# PocketBase v0.37.4 — Release & Upgrade Intelligence
- **Product:** PocketBase (https://pocketbase.io)
- **Version:** v0.37.4
- **Released:** Apr 27, 2026
- **Impact Score:** 5/10
- **Breaking Changes:** Not verified
- **Canonical Analysis:** https://changelogs.us/pocketbase/updates/v0.37.4/

## Executive Summary (TL;DR)
PocketBase v0.37.4. Source highlight: _To update the prebuilt executable you can run `./pocketbase update`._

## New Features
- Added backups list scroll container (#7655).
- Added `ghupdate.BaseURL` config option (#7665).
- Added dummy bcrypt password check for the failure auth path to minimize enumeration timing attacks when registrations are disabled.

## Bug Fixes
- Fixed SMTP IPv6 network address format (#7659).
- Fixed autocomplete selection not properly updating the underlying input value (#7664).
- ⚠️ Fixed a pre-hijacking OAuth2 linking vulnerability (#7662; thanks @Alardiians for reporting it privately).