Skip to content

pocketbase

v0.39.7 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 10d API Development
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

authentication backend go realtime

Affected surfaces

breaking_upgrade

ReleasePort's take

Moderate signal
editorial:auto 10d

ReleasePort Layer 1 v0.39.7 fixes an unhandled panic in internal worker goroutines and replaces the ozzo‑validation dependency with a trusted fork.

Why it matters: The fix (severity 90) prevents crashes from uncaught panics in critical worker routines; replacing the validation library mitigates trust concerns for all codepaths using that dependency.

Summary

AI summary

Security fix for unhandled panic in internal worker goroutines and replacement of the ozzo‑validation dependency with a trusted fork.

Changes in this release

Security Critical

Fixes unhandled panic in internal worker goroutines by wrapping functions with routine.SafeWrap.

Fixes unhandled panic in internal worker goroutines by wrapping functions with routine.SafeWrap.

Source: llm_adapter@2026-07-16

Confidence: high

 —
Dependency Medium

Replaces github.com/go-ozzo/ozzo-validation with fork github.com/pocketbase/ozzo-validation due to trust concerns.

Replaces github.com/go-ozzo/ozzo-validation with fork github.com/pocketbase/ozzo-validation due to trust concerns.

Source: llm_adapter@2026-07-16

Confidence: high

 —
Bugfix Medium

Fixes missing import collection `fields` property access issue.

Fixes missing import collection `fields` property access issue.

Source: llm_adapter@2026-07-16

Confidence: high

 —
Bugfix Medium

Fixes View collection `*` validator and adds friendlier error messages.

Fixes View collection `*` validator and adds friendlier error messages.

Source: llm_adapter@2026-07-16

Confidence: high

 —
Full changelog

To update the prebuilt executable you can run ./pocketbase update.

[!IMPORTANT]
This release includes a security fix related to #7762.

  • Replaced github.com/go-ozzo/ozzo-validation with the fork github.com/pocketbase/ozzo-validation since the original library has recently changed ownership and the new maintainer cannot be trusted.
    There are plans to create eventually a new validation library from scratch more suited for our needs in PocketBase because ozzo-validation is known to have some minor performance and obscure regex issues, but until then we'll stick with the fork (and if you use ozzo-validation in your own Go code, I'd suggest to swap the imports with the fork).

  • Fixed missing import collection fields property access (#7760).

  • Fixed View collection * validator and added more friendly error messages (#7761).

  • ⚠️ Security fix for unhandled panic in internal worker goroutines (#7762).
    To prevent this from showing again, all existing internal worker functions were wrapped with routine.SafeWrap(f) (auto recovers and returns any eventual panic as regular error).

Breaking Changes

  • Replaced github.com/go-ozzo/ozzo-validation with github.com/pocketbase/ozzo-validation

Security Fixes

  • Unhandled panic in internal worker goroutines – wrapped all functions with routine.SafeWrap to recover and return errors as regular Go errors.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track pocketbase

Get notified when new releases ship.

Sign up free

About pocketbase

Open Source realtime backend in 1 file

All releases →

Related context

Earlier breaking changes

  • v0.39.4 Removes required validator for redirectURL in authWithOAuth2Code endpoint

Beta — feedback welcome: [email protected]