Skip to content

dawarich

v1.8.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Privacy & Ad-blocking
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

google-maps gpslogger self-hosted maps memory owntracks
+1 more
timeline

Affected surfaces

auth

ReleasePort's take

Moderate signal
editorial:auto 1mo

The release updates the `oauth2` gem to 2.0.22, fixing a credential‑leak advisory (GHSA-pp92-crg2-gfv9) that affected Google/GitHub sign‑in flows.

Why it matters: Fixes a high‑severity (90) credential‑leak vulnerability in the Google/GitHub authentication path; upgrade immediately if you use this flow.

Summary

AI summary

Updates GHSA-pp92-crg2-gfv9, https://www.patreon.com/freika, and Self-hosted across a mixed release.

Changes in this release

Security Critical

Bumped the `oauth2` gem to 2.0.22 to close a known credential-leak advisory (GHSA-pp92-crg2-gfv9) on the Google/GitHub sign-in path

Bumped the `oauth2` gem to 2.0.22 to close a known credential-leak advisory (GHSA-pp92-crg2-gfv9) on the Google/GitHub sign-in path

Source: llm_adapter@2026-06-11

Confidence: high

Feature Low

Fog of War (Map v2) can now reveal explored areas per hexagon instead of per point, using precalculated monthly statistics; switch between "Per point" and "Per hexagon" in the map settings panel (#2899)

Fog of War (Map v2) can now reveal explored areas per hexagon instead of per point, using precalculated monthly statistics; switch between "Per point" and "Per hexagon" in the map settings panel (#2899)

Source: llm_adapter@2026-06-11

Confidence: high

Feature Low

Globe view is enabled by default for Pro and self‑hosted users

Globe view is enabled by default for Pro and self‑hosted users

Source: granite4.1:30b@2026-06-11-audit

Confidence: low

Feature Low

Map v2 Replay plays back proportionally to real elapsed time (1x = one real minute per second) and skips long point‑free gaps quickly; speed multiplier compresses further (#2845)

Map v2 Replay plays back proportionally to real elapsed time (1x = one real minute per second) and skips long point‑free gaps quickly; speed multiplier compresses further (#2845)

Source: granite4.1:30b@2026-06-11-audit

Confidence: low

Feature Low

Cloud Lite plan's 12‑month data window now applies to the Points page; "points outside your window" hint no longer caps visible points at the page size

Cloud Lite plan's 12‑month data window now applies to the Points page; "points outside your window" hint no longer caps visible points at the page size

Source: granite4.1:30b@2026-06-11-audit

Confidence: low

Performance Medium

Loading points on the map is faster for large histories; the points API now uses a spatial index when filtering by visible area instead of scanning every point in the date range

Loading points on the map is faster for large histories; the points API now uses a spatial index when filtering by visible area instead of scanning every point in the date range

Source: llm_adapter@2026-06-11

Confidence: high

Performance Medium

Monthly statistics calculation is lighter for point‑heavy months: hexagon aggregation reads coordinates in a single pass without instantiating database records and avoids re‑querying the whole month when falling back to lower resolution

Monthly statistics calculation is lighter for point‑heavy months: hexagon aggregation reads coordinates in a single pass without instantiating database records and avoids re‑querying the whole month when falling back to lower resolution

Source: granite4.1:30b@2026-06-11-audit

Confidence: low

Performance Low

Timeline day view eliminates one extra database query per visit; initial map view bounds are computed in a single query instead of two

Timeline day view eliminates one extra database query per visit; initial map view bounds are computed in a single query instead of two

Source: granite4.1:30b@2026-06-11-audit

Confidence: low

Performance Low

/admin/flipper feature‑flag UI is no longer rate‑limited, making it usable after multiple clicks (#2897)

/admin/flipper feature‑flag UI is no longer rate‑limited, making it usable after multiple clicks (#2897)

Source: granite4.1:30b@2026-06-11-audit

Confidence: low

Bugfix Medium

Deleting an import no longer gets stuck on an endless spinner; failed deletions revert to a retriable state and show a retry button after over one hour (#2835)

Deleting an import no longer gets stuck on an endless spinner; failed deletions revert to a retriable state and show a retry button after over one hour (#2835)

Source: llm_adapter@2026-06-11

Confidence: high

Bugfix Medium

Insights no longer report spurious "new country visited" entries caused by border‑crossing geocoding blips; yearly digest applies the same filter as monthly pages (#2727)

Insights no longer report spurious "new country visited" entries caused by border‑crossing geocoding blips; yearly digest applies the same filter as monthly pages (#2727)

Source: llm_adapter@2026-06-11

Confidence: high

Bugfix Medium

Deleting points or anomaly points via the map's "Select Area" tool now removes them from the anomalies layer immediately, without requiring a page reload (#2790)

Deleting points or anomaly points via the map's "Select Area" tool now removes them from the anomalies layer immediately, without requiring a page reload (#2790)

Source: llm_adapter@2026-06-11

Confidence: high

Bugfix Medium

OIDC login no longer fails with "undefined method 'with_indifferent_access'" when OIDC_ISSUER includes the /.well-known/openid-configuration suffix; the trailing path is now stripped automatically (#2056)

OIDC login no longer fails with "undefined method 'with_indifferent_access'" when OIDC_ISSUER includes the /.well-known/openid-configuration suffix; the trailing path is now stripped automatically (#2056)

Source: llm_adapter@2026-06-11

Confidence: high

Bugfix Medium

Importing files with invalid UTF‑8 bytes (e.g., Windows‑encoded degree signs) no longer fails; JSON, OwnTracks, and TCX importers now handle such cases gracefully (#2772)

Importing files with invalid UTF‑8 bytes (e.g., Windows‑encoded degree signs) no longer fails; JSON, OwnTracks, and TCX importers now handle such cases gracefully (#2772)

Source: llm_adapter@2026-06-11

Confidence: high

Bugfix Medium

Moving a point on Map v2 no longer drags unrelated route lines; routes are rebuilt from updated points instead of patching nearby vertices (#2150)

Moving a point on Map v2 no longer drags unrelated route lines; routes are rebuilt from updated points instead of patching nearby vertices (#2150)

Source: llm_adapter@2026-06-11

Confidence: high

Bugfix Medium

Data recalculation no longer fails with "Year has already been taken" when duplicate year‑end digests exist; duplicates are cleaned up automatically (#2866)

Data recalculation no longer fails with "Year has already been taken" when duplicate year‑end digests exist; duplicates are cleaned up automatically (#2866)

Source: llm_adapter@2026-06-11

Confidence: high

Bugfix Low

Months with very small distances on the Stats page now render a visible bar and show their tooltip; months without data no longer render a bar

Months with very small distances on the Stats page now render a visible bar and show their tooltip; months without data no longer render a bar

Source: granite4.1:30b@2026-06-11-audit

Confidence: low

Bugfix Low

Weekday labels in the Insights "Activity Overview" heatmap now line up with their grid rows (#2896)

Weekday labels in the Insights "Activity Overview" heatmap now line up with their grid rows (#2896)

Source: granite4.1:30b@2026-06-11-audit

Confidence: low

Bugfix Low

The replay marker now renders above track and route lines instead of being hidden beneath them

The replay marker now renders above track and route lines instead of being hidden beneath them

Source: granite4.1:30b@2026-06-11-audit

Confidence: low

Bugfix Low

Deleting a family no longer fails with a 500 error when location‑sharing requests exist for it (#2916)

Deleting a family no longer fails with a 500 error when location‑sharing requests exist for it (#2916)

Source: granite4.1:30b@2026-06-11-audit

Confidence: low

Bugfix Low

The Anomalies map layer now remembers being enabled across page reloads and day changes, like other layers (#2791)

The Anomalies map layer now remembers being enabled across page reloads and day changes, like other layers (#2791)

Source: granite4.1:30b@2026-06-11-audit

Confidence: low

Bugfix Low

The suggested‑visit card no longer promises alternative suggestions that never arrive; it now points to the visit's search button for picking a different place (#2852)

The suggested‑visit card no longer promises alternative suggestions that never arrive; it now points to the visit's search button for picking a different place (#2852)

Source: granite4.1:30b@2026-06-11-audit

Confidence: low

Refactor Medium

Post‑import steps (stats scheduling, anomaly filtering) no longer affect the import's status after successful point writes

Post‑import steps (stats scheduling, anomaly filtering) no longer affect the import's status after successful point writes

Source: granite4.1:30b@2026-06-11-audit

Confidence: low

Full changelog

Upgrade notes:

  1. A migration removes duplicate year-end digests that could accumulate before this release. If a yearly recap in Insights showed odd numbers, they may change after the upgrade — that's the duplicates being cleaned up.

Added

  • Fog of War (Map v2) can now reveal explored areas per hexagon instead of per point, using precalculated monthly statistics. Switch between "Per point" and "Per hexagon" in the map settings panel. (#2899)

Changed

  • The suggested-visit card no longer promises alternative suggestions that never arrive; it now points to the visit's search button for picking a different place (#2852)
  • Loading points on the map is faster on large histories: the points API now uses the spatial index when filtering by the visible map area, instead of scanning every point in the date range
  • Monthly statistics are lighter to calculate for point-heavy months: hexagon aggregation reads coordinates in a single pass without instantiating database records, and no longer re-queries the whole month when it has to fall back to a lower hexagon resolution
  • The Timeline day view no longer issues one extra database query per visit, and the initial map view's bounds are computed in a single query instead of two
  • Bumped the oauth2 gem to 2.0.22 to close a known credential-leak advisory (GHSA-pp92-crg2-gfv9) on the Google/GitHub sign-in path
  • CI now runs the full RSpec suite on every pull request; the previous workflow had been disabled
  • Globe view is enabled by default for Pro and self-hosted users.

Fixed

  • Deleting an import no longer gets stuck on an endless spinner: failed deletions revert to a retriable state, and imports stalled in "Deleting" for over an hour show a retry button (#2835)
  • Insights no longer report a "new country visited" for border-crossing geocoding blips that the statistics pages already filter out; the yearly digest now applies the same rule as the monthly one (#2727)
  • Deleting points or anomaly points via the map's "Select Area" tool now removes them from the anomalies layer immediately, without requiring a page reload (#2790)
  • Months with very small distances on the Stats page now render a visible bar and show their tooltip; months without data no longer render a bar at all (#2864)
  • Weekday labels in the Insights "Activity Overview" heatmap now line up with their grid rows (#2896)
  • OIDC login no longer fails with "undefined method 'with_indifferent_access'" when OIDC_ISSUER is set to the full discovery URL — the trailing /.well-known/openid-configuration is now stripped automatically (#2056)
  • Importing files containing invalid UTF-8 bytes (e.g. Windows-encoded degree signs in Google Timeline phone exports) no longer fails with "invalid byte sequence in UTF-8". Applies to the JSON-based importers as well as OwnTracks and TCX (#2772)
  • Moving a point on Map v2 no longer drags unrelated route lines along with it; routes are rebuilt from the updated points instead of patching nearby line vertices (#2150)
  • An import that finished successfully could still be marked "Failed" — with a failure notification — when a post-import step (stats scheduling, anomaly filtering) raised after all points were already written; post-import steps no longer affect the import's status
  • Cloud only: the Lite plan's 12-month data window now applies to the Points page as well, and the "points outside your window" hint no longer caps the visible-points count at the page size
  • Data recalculation no longer fails with "Year has already been taken" when duplicate year-end digests exist; duplicates are cleaned up automatically and can no longer be created (#2866)
  • The Anomalies map layer now remembers being enabled across page reloads and day changes, like other layers (#2791)
  • Map v2 Replay now plays back proportionally to real elapsed time (at 1x, one real minute per second; speed multiplier compresses further) instead of one point per tick, so slow and fast journeys of equal duration take equal playback time; long point-free gaps are skipped quickly instead of stalling (#2845)
  • The replay marker now renders above track and route lines instead of being hidden beneath them
  • Deleting a family no longer fails with a 500 error when location-sharing requests exist for it (#2916)
  • Self-hosted: the /admin/flipper feature-flag UI is no longer rate-limited, which made it unusable after a few clicks (#2897)

💙 This release is supported by Steven B., James Manolios, chenrik, aldumil, derpderpington, Chippie, dint, jhalpern, Lex Fradski, Schlufo, cyberswan.at, craftyklaus, Andre, hogenf, naraxius, Embrace, martin4861, Alex, evetters, GregF, Jon Coffee, Lukas, Robbie G, Kilian, Hans G, Chris, tabaha, Andre, Michael C, Chris, Jonah B., Dante, daallex, Tanner A., Milien M., Mathias, Travis S., Matthew F., Johnathan D., bleibdirtroy, no1etal, dixet, Bailey J., Alex D., Benjamin M., Daniel A., Florian, BeeHappy, ChemistryDachshund, OrangeWindies, Michelangelo V., Edward, Erazem Z., Denis Abt, Tony G., Andrew D., Lomky, Osamu Y., Simon van B., Linus T., Christian C., Sebastian, Jan K., Nathan T., Max G., Lars N., Karol B., Konstantin, Johannes H., t3hero, g3lin, Tim, Philipp M., Brand K., Pablo F. M., Jon H., fkB, Mikael, Dániel A., Hai_Tsung, ShooTex, GreenTentacle, PinkahPandah, David, Ken, Denna G., Andre, Hendl91, Jon H., MrRed, Arkadiusz Z., Jake, Bator T., Alex J. H., eps-dev, twiggu, Dragan V., Jerome G., Sheya B., ArnyminerZ, Gustav B., higgs01, Frank F., F. J. Kruz, Jon D., Alexander J. H., Daniel D., Gonzalo M., Ricardo T., Christof Z., Narrator, JohnSmith21, smartbert, A.M., Matthew Z., Dror T., Jonathan K., Henrik H., Kyle C., Mario B., Albin H., Phillip S., Bernd, Tom, Brett J., Nick O., greeting7416, Dick, Brian R., Henning, Markus, TheSlimShady, Andrew M., Peter D., Mkpenguin, Mason B., Chance, GoogilyBoogily on Patreon and KoFi 💙


What's Changed

  • 1.8.1 by @Freika in https://github.com/Freika/dawarich/pull/2914

Full Changelog: https://github.com/Freika/dawarich/compare/1.8.0...1.8.1

Security Fixes

  • GHSA-pp92-crg2-gfv9 — credential‑leak advisory closed by bumping oauth2 gem to 2.0.22 on Google/GitHub sign‑in path

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track dawarich

Get notified when new releases ship.

Sign up free

About dawarich

Your favorite self-hostable alternative to Google Timeline (Google Location History)

All releases →

Related context

Earlier breaking changes

  • v1.10.1 Drops legacy `latitude`/`longitude` columns on `points`; migrates to single `lonlat` column.
  • v1.8.0 Changes declining a visit to delete the visit entirely; removes "Declined" filter and Restore action.
  • v1.7.9 Place deletion no longer deletes visits; sets dependent: :nullify.
  • v1.7.9 Visit detection creates one Place per visit, not 25 candidates.
  • v1.7.8 Places without linked visits are permanently deleted during ownership migration.

Beta — feedback welcome: [email protected]