This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+1 more
ReleasePort's take
Moderate signalThe release drops the legacy `latitude`/`longitude` columns on the `points` table and replaces them with a single `lonlat` column.
Why it matters: Affects any code or queries referencing the old columns; update data models before upgrading to version 1.10.1.
Summary
AI summaryUpdates fix, imports, and PWA across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Breaking | High |
Drops legacy `latitude`/`longitude` columns on `points`; migrates to single `lonlat` column. Drops legacy `latitude`/`longitude` columns on `points`; migrates to single `lonlat` column. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Feature | Low |
Adds Google Photos Takeout metadata sidecars as sparse timeline points (skips non‑geotagged). Adds Google Photos Takeout metadata sidecars as sparse timeline points (skips non‑geotagged). Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Feature | Low |
Enables Poster Studio to open directly from a trip’s page, pre‑loaded with route, date range, and name. Enables Poster Studio to open directly from a trip’s page, pre‑loaded with route, date range, and name. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Feature | Low |
Makes Dawarich installable as a Progressive Web App (PWA) on phone home screens. Makes Dawarich installable as a Progressive Web App (PWA) on phone home screens. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Feature | Low |
Tags points from Google Semantic History and phone Timeline imports with a per‑import tracker ID, separating tracks by device. Tags points from Google Semantic History and phone Timeline imports with a per‑import tracker ID, separating tracks by device. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
| Performance | Medium |
Streams GeoJSON imports in bounded batches to avoid memory exhaustion. Streams GeoJSON imports in bounded batches to avoid memory exhaustion. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Performance | Low |
Streams large ZIP activity exports (up to 25,000 files) while retaining safety checks. Streams large ZIP activity exports (up to 25,000 files) while retaining safety checks. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
| Performance | Low |
Applies existing simplified point‑rendering mode in Map v2, thinning dense point streams while keeping other layers full. Applies existing simplified point‑rendering mode in Map v2, thinning dense point streams while keeping other layers full. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
| Bugfix | Medium |
Deletes a point now recalculates monthly distance and statistics correctly. Deletes a point now recalculates monthly distance and statistics correctly. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Bugfix | Medium |
Prevents cache preheating timeouts for accounts with large location histories. Prevents cache preheating timeouts for accounts with large location histories. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Bugfix | Medium |
Allows unauthenticated SMTP relays by setting `SMTP_AUTHENTICATION=none`. Allows unauthenticated SMTP relays by setting `SMTP_AUTHENTICATION=none`. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Bugfix | Medium |
Keeps the time component when Map v2 date pickers load a range from URL. Keeps the time component when Map v2 date pickers load a range from URL. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Bugfix | Medium |
Streams Google Timeline exports in bounded batches to avoid memory exhaustion. Streams Google Timeline exports in bounded batches to avoid memory exhaustion. Source: llm_adapter@2026-07-19 Confidence: low |
— |
| Bugfix | Low |
Allows FIT files without `device_info` section to be imported successfully. Allows FIT files without `device_info` section to be imported successfully. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
| Bugfix | Low |
Preserves XML byte‑order marks in GPX imports for correct encoding detection. Preserves XML byte‑order marks in GPX imports for correct encoding detection. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
| Bugfix | Low |
Prevents TCX and KML imports from failing when text fields contain raw ampersands. Prevents TCX and KML imports from failing when text fields contain raw ampersands. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
| Bugfix | Low |
Fixes container crash‑loop on startup when concurrency env vars are unexpanded strings. Fixes container crash‑loop on startup when concurrency env vars are unexpanded strings. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
| Bugfix | Low |
Retries point uploads and anomaly filtering after transient database deadlocks. Retries point uploads and anomaly filtering after transient database deadlocks. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
| Bugfix | Low |
Opens Dawarich PWA from iOS Home Screen directly into Map v2 instead of an unrelated page. Opens Dawarich PWA from iOS Home Screen directly into Map v2 instead of an unrelated page. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
| Bugfix | Low |
Retries track generation and user data recalculations after lock contention, with automatic recovery. Retries track generation and user data recalculations after lock contention, with automatic recovery. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
| Bugfix | Low |
Prevents OwnTracks `_type: waypoint` sync messages from being stored as location points. Prevents OwnTracks `_type: waypoint` sync messages from being stored as location points. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
| Bugfix | Low |
Handles malformed country or city entries on statistics pages without failure and repairs data on recalculation. Handles malformed country or city entries on statistics pages without failure and repairs data on recalculation. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
| Bugfix | Low |
Rejects points at exactly (0,0) from all ingestion paths, flags existing ones as anomalies, removes related visits, and recalculates affected stats/tracks. Rejects points at exactly (0,0) from all ingestion paths, flags existing ones as anomalies, removes related visits, and recalculates affected stats/tracks. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
Full changelog
Added
- Google Photos Takeout metadata sidecars can now add geotagged photos as sparse timeline points; sidecars without usable coordinates are skipped.
- The Poster Studio can now be opened directly from a trip's page, pre-loaded with the trip's route, date range, and name.
- Dawarich can now be installed to the phone home screen as a web app (PWA): all pages link the web app manifest and Apple touch icon, and the installed app opens straight into Map v2.
Changed
- The legacy
latitude/longitudecolumns onpointsare dropped — the PostGISlonlatcolumn has been the single source of truth since 0.25.0. The migration copies any remaining legacy-only coordinates intolonlatbefore dropping, so upgrades from older versions are safe. - File imports no longer store a copy of each source record in the point's
raw_data— the uploaded file stays attached to the import as the source of truth. API responses returnraw_data: {}for newly imported points, and FIT/TCX health fields (heart rate, cadence, power, temperature) as well as Google phone takeout HOME/WORK place labels are no longer stored. - TCX and FIT imports now store their activity type in
motion_data: transportation-mode detection works for TCX imports for the first time, and FIT driving activities are classified correctly. - Google phone takeout imports now store the mapped activity type in
motion_data, so transportation-mode detection (driving, walking, cycling, bus, train, flying) works for activity segments from phone takeout files.
Fixed
- Deleting a single point from the map now recalculates your monthly distance and statistics, instead of leaving them counting the deleted point.
- Large GeoJSON imports now stream features in bounded batches instead of loading the entire file into memory, preventing worker memory exhaustion on exports with hundreds of thousands of points.
- Google phone Timeline imports now stream semantic segments and raw signals in bounded batches instead of loading the entire export into memory, preventing worker memory exhaustion on large Timeline files.
- FIT activities without a
device_infosection now import their location records instead of failing strict FIT validation. - GPX imports now preserve XML byte-order marks, allowing files whose BOM correctly identifies the encoding despite an incorrect XML declaration to import successfully.
- ZIP imports now accept large activity exports containing up to 25,000 files, while retaining file-count and expanded-size safety checks.
- OwnTracks
_type: waypointsync messages are no longer stored as location points, so syncing your saved OwnTracks places no longer creates phantom distance/track spikes (#3137) - Map v2 date pickers now keep the time component when a range with a specific time is loaded from the URL, instead of resetting to the start/end of the day (#3106)
- Track generation and user data recalculations now retry a bounded number of times when another job is already processing the same user's tracks, instead of dropping the request and reporting an error; a genuinely stuck lock is logged after the retries are exhausted. The per-user lock also renews itself while a job runs and frees within a minute if a worker dies, so a crashed job no longer blocks a user's track processing for up to half an hour.
- Dawarich added to an iOS Home Screen now opens Map v2 instead of an unrelated previously visited page (#3097)
- Point uploads (REST API, OwnTracks, Overland, Traccar) now write batches in a consistent order so concurrent uploads no longer deadlock each other, and both uploads and anomaly filtering recover automatically from any remaining transient database deadlocks instead of failing the upload or background job.
- The app and Sidekiq containers no longer crash-loop on startup when
WEB_CONCURRENCYorBACKGROUND_PROCESSING_CONCURRENCYreach the container as an unexpanded${VAR:-default}string (seen with some podman-compose versions); the entrypoint now warns and falls back to the default value (#3124) - Cache preheating no longer times out for accounts with large location histories.
- Cloud: Changing plans resets the Lite archival-warning state, so a user downgraded to Lite again is notified about archived data again.
- TCX and KML imports no longer fail when text fields contain raw ampersands.
- The Map v2 "Share" button no longer renders its label below the button bounds on narrow layouts (#3007)
- Outgoing email now works with local unauthenticated SMTP relays: set
SMTP_AUTHENTICATION=none(alsooff/false/disabled) to disable SMTP AUTH instead of hitting "SMTP-AUTH requested but missing user name" (#3147, #2690, #1469, #1463) - Deleting a place from the Places list no longer jumps back to the first page — you stay on the page you were viewing (#3145)
- Map v2 now applies the existing simplified point-rendering mode, so dense point streams are thinned on the map when that setting is selected. Only the points layer is thinned — heatmap, fog of war, scratch map, and routes are still built from the full point set (#946).
- Statistics pages no longer fail to load when older monthly data contains malformed country or city entries. Recalculating stats for an affected month repairs the stored data.
- Google Semantic History and phone Timeline imports now tag points with a per-import tracker id instead of one shared constant, so tracks from different devices are no longer braided together. A one-time backfill rewrites existing points and regenerates affected tracks per user.
- Points at exactly (0,0) — a common GPS glitch — are no longer accepted from any ingestion path (API, OwnTracks, Overland, Traccar, file imports) and no longer produce suggested visits at "Null Island". Existing (0,0) points are flagged as anomalies by a one-time cleanup that also removes visits placed at (0,0) and recalculates affected stats and tracks.
💙 This release is supported by Steven B., James Manolios, chenrik, aldumil, derpderpington, Chippie, dint, jhalpern, Lex Fradski, Schlufo, cyberswan.at, craftyklaus, Andre, hogenf, naraxius, Embrace, martin4861, Alex, evetters, GregF, Jon Coffee, Lukas, Robbie G, Kilian, Hans G, Chris, tabaha, Andre, Michael C, Chris, Jonah B., Dante, daallex, Tanner A., Milien M., Mathias, Travis S., Matthew F., Johnathan D., bleibdirtroy, no1etal, dixet, Bailey J., Alex D., Benjamin M., Daniel A., Florian, BeeHappy, ChemistryDachshund, OrangeWindies, Michelangelo V., Edward, Erazem Z., Denis Abt, Tony G., Andrew D., Lomky, Osamu Y., Linus T., Christian C., Sebastian, Jan K., Nathan T., Max G., Lars N., Karol B., Konstantin, Johannes H., t3hero, g3lin, Tim, Philipp M., Brand K., Pablo F. M., Jon H., fkB, Mikael, Dániel A., Hai_Tsung, ShooTex, GreenTentacle, PinkahPandah, David, Ken, Denna G., Andre, Hendl91, Jon H., MrRed, Arkadiusz Z., Jake, Bator T., Alex J. H., eps-dev, twiggu, Dragan V., Jerome G., Sheya B., ArnyminerZ, Gustav B., higgs01, Frank F., F. J. Kruz, Jon D., Alexander J. H., Daniel D., Gonzalo M., Ricardo T., Christof Z., Narrator, JohnSmith21, smartbert, A.M., Matthew Z., Dror T., Jonathan K., Kyle C., Mario B., Albin H., Phillip S., Bernd, Tom, Brett J., Nick O., greeting7416, Dick, Brian R., Henning, Markus, TheSlimShady, Andrew M., Mason B., Chance, GoogilyBoogily, Dragon, Oliver, HexitNiels, Michael G., Pablo A., Leo L., Daniel D., DSKun, Ross, Andre K., Jonathan K., Erik K., Tiebolt v. d. L., Steven, Mathias, Poutouprod, Sam B. on Patreon and KoFi 💙
What's Changed
- Drop legacy points.latitude / points.longitude columns by @Freika in https://github.com/Freika/dawarich/pull/2771
- Stop persisting point raw_data for file-based imports by @Freika in https://github.com/Freika/dawarich/pull/3123
- 1.10.1 by @Freika in https://github.com/Freika/dawarich/pull/3118
- Add Dawarich/PointsLatLonAccess cop; fix 4 legacy lat/lon readers by @Freika in https://github.com/Freika/dawarich/pull/2770
- Detect transportation mode for Google phone takeout activity segments by @Freika in https://github.com/Freika/dawarich/pull/3125
- Guard entrypoints against unexpanded concurrency env vars by @Freika in https://github.com/Freika/dawarich/pull/3127
- fix: walk downgraded users through archival warnings gradually by @Freika in https://github.com/Freika/dawarich/pull/3128
- Prevent cache preheating timeouts on large histories by @Freika in https://github.com/Freika/dawarich/pull/3136
- Fix the red test suite: broken photo imports, factory flake, spec brittleness by @Freika in https://github.com/Freika/dawarich/pull/3142
- Handle raw ampersands in TCX and KML imports by @Freika in https://github.com/Freika/dawarich/pull/3140
- Retry transient point-ingest deadlocks by @Freika in https://github.com/Freika/dawarich/pull/3149
- Honor the existing simplified point-rendering mode in Map v2 by @Freika in https://github.com/Freika/dawarich/pull/3134
- feat: make the web app installable (PWA) by @Freika in https://github.com/Freika/dawarich/pull/3141
- Retry parallel track generation after lock contention by @Freika in https://github.com/Freika/dawarich/pull/3151
- Handle malformed toponym data on stats pages by @Freika in https://github.com/Freika/dawarich/pull/3135
- fix: keep pagination page when deleting a place by @Freika in https://github.com/Freika/dawarich/pull/3152
- fix: support unauthenticated SMTP relays via SMTP_AUTHENTICATION=none by @Freika in https://github.com/Freika/dawarich/pull/3153
- fix: keep Map v2 Share button label inside its bounds by @Freika in https://github.com/Freika/dawarich/pull/3154
- fix: keep Map v2 date-picker time component on URL hydration by @Freika in https://github.com/Freika/dawarich/pull/3156
- fix: ignore OwnTracks waypoint payloads on the live ingest path by @Freika in https://github.com/Freika/dawarich/pull/3155
- Strip UTF-8 BOM before detecting GPX and KML imports (#3101) by @TowyTowy in https://github.com/Freika/dawarich/pull/3110
- Open Poster Studio from trip pages by @Freika in https://github.com/Freika/dawarich/pull/3157
- The actual 1.10.1 by @Freika in https://github.com/Freika/dawarich/pull/3126
- fix(imports): accept large activity archives by @Freika in https://github.com/Freika/dawarich/pull/3163
- fix(imports): preserve GPX byte-order marks by @Freika in https://github.com/Freika/dawarich/pull/3161
- fix(imports): accept FIT files without device info by @Freika in https://github.com/Freika/dawarich/pull/3162
- perf(imports): stream Google Timeline exports by @Freika in https://github.com/Freika/dawarich/pull/3165
- perf(imports): stream GeoJSON feature collections by @Freika in https://github.com/Freika/dawarich/pull/3166
- feat(imports): support Google Photos sidecars by @Freika in https://github.com/Freika/dawarich/pull/3164
- Keep Null Island (0,0) points out of the dataset and visit detection by @Freika in https://github.com/Freika/dawarich/pull/3168
- Per-import tracker ids for Google importers + backfill for legacy constants by @Freika in https://github.com/Freika/dawarich/pull/3169
- Recalculate stats and tracks when points are deleted individually by @Freika in https://github.com/Freika/dawarich/pull/3167
- 1.10.1-2 by @Freika in https://github.com/Freika/dawarich/pull/3172
New Contributors
- @TowyTowy made their first contribution in https://github.com/Freika/dawarich/pull/3110
Full Changelog: https://github.com/Freika/dawarich/compare/1.10.0...1.10.1
Breaking Changes
- Dropped legacy `latitude`/`longitude` columns from `points`; all coordinates now stored in PostGIS `lonlat` column.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About dawarich
Your favorite self-hostable alternative to Google Timeline (Google Location History)
Related context
Related tools
Earlier breaking changes
- v1.8.0 Changes declining a visit to delete the visit entirely; removes "Declined" filter and Restore action.
- v1.7.9 Place deletion no longer deletes visits; sets dependent: :nullify.
- v1.7.9 Visit detection creates one Place per visit, not 25 candidates.
- v1.7.8 Places without linked visits are permanently deleted during ownership migration.
- v1.7.8 `ALLOW_EMAIL_PASSWORD_REGISTRATION` no longer controls login; use `ALLOW_EMAIL_PASSWORD_LOGIN` (defaults true).
Beta — feedback welcome: [email protected]