PocketBase

To update the prebuilt executable you can run ./pocketbase update.

• Reverted the auto panic recover handling for the cli commands to preserve the old behavior and allow panic to force exit with non-zero code (#7781). Proper command non-zero exit support will be available with the next v0.40/v0.41 release.

• Minor UI improvements (added placeholder loader for the logs chart, npm dev deps update, etc.).

• Updated modernc.org/sqlite to v1.55.0 (DSN query params compatibility and doc changes).

• (Backported from v0.39.10) Reverted the auto panic recover handling for the cli commands to preserve the old behavior and allow panic to force exit with non-zero code (#7781).

To update the prebuilt executable you can run ./pocketbase update.

• Fixed Shift + Click range bulk selection not working in Firefox (#7771)

• Updated goja and its related dependencies (fixes for TypedArray and regexp2 dep regression for the reported empty string match with lookahead patterns).

• Minor filter (fexpr) improvements (optimization for large string literals and fix for control characters handling).

• (Backported from v0.39.9) Bumped goja, fexpr and their related deps.

To update the prebuilt executable you can run ./pocketbase update.

• Properly reset JSVM global $app overwrite so that pooled executors always get a clean state.

• Minor UI improvements:

  • prevent resetting number inputs with leading 0 while still typing (normalized in onchange)
  • added support for Shift + Click range bulk selection (#7759)

• Bumped golang.org/x/* indirect dependencies as there are some minor security fixes.

• Updated modernc.org/sqlite to v1.54.0 (SQLite 3.53.3).

• (Backported from v0.39.8) Bumped golang.org/x/* indirect dependencies as there are some minor security fixes.

• (Backported from v0.39.8) Updated modernc.org/sqlite to v1.54.0 (SQLite 3.53.3).

To update the prebuilt executable you can run ./pocketbase update.

[!IMPORTANT] This release includes a security fix related to #7762.

• Replaced github.com/go-ozzo/ozzo-validation with the fork github.com/pocketbase/ozzo-validation since the original library has recently changed ownership and the new maintainer cannot be trusted. There are plans to create eventually a new validation library from scratch more suited for our needs in PocketBase because ozzo-validation is known to have some minor performance and obscure regex issues, but until then we'll stick with the fork (and if you use ozzo-validation in your own Go code, I'd suggest to swap the imports with the fork).

• Fixed missing import collection fields property access (#7760).

• Fixed View collection * validator and added more friendly error messages (#7761).

• ⚠️ Security fix for unhandled panic in internal worker goroutines (#7762). To prevent this from showing again, all existing internal worker functions were wrapped with routine.SafeWrap(f) (auto recovers and returns any eventual panic as regular error).

• (Backported from v0.39.7) Replaced github.com/go-ozzo/ozzo-validation with the fork github.com/pocketbase/ozzo-validation since the original library has recently changed ownership and the new maintainer cannot be trusted.

• (Backported from v0.39.7) Fixed View collection * validator and added more friendly error messages (#7761).

• (Backported from v0.39.7) ⚠️ Security fix for unhandled panic in internal worker goroutines (#7762).

To update the prebuilt executable you can run ./pocketbase update.

• Added Cc and Bcc recipients to the dev sendmail command for consistency with the SMTP mailer.

• Added extra hardening options to the Microsoft OAuth2 provider allowing developers to specify the preferred safe email extraction method (#7756).

• Updated goja and the related golang.org/x/* dependencies (WeakMap regression fixes).

• Bumped the min Go GitHub action version to 1.26.5 as it includes some minor security fixes.

• (Backported from v0.39.6) Bumped the min Go GitHub action version to 1.26.5 as it includes some minor security fixes.