pocketbase/pocketbase
Open Source realtime backend in 1 file
How pocketbase is put together
PocketBase is an open-source Go backend distributed both as a standalone single-binary application and as an embeddable Go framework/toolkit. It provides an embedded SQLite datastore (via the pure-Go modernc.org/sqlite driver), realtime subscriptions, file/user management, a REST-ish API under /api/*, and an admin (superuser) dashboard UI built with Vite. The architecture is layered: a core package defines the App abstraction, models, fields, migrations, and DB access; an apis package binds HTTP routes and middlewares onto a custom router; cmd provides CLI commands (serve, superuser); and plugins such as the JS VM (goja) allow extending the app. Data flows from HTTP requests through router middlewares (auth loading, rate limiting, body limits, security headers) into route handlers that operate on records/collections via the core layer and persist to SQLite.
Languages
Frameworks
Datastores
Infrastructure
Major components
core
Defines the App abstraction, base app lifecycle, collection/record models, field types (text, file, relation, geoPoint, etc.), migrations, transactions, backups, MFA/OTP/auth-origin models, and event hooks.
apis
Binds all HTTP API route groups (records CRUD, record auth, collections, settings, logs, backups, cron, files, batch, realtime, health, SQL) plus shared middlewares and static file serving.
cmd
CLI commands built on cobra, including `serve` (HTTP server startup) and `superuser` (superuser account management).
tools/router
Custom HTTP router/router-group implementation with middleware binding, ApiError types, wildcard params, and index-page fallback handling.
tools/filesystem
Filesystem abstraction for storing/serving uploaded files and backups, including S3-backed storage and blob helpers.
JSVM plugin (goja/tygoja)
Embeds a JavaScript runtime (dop251/goja) so the prebuilt executable can be extended with user-supplied JS hooks and routes.
migrations system
MigrationsList/MigrationsRunner in core manages schema migration registration and execution against the embedded database.
ui (PocketBase Superuser UI)
Admin dashboard frontend built with Vite, using the official pocketbase JS SDK and leaflet, served by the backend binary.
Follow-up fixes for the experimental JSON v2 upgrade, including safer handling of special characters and OAuth2 provider configuration.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
Follow-up fixes for the experimental JSON v2 upgrade, including safer handling of special characters and OAuth2 provider configuration.
Week of 2026-08-17
A busy week centered on experimental backup optimizations and a switch to the next-generation Go JSON encoding library.
Week of 2026-08-10
UI polish and developer-experience improvements, including better duplicate collection handling and a new security header.
Week of 2026-08-03
A quiet week with just two targeted changes: a new file-writing helper and corrected realtime API docs.
Week of 2026-07-27
File-serving refinements, command error handling, and dashboard chart improvements rounded out the week.
Over the past five weeks, PocketBase development focused on a major experimental upgrade to the new Go JSON encoding library, which required fixing UTF-8 handling and OAuth2 provider configuration along the way. Backup reliability got significant attention with concurrency fixes and performance optimizations, while smaller improvements landed across the admin UI, security headers, and API documentation examples. The overall arc shows steady hardening of core infrastructure alongside user-facing polish.
Week by week
2026-08-24Follow-up fixes for the experimental JSON v2 upgrade, including safer handling of special characters and OAuth2 provider configuration.latest5 changes
Fix
OAuth2 providers config merge fixed
Fixed a bug where OAuth2 provider settings weren't merging correctly when saved (#7815).
Fix
Missing providers prop checks
Added validation to catch cases where the OAuth2 providers list is missing entirely (#7815).
Feature
Invalid UTF-8 characters allowed in responses
JSON responses can now include invalid text characters without failing, with automatic replacement enabled by default.
Refactor
Removed redundant array cleanup code
Deleted unnecessary empty-array normalization since the new JSON library handles it automatically.
Chore
Version bump and typo fixes
Bumped the app version and cleaned up spelling mistakes in the codebase.
2026-08-17A busy week centered on experimental backup optimizations and a switch to the next-generation Go JSON encoding library.6 changes
Refactor
Experimental backup optimizations
Backups now use a faster concurrent database copy method, making them quicker and more reliable under load.
Fix
Backup zip thread-safety fix
Wrapped backup file operations in a lock so simultaneous background processes can't corrupt the backup archive.
Feature
Logs truncation endpoint
Added an API endpoint to clear old logs, plus a setting to cap how much data each log entry can store.
Refactor
Upgraded to encoding/json/v2 (experimental)
Switched to Go's next-generation JSON library for faster response encoding, with deterministic raw JSON scanning.
Feature
New record helper methods
Added Record.GetInt64() for reading whole-number fields and Store.Keys() for listing stored keys.
Chore
Toolchain updates
Updated the Go version, SQLite driver, and GitHub Actions tooling, including enabling defensive SQLite checks.
2026-08-10UI polish and developer-experience improvements, including better duplicate collection handling and a new security header.5 changes
Feature
Cross-Origin-Opener-Policy header added
New API responses now include a standard security header that protects against cross-window attacks.
Fix
Duplicate collection relation editing
When creating a copy of a collection, you can now edit which collections its relation fields point to.
Chore
Admin UI component fixes
Minor visual fixes to base UI components, select dropdown positioning, and template updates.
Chore
Dependency bumps
Updated supporting libraries and the minimum Go version used in automated builds.
Refactor
Search filter normalization
Switched search filtering to use PocketBase's built-in filter engine for consistency.
2026-08-03A quiet week with just two targeted changes: a new file-writing helper and corrected realtime API docs.2 changes
Feature
filesystem.NewWriter helper
Added a convenience function that makes it easier for developers to write files through PocketBase's storage layer.
Docs
Realtime API preview fix
Corrected the example code shown in the realtime API documentation so it works as documented (#7785).
2026-07-27File-serving refinements, command error handling, and dashboard chart improvements rounded out the week.6 changes
Fix
Safe download filenames
Files served for download now quote their filename properly so custom names with special characters don't break browsers.
Feature
Command exit status support
Custom commands that fail now report a non-zero exit status, letting scripts detect failures correctly.
Fix
Reverted panic auto-recovery for CLI commands
Rolled back automatic crash recovery for command-line commands after it caused issues (#7781).
Fix
API preview examples fixed
Corrected sample requests in the interactive API docs, including adding verification request examples (#7782).
Chore
Dashboard chart loading placeholder
Added a loading indicator for the admin dashboard charts and staggered their animations to avoid visual overload.
Chore
SQLite driver update
Updated the embedded database driver to version 1.55.0.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required