PocketBase changelog

To update the prebuilt executable you can run ./pocketbase update. Fixes for some reported regressions related to the encoding/json/v2 update: allow mangling invalid UTF8 characters when serializing json data (#7814) fixed OAuth2 providers

To update the prebuilt executable you can run ./pocketbase update. Propagate console command errors and recovered panics to app.Start() so that the program can exit with non-zero code while still ensuring that app.OnTerminate hook was trigg

Workaround encoding/json infinite recursion when used with Go 1.27.0 (#7808).

To update the prebuilt executable you can run ./pocketbase update. Fixed "API preview" examples (#7782, #7785). Other minor UI improvements (fixed sortable dragend event handling, allow ESC to workaround TAB trap for the rule fields, allow

(Backported from v0.39.11) Bumped golang.org/x/* deps and the min Go GitHub action version to 1.26.6 because it comes with some minor bug and security fixes.

To update the prebuilt executable you can run ./pocketbase update. Reverted the auto panic recover handling for the cli commands to preserve the old behavior and allow panic to force exit with non-zero code (#7781). Proper command non-zero

(Backported from v0.39.10) Reverted the auto panic recover handling for the cli commands to preserve the old behavior and allow panic to force exit with non-zero code (#7781).

To update the prebuilt executable you can run ./pocketbase update. Fixed Shift + Click range bulk selection not working in Firefox (#7771) Updated goja and its related dependencies (fixes for TypedArray and regexp2 dep regression for the re

(Backported from v0.39.9) Bumped goja, fexpr and their related deps.

To update the prebuilt executable you can run ./pocketbase update. Properly reset JSVM global $app overwrite so that pooled executors always get a clean state. Minor UI improvements: prevent resetting number inputs with leading 0 while stil

(Backported from v0.39.8) Bumped golang.org/x/* indirect dependencies as there are some minor security fixes. (Backported from v0.39.8) Updated modernc.org/sqlite to v1.54.0 (SQLite 3.53.3).

To update the prebuilt executable you can run ./pocketbase update. [!IMPORTANT] This release includes a security fix related to #7762. Replaced github.com/go-ozzo/ozzo-validation with the fork github.com/pocketbase/ozzo-validation since the

(Backported from v0.39.7) Replaced github.com/go-ozzo/ozzo-validation with the fork github.com/pocketbase/ozzo-validation since the original library has recently changed ownership and the new maintainer cannot be trusted. (Backported from v

To update the prebuilt executable you can run ./pocketbase update. Added Cc and Bcc recipients to the dev sendmail command for consistency with the SMTP mailer. Added extra hardening options to the Microsoft OAuth2 provider allowing develop

(Backported from v0.39.6) Bumped the min Go GitHub action version to 1.26.5 as it includes some minor security fixes.

To update the prebuilt executable you can run ./pocketbase update. Limit with ellipsis long url field values. Readded the "fullscreen" editor field option and preloaded the TinyMCE component for slightly faster initial rendering (#7746). Up

To update the prebuilt executable you can run ./pocketbase update. Removed redirectURL required validator from the code->token exchange endpoint (aka. authWithOAuth2Code()) (#7734). Note that OAuth2 providers have their own validations and

To update the prebuilt executable you can run ./pocketbase update. Fixed JS error on file settings maxSelect change (#7731). Apply the Ctrl+S record panel save shortcut only if it is the current top open modal. Fixed number settings validat

To update the prebuilt executable you can run ./pocketbase update. Fixed records list UI sorting (#7724). Don't clear the date input on invalid value while still typing (#7726). Return filepath.SkipDir in the pb_hooks dirs watcher to avoid

To update the prebuilt executable you can run ./pocketbase update. Fixed multiple select options wrapping (#7720). Return the hidden record data fields for superusers realtime subscribers (#7721). Added default panic-recover handling for th

(Backported from v0.39.1) Bumped the min Go GitHub action version to 1.26.4 as it includes some minor security fixes.

To update the prebuilt executable you can run ./pocketbase update. Added new "SQL console" section under Settings > Debug allowing executing any raw SQL query from the UI (#2236; #7638). Note that this is intended for one-off analytic queri

To update the prebuilt executable you can run ./pocketbase update. Added RealtimeConnectRequestEvent.MaxTimeout field to specify the absolute max duration a realtime connection can remain open (default to 30mins). This is in addition to the

(Backported from v0.38.2) Updated all golang.org/x/ packages to cover the recent security fixes (none of them should be a critical issue in PocketBase but nonetheless it is advised to update).

To update the prebuilt executable you can run ./pocketbase update. Silenced the superuser IPs confirmation if there is no change. Updated the experimental UI extensions APIs to allow top-level await in the initialization script. Force unset

(Backported from v0.38.1) Force unset the auth state of existing realtime connections on user tokenKey change.

To update the prebuilt executable you can run ./pocketbase update. Fixed UI logs pagination when no custom range is specified. Fixed default CSP not allowing audio/video previews (#7677). Serve fixed Content-Type for .xlsx, .docx and .pptx

(Backported from v0.38.0) Bumped min Go GitHub action version to 1.26.3 because it comes with some minor bug and security fixes.

To update the prebuilt executable you can run ./pocketbase update. Fixed password fields not being detected as changed (#7670). Added the local time zone name next to the date field label. Reload trusted proxy info UI after settings save. O

To update the prebuilt executable you can run ./pocketbase update. [!IMPORTANT] This release include a security fix related to #7662. Added backups list scroll container (#7655). Optimized record upsert and preview modals data loading to mi

(Backported from v0.37.4) Adjusted Bitbucket, GitHub, GitLab and Gitea/Forgejo OAuth2 providers to better reflect recent API updates and doc references. In case the userinfo data is not sufficient, some of the providers now send a separate

To update the prebuilt executable you can run ./pocketbase update. Fixed total count load on page back/forward navigation. Fixed editor floating dialogs position when scrolling (#7653). Enabled text wrapping for the API rule fields. Added v

To update the prebuilt executable you can run ./pocketbase update. Fixed autoexpandable input in Firefox (#7648). Slightly adjusted the dark theme colors for better readability (#7648). Removed unnecessary tags stripping from the displayed

To update the prebuilt executable you can run ./pocketbase update. Minor UI bugfixes: Fixed number field input values normalization (#7646). Allow opening collections in new tab with middle click. Show collection name in the page title on i

To update the prebuilt executable you can run ./pocketbase update. New UI rewritten from scratch and with support for external customization in mind. Note that as explained in #7612 the new UI kit and extensions APIs will intentionally rema

To update the prebuilt executable you can run ./pocketbase update. Updated the Discord AuthUser.Name field to use global_name (#7603; thanks @HansHans135). Fixed settings SMTP password clear persistence. Added extra OAuth2 checks when downl

(Backported from v0.36.9) Updated the Discord AuthUser.Name field to use global_name (#7603). (Backported from v0.36.9) Updated modernc.org/sqlite to v1.48.2 (vfs and other error path related fixes). (Backported from v0.36.9) Bumped min Go

To update the prebuilt executable you can run ./pocketbase update. Fixed OAuth2 client secret reset when serializing a cached collection model. Bumped all Go and npm deps. This should also silence recent spam reports and security scanners r

To update the prebuilt executable you can run ./pocketbase update. Fixed high memory usage with large file uploads (#7572). Updated the rate limiter reset rules to follow a more traditional fixed window strategy (aka. to be more close to ho

(Backported from v0.36.7) Updated modernc.org/sqlite to v1.46.2 and SQLite 3.51.3. ⚠️ SQLite 3.51.3 fixed a database corruption bug that is very unlikely to happen (with PocketBase even more so because we queue on app level all writes and e

To update the prebuilt executable you can run ./pocketbase update. Set NumberField.OnlyInt:true for the generated View collection schema fields when a view column expression is known to return int-only values (#7538). Documented the unmarsh

(Backported from v0.36.6) Bumped min Go GitHub action version to 1.26.1 because it comes with some minor bug and security fixes.

To update the prebuilt executable you can run ./pocketbase update. Disabled collection and fields name normalization while in IME mode (#7532; thanks @miaopan607). Updated modernc.org/sqlite to v1.46.1 (resets connection state on Tx.Commit

To update the prebuilt executable you can run ./pocketbase update. Made the optional Bearer token prefix case-insensitive (#7525; thanks @benjamesfleming). Enabled $filesystem.s3(...) and $filesystem.local(...) JSVM bindings (#7526).

To update the prebuilt executable you can run ./pocketbase update. Added Accept-Encoding: identity to the S3 requests per the suggestion in #7523. This should help fixing the 0-bytes file response when S3 API compression is enabled. Bumped

To update the prebuilt executable you can run ./pocketbase update. Updated modernc.org/sqlite to v1.44.3 (race check fix), goja (circular references fix) and other go deps. Other minor fixes (updated tests to silence some of the race detect

To update the prebuilt executable you can run ./pocketbase update. Reverted the DISTINCT with GROUP BY replacement optimization from v0.36.0 as it was reported to negatively impact the indexes utilization for some queries and the minor perf

To update the prebuilt executable you can run ./pocketbase update. List query and API rules optimizations: Removed unnecessary correlated subquery expression when using back-relations via single relation field. Replaced DISTINCT with GROUP

(Backported from v0.36.0) Bumped min Go GitHub action version to 1.25.6 because it comes with some minor security fixes.

To update the prebuilt executable you can run ./pocketbase update. Updated modernc.org/sqlite to v1.43.0 (query cancellation race fix). Minor UI fixes (normalized relations picker selection and confirmation message when maxSelect=0/1, updat

To update the prebuilt executable you can run ./pocketbase update. Added nullString(), nullInt(), nullFloat(), nullBool, nullArray(), nullObject() JSVM helpers for scanning nullable columns (#7396). Store the correct image/png as attrs cont

To update the prebuilt executable you can run ./pocketbase update. Bumped JS SDK to v0.26.5 to fix Safari AbortError detection introduced with the previous release (#7369).

To update the prebuilt executable you can run ./pocketbase update. Added missing : char to the autocomplete regex (#7353; thanks @ouvreboite). Added "Copy raw JSON" collection dropdown option (#7357). Updated Go deps and JS SDK. Bumped min

(Backported from v0.34.1) - Added missing : char to the autocomplete regex (#7353). (Backported from v0.34.1) Bumped min Go GitHub action version to 1.25.5 because it comes with some minor security fixes. The runner action was also updated

To update the prebuilt executable you can run ./pocketbase update. Added @request.body.someField:changed modifier. It could be used when you want to ensure that a body field either wasn't submitted or was submitted with the same value. Or i

To update the prebuilt executable you can run ./pocketbase update. Added extra id characters validation in addition to the user specified regex pattern (#7312). The following special characters are always forbidden: ./\|"'``<>:?*%$\n\r\t\0

To update the prebuilt executable you can run ./pocketbase update. ⚠️ Added extra List/Search API rules checks for the client-side filter/sort relations. This is continuation of the effort to eliminate the risk of information disclosure (an

To update the prebuilt executable you can run ./pocketbase update. Display presentable multiple relation fields (#7260). Support Ed25519 in the optional OIDC id_token signature validation (#7252; thanks @shynome). Added ApiScenario.DisableT

To update the prebuilt executable you can run ./pocketbase update. Fixed json field CSS regression introduced with the overflow workaround in v0.30.3 (#7259).

To update the prebuilt executable you can run ./pocketbase update. Fixed legacy identitity field priority check when a username is a valid email address (#7256). Workaround autocomplete overflow issue in Firefox 144 (#7223). Updated modernc