# PocketBase v0.36.9 — Release & Upgrade Intelligence
- **Product:** PocketBase (https://pocketbase.io)
- **Version:** v0.36.9
- **Released:** Apr 09, 2026
- **Impact Score:** 5/10
- **Breaking Changes:** Not verified
- **Canonical Analysis:** https://changelogs.us/pocketbase/updates/v0.36.9/

## Executive Summary (TL;DR)
PocketBase v0.36.9. Source highlight: _To update the prebuilt executable you can run `./pocketbase update`._

## New Features
- Added extra OAuth2 checks when downloading the avatar URL to prevent internal network probing requests in case of a malicious/vulnerable vendor.

## Bug Fixes
- Fixed settings SMTP password clear persistence.
- Updated `modernc.org/sqlite` to v1.48.2 _(vfs and other error path related fixes)_.
- Updated min Go GitHub action version to 1.26.2 because it comes with some minor security fixes.
- Other small improvements _(updated `$apis.static` JSVM documentation, fixed comment typos, added missing file close on seek error, etc.)_.