pocketbase

v0.22.45 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 2mo API Development

✓ No known CVEs patched

This release patches 1 known CVE

Topics

authentication backend go realtime

Affected surfaces

deps

ReleasePort's take

Moderate signal

editorial:auto 2mo

The release updates all golang.org/x/ packages to incorporate recent security fixes.

Why it matters: Patch immediately if you depend on any golang.org/x/ libraries, as they contain recent security fixes.

AI summary

Updated all golang.org/x/ packages to incorporate recent security fixes.

Type	Severity	Summary	CVE
Security	Medium	Updated golang.org/x/ packages with recent security fixes. Updated golang.org/x/ packages with recent security fixes. Source: llm_adapter@2026-05-22 Confidence: high	—

Full changelog

(Backported from v0.38.2) Updated all golang.org/x/ packages to cover the recent security fixes (none of them should be a critical issue in PocketBase but nonetheless it is advised to update).

Updated all golang.org/x/ packages to include recent security fixes (see https://groups.google.com/g/golang-announce/c/PdiGK3xulk4).

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track pocketbase

Get notified when new releases ship.

About pocketbase

Open Source realtime backend in 1 file

v0.39.4 Removes required validator for redirectURL in authWithOAuth2Code endpoint