Impact Score: 5/10
PocketBase: v0.39.7 Release
Source available — automated, not human-reviewed
Component: pocketbase · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
PocketBase v0.39.7. Source highlight: _To update the prebuilt executable you can run `./pocketbase update`._
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
🔧 Bug Fixes & Patches (3)
- Fixed missing import collection `fields` property access (#7760).
- Fixed View collection `*` validator and added more friendly error messages (#7761).
- ⚠️ Security fix for unhandled panic in internal worker goroutines (#7762).
📄 View Raw Release Notes (Original Developer Log)
> _To update the prebuilt executable you can run `./pocketbase update`._
> [!IMPORTANT]
> This release includes a security fix related to [#7762](https://github.com/pocketbase/pocketbase/discussions/7762).
- Replaced `github.com/go-ozzo/ozzo-validation` with the fork `github.com/pocketbase/ozzo-validation` since the original library has recently changed ownership and the new maintainer cannot be trusted.
_There are plans to create eventually a new validation library from scratch more suited for our needs in PocketBase because ozzo-validation is known to have some minor performance and obscure regex issues, but until then we'll stick with the fork (and if you use `ozzo-validation` in your own Go code, I'd suggest to swap the imports with the fork)_.
- Fixed missing import collection `fields` property access ([#7760](https://github.com/pocketbase/pocketbase/issues/7760)).
- Fixed View collection `*` validator and added more friendly error messages ([#7761](https://github.com/pocketbase/pocketbase/issues/7761)).
- ⚠️ Security fix for unhandled panic in internal worker goroutines ([#7762](https://github.com/pocketbase/pocketbase/discussions/7762)).
_To prevent this from showing again, all existing internal worker functions were wrapped with [`routine.SafeWrap(f)`](https://pkg.go.dev/github.com/pocketbase/pocketbase/tools/routine#SafeWrap) (auto recovers and returns any eventual panic as regular error)._