Pocket ID

v1.14.2 →v2.19.2

Releases to cross

28

Spanning

12 mo

Need action

11

What breaks

Every item below is quoted from the release notes it came from, and the quote was checked against the source before it was stored.

• ■blocker

  The storage backend configuration value for the file system has been renamed from 'fs' to 'filesystem', requiring an update to the configuration file.

  config · Pocket ID v1.16.0 · 2025-11-30

  rename file backend value `fs` to `filesystem`

  Do: Update your storage backend configuration to use 'filesystem' instead of 'fs'.

• ■blocker

  The release notes explicitly require following a migration guide to upgrade to v2.

  migration · Pocket ID v2.0.0 · 2026-01-02

  please follow the migration guide to upgrade to `v2`.

• ■blocker

  Support for storing JWKs on the filesystem has been dropped.

  removal · Pocket ID v2.0.0 · 2026-01-02

  drop support for storing JWK on the filesystem

• ▲high

  The LDAP_ATTRIBUTE_ADMIN_GROUP environment variable has been renamed to LDAP_ADMIN_GROUP_NAME.

  config · Pocket ID v2.0.0 · 2026-01-02

  rename `LDAP_ATTRIBUTE_ADMIN_GROUP` env variable to `LDAP_ADMIN_GROUP_NAME`

• ▲high

  The DbProvider environment variable has been removed and is now calculated dynamically.

  config · Pocket ID v2.0.0 · 2026-01-02

  remove DbProvider env variable and calculate it dynamically

• ▲high

  OIDC clients are now restricted by user groups by default, changing previous behavior.

  behaviour · Pocket ID v2.0.0 · 2026-01-02

  restrict oidc clients by user groups per default

• ▲high

  Insecure callback URLs are now allowed by default, potentially weakening security posture until the next major release.

  config · Pocket ID v2.11.0 · 2026-07-13

  allow insecure callback URLs by default until next major release

  Do: Review callback URL configurations to ensure they are secure, as the default has changed to allow insecure URLs.

• ■blocker

  This release includes security fixes that are highly recommended to apply immediately.

  security · Pocket ID v2.12.0 · 2026-07-29

  This version includes some security fixes, it's highly recommended to update.

• ▲high

  The user-initiated one-time access token login method has been removed, breaking existing flows using this authentication method.

  removal · Pocket ID v2.12.0 · 2026-07-29

  drop user initiated one time access token login method

  Do: Migrate users to the new one-time token actor mechanism or alternative sign-in methods.

• ▲high

  Upgrading to SvelteKit 3 may introduce breaking API changes or require configuration updates.

  config · Pocket ID v2.18.0 · 2026-10-04

  upgrade to SvelteKit 3

  Do: Review SvelteKit 3 migration guide for breaking changes.

• ■blocker

  Automated updates using the 'latest' image tag are discouraged as they may pull breaking changes from major version upgrades.

  migration · Pocket ID v2.19.2 · 2026-11-02

  If you are using automated updates make sure that you don't use the `latest` image tag, pin it to a major version instead e.g `v2`.

  Do: Pin your Docker image tag to a specific major version (e.g., `v2`) instead of `latest`.

Releases in this span

All Pocket ID versions and support cycles