pocketbase

v0.39.8 Maintenance

This release keeps dependencies and maintenance posture current for teams operating this tool.

Published 7d API Development

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

authentication backend go realtime

Affected surfaces

deps

Summary

AI summary

Minor fixes and improvements.

Type	Severity	Summary	CVE
Security	High	Bump indirect `golang.org/x/` dependencies for minor security fixes Bump indirect `golang.org/x/` dependencies for minor security fixes Source: llm_adapter@2026-07-19 Confidence: high	—
Feature	Low	Prevent resetting number inputs with leading 0 while typing Prevent resetting number inputs with leading 0 while typing Source: llm_adapter@2026-07-19 Confidence: high	—
Feature	Low	Add Shift+Click range bulk selection for UI elements Add Shift+Click range bulk selection for UI elements Source: llm_adapter@2026-07-19 Confidence: high	—
Dependency	Low	Update `modernc.org/sqlite` to v1.54.0 (SQLite 3.53.3) Update `modernc.org/sqlite` to v1.54.0 (SQLite 3.53.3) Source: llm_adapter@2026-07-19 Confidence: high	—
Bugfix	Medium	Reset JSVM global $app to clean state for pooled executors Reset JSVM global $app to clean state for pooled executors Source: llm_adapter@2026-07-19 Confidence: high	—

Full changelog

To update the prebuilt executable you can run ./pocketbase update.

Properly reset JSVM global $app overwrite so that pooled executors always get a clean state.
Minor UI improvements:
- prevent resetting number inputs with leading 0 while still typing (normalized in onchange)
- added support for Shift + Click range bulk selection (#7759)
Bumped golang.org/x/* indirect dependencies as there are some minor security fixes.
Updated modernc.org/sqlite to v1.54.0 (SQLite 3.53.3).

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track pocketbase

Get notified when new releases ship.

About pocketbase

Open Source realtime backend in 1 file

v0.39.4 Removes required validator for redirectURL in authWithOAuth2Code endpoint