To update the prebuilt executable you can run ./pocketbase update.

• Enabled calling the /auth-refresh endpoint with nonrenewable tokens.
  When used with nonrenewable tokens (e.g. impersonate) the endpoint will simply return the same token with the up-to-date user data associated with it.

• Added the triggered rate rimit rule in the error log details.

• Added optional ServeEvent.Listener field to initialize a custom network listener (e.g. unix) instead of the default tcp (#3233).

• Added toBytes JSVM helper (#6935).

• Fixed request data unmarshalization for the DynamicModel array/object fields (#7022).

• Fixed Dashboard page title - escaping (#6982).

• Other minor improvements (updated first superuser console text when running with go run, clarified trusted IP proxy header label, wrapped the backup restore in a transaction as an extra precaution, updated deps, etc.).

To update the prebuilt executable you can run ./pocketbase update.

• Added global JSVM toBytes() helper to return the bytes slice representation of a value such as io.Reader or string (other types are first serialized to Go string).

• Fixed security.RandomStringByRegex random distribution (#6947; thanks @yerTools).

• Minor docs and typos fixes.

To update the prebuilt executable you can run ./pocketbase update.

• Skip sending empty Range header when fetching blobs from S3 (#6914).

• Updated Go deps and particularly modernc.org/sqlite to 1.38.0 (SQLite 3.50.1).

• Bumped GitHub action min Go version to 1.23.10 as it comes with some minor security net/http fixes.

To update the prebuilt executable you can run ./pocketbase update.

• Loaded latin-ext charset for the default text fonts (#6869).

• Updated view query CAST regex to properly recognize multiline expressions (#6860; thanks @azat-ismagilov).

• Updated Go and npm dependencies.

To update the prebuilt executable you can run ./pocketbase update.

• Fixed json_each/json_array_length normalizations to properly check for array values (#6835).

To update the prebuilt executable you can run ./pocketbase update.

• Write the default response body of *Request hooks that are wrapped in a transaction after the related transaction completes to allow propagating the transaction error (#6462).

• Updated app.DB() to automatically routes raw write SQL statements to the nonconcurrent db pool (#6689).
  For the rare cases when it is needed users still have the option to explicitly target the specific pool they want using app.ConcurrentDB()/app.NonconcurrentDB().

• ⚠️ Changed the default json field max size to 1MB.
  Users still have the option to adjust the default limit from the collection field options but keep in mind that storing large strings/blobs in the database is known to cause performance issues and should be avoided when possible.

• ⚠️ Soft-deprecated and replaced filesystem.System.GetFile(fileKey) with filesystem.System.GetReader(fileKey) to avoid the confusion with filesystem.File.
  The old method will still continue to work for at least until v0.29.0 but you'll get a console warning to replace it with GetReader.

• Added new filesystem.System.GetReuploadableFile(fileKey, preserveName) method to return an existing blob as a *filesystem.File value (#6792).
  This method could be useful in case you want to clone an existing Record file and assign it to a new Record (e.g. in a Record duplicate action).

• Other minor improvements (updated the GitHub release min Go version to 1.23.9, updated npm and Go deps, etc.)

To update the prebuilt executable you can run ./pocketbase update.

• Added workers pool when cascade deleting record files to minimize "thread exhaustion" errors (#6780).

• Updated the :excerpt fields modifier to properly account for multibyte characters (#6778).

• Use rowid as count column for non-view collections to minimize the need of having the id field in a covering index (#6739).

To update the prebuilt executable you can run ./pocketbase update.

• Updated example geoPoint API preview body data.

• Added JSVM new GeoPointField({ ... }) constructor.

• Added partial WebP thumbs support (the thumbs will be stored as PNG; #6744).

• Updated npm dev dependencies.

To update the prebuilt executable you can run ./pocketbase update.

• ⚠️ Moved the Create and Manage API rule checks out of the OnRecordCreateRequest hook finalizer, aka. now all CRUD API rules are checked BEFORE triggering their corresponding *Request hook.
  This was done to minimize the confusion regarding the firing order of the request operations, making it more predictable and consistent with the other record List/View/Update/Delete request actions.
  It could be a minor breaking change if you are relying on the old behavior and have a Go tests.ApiScenario that is testing a Create API rule failure and expect OnRecordCreateRequest to be fired. In that case for example you may have to update your test scenario like:

  tests.ApiScenario{
      Name:   "Example test that checks a Create API rule failure"
      Method: http.MethodPost,
      URL:    "/api/collections/example/records",
      ...
      // old:
      ExpectedEvents:  map[string]int{
          "*":                     0,
          "OnRecordCreateRequest": 1,
      },
      // new:
      ExpectedEvents:  map[string]int{"*": 0},
  }

  If you are having difficulties adjusting your code, feel free to open a Q&A discussion with the failing/problematic code sample.

• Added new geoPoint field for storing {"lon":x,"lat":y} geographic coordinates.
  In addition, a new geoDistance(lonA, lotA, lonB, lotB) function was also implemented that could be used to apply an API rule or filter constraint based on the distance (in km) between 2 geo points.

• Updated the select field UI to accommodate better larger lists and RTL languages (#4674).

• Updated the mail attachments auto MIME type detection to use gabriel-vasile/mimetype for consistency and broader sniffing signatures support.

• Forced text/javascript Content-Type when serving .js/.mjs collection uploaded files with the /api/files/... endpoint (#6597).

• Added second optional JSVM DateTime constructor argument for specifying a default timezone as TZ identifier when parsing the date string as alternative to a fixed offset in order to better handle daylight saving time nuances (#6688):

  // the same as with CET offset: new DateTime("2025-10-26 03:00:00 +01:00")
  new DateTime("2025-10-26 03:00:00", "Europe/Amsterdam") // 2025-10-26 02:00:00.000Z
  // the same as with CEST offset: new DateTime("2025-10-26 01:00:00 +02:00")
  new DateTime("2025-10-26 01:00:00", "Europe/Amsterdam") // 2025-10-25 23:00:00.000Z

• Soft-deprecated the $http.send's result.raw field in favor of result.body that contains the response body as plain bytes slice to avoid the discrepancies between Go and the JSVM when casting binary data to string.

• Updated modernc.org/sqlite to 1.37.0.

• Other minor improvements (removed the superuser fields from the auth record create/update body examples, allowed programmatically updating the auth record password from the create/update hooks, fixed collections import error response, etc.).

To update the prebuilt executable you can run ./pocketbase update.

• Allow OIDC email_verified to be int or boolean string since some OIDC providers like AWS Cognito has non-standard userinfo response (#6657).

• Updated modernc.org/sqlite to 1.36.3.