Skip to content

v3.2.6

Choose a tag to compare

View all tags
@elemdos elemdos released this 20 Aug 05:14
· 396 commits to main since this release
v3.2.6
b836c7d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's new

Fixes

Preserve page _id on re-import so cross-file page: links resolve (#1217)
Internal page links (nav, footer, in-content) reference pages by their exported _id (page: <id>). The importer previously only honored that _id when creating a brand-new page, so a page matched as "existing" kept its old record id — every link pointing at the file's _id resolved to an empty URL and silently rendered as href="#". This surfaced on primo.build: a pulled Pricing page got a fresh record id while content.yaml still linked to its exported _id, leaving a dead nav link.

  • The page lookup in importPage is now parent-scoped, so importing /support/docs can no longer match and merge an unrelated /product/docs (both named "Docs").
  • The _id-preservation branch now also runs for pages matched as existing, keeping cross-file page: references intact on re-import.

Fix :5173 dev server, onboarding docs, and unassigned first-site redirect (#1215)
Two follow-ups to the unassigned-host-sites feature (#1213) that were stranded off main.

  • Unassigned first-site redirect — the localhost "redirect to first site" path used first_site.host as a hostname unconditionally. For an unassigned site (host === id) that turned the id into a domain (DNS_PROBE_FINISHED_NXDOMAIN), so the operator could never reach their first site's editor. It now routes through site_editor_url, sending unassigned sites to /admin/sites/{id}.
  • Dev server + onboarding docs — points developers at :8090 (Go/PocketBase serves the built app and /api/primo/* together) as the URL to actually use, and explains that :5173 is frontend-only and 404s all backend calls. Adds a WSL2/git note to prerequisites.

Security

Enable login rate limiting so brute-force has a floor (#1216)
auth-with-password (the login endpoint) had no brute-force protection, and Railway puts no WAF in front of the instance. This enables PocketBase's built-in IP rate limiter; its default *:auth rule (2 requests / 3s per IP) already covers login.

  • Delivered as a dedicated migration with a fresh identity so it runs on existing installs, not just fresh ones.
  • PRIMO_RATE_LIMIT=off opts out, for self-hosters running behind their own proxy/WAF.

Note for operators: running instances pick this up on their next redeploy/restart onto the new :latest image.

Assets 7
Loading