PocketBase: alte Versionen herunterladen

> _To update the prebuilt executable you can run `./pocketbase update`._

• Replaced the GitHub update command with update from the new host in relation to [#7841](https://github.com/pocketbase/pocketbase/discussions/7841).
⚠️ Note that this will be most likely the last release here on GitHub. The next time when you run update, new releases will be fetched from `https://ganigeorgiev.com` _(there is nothing there yet)_.

• Additional fileblob bucket escape checks for just in case if the filesystem abstraction is used as standalone without the PocketBase validations.

• Added a global restriction for the max `WxH` pixels size when generating a thumb to reduce the risk of excessive memory usage.
The issue was initially privately reported by @reload3d but it is treated as regular public issue since it is a [known Go caveat](https://github.com/golang/go/issues/27830).
The default limit is pretty generous and currently set to max `250<<20 (262144000)` pixels and can be changed with the env `PB_THUMBS_MAX_SOURCE_PIXELS`.
**The workaround is not bulletproof and thumbs generation remains one of the main culprit for potential OOMs in PocketBase**, so better solutions will have to be investigated in the future, including eventually switching to [libvips](https://github.com/libvips/libvips) or other similar library once there is [better CGO portability](https://github.com/golang/go/issues/81450) _(if you have better suggestions, please open a discussion)_.

• Bumped the min Go GitHub action version to 1.27.3 as it includes a [security fix](https://groups.google.com/g/golang-announce/c/66pojueaQek) related to the recent eMudhra CA compromise.
_I didn't rush a fix 2 days ago as the impact for most PocketBase servers is not that serious and requires to already have a MiTM, but nonetheless it is recommended to update. Please make sure to also check for OS/Docker image updates to ensure that you have the latest `ca-certificates` bundle._

• Bumped `golang.org/x/` dependencies ([#7865](https://github.com/pocketbase/pocketbase/discussions/7865)).

• Bumped goja and its related dependencies _(string allocations optimization, `Date.getYear/setYear` support and other minor correctness fixes)_.

• Minor UI fixes - superuser IPs description grammar fix, rotating btn loader icon alignment fix, slight dark background correction in attempt to minimize the color profile differences between Chrome and Firefox, etc.

> _To update the prebuilt executable you can run `./pocketbase update`._

• Minor improvements for the JSVM migration error handling:
• Included the recovered panic stack trace of `routine.SafeWrap` in the returned error (max 2KB).
• Wrapped the individual `up`/`down` JSVM migration arguments in `routine.SafeWrap` so that in case of panic we can still print the failed js migration filename.

• Updated `modernc.org/sqlite` to 1.60.1 _(minor performance improvements for queries with large text fields and/or many params)_.

• Bumped the min Go GitHub action version to 1.27.2 as it includes several [`net/http` security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.27.2).
_One of the fixes is for a DoS that could potentially affect PocketBase applications and it is advised to update._

• Other minor fixes _(godoc typos, normalized negative jsvm pool size, extra CORS wildcard subdomain checks to prevent misuse, support `Promise` as autocomplete suggestions return, autoexpand textarea scrollbar-gutter fix, etc.)_.

> _To update the prebuilt executable you can run `./pocketbase update`._

• Fixed migration deadlock if a logs db write happens to run while the migration is still executing ([#7836](https://github.com/pocketbase/pocketbase/issues/7836)).

• `app.ResetBootstrapState()` was soft-deprecated in favour of `app.ClearBootstrap()`.
_Additionally a new `app.OnBootstrapClear()` hook was added to allow clearing custom allocated `OnBootstrap` resources in case the app uses a non-standard initialization (e.g. doesn't call `Start()` or intentionally skip the `OnTerminate` hook)._

• Bumped `golang.org/x/*` dependencies.

> _To update the prebuilt executable you can run `./pocketbase update`._

• Write the status header for JSON responses only if the fields picker succeed or has acceptable fallback.
_This is to allow custom response status code for failed json writes._

• Fixes for various minor bugs spammed by 2 LLM users (bots?):
• Fixed collection index validator to allow expressions with parenthesis in the optional `WHERE` clause.

• Clamped arccosine to [-1,1] in the Harvesine formula for the `geoDistance()` filter function to workaround edge case related to float rounding errors for some coordinates.

• Prevent unnecessary body chunk read if we already known that we are beyond the allowed limit.

• Updated the `json` field validator to check the `encoding/json/v2` semantics and allow duplicated keys on record marshalize for compliance with old jsonv1 data.

• Fixed nested cascade delete of self-referenced relation records.

• Minor UI fixes (updated dark primary btn color contrast, force reload the records list if the deleted record has self-referenced cascade relation field, etc.).

• Changed JSVM `$app` variable definition from TS type to interface ([#7834](https://github.com/pocketbase/pocketbase/issues/7834)).

• Bumped `golang.org/x/*` dependencies to silence security scanners ([#7829](https://github.com/pocketbase/pocketbase/discussions/7829)).

> _To update the prebuilt executable you can run `./pocketbase update`._

• Return an error when filter params fallback fails to json serialize and optimized params replacement to execute in a single pass.

• Fixed collection index parsing error for indexes with missing name.

• Minor UI autocomplete optimizations _(prefix match, autocomplete debounce, etc.)_.

• Fixed linter warnings and comment typos.

• Bumped goja and its related dependencies _(regex unescaped dash error fix and base64 optimizations)_.

• Bumped the min Go GitHub action version to 1.27.1 as it includes some [minor `database/sql` and `enconding/json/v2` bug fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.27.1).

> _To update the prebuilt executable you can run `./pocketbase update`._

• Fixes for some reported regressions related to the `encoding/json/v2` update:
• allow mangling invalid UTF8 characters when serializing json data ([#7814](https://github.com/pocketbase/pocketbase/issues/7814))
• fixed OAuth2 providers config merge incorrectly replacing the entire slice ([#7815](https://github.com/pocketbase/pocketbase/issues/7815))