PocketBase - Package Updates

[Package Updates]

[1.17.10]

• Update pocketbase to 0.39.9
• Full Changelog
• Fixed Shift + Click range bulk selection not working in Firefox (#7771)
• Updated goja and its related dependencies (fixes for TypedArray and regexp2 dep regression for the reported empty string match with lookahead patterns).
• Minor filter (fexpr) improvements (optimization for large string literals and fix for control characters handling).

[Package Updates]

[1.17.11]

• Update pocketbase to 0.39.10
• Full Changelog
• Reverted the auto panic recover handling for the cli commands to preserve the old behavior and allow panic to force exit with non-zero code (#7781).
• Minor UI improvements (added placeholder loader for the logs chart, npm dev deps update, etc.).
• Updated modernc.org/sqlite to v1.55.0 (doc changes).

[Package Updates]

[1.17.12]

• Update pocketbase to 0.39.11
• Full Changelog
• Fixed "API preview" examples (#7782, #7785).
• Other minor UI improvements (fixed sortable dragend event handling, allow ESC to workaround TAB trap for the rule fields, allow new duplicated collection to edit the collection of relation fields, updated shablon, updated npm dev dependencies, etc.).
• Bumped golang.org/x/* deps and the min Go GitHub action version to 1.26.6 because it comes with some minor bug and security fixes.

[Package Updates]

[1.18.0]

• Update pocketbase to 0.40.0
• Full Changelog
• Propagate console command errors and recovered panics to app.Start() so that the program can exit with non-zero code while still ensuring that app.OnTerminate hook was triggered (responsible for the app graceful shutdown handling).
• Added quotes around the default Content-Disposition serving filename in case custom name with special characters is provided.
• Added Cross-Origin-Opener-Policy:same-origin to the default security response headers.
• Added Record.GetInt64(field) helper (note that the serializable max safe integer of the number field is ~2^53-1).
• Added Store.Keys() method that returns a slice with all of the store keys.
• Added new DELETE /api/logs endpoint and UI control to delete all logs without changing the maxDays retention setting.
• Added new log settings option to limit the max Log.Data size that will be saved in the database (default to ~16KB).
• Added new filesystem low-level helper methods:
• Optimized backups to no longer transaction lock the database during backup generation (#7799).
• Bumped the min Go version to 1.27.0 and migrated to the new encoding/json/v2 package.

[Package Updates]

[1.18.1]

• Update pocketbase to 0.40.1
• Full Changelog
• allow mangling invalid UTF8 characters when serializing json data (#7814)
• fixed OAuth2 providers config merge incorrectly replacing the entire slice (#7815)

[Package Updates]

[1.18.2]

• Update pocketbase to 0.40.2
• Full Changelog
• Return an error when filter params fallback fails to json serialize and optimized params replacement to execute in a single pass.
• Fixed collection index parsing error for indexes with missing name.
• Minor UI autocomplete optimizations (prefix match, autocomplete debounce, etc.).
• Fixed linter warnings and comment typos.
• Bumped goja and its related dependencies (regex unescaped dash error fix and base64 optimizations).
• Bumped the min Go GitHub action version to 1.27.1 as it includes some minor database/sql and enconding/json/v2 bug fixes.

[Package Updates]

[1.18.3]

• Update pocketbase to 0.40.3
• Full Changelog
• Write the status header for JSON responses only if the fields picker succeed or has acceptable fallback.
• Fixed collection index validator to allow expressions with parenthesis in the optional WHERE clause.
• Clamped arccosine to [-1,1] in the Harvesine formula for the geoDistance() filter function to workaround edge case related to float rounding errors for some coordinates.
• Prevent unnecessary body chunk read if we already known that we are beyond the allowed limit.
• Updated the json field validator to check the encoding/json/v2 semantics and allow duplicated keys on record marshalize for compliance with old jsonv1 data.
• Fixed nested cascade delete of self-referenced relation records.
• Minor UI fixes (updated dark primary btn color contrast, force reload the records list if the deleted record has self-referenced cascade relation field, etc.).
• Changed JSVM $app variable definition from TS type to interface (#7834).
• Bumped golang.org/x/* dependencies to silence security scanners (#7829).

[Package Updates]

[1.18.4]

• Update pocketbase to 0.40.4
• Full Changelog
• Fixed migration deadlock if a logs db write happens to run while the migration is still executing (#7836).
• app.ResetBootstrapState() was soft-deprecated in favour of app.ClearBootstrap().
• Additionally a new app.OnClearBootstrap() hook was added to allow clearing custom allocated OnBootstrap resources in case the app uses a non-standard initialization (e.g. doesn't call Start() or intentionally skip the OnTerminate hook).
• Bumped golang.org/x/* dependencies.

[Package Updates]

[1.18.5]

• Update pocketbase to 0.40.5
• Full Changelog
• Minor improvements for the JSVM migration error handling:
• Included the recovered panic stack trace of routine.SafeWrap in the returned error (max 2KB).
• Wrap the individual up/down JSVM migration arguments in routine.SafeWrap so that in case of panic we can still print the failed js migration filename.
• Updated modernc.org/sqlite to 1.60.1 (minor performance improvements for queries with large text fields and/or many params).
• Bumped the min Go GitHub action version to 1.27.2 as it includes several net/http security fixes.
• One of the fixes is for a DoS that could potentially affect PocketBase applications and it is advised to update.
• Other minor fixes (godoc typos, normalized negative jsvm pool size, extra CORS wildcard subdomain checks to prevent misuse, support Promise as autocomplete suggestions return, autoexpand textarea scrollbar-gutter fix, etc.).

[Package Updates]

[1.18.6]

• Update base | final to 6.0.1
• Security: Fix eMudhra Certificate compromise

[Package Updates]

[1.18.7]

• Update pocketbase to 0.40.6
• Full Changelog
• Replaced the GitHub update command with update from the new host in relation to #7841.
• Additional fileblob bucket escape checks for just in case if the filesystem abstraction is used as standalone without the PocketBase validations.
• Added a global restriction for the max WxH pixels size when generating a thumb to reduce the risk of excessive memory usage.
• The default limit is pretty generous and currently set to max 250<<20 (262144000) pixels and can be changed with the env PB_THUMBS_MAX_SOURCE_PIXELS.
• The workaround is not bulletproof and thumbs generation remains one of the main culprit for potential OOMs in PocketBase, so better solutions will have to be investigated in the future, including eventually switching to libvips or other similar library once there is better CGO portability (if you have better suggestions, please open a discussion).
• Bumped the min Go GitHub action version to 1.27.3 as it includes a security fix related to the recent eMudhra CA compromise.
• Bumped golang.org/x/ dependencies (#7865).
• Bumped goja and its related dependencies (string allocations optimization, Date.getYear/setYear support and other minor correctness fixes).
• Minor UI fixes - superuser IPs description grammar fix, rotating btn loader icon alignment fix, slight dark background correction in attempt to minimize the color profile differences between Chrome and Firefox, etc.