Skip to content

pocketbase

v0.38.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 27d API Development
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

authentication backend go realtime

Summary

AI summary

Fixed default CSP allowing audio/video previews, added Superuser IPs/CIDR whitelist setting.

Full changelog

To update the prebuilt executable you can run ./pocketbase update.

  • Fixed UI logs pagination when no custom range is specified.

  • Fixed default CSP not allowing audio/video previews (#7677).

  • Serve fixed Content-Type for .xlsx, .docx and .pptx files to allow previews on iOS (#7467).

  • Changed settings app URL input to type="text" for compatibility with earlier versions (#7681).

  • Added an internal watcher to sync various runtime states between multiple PocketBase processes (e.g. memory store) using the same pb_data.
    This is helpful in case for example a separate PocketBase console command change the collections or application settings while the server is still running.
    The watcher is debounced and implemented by watching the special pb_data/.notify dir as a workaround to avoid depending on OS and SQLite driver specific APIs.

  • Added new Superuser IPs/CIDR subnets whitelist setting.
    The optional setting can be changed from the UI under Dasboard > Settings > Application > Superuser IPs.
    To avoid lockout in case your superuser IP change, the ips whitelist can be updated also via the superuser ips console command:

    # note: --dir is optional and defaults to pb_data next to the executable
    
    # clear whitelisted IPs
    ./pocketbase superuser ips --dir=/custom/path/to/pb_data
    
    # OR change the whitelisted IPs to 127.0.0.1 and 10.0.0.0 (replace with your real IP(s))
    ./pocketbase superuser ips 127.0.0.1 10.0.0.0 --dir=/custom/path/to/pb_data
    
  • Added rate limit option to exclude IPs/CIDR subnets (#6410).

  • Bumped min Go GitHub action version to 1.26.3 because it comes with some minor bug and security fixes.

Security Fixes

  • Bumped minimum Go GitHub Action version to 1.26.3, which includes minor bug and security fixes.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track pocketbase

Get notified when new releases ship.

Sign up free

About pocketbase

Open Source realtime backend in 1 file

All releases →

Beta — feedback welcome: [email protected]