fix(deps): update module github.com/pocketbase/pocketbase to v0.22.16 #93
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/github.com-pocketbase-pocketbase-0.x
branch
from
b08e923 to
f9ec6bb
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/github.com-pocketbase-pocketbase-0.x
branch
from
f9ec6bb to
6f23efe
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/github.com-pocketbase-pocketbase-0.x
branch
from
6f23efe to
e405440
Compare
renovate
bot
changed the title
ℹ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
renovate
bot
force-pushed
the
renovate/github.com-pocketbase-pocketbase-0.x
branch
from
e405440 to
69ca081
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/github.com-pocketbase-pocketbase-0.x
branch
from
69ca081 to
1a0fd48
Compare
renovate
bot
changed the title
catouberos
approved these changes
Jul 8, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.22.10->v0.22.16Release Notes
pocketbase/pocketbase (github.com/pocketbase/pocketbase)
v0.22.16Compare Source
Note that the previous versions correctly delete only the logs older than the configured setting but due to the typo the delete query is invoked unnecessary on each logs batch write.
v0.22.15Compare Source
Added mutex to
tests.TestMailer()to minimize tests data race warnings (#5157).Updated goja and the other Go dependencies.
Bumped the min Go version in the GitHub release action to Go 1.22.5 since it comes with
net/httpsecurity fixes.v0.22.14Compare Source
Added OAuth2 POST redirect support (in case of
response_mode=form_post) to allow specifying scopes for the Apple OAuth2 integration.Note 1: If you are using the "Manual code exchange" flow with Apple (aka.
authWithOAuth2Code()), you need to either update your customredirect handler to accept POST requests OR if you want to keep the old behavior and don't need the Apple user's email - replace in the Apple authorization url
response_mode=form_postback toresponse_mode=query.Note 2: Existing users that have already logged in with Apple may need to revoke their access in order to see the email sharing options as shown in this screenshot.
If you want to force the new consent screen you could register a new Apple OAuth2 app.
Just to be safe I've also published a GitHub security advisory (may take some time to show up in the related security databases).
In order to be exploited you must have both OAuth2 and Password auth methods enabled.
A possible attack scenario could be:
To prevent this for happening we now reset the password for this specific case if the previously created user wasn't verified (an exception to this is if the linking is explicit/manual, aka. when you send
Authorization:TOKENwith the OAuth2 auth call).Additionally to warn users we now send an email alert in case the user has logged in with password but has at least one OAuth2 account linked. It looks something like:
Hello,
Just to let you know that someone has logged in to your Acme account using a password while you already have OAuth2 GitLab auth linked.
If you have recently signed in with a password, you may disregard this email.
If you don't recognize the above action, you should immediately change your Acme account password.
Thanks,
Acme team
The flow will be further improved with the ongoing refactoring and we will start sending emails for "unrecognized device" logins (OTP and MFA is already implemented and will be available with the next v0.23.0 release in the near future).
v0.22.13Compare Source
Fixed rules inconsistency for text literals when inside parenthesis (#5017).
Updated Go deps.
v0.22.12Compare Source
Fixed calendar picker grid layout misalignment on Firefox (#4865).
Updated Go deps and bumped the min Go version in the GitHub release action to Go 1.22.3 since it comes with some minor security fixes.
v0.22.11Compare Source
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.