fixes.
(Backported from v0.39.1) Bumped the min Go GitHub action version to 1.26.4 as it includes some minor security fixes.