build(deps): bump github.com/pocketbase/pocketbase from 0.35.0 to 0.39.9

[dependabot]

Bumps github.com/pocketbase/pocketbase from 0.35.0 to 0.39.9.

Release notes

Sourced from github.com/pocketbase/pocketbase's releases.

v0.39.9 Release

To update the prebuilt executable you can run ./pocketbase update.

• Fixed Shift + Click range bulk selection not working in Firefox (#7771)

• Updated goja and its related dependencies (fixes for TypedArray and regexp2 dep regression for the reported empty string match with lookahead patterns).

• Minor filter (fexpr) improvements (optimization for large string literals and fix for control characters handling).

v0.39.8 Release

To update the prebuilt executable you can run ./pocketbase update.

• Properly reset JSVM global $app overwrite so that pooled executors always get a clean state.

• Minor UI improvements:

  • prevent resetting number inputs with leading 0 while still typing (normalized in onchange)
  • added support for Shift + Click range bulk selection (#7759)

• Bumped golang.org/x/* indirect dependencies as there are some minor security fixes.

• Updated modernc.org/sqlite to v1.54.0 (SQLite 3.53.3).

v0.39.7 Release

To update the prebuilt executable you can run ./pocketbase update.

[!IMPORTANT] This release includes a security fix related to #7762.

• Replaced github.com/go-ozzo/ozzo-validation with the fork github.com/pocketbase/ozzo-validation since the original library has recently changed ownership and the new maintainer cannot be trusted. There are plans to create eventually a new validation library from scratch more suited for our needs in PocketBase because ozzo-validation is known to have some minor performance and obscure regex issues, but until then we'll stick with the fork (and if you use ozzo-validation in your own Go code, I'd suggest to swap the imports with the fork).

• Fixed missing import collection fields property access (#7760).

• Fixed View collection * validator and added more friendly error messages (#7761).

• ⚠️ Security fix for unhandled panic in internal worker goroutines (#7762). To prevent this from showing again, all existing internal worker functions were wrapped with routine.SafeWrap(f) (auto recovers and returns any eventual panic as regular error).

v0.39.6 Release

To update the prebuilt executable you can run ./pocketbase update.

• Added Cc and Bcc recipients to the dev sendmail command for consistency with the SMTP mailer.

• Added extra hardening options to the Microsoft OAuth2 provider allowing developers to specify the preferred safe email extraction method (#7756).

• Updated goja and the related golang.org/x/* dependencies (WeakMap regression fixes).

• Bumped the min Go GitHub action version to 1.26.5 as it includes some minor security fixes.

v0.39.5 Release

... (truncated)

Changelog

Sourced from github.com/pocketbase/pocketbase's changelog.

v0.39.9

• Fixed Shift + Click range bulk selection not working in Firefox (#7771)

• Updated goja and its related dependencies (fixes for TypedArray and regexp2 dep regression for the reported empty string match with lookahead patterns).

• Minor filter (fexpr) improvements (optimization for large string literals and fix for control characters handling).

v0.39.8

• Properly reset JSVM global $app overwrite so that pooled executors always get a clean state.

• Minor UI improvements:

  • prevent resetting number inputs with leading 0 while still typing (normalized in onchange)
  • added support for Shift + Click range bulk selection (#7759)

• Bumped golang.org/x/* indirect dependencies as there are some minor security fixes.

• Updated modernc.org/sqlite to v1.54.0 (SQLite 3.53.3).

v0.39.7

• Replaced github.com/go-ozzo/ozzo-validation with the fork github.com/pocketbase/ozzo-validation since the original library has recently changed ownership and the new maintainer cannot be trusted. There are plans to create eventually a new validation library from scratch more suited for our needs in PocketBase because ozzo-validation is known to have some minor performance and obscure regex issues, but until then we'll stick with the fork (and if you use ozzo-validation in your own Go code, I'd suggest to swap the imports with the fork).

• Fixed missing import collection fields property access (#7760).

• Fixed View collection * validator and added more friendly error messages (#7761).

• ⚠️ Security fix for unhandled panic in internal worker goroutines (#7762). To prevent this from showing again, all existing internal worker functions were wrapped with routine.SafeWrap(f) (auto recovers and returns any eventual panic as regular error).

v0.39.6

• Added Cc and Bcc recipients to the dev sendmail command for consistency with the SMTP mailer.

• Added extra hardening options to the Microsoft OAuth2 provider allowing developers to specify the preferred safe email extraction method.

• Updated goja and the related golang.org/x/* dependencies (WeakMap regression fixes).

• Bumped the min Go GitHub action version to 1.26.5 as it includes some minor security fixes.

v0.39.5

• Limit with ellipsis long url field values.

... (truncated)

Commits

• 0cbfc04 bumped app version
• d02016c updated changelogs
• 9425a5c updated goja (should resolve the reported regexp2 dep regression)
• 244ae1a updated fexpr
• 8af9961 #7771 workaround shift+click in Firefox
• cc4e857 updated jsvm types
• ae2cb3c updated backport changelog
• fe6811f bumped app version
• 77bd87b updated text and password fields number input settings events
• 7964a8c #7759 added shift+click bulk selection
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)