dietrichmax/colota

v1.9.0 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 9d Forensics & Incident Response

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

android google-timeline gps-tracker gps-tracking location location-tracker

+1 more

react-native

Affected surfaces

crypto_tls auth

ReleasePort's take

Moderate signal

editorial:auto 7d

Colota v1.9.0 now rejects Android user‑installed CA certificates for TLS trust.

Why it matters: If your workflows depend on custom Android CAs, they will no longer be trusted; migrate to system‑trusted certificates before upgrade.

Summary

AI summary

Updates New Features, Breaking Change, and Bug Fixes across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Breaking	High	Stricter TLS trust: user-installed Android CAs no longer trusted by Colota. Stricter TLS trust: user-installed Android CAs no longer trusted by Colota. Source: llm_adapter@2026-05-28 Confidence: high	—
Feature
Feature	Medium	Adds encrypted backup and restore of locations, settings, and credentials to a password‑protected .colota file. Adds encrypted backup and restore of locations, settings, and credentials to a password‑protected .colota file. Source: llm_adapter@2026-05-28 Confidence: high	—
Feature	Medium	Adds mTLS client certificate support for authenticating to servers during TLS handshake. Adds mTLS client certificate support for authenticating to servers during TLS handshake. Source: llm_adapter@2026-05-28 Confidence: high	—
Feature	Medium	Adds support for self‑signed and private CA certificates via new mTLS Settings screen. Adds support for self‑signed and private CA certificates via new mTLS Settings screen. Source: llm_adapter@2026-05-28 Confidence: high	—
Feature	Medium	Adds import of location history from GeoJSON, Google Timeline, GPX, KML, and CSV files. Adds import of location history from GeoJSON, Google Timeline, GPX, KML, and CSV files. Source: llm_adapter@2026-05-28 Confidence: high	—
Feature	Medium	Adds GPS position‑jump filter to automatically remove outlier points caused by GPS glitches. Adds GPS position‑jump filter to automatically remove outlier points caused by GPS glitches. Source: llm_adapter@2026-05-28 Confidence: high	—
Bugfix	Low	Removes the "Delete Queue" button from offline‑mode switch dialog; action remains via Data Management -> Clear Queue. Removes the "Delete Queue" button from offline‑mode switch dialog; action remains via Data Management -> Clear Queue. Source: llm_adapter@2026-05-28 Confidence: high	—

Full changelog

Breaking Change

Stricter TLS trust - User-installed CAs from Android Settings -> Encryption & credentials are no longer trusted by Colota. If your sync endpoint uses a self-signed or private-CA certificate that you previously trusted via system Settings, sync will fail until you re-import the CA via the new mTLS Settings -> Trusted Server CA flow. Publicly-trusted certificates (Let's Encrypt etc.) are unaffected.

New Features

Encrypted backup and restore - Bundle your locations, settings and credentials into a single password-encrypted .colota file you can store anywhere. Restore on the same device or migrate to a new one. There is no password recovery, so use a password you won't lose.
mTLS client certificate support - Authenticate to your server with a client certificate at the TLS handshake. Pick a cert already installed in Android's KeyChain or import a .p12 / .pfx file directly. Useful when your reverse proxy enforces mTLS.
Self-signed and private CA support - For self-hosters running their own CA, import a Trusted Server CA in the new mTLS Settings screen. Trust is scoped to Colota only
Import location history from external files - Merge GeoJSON, Google Timeline, GPX, KML and CSV files into your existing history. Duplicates are skipped, the preview shows any invalid rows and the import can optionally be queued for replication to your sync backend.
GPS position-jump filter - Filters out the rare GPS glitch where a single point appears many kilometres off your actual route. Works automatically and doesn't affect normal tracking.

Bug Fixes

Removed "Delete Queue" button - Cleaned up the offline-mode switch dialog. The same action remains accessible via Data Management -> Clear Queue

Full Changelog: https://github.com/dietrichmax/colota/compare/v1.8.0...v1.9.0

Breaking Changes

User-installed CAs from Android Settings are no longer trusted by Colota; sync with self‑signed or private CA certificates will fail until re‑imported via the new mTLS Settings -> Trusted Server CA flow.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track dietrichmax/colota

Get notified when new releases ship.

About dietrichmax/colota

All releases →