🗓️ Release date:
This release of PocketQuery is a security release.
Security
-
Stored results are verified before interactive content runs; refresh older stored results to restore charts.
-
JDBC URLs with properties that load local files, classes or plugins are now rejected.
-
REST datasources no longer follow redirects, and their hosts must resolve to public addresses.
-
XML imports only accept PocketQuery's own data types.
-
Templates containing scripts are now always sanitized, so event handlers and embedded content are removed.
-
User wildcards such as @user.email are now filled in on the server.
-
Live queries are now refused for guests and anonymous visitors on the server as well.
-
The pages using a query only list pages you are allowed to view.
-
The PocketQuery Builder in Rovo now asks for confirmation before every query preview.
-
Creator and editor names are looked up with your own permissions and may show as Unknown.
-
Imported items now show the importing user and time as their last update.
-
Cached query results are now bound to your Confluence site.
-
Imports only accept XML and JSON files.
-
REST header and parameter values are now write-only and are no longer included in exports or copies.
Internal version number: 2026-10-18