šļø Release date:
This release of PocketQuery is a bug fix, security and maintenance release.
Bug Fixes
-
A plus sign in a REST datasource's request parameters now reaches the server as a plus sign.
Security
-
SQL queries now run only a single statement that reads data or calls a stored procedure.
-
A REST datasource's own credentials are now removed from query results before they are shown.
-
The editable-parameter settings of a PocketQuery macro are now enforced on the server.
-
Testing the connection of an unsaved datasource now requires the PocketQuery administrator role.
-
Cached query results now expire reliably after 30 minutes.
-
Added automated checks that keep detailed database errors visible only to PocketQuery administrators.
Maintenance
-
Made deployments more reliable.
Compatibility notes
-
SQL queries: Queries that change data, schema or permissions (for example INSERT, UPDATE, DELETE, CREATE or GRANT), that contain more than one statement, or that call the database's own administrative procedures or functions that reach files, programs or other servers are no longer run. They show the message "This query was not run: PocketQuery only runs a single statement that reads data (such as SELECT) or calls a stored procedure." Rewrite such queries as read-only queries, or move the logic into a stored procedure.
-
SQL queries on MySQL, MariaDB, Db2, Informix, HANA, Snowflake, BigQuery, Redshift and Elasticsearch: JDBC escape syntax in curly braces (such as
{fn ...}) is no longer accepted, except around a single{call ...}. -
REST request parameters: A
+in a stored request parameter is now sent as a plus sign. Before, the server received it as a space. -
REST query results: If a response contains one of the datasource's own credentials in a form PocketQuery cannot remove, the result is not shown.
Internal version number: 2026-10-29