Summary

The release enables a same-origin Cross-Origin-Opener-Policy header by default, adds log deletion, caps log payload sizes, and avoids transaction locking during backups. It also enables SQLite defensive mode, updates modernc SQLite, raises the minimum Go version to 1.27, and migrates to encoding/json/v2.

Why it matters

The combined security and operational changes affect developers using PocketBase as a self-hosted application backend, particularly teams relying on its built-in logs and backups.

Sources