pocketbase

v0.22.48 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 10d API Development

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

authentication backend go realtime

Affected surfaces

deps breaking_upgrade

ReleasePort's take

Moderate signal

editorial:auto 10d

The release replaces the validation library dependency with a trusted fork and patches an unhandled panic in internal worker goroutines.

Why it matters: A security fix addressing an unhandled panic (severity 90) prevents potential crashes in production environments; the validation library replacement mitigates risk from an untrusted maintainer.

Summary

AI summary

Security fix for unhandled panic in internal worker goroutines.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Security fix for unhandled panic in internal worker goroutines. Security fix for unhandled panic in internal worker goroutines. Source: llm_adapter@2026-07-16 Confidence: high	—
Dependency	High	Replaced github.com/go-ozzo/ozzo-validation with fork github.com/pocketbase/ozzo-validation due to untrusted new maintainer. Replaced github.com/go-ozzo/ozzo-validation with fork github.com/pocketbase/ozzo-validation due to untrusted new maintainer. Source: llm_adapter@2026-07-16 Confidence: high	—
Bugfix	Medium	Fixed View collection `` validator and added friendlier error messages. Fixed View collection `` validator and added friendlier error messages. Source: llm_adapter@2026-07-16 Confidence: high	—

Full changelog

(Backported from v0.39.7) Replaced github.com/go-ozzo/ozzo-validation with the fork github.com/pocketbase/ozzo-validation since the original library has recently changed ownership and the new maintainer cannot be trusted.
(Backported from v0.39.7) Fixed View collection * validator and added more friendly error messages (#7761).
(Backported from v0.39.7) ⚠️ Security fix for unhandled panic in internal worker goroutines (#7762).

Security Fixes

Unhandled panic in internal worker goroutines — security fix

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track pocketbase

Get notified when new releases ship.

About pocketbase

Open Source realtime backend in 1 file

All releases →

Related context

Related tools

Earlier breaking changes

v0.39.4 Removes required validator for redirectURL in authWithOAuth2Code endpoint