This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+1 more
Affected surfaces
ReleasePort's take
Moderate signalThe release bumps bundled gems to close 9 known CVEs and adds several bugfixes and new features across Map v2, the visits API, onboarding, and visit assignment.
Why it matters: Closing 9 known CVEs in bundled dependencies reduces attack surface; immediate patch adoption is advised for security hygiene.
Summary
AI summaryVisits can now be manually assigned to saved areas, adopting the area name unless overridden by a custom name or place.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Bumped bundled gems to close 9 known CVEs. Bumped bundled gems to close 9 known CVEs. Source: llm_adapter@2026-05-31 Confidence: high |
— |
| Feature | Low |
Onboarding "Load demo data" seeds a fully populated /map/v2 instantly with 30‑day Berlin and Prague‑weekend trip data (~80 visits). Onboarding "Load demo data" seeds a fully populated /map/v2 instantly with 30‑day Berlin and Prague‑weekend trip data (~80 visits). Source: llm_adapter@2026-05-31 Confidence: high |
— |
| Feature | Low |
Visits can be manually assigned to saved areas; area name auto‑applies unless custom name or place overrides. Visits can be manually assigned to saved areas; area name auto‑applies unless custom name or place overrides. Source: llm_adapter@2026-05-31 Confidence: high |
— |
| Bugfix | Medium |
Map v2 Timeline calendar now lights up days with raw points before generation completes. Map v2 Timeline calendar now lights up days with raw points before generation completes. Source: llm_adapter@2026-05-31 Confidence: high |
— |
| Bugfix | Medium |
Map v2 visits layer respects selected date range filter. Map v2 visits layer respects selected date range filter. Source: llm_adapter@2026-05-31 Confidence: high |
— |
| Bugfix | Medium |
POST /api/v1/visits no longer links a visit to another user's place. POST /api/v1/visits no longer links a visit to another user's place. Source: llm_adapter@2026-05-31 Confidence: high |
— |
| Bugfix | Medium |
Map v2 settings panel "Apply Settings" now saves changes persistently. Map v2 settings panel "Apply Settings" now saves changes persistently. Source: llm_adapter@2026-05-31 Confidence: high |
— |
| Bugfix | Medium |
Reverse‑geocoding flood handling coalesces duplicate enqueues, caps retries at 3, and nightly sweep clears dedup keys. Reverse‑geocoding flood handling coalesces duplicate enqueues, caps retries at 3, and nightly sweep clears dedup keys. Source: llm_adapter@2026-05-31 Confidence: high |
— |
| Bugfix | Medium |
Cloud only: PostHog exception capture enabled for production error diagnosis. Cloud only: PostHog exception capture enabled for production error diagnosis. Source: llm_adapter@2026-05-31 Confidence: high |
— |
| Bugfix | Low |
Two unused indexes on the `points` table are dropped on upgrade, freeing several GB of disk on large self‑hosted instances. Two unused indexes on the `points` table are dropped on upgrade, freeing several GB of disk on large self‑hosted instances. Source: llm_adapter@2026-05-31 Confidence: low |
— |
Full changelog
Added
- Onboarding "Load demo data" now seeds a fully populated
/map/v2instantly: 30 days of Berlin + a Prague-weekend trip, ~80 visits with tags and places, and stats anchored to the current calendar month. "Remove demo data" wipes everything in one click while preserving anything you've confirmed, edited, or built on top of (visits, trips, places, tags adopted by user action stay). - Visits can now be manually assigned to one of your saved areas. When you do, the visit takes the area's name automatically — unless you've already given it a custom name, or you've also picked a place (a place name wins over an area name). Available via API now; UI to follow. #2577
Changed
- Two unused indexes on the
pointstable are dropped on upgrade; on large self-hosted instances this frees several GB of disk. - Areas now validate their geometry: radius must be greater than 0, latitude must be within -90…90, and longitude within -180…180. Invalid values are rejected instead of silently saved.
- Bumped bundled gems (aws-sdk, devise, jwt, httparty, and others) to close 9 known CVEs. Self-hosters get the security fixes by upgrading.
Fixed
- Cloud only: PostHog exception capture is enabled to help diagnose production errors.
- Map v2 Timeline calendar now lights up days that have raw points even before Track or Visit generation has caught up, matching the Insights → Activity Overview calendar. #2579
- Reverse-geocoding flood: duplicate per-point enqueues are now coalesced for 24 h via a Redis dedup key, retries are capped at 3, and the nightly sweep bypasses (and clears) the dedup so points whose retries were exhausted — or whose key still lingers — are picked up on the next run.
- Map v2 visits layer now honours the selected date range. Since 1.7.10 the viewport-bounded visits fetch silently dropped the
start_at/end_atfilter on the backend, so all visits inside the viewport were rendered regardless of the date filter. #2817 POST /api/v1/visitsno longer links a new visit to a place owned by another user. Passing a foreignplace_idis ignored — the visit gets a place owned by the requester at the requested coordinates, and the response no longer echoes the other user's place id or coordinates.- Map v2 settings panel: "Apply Settings" now actually saves your changes. Points rendering mode, speed-colored routes, live mode, and fog-of-war toggles all persist on click and reload. Apply/Reset buttons moved above the Transportation Mode section so they sit inside the outer form. #2680
- The app no longer trips firewall blocks by repeatedly checking family status when you're not part of a family.
💙 This release is supported by Steven B., James Manolios, chenrik, aldumil, derpderpington, Chippie, dint, jhalpern, Lex Fradski, Schlufo, cyberswan.at, craftyklaus, Andre, hogenf, naraxius, Embrace, martin4861, Alex, evetters, GregF, Jon Coffee, Lukas, Robbie G, Kilian, Hans G, Chris, tabaha, Andre, Michael C, Chris, Jonah B., Dante, daallex, Tanner A., Milien M., Mathias, Travis S., Matthew F., Johnathan D., bleibdirtroy, no1etal, dixet, Bailey J., Alex D., Benjamin M., Daniel A., Florian, BeeHappy, ChemistryDachshund, OrangeWindies, Michelangelo V., Edward, Erazem Z., Denis Abt, Tony G., Andrew D., Lomky, Osamu Y., Simon van B., Linus T., Christian C., Sebastian, Jan K., Nathan T., Max G., Lars N., Karol B., Konstantin, Johannes H., t3hero, g3lin, Tim, Philipp M., Brand K., Pablo F. M., Jon H., fkB, Mikael, Dániel A., Hai_Tsung, ShooTex, GreenTentacle, PinkahPandah, David, Ken, Denna G., Andre, Hendl91, Jon H., MrRed, Arkadiusz Z., Jake, Bator T., Alex J. H., eps-dev, twiggu, Dragan V., Jerome G., Carsten M., Sheya B., ArnyminerZ, Gustav B., higgs01, Frank F., F. J. Kruz, Jon D., Alexander J. H., Daniel D., Gonzalo M., Ricardo T., Christof Z., Narrator, JohnSmith21, smartbert, A.M., Matthew Z., Dror T., Jonathan K., Henrik H., Kyle C., Mario B., Albin H., RN, Phillip S., Bernd, Tom, Brett J., Nick O., greeting7416, Dick, Brian R., Henning, Markus, TheSlimShady, on Patreon and KoFi 💙
What's Changed
- 1.7.11 by @Freika in https://github.com/Freika/dawarich/pull/2818
Full Changelog: https://github.com/Freika/dawarich/compare/1.7.10...1.7.11
Security Fixes
- Bumped bundled gems (aws-sdk, devise, jwt, httparty, etc.) to close 9 known CVEs
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About dawarich
Your favorite self-hostable alternative to Google Timeline (Google Location History)
Related context
Earlier breaking changes
- v1.7.9 Place deletion no longer deletes visits; sets dependent: :nullify.
- v1.7.9 Visit detection creates one Place per visit, not 25 candidates.
- v1.7.8 Places without linked visits are permanently deleted during ownership migration.
- v1.7.8 `ALLOW_EMAIL_PASSWORD_REGISTRATION` no longer controls login; use `ALLOW_EMAIL_PASSWORD_LOGIN` (defaults true).
- v1.7.8 Self-hosters must set ALLOW_EMAIL_PASSWORD_LOGIN=false for OIDC-only sign-in after upgrade.
Beta — feedback welcome: [email protected]