LoginSign Up
← Back to all sparks
P

PocketBase

INFRA · APIS
Velocity5.0

Open-source backend in a single file with realtime database

pocketbase.io ↗

PocketBase v0.40.6 caps thumbnail memory and says releases will leave GitHub.

backend-as-a-serviceself-hostedgolangsecurity-patchrelease-distribution
◆Current state
PocketBase v0.40.6 limits the source image size for thumbnail generation (about 262 megapixels by default, set via PB_THUMBS_MAX_SOURCE_PIXELS) to cut out-of-memory risk, adds extra file-bucket escape checks, and bumps Go for the eMudhra CA fix. It also switches the update command to a new host, and the maintainer says this is probably the last release published on GitHub. v0.22.57 backports the thumbnail cap and Go bump to the older line.
◆Where it's heading
PocketBase continues to ship paired releases on v0.40 and the v0.22 LTS line, mostly security and stability fixes. Moving releases off GitHub to the maintainer's own host is the larger change, and it affects how every self-hoster updates.
◆Prediction
The next release should arrive through the new host rather than GitHub; expect continued backports to v0.22 and further work on thumbnail memory use.

◆Recent moves

  1. 6d ago

    v0.40.6: thumbnail memory cap; releases move off GitHub

    A cap on thumbnail source size addresses one of PocketBase's known out-of-memory paths, and Go is bumped for the eMudhra CA issue. The bigger signal is distribution: the update command now points to a new host, and future releases are expected to stop appearing on GitHub.

    View source ↗
  2. 6d ago

    v0.22.57: thumbnail cap and Go security bump backported

    The usual LTS backport: the thumbnail pixel cap, dependency bumps and the Go 1.27.3 floor for the eMudhra CA fix. Users on v0.22 stay patched without migrating.

    View source ↗
  3. 20d ago

    v0.40.5 Release

    Bumps the Go toolchain floor to 1.27.2 for a net/http DoS fix that the team says can affect PocketBase apps, and makes JSVM migration panics report the failing filename and stack trace. A SQLite driver update and stricter CORS wildcard checks round it out. It is the quietest v0.40.x release yet, a sign the json/v2 migration has settled.

    View source ↗
  4. 20d ago

    v0.22.56 Release

    Same-day LTS backport of the Go 1.27.2 toolchain bump, so v0.22.x users get the net/http DoS fix without migrating to v0.40.

    View source ↗
  5. 1mo ago

    v0.40.4 Release

    Fixes a migration deadlock triggered when a logs DB write races with an in-progress schema migration — an edge case, but a hard failure when hit. The soft-deprecation of ResetBootstrapState in favor of ClearBootstrap, plus the new OnBootstrapClear hook, is a minor API lifecycle tightening that matters only to custom init setups.

    View source ↗
  6. 1mo ago

    v0.40.3 Release

    Seven distinct bug fixes in one release, several non-trivial: the nested cascade delete fix affects any schema with self-referential relation fields, the geoDistance arccosine clamp corrects a floating-point edge case silently returning wrong distances, and the json/v2 field validator update ensures old jsonv1 data with duplicate keys serializes correctly. The breadth here reflects active dogfooding — including by LLM bots, per the release notes.

    View source ↗