fix(deps): update module github.com/pocketbase/pocketbase to v0.23.12

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/pocketbase/pocketbase	v0.22.27 -> v0.23.12

---

Release Notes

pocketbase/pocketbase (github.com/pocketbase/pocketbase)

v0.23.12

Compare Source

• Added warning logs in case of mismatched modernc.org/sqlite and modernc.org/libs versions (#​6136).

• Skipped the default body size limit middleware for the backup upload endpooint (#​6152).

v0.23.11

Compare Source

• Upgraded golang.org/x/net to 0.33.0 to fix CVE-2024-45338.
  PocketBase uses the vulnerable functions primarily for the auto html->text mail generation, but most applications shouldn't be affected unless you are manually embedding unrestricted user provided value in your mail templates.

v0.23.10

Compare Source

• Renew the superuser file token cache when clicking on the thumb preview or download link (#​6137).

• Upgraded modernc.org/sqlite to 1.34.3 to fix "disk io" error on arm64 systems.
  If you are extending PocketBase with Go and upgrading with go get -u make sure to manually set in your go.mod the modernc.org/libc indirect dependency to v1.55.3, aka. the exact same version the driver is using.

v0.23.9

Compare Source

• Replaced strconv.Itoa with strconv.FormatInt to avoid the int64->int conversion overflow on 32-bit platforms (#​6132).

v0.23.8

Compare Source

• Fixed Model->Record and Model->Collection hook events sync for nested and/or inner-hook transactions (#​6122).

• Other minor improvements (updated Go and npm deps, added extra escaping for the default mail record params in case the emails are stored as html files, fixed code comment typos, etc.).

v0.23.7

Compare Source

• Fixed JSVM exception -> Go error unwrapping when throwing errors from non-request hooks (#​6102).

v0.23.6

Compare Source

• Fixed $filesystem.fileFromURL documentation and generated type (#​6058).

• Fixed X-Forwarded-For header typo in the suggested UI "Common trusted proxy" headers (#​6063).

• Updated the text field max length validator error message to make it more clear (#​6066).

• Other minor fixes (updated Go deps, skipped unnecessary validator check when the default primary key pattern is used, updated JSVM types, etc.).

v0.23.5

Compare Source

• Fixed UI logs search not properly accounting for the "Include requests by superusers" toggle when multiple search expressions are used.

• Fixed text field max validation error message (#​6053).

• Other minor fixes (comment typos, JSVM types update).

• Updated Go deps and the min Go releleaser GitHub action version to 1.23.4.

v0.23.4

Compare Source

• Fixed autodate fields not refreshing when calling Save multiple times on the same Record instance (#​6000).

• Added more descriptive test OTP id and failure log message (#​5982).

• Moved the default UI CSP from meta tag to response header (#​5995).

• Updated Go and npm dependencies.

v0.23.3

Compare Source

• Fixed Gzip middleware not applying when serving static files.

• Fixed Record.Fresh()/Record.Clone() methods not properly cloning autodate fields (#​5973).

v0.23.2

Compare Source

• Fixed RecordQuery() custom struct scanning (#​5958).

• Fixed --dev log query print formatting.

• Added support for passing more than one id in the Hook.Unbind method for consistency with the router.

• Added collection rules change list in the confirmation popup
  (to avoid getting anoying during development, the rules confirmation currently is enabled only when using https).

v0.23.1

Compare Source

• Added RequestEvent.Blob(status, contentType, bytes) response write helper (#​5940).

• Added more descriptive error messages.

v0.23.0

Compare Source

[!NOTE]
You don't have to upgrade to PocketBase v0.23.0 if you are not planning further developing
your existing app and/or are satisfied with the v0.22.x features set. There are no identified critical issues
with PocketBase v0.22.x yet and in the case of critical bugs and security vulnerabilities, the fixes
will be backported for at least until Q1 of 2025 (if not longer).

If you don't plan upgrading make sure to pin the SDKs version to their latest PocketBase v0.22.x compatible:

• JS SDK: <0.22.0
• Dart SDK: <0.19.0

[!CAUTION]
This release introduces many Go/JSVM and Web APIs breaking changes!

Existing pb_data will be automatically upgraded with the start of the new executable,
but custom Go or JSVM (pb_hooks, pb_migrations) and JS/Dart SDK code will have to be migrated manually.
Please refer to the below upgrade guides:

• Go: https://pocketbase.io/v023upgrade/go/.
• JSVM: https://pocketbase.io/v023upgrade/jsvm/.

If you had already switched to some of the earlier <v0.23.0-rc14 versions and have generated a full collections snapshot migration (aka. ./pocketbase migrate collections), then you may have to regenerate the migration file to ensure that it includes the latest changes.

PocketBase v0.23.0 is a major refactor of the internals with the overall goal of making PocketBase an easier to use Go framework.
There are a lot of changes but to highlight some of the most notable ones:

• New and more detailed documentation.
  The old documentation could be accessed at pocketbase.io/old.
• Replaced echo with a new router built on top of the Go 1.22 net/http mux enhancements.
• Merged daos packages in core.App to simplify the DB operations (the models package structs are also migrated in core).
• Option to specify custom DBConnect function as part of the app configuration to allow different database/sql SQLite drivers (turso/libsql, sqlcipher, etc.) and custom builds.
  Note that we no longer loads the mattn/go-sqlite3 driver by default when building with CGO_ENABLED=1 to avoid multiple definition linker errors in case different CGO SQLite drivers or builds are used. You can find an example how to enable it back if you want to in the new documentation.
• New hooks allowing better control over the execution chain and error handling (including wrapping an entire hook chain in a single DB transaction).
• Various Record model improvements (support for get/set modifiers, simplfied file upload by treating the file(s) as regular field value like record.Set("document", file), etc.).
• Dedicated fields structs with safer defaults to make it easier creating/updating collections programmatically.
• Option to mark field as "Hidden", disallowing regular users to read or modify it (there is also a dedicated Record hook to hide/unhide Record fields programmatically from a single place).
• Option to customize the default system collection fields (id, email, password, etc.).
• Admins are now system _superusers auth records.
• Builtin rate limiter (supports tags, wildcards and exact routes matching).
• Batch/transactional Web API endpoint.
• Impersonate Web API endpoint (it could be also used for generating fixed/non-refreshable superuser tokens, aka. "API keys").
• Support for custom user request activity log attributes.
• One-Time Password (OTP) auth method (via email code).
• Multi-Factor Authentication (MFA) support (currently requires any 2 different auth methods to be used).
• Support for Record "proxy/projection" in preparation for the planned autogeneration of typed Go record models.
• Linear OAuth2 provider (#​5909; thanks @​chnfyi).
• WakaTime OAuth2 provider (#​5829; thanks @​tigawanna).
• Notion OAuth2 provider (#​4999; thanks @​s-li1).
• monday.com OAuth2 provider (#​5346; thanks @​Jaytpa01).
• New Instagram provider compatible with the new Instagram Login APIs (#​5588; thanks @​pnmcosta).
  The provider key is instagram2 to prevent conflicts with existing linked users.
• Option to retrieve the OIDC OAuth2 user info from the id_token payload for the cases when the provider doesn't have a dedicated user info endpoint.
• Various minor UI improvements (recursive Presentable view, slightly different collection options organization, zoom/pan for the logs chart, etc.)
• and many more...

Go/JSVM APIs changes

• Go: https://pocketbase.io/v023upgrade/go/.
• JSVM: https://pocketbase.io/v023upgrade/jsvm/.

SDKs changes

• JS SDK v0.22.0
• Dart SDK v0.19.0

Web APIs changes

• New POST /api/batch endpoint.

• New GET /api/collections/meta/scaffolds endpoint.

• New DELETE /api/collections/{collection}/truncate endpoint.

• New POST /api/collections/{collection}/request-otp endpoint.

• New POST /api/collections/{collection}/auth-with-otp endpoint.

• New POST /api/collections/{collection}/impersonate/{id} endpoint.

• ⚠️ If you are constructing requests to /api/* routes manually remove the trailing slash (there is no longer trailing slash removal middleware registered by default).

• ⚠️ Removed /api/admins/* endpoints because admins are converted to _superusers auth collection records.

• ⚠️ Previously when uploading new files to a multiple file field, new files were automatically appended to the existing field values.
  This behaviour has changed with v0.23+ and for consistency with the other multi-valued fields when uploading new files they will replace the old ones. If you want to prepend or append new files to an existing multiple file field value you can use the + prefix or suffix:

  "documents": [file1, file2]  // => [file1_name, file2_name]
  "+documents": [file1, file2] // => [file1_name, file2_name, old1_name, old2_name]
  "documents+": [file1, file2] // => [old1_name, old2_name, file1_name, file2_name]

• ⚠️ Removed GET /records/{id}/external-auths and DELETE /records/{id}/external-auths/{provider} endpoints because this is now handled by sending list and delete requests to the _externalAuths collection.

• ⚠️ Changes to the app settings model fields and response (+new options such as trustedProxy, rateLimits, batch, etc.). The app settings Web APIs are mostly used by the Dashboard UI and rarely by the end users, but if you want to check all settings changes please refer to the Settings Go struct.

• ⚠️ New flatten Collection model and fields structure. The Collection model Web APIs are mostly used by the Dashboard UI and rarely by the end users, but if you want to check all changes please refer to the Collection Go struct.

• ⚠️ The top level error response code key was renamed to status for consistency with the Go APIs.
  The error field key remains code:

  {
      "status": 400, // <-- old: "code"
      "message": "Failed to create record.",
      "data": {
          "title": {
              "code": "validation_required",
              "message": "Missing required value."
          }
      }
  }

• ⚠️ New fields in the GET /api/collections/{collection}/auth-methods response.
  The old authProviders, usernamePassword, emailPassword fields are still returned in the response but are considered deprecated and will be removed in the future.

  {
      "mfa": {
          "duration": 100,
          "enabled": true
      },
      "otp": {
          "duration": 0,
          "enabled": false
      },
      "password": {
          "enabled": true,
          "identityFields": ["email", "username"]
      },
      "oauth2": {
          "enabled": true,
          "providers": [{"name": "gitlab", ...}, {"name": "google", ...}]
      },
      // old fields...
  }

• ⚠️ Soft-deprecated the OAuth2 auth success meta.avatarUrl field in favour of meta.avatarURL.

v0.22.29: Release

Compare Source

• (Backported from v0.23.11) Upgraded golang.org/x/net to 0.33.0 to fix CVE-2024-45338.
  PocketBase uses the vulnerable functions primarily for the auto html->text mail generation, but most applications shouldn't be affected unless you are manually embedding unrestricted user provided value in your mail templates.

v0.22.28: Release

Compare Source

• (Backported from v0.23.10) Renew the superuser file token cache when clicking on the thumb preview or download link (#​6137).

• (Backported from v0.23.10) Upgraded modernc.org/sqlite to 1.34.3 to fix "disk io" error on arm64 systems.
  If you are extending PocketBase with Go and upgrading with go get -u make sure to manually set in your go.mod the modernc.org/libc indirect dependency to v1.55.3, aka. the exact same version the driver is using.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 41 additional dependencies were updated

Details:

Package	Change
github.com/aws/aws-sdk-go-v2	v1.32.2 -> v1.32.7
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	v1.6.4 -> v1.6.7
github.com/aws/aws-sdk-go-v2/config	v1.27.31 -> v1.28.7
github.com/aws/aws-sdk-go-v2/credentials	v1.17.30 -> v1.17.48
github.com/aws/aws-sdk-go-v2/feature/ec2/imds	v1.16.12 -> v1.16.22
github.com/aws/aws-sdk-go-v2/feature/s3/manager	v1.17.15 -> v1.17.44
github.com/aws/aws-sdk-go-v2/internal/configsources	v1.3.16 -> v1.3.26
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2	v2.6.16 -> v2.6.26
github.com/aws/aws-sdk-go-v2/internal/v4a	v1.3.16 -> v1.3.26
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding	v1.11.4 -> v1.12.1
github.com/aws/aws-sdk-go-v2/service/internal/checksum	v1.3.18 -> v1.4.7
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url	v1.11.18 -> v1.12.7
github.com/aws/aws-sdk-go-v2/service/internal/s3shared	v1.17.16 -> v1.18.7
github.com/aws/aws-sdk-go-v2/service/s3	v1.60.1 -> v1.71.1
github.com/aws/aws-sdk-go-v2/service/sso	v1.22.5 -> v1.24.8
github.com/aws/aws-sdk-go-v2/service/ssooidc	v1.26.5 -> v1.28.7
github.com/aws/aws-sdk-go-v2/service/sts	v1.30.5 -> v1.33.3
github.com/aws/smithy-go	v1.22.0 -> v1.22.1
github.com/gabriel-vasile/mimetype	v1.4.5 -> v1.4.7
github.com/golang-jwt/jwt/v4	v4.5.0 -> v4.5.1
github.com/golang/groupcache	v0.0.0-20210331224755-41bb18bfe9da -> v0.0.0-20241129210726-2c02b8208cf8
github.com/googleapis/gax-go/v2	v2.13.0 -> v2.14.1
github.com/pocketbase/dbx	v1.10.1 -> v1.11.0
github.com/spf13/cast	v1.7.0 -> v1.7.1
gocloud.dev	v0.39.0 -> v0.40.0
golang.org/x/crypto	v0.28.0 -> v0.31.0
golang.org/x/image	v0.19.0 -> v0.23.0
golang.org/x/net	v0.30.0 -> v0.33.0
golang.org/x/oauth2	v0.22.0 -> v0.24.0
golang.org/x/sync	v0.8.0 -> v0.10.0
golang.org/x/sys	v0.26.0 -> v0.28.0
golang.org/x/term	v0.25.0 -> v0.27.0
golang.org/x/text	v0.19.0 -> v0.21.0
golang.org/x/time	v0.6.0 -> v0.8.0
golang.org/x/xerrors	v0.0.0-20240716161551-93cc26a95ae9 -> v0.0.0-20240903120638-7835f813f4da
google.golang.org/api	v0.194.0 -> v0.214.0
google.golang.org/genproto/googleapis/rpc	v0.0.0-20240827150818-7e3bb234dfed -> v0.0.0-20241219192143-6b3ec007d9bb
google.golang.org/grpc	v1.65.0 -> v1.69.2
google.golang.org/protobuf	v1.34.2 -> v1.36.0
modernc.org/gc/v3	v3.0.0-20240801135723-a856999a2e4a -> v3.0.0-20241213165251-3bc300f6d0c9
modernc.org/sqlite	v1.32.0 -> v1.34.4