v0.7.0

Download the archive for your platform, unzip it, and run:

./cratebase superuser create you@example.com yourpassword
./cratebase serve

The admin dashboard is at http://127.0.0.1:8090/_/ and the API
at http://127.0.0.1:8090/api/. The database is created on first
run; there is nothing else to install.

Each archive has a matching .sha256 to verify the download.

What's Changed

• fix(create-cratebase): prefix search in dashboard search box by @nicoaudy in #46
• chore(deps): bun audit fix (brace-expansion, undici, hono, fast-uri, ip-address) by @nicoaudy in #47
• feat!: one backend for every project; drop PocketBase compatibility; revamp dashboard and scaffold by @developerverygoodlabs-cpu in #48
• chore(release): react 0.5.0 and docs for 0.7.0 by @developerverygoodlabs-cpu in #49

Full Changelog: v0.6.0...v0.7.0

v0.6.0

Download the archive for your platform, unzip it, and run:

./cratebase superuser create you@example.com yourpassword
./cratebase serve

The admin dashboard is at http://127.0.0.1:8090/_/ and the API
at http://127.0.0.1:8090/api/. The database is created on first
run; there is nothing else to install.

Each archive has a matching .sha256 to verify the download.

What's Changed

• World-class landing page revamp + /features by @developerverygoodlabs-cpu in #39
• Launch film in the landing hero (+ video source, HeroMedia fix) by @developerverygoodlabs-cpu in #40
• fix(deps): bump wasmtime to 48.0.3 (RUSTSEC-2026-0315/0316) by @developerverygoodlabs-cpu in #41
• create-cratebase: one-command starter kits (Next.js, Vite React, Expo) by @developerverygoodlabs-cpu in #42
• Background jobs from JS, reliable webhook deliveries, multi-node-safe cron by @developerverygoodlabs-cpu in #43
• Release 0.6.0 by @developerverygoodlabs-cpu in #44
• fix(cron): claim each tick durably (multi-node double-run) by @developerverygoodlabs-cpu in #45

Full Changelog: v0.5.0...v0.6.0

v0.5.0

Download the archive for your platform, unzip it, and run:

./cratebase superuser create you@example.com yourpassword
./cratebase serve

The admin dashboard is at http://127.0.0.1:8090/_/ and the API
at http://127.0.0.1:8090/api/. The database is created on first
run; there is nothing else to install.

Each archive has a matching .sha256 to verify the download.

What's Changed

• Full-text search (FTS5/tsvector) + presigned uploads, image transforms, storage quota by @developerverygoodlabs-cpu in #36
• In-app notifications + realtime channels/presence (cross-node) by @developerverygoodlabs-cpu in #37
• Release 0.5.0 by @developerverygoodlabs-cpu in #38

Full Changelog: v0.4.0...v0.5.0

v0.4.0

Download the archive for your platform, unzip it, and run:

./cratebase superuser create you@example.com yourpassword
./cratebase serve

The admin dashboard is at http://127.0.0.1:8090/_/ and the API
at http://127.0.0.1:8090/api/. The database is created on first
run; there is nothing else to install.

Each archive has a matching .sha256 to verify the download.

What's Changed

• Email platform: templates, send API with sendRule, triggers, magic link, dashboard editor by @developerverygoodlabs-cpu in #29
• Database extensibility: Postgres extensions, custom SQL RPC, PostGIS-accelerated geo by @developerverygoodlabs-cpu in #30
• Auth: OAuth presets (Apple, Microsoft, ...), generic OIDC, linked accounts, TOTP 2FA by @developerverygoodlabs-cpu in #31
• Dashboard: every setting configurable, 7-group tabbed settings nav, onboarding checklist, landing update by @developerverygoodlabs-cpu in #32
• Docs & integrations sync: MCP runtime/dev tools, docs consistency, SDK READMEs, example by @developerverygoodlabs-cpu in #33
• Fix $mails.send deadlock in after-success hooks (defer past commit); fix flaky test root cause by @developerverygoodlabs-cpu in #34
• Release 0.4.0 by @developerverygoodlabs-cpu in #35

Full Changelog: v0.3.0...v0.4.0

v0.3.0

Download the archive for your platform, unzip it, and run:

./cratebase superuser create you@example.com yourpassword
./cratebase serve

The admin dashboard is at http://127.0.0.1:8090/_/ and the API
at http://127.0.0.1:8090/api/. The database is created on first
run; there is nothing else to install.

Each archive has a matching .sha256 to verify the download.

What's Changed

• feat(sdk): @cratebase/react — first-party React hooks by @nicoaudy in #19
• fix(filter): resolve @request.body.. dot-paths by @nicoaudy in #20
• chore(dashboard): drop PocketBase branding from user-facing UI labels by @nicoaudy in #26
• fix: bound /logs/stats scan to a time window, fix pagination number overflow by @nicoaudy in #25
• Audit fixes: security hardening, working migrations, cratebase dev/typegen, flagship example by @developerverygoodlabs-cpu in #27
• Dogfooding fixes + release 0.3.0 by @developerverygoodlabs-cpu in #28

Full Changelog: v0.2.0...v0.3.0

v0.2.0

First-class auth: a typed SDK, real sessions, cookie mode, and a server-driven OAuth2 flow

This release is about the auth story growing up. If you're evaluating
Cratebase against PocketBase, or against hand-rolling auth on top of
Postgres yourself, here's what changed:

• @cratebase/client
  is now the first-party TypeScript SDK, and the one the docs and
  admin dashboard recommend by default (the dashboard itself has been
  migrated off the community pocketbase npm package onto it). It's a
  typed client for records, auth, realtime, files, batch, and admin,
  plus Cratebase's value-add surface (vector/LLM/MCP/queue/presence)
  built in — see Using the TypeScript
  SDK. The
  wire-compatible pocketbase SDK still works unchanged if you'd
  rather keep using it.
• Server-side sessions with instant revocation. A new _sessions
  system collection records one row per minted token. Token
  verification stays a stateless JWT check on the hot path — no
  database read per request — but sessions.list() /
  .revoke(id) / .revokeOthers() / .revokeAll() now give you real,
  immediate control over who's signed in, instead of just waiting for
  tokens to expire. See Sessions.
• Cookie-mode sessions for browser clients, and a documented
  bearer-token + first-party-cookie pattern for SSR frameworks. Turn on
  SESSION_COOKIE and logins/refreshes set an HttpOnly cookie
  instead of handing the token to page JavaScript, with a same-origin
  CSRF check on unsafe methods. See Cookie
  sessions.
• OAuth2 without a client-side redirect dance. With cookie sessions
  on, the server can now drive the whole provider round trip itself —
  GET .../oauth2/{provider}/start sends the browser to the provider
  and GET .../oauth2/{provider}/callback completes the login and
  lands the session in a cookie, no authURL/code juggling in your
  frontend. See OAuth2 → Server-driven redirect
  flow.
• Bans and impersonation as first-class routes, plus a _bans
  system collection, and a Sessions panel and Impersonate/Ban actions
  in the admin dashboard.

Also in this release: a toggle-gated ZIP-export plugin
(POST /api/plugins/zip-export/enqueue) for bundling a collection
field's files into an archive, and $app.rawQuery(sql, params?) in JS
hooks for read-only raw SQL that a filter string can't express (joins,
GROUP BY, window functions).

Download the archive for your platform, unzip it, and run:

./cratebase superuser create you@example.com yourpassword
./cratebase serve

The admin dashboard is at http://127.0.0.1:8090/_/ and the API
at http://127.0.0.1:8090/api/. The database is created on first
run; there is nothing else to install.

Each archive has a matching .sha256 to verify the download.

What's Changed

• feat(server): add ZIP-export plugin by @nicoaudy in #14
• feat(jsvm): $app.rawQuery for raw-SQL reads without Record hydration by @nicoaudy in #16
• feat: first-class auth — @cratebase/client SDK, sessions, cookies, OAuth2 redirect, bans by @nicoaudy in #17

Full Changelog: v0.1.0...v0.2.0

v0.1.0

Download the archive for your platform, unzip it, and run:

./cratebase superuser create you@example.com yourpassword
./cratebase serve

The admin dashboard is at http://127.0.0.1:8090/_/ and the API
at http://127.0.0.1:8090/api/. The database is created on first
run; there is nothing else to install.

Each archive has a matching .sha256 to verify the download.

Full Changelog: https://github.com/cratebasehq/cratebase/commits/v0.1.0