This release includes 2 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+1 more
Affected surfaces
ReleasePort's take
Light signalVisits now create one Place per visit instead of 25 candidates, simplifying the Visit/Place relationship. Place deletion no longer cascades to Visits, changing data lifecycle management.
Why it matters: Developers must update Visit/Place API code before upgrading. Real-time family tracking replaces 60-second polling. Self-hosted instances get critical Stats/Insights stability fix.
Summary
AI summaryUpdates ⚠️ Upgrade notes, fix, and feat across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Breaking | Medium |
Visit detection creates one Place per visit, not 25 candidates. Visit detection creates one Place per visit, not 25 candidates. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Breaking | Medium |
Place deletion no longer deletes visits; sets dependent: :nullify. Place deletion no longer deletes visits; sets dependent: :nullify. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Map v2 Hexagons layer adds H3 cell heatmap with zoom-adaptive resolution. Map v2 Hexagons layer adds H3 cell heatmap with zoom-adaptive resolution. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
OIDC PKCE support via OIDC_PKCE_ENABLED environment variable. OIDC PKCE support via OIDC_PKCE_ENABLED environment variable. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Visits auto-cleanup orphaned Places on reassignment or destroy. Visits auto-cleanup orphaned Places on reassignment or destroy. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Download trips as GPX or GeoJSON from trip page. Download trips as GPX or GeoJSON from trip page. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
POST /api/v1/visits/:id/select_place assigns Photon candidate to visit. POST /api/v1/visits/:id/select_place assigns Photon candidate to visit. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
GET /api/v1/visits/:id/possible_places returns live Photon suggestions. GET /api/v1/visits/:id/possible_places returns live Photon suggestions. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
GET/POST /api/v1/places/nearby now includes id, source, geodata. GET/POST /api/v1/places/nearby now includes id, source, geodata. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Optional OIDC PKCE support is available via `OIDC_PKCE_ENABLED=true` (off by default). Optional OIDC PKCE support is available via `OIDC_PKCE_ENABLED=true` (off by default). Source: granite4.1:30b@2026-05-21-audit Confidence: low |
— |
| Feature | Medium |
Visits automatically nullify their previous Place when reassigned or destroyed if the old Place has no notes, tags, or references. Visits automatically nullify their previous Place when reassigned or destroyed if the old Place has no notes, tags, or references. Source: granite4.1:30b@2026-05-21-audit Confidence: low |
— |
| Performance | Medium |
Family members' positions update in real time instead of every 60s. Family members' positions update in real time instead of every 60s. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Performance | Medium |
Real-time track boundary detector skips per-track scan when unnecessary. Real-time track boundary detector skips per-track scan when unnecessary. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Deprecation | Medium |
place_visits table will be dropped in follow-up release. place_visits table will be dropped in follow-up release. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Self-hosted no longer 500 on Stats/Insights with unset JWT_SECRET_KEY. Self-hosted no longer 500 on Stats/Insights with unset JWT_SECRET_KEY. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Tracks no longer split when points arrive late or out of order. Tracks no longer split when points arrive late or out of order. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Imports table shows duplicate-skip counts and all-duplicates notification. Imports table shows duplicate-skip counts and all-duplicates notification. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Trips respect GPS anomaly filter for route, distance, countries. Trips respect GPS anomaly filter for route, distance, countries. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Recalculate operations skip anomaly points, matching real-time generation. Recalculate operations skip anomaly points, matching real-time generation. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Same-tracker boundary merging skips tracks more than 5km apart. Same-tracker boundary merging skips tracks more than 5km apart. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
select_place validates lat/lon bounds, returns 422 on out-of-range. select_place validates lat/lon bounds, returns 422 on out-of-range. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
select_place deduplicates by name + 50m proximity, independent of geodata. select_place deduplicates by name + 50m proximity, independent of geodata. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Immich/Photoprism photos reappear after transient empty response. Immich/Photoprism photos reappear after transient empty response. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Map v2 Select Area includes anomaly points for bulk-delete coverage. Map v2 Select Area includes anomaly points for bulk-delete coverage. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Map v2 area Delete Points action restored; capped at 5,000 per request. Map v2 area Delete Points action restored; capped at 5,000 per request. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Timeline day click no longer corrupts Search end-time field. Timeline day click no longer corrupts Search end-time field. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Map v2 speed-color gradient editor saves and applies correctly. Map v2 speed-color gradient editor saves and applies correctly. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Bulk and single point deletion recalculate affected tracks. Bulk and single point deletion recalculate affected tracks. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Trip photos appear on sub-day trips; timestamps no longer truncated. Trip photos appear on sub-day trips; timestamps no longer truncated. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
DataMigrations::BackfillPlacesUserIdJob correctly excludes just-assigned places. DataMigrations::BackfillPlacesUserIdJob correctly excludes just-assigned places. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Bulk visit suggestion accepts both user_id and user_ids keywords. Bulk visit suggestion accepts both user_id and user_ids keywords. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Trips respect the GPS anomaly filter for route calculation, distance, and country detection; existing trips can be refreshed with “Recalculate trip”. Trips respect the GPS anomaly filter for route calculation, distance, and country detection; existing trips can be refreshed with “Recalculate trip”. Source: granite4.1:30b@2026-05-21-audit Confidence: low |
— |
| Bugfix | Medium |
“Recalculate tracks & stats” and “Re‑evaluate past data” skip anomaly points, aligning with real‑time generation behavior. “Recalculate tracks & stats” and “Re‑evaluate past data” skip anomaly points, aligning with real‑time generation behavior. Source: granite4.1:30b@2026-05-21-audit Confidence: low |
— |
| Bugfix | Low |
Import UI displays counts of skipped duplicates and notifies when an import consists solely of duplicates. Import UI displays counts of skipped duplicates and notifies when an import consists solely of duplicates. Source: granite4.1:30b@2026-05-21-audit Confidence: low |
— |
| Bugfix | Low |
Same‑tracker boundary merging ignores tracks that are more than 5 km apart, preventing unwanted GPS‑jump fusion. Same‑tracker boundary merging ignores tracks that are more than 5 km apart, preventing unwanted GPS‑jump fusion. Source: granite4.1:30b@2026-05-21-audit Confidence: low |
— |
| Refactor | Medium |
Visit place cleanup runs in Places::DeleteIfOrphanJob, not inline. Visit place cleanup runs in Places::DeleteIfOrphanJob, not inline. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
Orphaned Place cleanup for visits is now performed asynchronously via `Places::DeleteIfOrphanJob`. Orphaned Place cleanup for visits is now performed asynchronously via `Places::DeleteIfOrphanJob`. Source: granite4.1:30b@2026-05-21-audit Confidence: low |
— |
Full changelog
⚠️ Upgrade notes
- Run Settings → Recalculate tracks & stats to merge pre-existing overlapping tracks. #2463
- Visit detection now creates one Place per visit (was up to 25 candidates). Use
GET /api/v1/visits/:id/possible_placesandPOST /api/v1/visits/:id/select_placefor alternatives. Theplace_visitstable will be dropped in a follow-up release. - Run after deploy (both safe to re-run):
bin/rails dawarich:backfill_place_namesbin/rails dawarich:cleanup_suggested_places
Added
- Map v2 Hexagons layer — H3 cell heatmap, zoom-adaptive resolution. #2568
- Download a trip's points as GPX or GeoJSON from the trip page. #2400
- OIDC PKCE support via
OIDC_PKCE_ENABLED=true(off by default). #2282 POST /api/v1/visits/:id/select_place— assign a Photon candidate to a visit.- Visits auto-clean their previous Place on reassignment/destroy when it has no notes, tags, or other references.
Changed
GET /api/v1/visits/:id/possible_placesreturns live Photon suggestions; the assigned place comes first with itsid, others haveid: null.GET/POST /api/v1/places/nearbynow includeid,source, andgeodataper item (additive).Place#has_many :visitsis nowdependent: :nullify— deleting a Place no longer deletes its visits.
Fixed
select_placevalidates lat/lon bounds (422 on out-of-range) and serializes concurrent calls via PG advisory lock to prevent duplicate Places.select_placededups by name + 50 m proximity instead ofgeodataJSONB, working regardless ofSTORE_GEODATA.- Self-hosted instances no longer 500 on Stats/Insights when
JWT_SECRET_KEYis unset;/trial/upgradenow redirects home. #2682 - Imports table shows duplicate-skip counts and notifies when an import is all duplicates. #2721
- Family members' positions update in real time instead of every 60 s. #2733
- Immich/Photoprism photos reappear after a transient empty response (no more 30-minute hidden window). #1071, #784
- Map v2 Select Area includes anomaly points so bulk-delete works on them. #2476
- Map v2 area-selection: restored the "Delete N Points" action that disappeared in 1.7.8. Pro / self-hosted, confirmation prompt, capped at 5,000 per request; recalculates affected tracks and monthly stats. #2754
- Timeline day click no longer corrupts the Search end-time; fields match date-picker minute precision. #2624
- Map v2 speed-color gradient editor saves and applies correctly. #2120
- Trips respect the GPS anomaly filter for route, distance, and countries. Run Recalculate trip to refresh existing trips. #2474
- Bulk and single point deletion recalculate affected tracks. #2496
- "Recalculate tracks & stats" and "Re-evaluate past data" skip anomaly points, matching real-time generation. #2630
- Trip photos appear on sub-day trips (timestamps no longer truncated to dates). #2708
- Tracks no longer split into overlapping segments when points arrive late/out of order; same-device overlaps auto-merge on the next run. #2463
- Same-tracker boundary merging skips tracks more than 5 km apart (no more GPS-jump fusion).
- Visit place cleanup runs in
Places::DeleteIfOrphanJobinstead of inlineafter_commit. DataMigrations::BackfillPlacesUserIdJobcorrectly excludes just-assigned places from the orphan-delete pass.- Real-time track boundary detector skips the per-track scan when no untracked points exist.
- Bulk visit suggestion accepts both
user_id:anduser_ids:to survive stale Sidekiq jobs. #2740 RemoveUnusedIndexesmigration drops invalidpointsindexes left by failedREINDEX CONCURRENTLYbefore removing unused ones. #2124- Vendored
h3-jsretains its upstream Apache-2.0 license header. - Insights "Top Visited Locations" no longer underreports days for multi-month totals (e.g. 133 days rendered as "4 days"). #2743
💙 This release is supported by Steven B., James Manolios, chenrik, aldumil, derpderpington, Chippie, dint, jhalpern, Lex Fradski, Schlufo, cyberswan.at, craftyklaus, Andre, hogenf, naraxius, Embrace, martin4861, Alex, evetters, GregF, Jon Coffee, Lukas, Robbie G, Kilian, Hans G, Chris, tabaha, Andre, Michael C, Chris, Jonah B., Dante, daallex, Tanner A., Milien M., Mathias, Travis S., Matthew F., Johnathan D., bleibdirtroy, no1etal, dixet, Bailey J., Alex D., Benjamin M., Daniel A., Florian, BeeHappy, ChemistryDachshund, OrangeWindies, Michelangelo V., Edward, Erazem Z., Denis Abt, Tony G., Andrew D., Lomky, Osamu Y., Simon van B., Linus T., Christian C., Sebastian, Jan K., Nathan T., Max G., Lars N., Karol B., Konstantin, Johannes H., t3hero, g3lin, Tim, Philipp M., Brand K., Pablo F. M., Jon H., fkB, Mikael, Dániel A., Hai_Tsung, ShooTex, GreenTentacle, PinkahPandah, David, Ken, Denna G., Andre, Hendl91, Jon H., MrRed, Arkadiusz Z., Jake, Bator T., Alex J. H., eps-dev, twiggu, Dragan V., Jerome G., Carsten M., Sheya B., ArnyminerZ, Gustav B., higgs01, Frank F., F. J. Kruz, Jon D., Alexander J. H., Daniel D., Gonzalo M., Ricardo T., Christof Z., Abc123, Narrator, JohnSmith21, smartbert, A.M., Matthew Z., Dror T., Jonathan K., Henrik H., Kyle C., Mario B., Albin H., RN, Phillip S., Bernd, Tom, Brett J., Nick O., greeting7416, Dick, Brian R., on Patreon and KoFi 💙
What's Changed
- Add H3 hexagon visualization layer to Maps v2 by @Freika in https://github.com/Freika/dawarich/pull/2644
- fix: speed-color editor modal misses Stimulus controller (#2120) by @Freika in https://github.com/Freika/dawarich/pull/2748
- fix: timeline day-click sets invalid Search end-time (#2624) by @Freika in https://github.com/Freika/dawarich/pull/2747
- fix: include anomalies in Map v2 Select Area for bulk delete (#2476) by @Freika in https://github.com/Freika/dawarich/pull/2759
- fix: Trip geometry / stats respect anomaly filter (#2474) by @Freika in https://github.com/Freika/dawarich/pull/2761
- fix: don't cache empty photo search results (#1071, #784) by @Freika in https://github.com/Freika/dawarich/pull/2750
- fix: real-time family location updates (#2733) by @Freika in https://github.com/Freika/dawarich/pull/2757
- fix: surface skipped duplicates on imports (#2721) by @Freika in https://github.com/Freika/dawarich/pull/2749
- fix: guard upgrade-token paths on self-hosted (#2682) by @Freika in https://github.com/Freika/dawarich/pull/2760
- Real-time place suggestions + orphan cleanup by @Freika in https://github.com/Freika/dawarich/pull/2745
- fix: exclude anomalies from bulk track recalculation (#2630) by @Freika in https://github.com/Freika/dawarich/pull/2758
- Use ISO8601 timestamps for trip photo bounds and cover sub-day case by @Freika in https://github.com/Freika/dawarich/pull/2767
- feat: optional OIDC PKCE support (#2282) by @Freika in https://github.com/Freika/dawarich/pull/2753
- Recalculate tracks after bulk point delete by @ibigbug in https://github.com/Freika/dawarich/pull/2496
- Recalculate tracks after single + bulk point delete by @Freika in https://github.com/Freika/dawarich/pull/2768
- fix: reconcile overlapping tracks + reabsorb late-arriving points (#2463) by @Freika in https://github.com/Freika/dawarich/pull/2756
- Follow-ups to #2745: async place naming, advisory-lock dedup, SelectPlace input validation by @Freika in https://github.com/Freika/dawarich/pull/2769
- fix: clean invalid points indexes in RemoveUnusedIndexes migration (#2124) by @Freika in https://github.com/Freika/dawarich/pull/2751
- feat: trip page GPX/GeoJSON download button (#2400) by @Freika in https://github.com/Freika/dawarich/pull/2752
- Fix/map settings panel by @caddish in https://github.com/Freika/dawarich/pull/2738
- fix: BulkVisitsSuggestingJob accepts legacy user_id keyword (#2740) by @Freika in https://github.com/Freika/dawarich/pull/2763
- Fix Insights top visited locations underreporting days by @danielr18 in https://github.com/Freika/dawarich/pull/2743
- feat: Map v2 area-selection bulk delete by @Freika in https://github.com/Freika/dawarich/pull/2754
- 1.7.9 by @Freika in https://github.com/Freika/dawarich/pull/2729
New Contributors
- @ibigbug made their first contribution in https://github.com/Freika/dawarich/pull/2496
- @danielr18 made their first contribution in https://github.com/Freika/dawarich/pull/2743
Full Changelog: https://github.com/Freika/dawarich/compare/1.7.8...1.7.9
Breaking Changes
- Visit place assignment now creates a single Place per visit; `place_visits` table will be dropped in a follow‑up release.
- `Place#has_many :visits` changed to `dependent: :nullify`, so deleting a Place no longer deletes its visits.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About dawarich
Your favorite self-hostable alternative to Google Timeline (Google Location History)
Related context
Earlier breaking changes
- v1.7.8 Places without linked visits are permanently deleted during ownership migration.
- v1.7.8 `ALLOW_EMAIL_PASSWORD_REGISTRATION` no longer controls login; use `ALLOW_EMAIL_PASSWORD_LOGIN` (defaults true).
- v1.7.8 Self-hosters must set ALLOW_EMAIL_PASSWORD_LOGIN=false for OIDC-only sign-in after upgrade.
Beta — feedback welcome: [email protected]