This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+1 more
Affected surfaces
ReleasePort's take
Light signalThe /api/v1/points endpoint now delivers ~5× faster responses for large date ranges, and the default self‑hosted stack’s memory usage drops by ~20%.
Why it matters: Performance gains: API latency reduced 5×; resource efficiency improved with a 20% smaller memory footprint. Operators should monitor these metrics post‑upgrade.
Summary
AI summaryBroad release touches fix, deps, feat, and Fix.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Adds Poster Studio for designing printable travel posters. Adds Poster Studio for designing printable travel posters. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds API endpoints for demo data management (`/api/v1/demo_data`). Adds API endpoints for demo data management (`/api/v1/demo_data`). Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds API endpoints for syncing mobile app settings (`/api/v1/settings/mobile`). Adds API endpoints for syncing mobile app settings (`/api/v1/settings/mobile`). Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Map v2 now reopens at the last viewport instead of a zoomed‑out globe when no data matches the selected date range. Map v2 now reopens at the last viewport instead of a zoomed‑out globe when no data matches the selected date range. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Adds custom map color presets and an organized, collapsible Settings tab for managing colors. Adds custom map color presets and an organized, collapsible Settings tab for managing colors. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Shows a dismissible banner in Map v1 announcing its retirement in August 2026 and notes family location history visibility only on Map v2. Shows a dismissible banner in Map v1 announcing its retirement in August 2026 and notes family location history visibility only on Map v2. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
During replay, photos stack as tilted Polaroid‑style cards in the top‑left corner (up to five), clickable to open. During replay, photos stack as tilted Polaroid‑style cards in the top‑left corner (up to five), clickable to open. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Adds a “recenter & follow” button in the replay panel to keep the camera following moving markers during playback. Adds a “recenter & follow” button in the replay panel to keep the camera following moving markers during playback. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Toggling the photos layer during an ongoing replay now adds or removes photo cards live (both corner pile and map markers). Toggling the photos layer during an ongoing replay now adds or removes photo cards live (both corner pile and map markers). Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Clarifies the “Location history” toggle in settings, explaining its distinction from live location and expanding default window to 7 days. Clarifies the “Location history” toggle in settings, explaining its distinction from live location and expanding default window to 7 days. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Makes print ordering discoverable from any Poster Studio layout via Stripe Checkout (Gelato). Makes print ordering discoverable from any Poster Studio layout via Stripe Checkout (Gelato). Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Performance | Medium |
/api/v1/points endpoint is ~5× faster over large date ranges. /api/v1/points endpoint is ~5× faster over large date ranges. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Performance | Medium |
Default self‑hosted stack memory footprint reduced by ~20%. Default self‑hosted stack memory footprint reduced by ~20%. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Performance | Low |
Public shared‑trip pages now query Immich/Photoprism once per view by caching the photo search result briefly. Public shared‑trip pages now query Immich/Photoprism once per view by caching the photo search result briefly. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Medium |
Fixes admin user‑management forms showing HTTP 422 errors on validation failure. Fixes admin user‑management forms showing HTTP 422 errors on validation failure. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Fixes raw data archival read failures and export portability. Fixes raw data archival read failures and export portability. Source: llm_adapter@2026-07-15 Confidence: low |
— |
| Bugfix | Medium |
Fixes Photoprism photo import failures due to date filter format. Fixes Photoprism photo import failures due to date filter format. Source: llm_adapter@2026-07-15 Confidence: low |
— |
| Bugfix | Medium |
Fixes family location history display on Map v2. Fixes family location history display on Map v2. Source: llm_adapter@2026-07-15 Confidence: low |
— |
| Bugfix | Medium |
Fixes email delivery timeouts with implicit TLS (SMTP port 465). Fixes email delivery timeouts with implicit TLS (SMTP port 465). Source: llm_adapter@2026-07-15 Confidence: low |
— |
| Bugfix | Medium |
Fixes Photoprism photo import failures by sending date filters as plain YYYY-MM-DD strings. Fixes Photoprism photo import failures by sending date filters as plain YYYY-MM-DD strings. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Medium |
Prevents accidental point movement on Map v2 by requiring an “Edit points” toggle; the toggle resets each page load. Prevents accidental point movement on Map v2 by requiring an “Edit points” toggle; the toggle resets each page load. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Medium |
Ensures deleting a point on Map v2 removes it instantly and restores it if the delete request fails. Ensures deleting a point on Map v2 removes it instantly and restores it if the delete request fails. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Medium |
Fixes family location history returning nil coordinates by deriving them from lonlat column. Fixes family location history returning nil coordinates by deriving them from lonlat column. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Medium |
Prevents empty duplicate visits when a new point bridges two separate visits; nightly re‑scan now leaves confirmed visits untouched. Prevents empty duplicate visits when a new point bridges two separate visits; nightly re‑scan now leaves confirmed visits untouched. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Medium |
Generates routes for points added retroactively through API or trackers, eliminating need for manual recalculation. Generates routes for points added retroactively through API or trackers, eliminating need for manual recalculation. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Resolves raw data archival read failures, adds month labeling, verification pipeline, and makes exports portable (gzip files). Resolves raw data archival read failures, adds month labeling, verification pipeline, and makes exports portable (gzip files). Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
Full changelog
⚠️ Important: ⚠️ there are some changes to defaults in the docker-compose.yml for self-hosted users. You may want to adjust environment variables to reduce memory usage or increase concurrency. See the "Changed" section below.
Added
- Poster Studio: design a printable poster of your travels in a full-screen studio opened from Map v2, with live preview, theme and layout presets, text controls, and PNG/PDF export. Posters can be saved to a server-rendered gallery or — in the future releases — ordered as a print via Stripe. Self-hosters: the Docker image grows by ~100 MB for the server-side renderer, and gallery rendering is unavailable on 32-bit ARM (armv7) hosts.
- New API endpoints
GET/POST/DELETE /api/v1/demo_datato check, load and remove demo data, enabling demo-data onboarding in the mobile app. - New API endpoints
GET/PATCH /api/v1/settings/mobilefor syncing mobile app settings between devices (most recent write wins). The existing settings API now also acceptsmaps.distance_unitand merges themapshash instead of replacing it, so partial updates no longer wipe other map settings. - Map v2 now reopens at your last viewport instead of the zoomed-out globe when the selected date range has no data to fit.
- Custom map colors: pick from theme presets or edit individual color tokens for the map, and a reorganized, collapsible Settings tab to manage them.
- The classic map (v1) now shows a dismissible banner announcing its retirement in August 2026, plus — when your family shares location — a second banner noting that family location history is only visible on Map v2. Dismissals are remembered per browser.
Changed
- The default self-hosted stack now idles about 20% lighter (app container 452 → 325 MB, whole stack 843 → 690 MB):
docker-compose.ymldefaults to one Puma worker (WEB_CONCURRENCY=1) and 3 background job threads (BACKGROUND_PROCESSING_CONCURRENCY=3) — raise either env var for busier instances — and jemalloc now returns freed memory to the OS promptly. Installations that already set these variables are unaffected (#3119). - Deleting a point on Map v2 now removes it instantly and restores it if the delete request fails.
- During replay, photos now stack up as a tilted, Polaroid-style pile in the top-left corner as the playhead reaches them (newest on top, up to five shown); click a photo to open it. The pile stays in sync as you play, scrub, or rewind, and works on map, trip, and public shared-trip replays.
- Toggling the photos layer during a running replay now adds or removes its photos live (corner pile and map markers) — previously photos only appeared if the layer was enabled before starting the replay.
- Replay panel: a new recenter & follow button. The camera follows the moving marker during playback; dragging the map turns following off, and the button re-centers and resumes it.
- The replay panel no longer shows the per-day point count.
GET /api/v1/pointsis significantly faster over large date ranges: slim responses are built from a single SQL query (~5× faster, byte-identical output), the bounding-box filter runs as a single PostGIS predicate, and repeat requests answer304 Not Modifiedvia ETags. Map v2 and the monthly stats map both use this path (#3026).- Public shared-trip pages now query Immich/Photoprism once per view instead of twice: the photo search result is briefly cached and reused.
Fixed
- Family location history now actually shows up on Map v2: the history endpoint read coordinates from the legacy
latitude/longitudecolumns, which are empty on instances that only store the PostGISlonlatvalue, so nothing was drawn. Coordinates are now derived fromlonlat(#2977) - Declining the "Move the visit here?" prompt when picking a distant place for a Map v2 visit no longer renames the visit to that place.
- Place visit detection no longer leaves an empty duplicate visit behind when a new point bridges two previously separate visits at the same place — they are now merged into one. The nightly re-scan also leaves confirmed visits untouched, so a new nearby point can no longer pull points out of a visit you already confirmed.
- Re-evaluating anomalous points now refreshes the map immediately instead of occasionally serving a cached copy of the points until the next change.
- Raw data archival: reading archived
raw_databack works again (it silently returned nothing before), archive chunks are labeled with the points' actual month, archives are verified at write time, and the previously brokenpoints:raw_data:archive/archive_fullrake tasks work again. - Raw data archival, continued: re-importing a duplicate point with different
raw_datanow detaches it from its stale archive so the newer data can't be cleared away, and clearing archived data now waits out a 7-day cooling window. Restores are reported under therestoredmetric label instead ofremoved— update dashboards readingpoints_total{operation="removed"}accordingly. - User data exports now include archived
raw_dataas plain gzip files, so an export can be imported on a different instance (previously the archives were encrypted with the exporting instance's key and unreadable elsewhere). - Creating, updating, or deleting a user in Settings no longer shows a blank "HTTP ERROR 422" page when validation fails — the admin is redirected back with a message explaining what went wrong (e.g. password too short) (#3051)
- Email delivery no longer times out with providers that use implicit TLS (SMTP port 465, e.g. many hosted mail services): set
SMTP_SSL=trueto enable it, and it is enabled automatically whenSMTP_PORT=465. STARTTLS remains the default for all other ports (#3068) - Points on Map v2 can no longer be moved by accident: dragging a point now requires enabling the new "Edit points" toggle in the layers panel. The toggle resets on every page load, so points stay put unless you deliberately turn editing on (#3060)
- The family "Location history" toggle is clearer: the settings page now explains it is distinct from live location, powers the recent-track view on Map v2, and only shares points recorded after enabling it. The default history window grew from 24 hours to 7 days, so newly-shared members show a useful track.
- Place-based visit suggestions now work for users whose distance unit is kilometres — an integer-rounding bug set the detection radius to zero. Self-hosters on kilometres: the first nightly run after upgrading processes your whole history at once; on large databases raise
PLACE_VISITS_THROTTLE_SECONDSbeforehand to make it gentler (#2963) - The nightly place-visit job now only processes points that don't yet belong to a visit and pauses briefly between places, so it no longer saturates the database and delays incoming location uploads. The pause is tunable via
PLACE_VISITS_THROTTLE_SECONDS(default0.1) (#2963) - Opening "View on map" for an import on Map v2 now shows only that import's points, instead of every point within the import's date range (#2734)
- Place and area visit detection no longer silently finds zero visits for users whose distance unit is kilometers (the search radius was being truncated to 0 by integer division) (#3031).
- Points added retroactively through the API or trackers (with timestamps in the past) now get their routes generated, instead of only connecting after a manual data recalculation (#3036).
- Photoprism photo imports no longer fail with an HTTP 400: the
after/beforefilters are now sent as plainYYYY-MM-DDdates, as recent Photoprism requires (it rejects the full timestamps shipped in 1.9.2). Results are still bounded in-app by the exact end timestamp, and a blank start date no longer breaks the import (#3034).
💙 This release is supported by Steven B., James Manolios, chenrik, aldumil, derpderpington, Chippie, dint, jhalpern, Lex Fradski, Schlufo, cyberswan.at, craftyklaus, Andre, hogenf, naraxius, Embrace, martin4861, Alex, evetters, GregF, Jon Coffee, Lukas, Robbie G, Kilian, Hans G, Chris, tabaha, Andre, Michael C, Chris, Jonah B., Dante, daallex, Tanner A., Milien M., Mathias, Travis S., Matthew F., Johnathan D., bleibdirtroy, no1etal, dixet, Bailey J., Alex D., Benjamin M., Daniel A., Florian, BeeHappy, ChemistryDachshund, OrangeWindies, Michelangelo V., Edward, Erazem Z., Denis Abt, Tony G., Andrew D., Lomky, Osamu Y., Linus T., Christian C., Sebastian, Jan K., Nathan T., Max G., Lars N., Karol B., Konstantin, Johannes H., t3hero, g3lin, Tim, Philipp M., Brand K., Pablo F. M., Jon H., fkB, Mikael, Dániel A., Hai_Tsung, ShooTex, GreenTentacle, PinkahPandah, David, Ken, Denna G., Andre, Hendl91, Jon H., MrRed, Arkadiusz Z., Jake, Bator T., Alex J. H., eps-dev, twiggu, Dragan V., Jerome G., Sheya B., ArnyminerZ, Gustav B., higgs01, Frank F., F. J. Kruz, Jon D., Alexander J. H., Daniel D., Gonzalo M., Ricardo T., Christof Z., Narrator, JohnSmith21, smartbert, A.M., Matthew Z., Dror T., Jonathan K., Kyle C., Mario B., Albin H., Phillip S., Bernd, Tom, Brett J., Nick O., greeting7416, Dick, Brian R., Henning, Markus, TheSlimShady, Andrew M., Mason B., Chance, GoogilyBoogily, Dragon, Oliver, HexitNiels, Michael G., Pablo A., Leo L., Daniel D., DSKun, Ross, Andre K., Jonathan K., Erik K., on Patreon and KoFi 💙
What's Changed
- perf(points): faster /points index — slim pluck, exact ST_Intersects bbox, conditional-GET caching by @Freika in https://github.com/Freika/dawarich/pull/3026
- Bump shoulda-matchers from 7.0.1 to 8.0.1 by @dependabot[bot] in https://github.com/Freika/dawarich/pull/2994
- Bump actions/checkout from 4 to 7 by @dependabot[bot] in https://github.com/Freika/dawarich/pull/2992
- Bump gitleaks/gitleaks-action from 2.3.9 to 3.0.0 by @dependabot[bot] in https://github.com/Freika/dawarich/pull/2991
- Bump docker/metadata-action from 5 to 6 by @dependabot[bot] in https://github.com/Freika/dawarich/pull/2990
- Bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in https://github.com/Freika/dawarich/pull/2989
- Bump actions/download-artifact from 4 to 8 by @dependabot[bot] in https://github.com/Freika/dawarich/pull/2988
- Bump dompurify from 3.4.8 to 3.4.11 in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/Freika/dawarich/pull/2986
- chore(deps): bump the ruby-minor-patch group across 1 directory with 9 updates by @dependabot[bot] in https://github.com/Freika/dawarich/pull/3025
- Fix: km place-visit detection (radius 0) + make nightly visit job incremental and throttled by @Freika in https://github.com/Freika/dawarich/pull/3040
- feat: reveal trip photos along replay playhead with stacked photo cards by @Freika in https://github.com/Freika/dawarich/pull/3014
- feat(map v2): reopen at last viewport; optimistic point delete by @Freika in https://github.com/Freika/dawarich/pull/3041
- Fix: Map v2 import view shows only the import's points by @Freika in https://github.com/Freika/dawarich/pull/3039
- fix: stop integer division zeroing the visit-detection radius for km users (#3031) by @Freika in https://github.com/Freika/dawarich/pull/3056
- fix: generate tracks for retroactively-added points (#3036) by @Freika in https://github.com/Freika/dawarich/pull/3053
- fix: send Photoprism 'after'/'before' filters as plain dates (#3034) by @Freika in https://github.com/Freika/dawarich/pull/3055
- feat: mobile settings sync API + distance unit via API by @Freika in https://github.com/Freika/dawarich/pull/3063
- fix: mobile settings API follow-ups (maps guard, docs, logging) by @Freika in https://github.com/Freika/dawarich/pull/3064
- Tools → signup handoff: pending imports with claim tickets by @Freika in https://github.com/Freika/dawarich/pull/2808
- Add API endpoints for demo data management by @Freika in https://github.com/Freika/dawarich/pull/3067
- Derive pending-import claim URL from the request host by @Freika in https://github.com/Freika/dawarich/pull/3069
- Claim pending imports on reverse-trial signup by @Freika in https://github.com/Freika/dawarich/pull/3070
- avoid renaming visit on cancelled place selection by @liam-prod in https://github.com/Freika/dawarich/pull/3059
- Gate Map v2 point dragging behind an Edit points toggle by @Freika in https://github.com/Freika/dawarich/pull/3076
- Support implicit TLS (SMTP port 465) for email delivery by @Freika in https://github.com/Freika/dawarich/pull/3075
- Show validation errors when admin user management forms fail by @Freika in https://github.com/Freika/dawarich/pull/3074
- fix: overhaul raw_data archival — read path, month labels, verification pipeline, portable exports by @Freika in https://github.com/Freika/dawarich/pull/3072
- Poster Studio: WYSIWYG editor, map color themes, and native in-container rendering by @Freika in https://github.com/Freika/dawarich/pull/3073
- Fix points cache staleness, mobile boolean reset, poster theme reads by @Freika in https://github.com/Freika/dawarich/pull/3077
- Invalidate points ETag when anomaly flags change by @Freika in https://github.com/Freika/dawarich/pull/3080
- Fix orphaned duplicate visit from incremental place-visit merge by @Freika in https://github.com/Freika/dawarich/pull/3078
- Release 1.10.0 polish: job queues, poster button icon, changelog by @Freika in https://github.com/Freika/dawarich/pull/3081
- Surface family location history and warn about Map v1 sunset by @Freika in https://github.com/Freika/dawarich/pull/3079
- Render posters natively only; drop the render sidecar by @Freika in https://github.com/Freika/dawarich/pull/3082
- chore(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in https://github.com/Freika/dawarich/pull/3045
- chore(deps): bump actions/cache from 5 to 6 by @dependabot[bot] in https://github.com/Freika/dawarich/pull/3044
- feat: family plan — effective-plan access model, gating, and creation gate by @Freika in https://github.com/Freika/dawarich/pull/2815
- Poster Studio + print ordering (Gelato via Stripe Checkout) by @Freika in https://github.com/Freika/dawarich/pull/3088
- Make print ordering discoverable from any layout by @Freika in https://github.com/Freika/dawarich/pull/3090
- Poster/client side renderer by @Freika in https://github.com/Freika/dawarich/pull/3095
- Fix family history returning nil coordinates by @Freika in https://github.com/Freika/dawarich/pull/3102
- build: make Docker image build self-contained (npm ci in image) by @Freika in https://github.com/Freika/dawarich/pull/3122
- perf: cut default self-hosted memory footprint by ~20% by @Freika in https://github.com/Freika/dawarich/pull/3119
- 1.10.0 by @Freika in https://github.com/Freika/dawarich/pull/3027
New Contributors
- @liam-prod made their first contribution in https://github.com/Freika/dawarich/pull/3059
Full Changelog: https://github.com/Freika/dawarich/compare/1.9.2...1.10.0
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About dawarich
Your favorite self-hostable alternative to Google Timeline (Google Location History)
Related context
Related tools
Earlier breaking changes
- v1.10.1 Drops legacy `latitude`/`longitude` columns on `points`; migrates to single `lonlat` column.
- v1.8.0 Changes declining a visit to delete the visit entirely; removes "Declined" filter and Restore action.
- v1.7.9 Place deletion no longer deletes visits; sets dependent: :nullify.
- v1.7.9 Visit detection creates one Place per visit, not 25 candidates.
- v1.7.8 Places without linked visits are permanently deleted during ownership migration.
Beta — feedback welcome: [email protected]