build(deps): bump github.com/pocketbase/pocketbase from 0.35.0 to 0.39.8

[dependabot]

Bumps github.com/pocketbase/pocketbase from 0.35.0 to 0.39.8.

Release notes

Sourced from github.com/pocketbase/pocketbase's releases.

v0.39.8 Release

To update the prebuilt executable you can run ./pocketbase update.

• Properly reset JSVM global $app overwrite so that pooled executors always get a clean state.

• Minor UI improvements:

  • prevent resetting number inputs with leading 0 while still typing (normalized in onchange)
  • added support for Shift + Click range bulk selection (#7759)

• Bumped golang.org/x/* indirect dependencies as there are some minor security fixes.

• Updated modernc.org/sqlite to v1.54.0 (SQLite 3.53.3).

v0.39.7 Release

To update the prebuilt executable you can run ./pocketbase update.

[!IMPORTANT] This release includes a security fix related to #7762.

• Replaced github.com/go-ozzo/ozzo-validation with the fork github.com/pocketbase/ozzo-validation since the original library has recently changed ownership and the new maintainer cannot be trusted. There are plans to create eventually a new validation library from scratch more suited for our needs in PocketBase because ozzo-validation is known to have some minor performance and obscure regex issues, but until then we'll stick with the fork (and if you use ozzo-validation in your own Go code, I'd suggest to swap the imports with the fork).

• Fixed missing import collection fields property access (#7760).

• Fixed View collection * validator and added more friendly error messages (#7761).

• ⚠️ Security fix for unhandled panic in internal worker goroutines (#7762). To prevent this from showing again, all existing internal worker functions were wrapped with routine.SafeWrap(f) (auto recovers and returns any eventual panic as regular error).

v0.39.6 Release

To update the prebuilt executable you can run ./pocketbase update.

• Added Cc and Bcc recipients to the dev sendmail command for consistency with the SMTP mailer.

• Added extra hardening options to the Microsoft OAuth2 provider allowing developers to specify the preferred safe email extraction method (#7756).

• Updated goja and the related golang.org/x/* dependencies (WeakMap regression fixes).

• Bumped the min Go GitHub action version to 1.26.5 as it includes some minor security fixes.

v0.39.5 Release

To update the prebuilt executable you can run ./pocketbase update.

• Limit with ellipsis long url field values.

• Readded the "fullscreen" editor field option and preloaded the TinyMCE component for slightly faster initial rendering (#7746).

• Updated goja (TypedArray fixes).

v0.39.4 Release

... (truncated)

Changelog

Sourced from github.com/pocketbase/pocketbase's changelog.

v0.39.8

• Properly reset JSVM global $app overwrite so that pooled executors always get a clean state.

• Minor UI improvements:

  • prevent resetting number inputs with leading 0 while still typing (normalized in onchange)
  • added support for Shift + Click range bulk selection (#7759)

• Bumped golang.org/x/* indirect dependencies as there are some minor security fixes.

• Updated modernc.org/sqlite to v1.54.0 (SQLite 3.53.3).

v0.39.7

• Replaced github.com/go-ozzo/ozzo-validation with the fork github.com/pocketbase/ozzo-validation since the original library has recently changed ownership and the new maintainer cannot be trusted. There are plans to create eventually a new validation library from scratch more suited for our needs in PocketBase because ozzo-validation is known to have some minor performance and obscure regex issues, but until then we'll stick with the fork (and if you use ozzo-validation in your own Go code, I'd suggest to swap the imports with the fork).

• Fixed missing import collection fields property access (#7760).

• Fixed View collection * validator and added more friendly error messages (#7761).

• ⚠️ Security fix for unhandled panic in internal worker goroutines (#7762). To prevent this from showing again, all existing internal worker functions were wrapped with routine.SafeWrap(f) (auto recovers and returns any eventual panic as regular error).

v0.39.6

• Added Cc and Bcc recipients to the dev sendmail command for consistency with the SMTP mailer.

• Added extra hardening options to the Microsoft OAuth2 provider allowing developers to specify the preferred safe email extraction method.

• Updated goja and the related golang.org/x/* dependencies (WeakMap regression fixes).

• Bumped the min Go GitHub action version to 1.26.5 as it includes some minor security fixes.

v0.39.5

• Limit with ellipsis long url field values.

• Readded the "fullscreen" editor field option and preloaded the TinyMCE component for slightly faster initial rendering (#7746).

• Updated goja (TypedArray fixes).

v0.39.4

• Removed redirectURL required validator from the code->token exchange endpoint (aka. authWithOAuth2Code()) (#7734). Note that OAuth2 providers have their own validations and whether it is allowed to be empty or not could depend on the configured OAuth2 app (in most cases it is required and the redirect address must match with the initial value submitted with the authorization request).

... (truncated)

Commits

• cc4e857 updated jsvm types
• ae2cb3c updated backport changelog
• fe6811f bumped app version
• 77bd87b updated text and password fields number input settings events
• 7964a8c #7759 added shift+click bulk selection
• 09af56b prevent resetting number inputs with leading 0 while still typing
• 6aa6b2c updated ui/dist
• a51a53d updated modernc.org/sqlite to 1.54.0
• 4ea2513 added extra panic-recover handling for CreateThumb
• b419498 properly reset JSVM global app state overwrite so that pooled executors alway...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #1210.