Pocket ID

v2.5.0 →v2.19.2

Releases to cross

18

Spanning

6 mo

Need action

5

What breaks

Every item below is quoted from the release notes it came from, and the quote was checked against the source before it was stored.

• ▲high

  Insecure callback URLs are now allowed by default, potentially weakening security posture until the next major release.

  config · Pocket ID v2.11.0 · 2026-07-13

  allow insecure callback URLs by default until next major release

  Do: Review callback URL configurations to ensure they are secure, as the default has changed to allow insecure URLs.

• ■blocker

  This release includes security fixes that are highly recommended to apply immediately.

  security · Pocket ID v2.12.0 · 2026-07-29

  This version includes some security fixes, it's highly recommended to update.

• ▲high

  The user-initiated one-time access token login method has been removed, breaking existing flows using this authentication method.

  removal · Pocket ID v2.12.0 · 2026-07-29

  drop user initiated one time access token login method

  Do: Migrate users to the new one-time token actor mechanism or alternative sign-in methods.

• ▲high

  Upgrading to SvelteKit 3 may introduce breaking API changes or require configuration updates.

  config · Pocket ID v2.18.0 · 2026-10-04

  upgrade to SvelteKit 3

  Do: Review SvelteKit 3 migration guide for breaking changes.

• ■blocker

  Automated updates using the 'latest' image tag are discouraged as they may pull breaking changes from major version upgrades.

  migration · Pocket ID v2.19.2 · 2026-11-02

  If you are using automated updates make sure that you don't use the `latest` image tag, pin it to a major version instead e.g `v2`.

  Do: Pin your Docker image tag to a specific major version (e.g., `v2`) instead of `latest`.

Releases in this span

All Pocket ID versions and support cycles