PocketBase - Package Updates

[Package Updates]

[1.17.3]

• Update pocketbase to 0.39.3
• Full Changelog
• Fixed JS error on file settings maxSelect change (#7731).
• Apply the Ctrl+S record panel save shortcut only if it is the current top open modal.
• Fixed number settings validator to not ignore 0 max value.
• Normalized field settings validation error messages and tooltips.

[Package Updates]

[1.17.4]

• Update pocketbase to 0.39.4
• Full Changelog
• Removed redirectURL required validator from the code->token exchange endpoint (aka. authWithOAuth2Code()) (#7734).
• Enabled sorting by the first implicit presentable relation field (#7735).
• Other minor UI fixes (tooltip clear on hovered element removal, sortable optional before element fix, etc.).
• Updated goja and the related golang.org/x/* dependencies (regex support improvements).

[Package Updates]

[1.17.5]

• Update pocketbase to 0.39.5
• Full Changelog
• Limit with ellipsis long url field values.
• Readded the "fullscreen" editor field option and preloaded the TinyMCE component for slightly faster initial rendering (#7746).
• Updated goja (TypedArray fixes).

[Package Updates]

[1.17.6]

• Update pocketbase to 0.39.6
• Full Changelog
• Added Cc and Bcc recipients to the dev sendmail command for consistency with the SMTP mailer.
• Added extra hardening options to the Microsoft OAuth2 provider allowing developers to specify the preferred safe email extraction method.
• Updated goja and the related golang.org/x/* dependencies (WeakMap regression fixes).
• Bumped the min Go GitHub action version to 1.26.5 as it includes some minor security fixes.

[Package Updates]

[1.17.7]

• Make sendmail optional

[Package Updates]

[1.17.8]

• Update pocketbase to 0.39.7
• Full Changelog
• Replaced github.com/go-ozzo/ozzo-validation with the fork github.com/pocketbase/ozzo-validation since the original library has recently changed ownership and the new maintainer cannot be trusted.
• Fixed missing import collection fields property access (#7760).
• Fixed View collection * validator and added more friendly error messages (#7761).
• Security fix for unhandled panic in internal worker goroutines (#7762).

[Package Updates]

[1.17.9]

• Update pocketbase to 0.39.8
• Full Changelog
• Properly reset JSVM global $app overwrite so that pooled executors always get a clean state.
• prevent resetting number inputs with leading 0 while still typing (normalized in onchange)
• added support for Shift + Click range bulk selection (#7759)
• Bumped golang.org/x/* indirect dependencies as there are some minor security fixes.
• Updated modernc.org/sqlite to v1.54.0 (SQLite 3.53.3).

[Package Updates]

[1.17.10]

• Update pocketbase to 0.39.9
• Full Changelog
• Fixed Shift + Click range bulk selection not working in Firefox (#7771)
• Updated goja and its related dependencies (fixes for TypedArray and regexp2 dep regression for the reported empty string match with lookahead patterns).
• Minor filter (fexpr) improvements (optimization for large string literals and fix for control characters handling).

[Package Updates]

[1.17.11]

• Update pocketbase to 0.39.10
• Full Changelog
• Reverted the auto panic recover handling for the cli commands to preserve the old behavior and allow panic to force exit with non-zero code (#7781).
• Minor UI improvements (added placeholder loader for the logs chart, npm dev deps update, etc.).
• Updated modernc.org/sqlite to v1.55.0 (doc changes).

[Package Updates]

[1.17.12]

• Update pocketbase to 0.39.11
• Full Changelog
• Fixed "API preview" examples (#7782, #7785).
• Other minor UI improvements (fixed sortable dragend event handling, allow ESC to workaround TAB trap for the rule fields, allow new duplicated collection to edit the collection of relation fields, updated shablon, updated npm dev dependencies, etc.).
• Bumped golang.org/x/* deps and the min Go GitHub action version to 1.26.6 because it comes with some minor bug and security fixes.

[Package Updates]

[1.18.0]

• Update pocketbase to 0.40.0
• Full Changelog
• Propagate console command errors and recovered panics to app.Start() so that the program can exit with non-zero code while still ensuring that app.OnTerminate hook was triggered (responsible for the app graceful shutdown handling).
• Added quotes around the default Content-Disposition serving filename in case custom name with special characters is provided.
• Added Cross-Origin-Opener-Policy:same-origin to the default security response headers.
• Added Record.GetInt64(field) helper (note that the serializable max safe integer of the number field is ~2^53-1).
• Added Store.Keys() method that returns a slice with all of the store keys.
• Added new DELETE /api/logs endpoint and UI control to delete all logs without changing the maxDays retention setting.
• Added new log settings option to limit the max Log.Data size that will be saved in the database (default to ~16KB).
• Added new filesystem low-level helper methods:
• Optimized backups to no longer transaction lock the database during backup generation (#7799).
• Bumped the min Go version to 1.27.0 and migrated to the new encoding/json/v2 package.

[Package Updates]

[1.18.1]

• Update pocketbase to 0.40.1
• Full Changelog
• allow mangling invalid UTF8 characters when serializing json data (#7814)
• fixed OAuth2 providers config merge incorrectly replacing the entire slice (#7815)

[Package Updates]

[1.18.2]

• Update pocketbase to 0.40.2
• Full Changelog
• Return an error when filter params fallback fails to json serialize and optimized params replacement to execute in a single pass.
• Fixed collection index parsing error for indexes with missing name.
• Minor UI autocomplete optimizations (prefix match, autocomplete debounce, etc.).
• Fixed linter warnings and comment typos.
• Bumped goja and its related dependencies (regex unescaped dash error fix and base64 optimizations).
• Bumped the min Go GitHub action version to 1.27.1 as it includes some minor database/sql and enconding/json/v2 bug fixes.

[Package Updates]

[1.18.3]

• Update pocketbase to 0.40.3
• Full Changelog
• Write the status header for JSON responses only if the fields picker succeed or has acceptable fallback.
• Fixed collection index validator to allow expressions with parenthesis in the optional WHERE clause.
• Clamped arccosine to [-1,1] in the Harvesine formula for the geoDistance() filter function to workaround edge case related to float rounding errors for some coordinates.
• Prevent unnecessary body chunk read if we already known that we are beyond the allowed limit.
• Updated the json field validator to check the encoding/json/v2 semantics and allow duplicated keys on record marshalize for compliance with old jsonv1 data.
• Fixed nested cascade delete of self-referenced relation records.
• Minor UI fixes (updated dark primary btn color contrast, force reload the records list if the deleted record has self-referenced cascade relation field, etc.).
• Changed JSVM $app variable definition from TS type to interface (#7834).
• Bumped golang.org/x/* dependencies to silence security scanners (#7829).

[Package Updates]

[1.18.4]

• Update pocketbase to 0.40.4
• Full Changelog
• Fixed migration deadlock if a logs db write happens to run while the migration is still executing (#7836).
• app.ResetBootstrapState() was soft-deprecated in favour of app.ClearBootstrap().
• Additionally a new app.OnClearBootstrap() hook was added to allow clearing custom allocated OnBootstrap resources in case the app uses a non-standard initialization (e.g. doesn't call Start() or intentionally skip the OnTerminate hook).
• Bumped golang.org/x/* dependencies.

[Package Updates]

[1.18.5]

• Update pocketbase to 0.40.5
• Full Changelog
• Minor improvements for the JSVM migration error handling:
• Included the recovered panic stack trace of routine.SafeWrap in the returned error (max 2KB).
• Wrap the individual up/down JSVM migration arguments in routine.SafeWrap so that in case of panic we can still print the failed js migration filename.
• Updated modernc.org/sqlite to 1.60.1 (minor performance improvements for queries with large text fields and/or many params).
• Bumped the min Go GitHub action version to 1.27.2 as it includes several net/http security fixes.
• One of the fixes is for a DoS that could potentially affect PocketBase applications and it is advised to update.
• Other minor fixes (godoc typos, normalized negative jsvm pool size, extra CORS wildcard subdomain checks to prevent misuse, support Promise as autocomplete suggestions return, autoexpand textarea scrollbar-gutter fix, etc.).

[Package Updates]

[1.18.6]

• Update base | final to 6.0.1
• Security: Fix eMudhra Certificate compromise

[Package Updates]

[1.18.7]

• Update pocketbase to 0.40.6
• Full Changelog
• Replaced the GitHub update command with update from the new host in relation to #7841.
• Additional fileblob bucket escape checks for just in case if the filesystem abstraction is used as standalone without the PocketBase validations.
• Added a global restriction for the max WxH pixels size when generating a thumb to reduce the risk of excessive memory usage.
• The default limit is pretty generous and currently set to max 250<<20 (262144000) pixels and can be changed with the env PB_THUMBS_MAX_SOURCE_PIXELS.
• The workaround is not bulletproof and thumbs generation remains one of the main culprit for potential OOMs in PocketBase, so better solutions will have to be investigated in the future, including eventually switching to libvips or other similar library once there is better CGO portability (if you have better suggestions, please open a discussion).
• Bumped the min Go GitHub action version to 1.27.3 as it includes a security fix related to the recent eMudhra CA compromise.
• Bumped golang.org/x/ dependencies (#7865).
• Bumped goja and its related dependencies (string allocations optimization, Date.getYear/setYear support and other minor correctness fixes).
• Minor UI fixes - superuser IPs description grammar fix, rotating btn loader icon alignment fix, slight dark background correction in attempt to minimize the color profile differences between Chrome and Firefox, etc.