Repository navigation
v0.6.2
Highlights:
- PocketBase v0.40.5 and Go 1.27.3, picking up the Go net/http security fixes (including a DoS) and GO-2026-6809 (crypto/x509)
- No more "modernc.org/libc differs from the expected version" warning at startup
- QR codes now render through upstream cuer 0.0.4; the qr pin from v0.6.1 is gone
Security:
- Go 1.27 -> 1.27.3. 1.27.2 carries the net/http security fixes PocketBase recommends; 1.27.3 fixes GO-2026-6809 (crypto/x509), which govulncheck reported as reachable. govulncheck now reports no reachable vulnerabilities.
Backend dependencies:
- PocketBase v0.40.4 -> v0.40.5 (JSVM migration error handling, sqlite 1.60.1, extra CORS wildcard subdomain checks)
- modernc.org/sqlite v1.60.1 and libc v1.77.1, matching PocketBase v0.40.5
- firebase v4.22.0, aws-sdk-go-v2 v1.47.3 (config v1.33.9, pinpointsmsvoicev2 v1.42.1), smithy-go v1.28.6, google.golang.org/api v0.307.0
Frontend dependencies:
- All dependencies to latest: React 19.3.1, Radix UI, TanStack Query/Router/Table, lucide-react, Vite 8.3.5, Biome 2.6.2, @hookform/resolvers 6, dotenv 18
- cuer 0.0.4 handles qr >= 0.6 upstream, so the qr override is dropped and qr moves to 0.7.2
- @playwright/test 1.64.1 with the matching v1.64.1-noble image
Modem agent:
- golang.org/x/sys v0.49.0, Go 1.27.3 and golang:1.27-alpine