Skip to content

dawarich

v1.7.11 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

google-maps gpslogger self-hosted maps memory owntracks
+1 more
timeline

Affected surfaces

deps

ReleasePort's take

Moderate signal
editorial:auto 3d

The release bumps bundled gems to close 9 known CVEs and adds several bugfixes and new features across Map v2, the visits API, onboarding, and visit assignment.

Why it matters: Closing 9 known CVEs in bundled dependencies reduces attack surface; immediate patch adoption is advised for security hygiene.

Summary

AI summary

Visits can now be manually assigned to saved areas, adopting the area name unless overridden by a custom name or place.

Changes in this release

Security Critical

Bumped bundled gems to close 9 known CVEs.

Bumped bundled gems to close 9 known CVEs.

Source: llm_adapter@2026-05-31

Confidence: high

Feature Low

Onboarding "Load demo data" seeds a fully populated /map/v2 instantly with 30‑day Berlin and Prague‑weekend trip data (~80 visits).

Onboarding "Load demo data" seeds a fully populated /map/v2 instantly with 30‑day Berlin and Prague‑weekend trip data (~80 visits).

Source: llm_adapter@2026-05-31

Confidence: high

Feature Low

Visits can be manually assigned to saved areas; area name auto‑applies unless custom name or place overrides.

Visits can be manually assigned to saved areas; area name auto‑applies unless custom name or place overrides.

Source: llm_adapter@2026-05-31

Confidence: high

Bugfix Medium

Map v2 Timeline calendar now lights up days with raw points before generation completes.

Map v2 Timeline calendar now lights up days with raw points before generation completes.

Source: llm_adapter@2026-05-31

Confidence: high

Bugfix Medium

Map v2 visits layer respects selected date range filter.

Map v2 visits layer respects selected date range filter.

Source: llm_adapter@2026-05-31

Confidence: high

Bugfix Medium

POST /api/v1/visits no longer links a visit to another user's place.

POST /api/v1/visits no longer links a visit to another user's place.

Source: llm_adapter@2026-05-31

Confidence: high

Bugfix Medium

Map v2 settings panel "Apply Settings" now saves changes persistently.

Map v2 settings panel "Apply Settings" now saves changes persistently.

Source: llm_adapter@2026-05-31

Confidence: high

Bugfix Medium

Reverse‑geocoding flood handling coalesces duplicate enqueues, caps retries at 3, and nightly sweep clears dedup keys.

Reverse‑geocoding flood handling coalesces duplicate enqueues, caps retries at 3, and nightly sweep clears dedup keys.

Source: llm_adapter@2026-05-31

Confidence: high

Bugfix Medium

Cloud only: PostHog exception capture enabled for production error diagnosis.

Cloud only: PostHog exception capture enabled for production error diagnosis.

Source: llm_adapter@2026-05-31

Confidence: high

Bugfix Low

Two unused indexes on the `points` table are dropped on upgrade, freeing several GB of disk on large self‑hosted instances.

Two unused indexes on the `points` table are dropped on upgrade, freeing several GB of disk on large self‑hosted instances.

Source: llm_adapter@2026-05-31

Confidence: low

Full changelog

Added

  • Onboarding "Load demo data" now seeds a fully populated /map/v2 instantly: 30 days of Berlin + a Prague-weekend trip, ~80 visits with tags and places, and stats anchored to the current calendar month. "Remove demo data" wipes everything in one click while preserving anything you've confirmed, edited, or built on top of (visits, trips, places, tags adopted by user action stay).
  • Visits can now be manually assigned to one of your saved areas. When you do, the visit takes the area's name automatically — unless you've already given it a custom name, or you've also picked a place (a place name wins over an area name). Available via API now; UI to follow. #2577

Changed

  • Two unused indexes on the points table are dropped on upgrade; on large self-hosted instances this frees several GB of disk.
  • Areas now validate their geometry: radius must be greater than 0, latitude must be within -90…90, and longitude within -180…180. Invalid values are rejected instead of silently saved.
  • Bumped bundled gems (aws-sdk, devise, jwt, httparty, and others) to close 9 known CVEs. Self-hosters get the security fixes by upgrading.

Fixed

  • Cloud only: PostHog exception capture is enabled to help diagnose production errors.
  • Map v2 Timeline calendar now lights up days that have raw points even before Track or Visit generation has caught up, matching the Insights → Activity Overview calendar. #2579
  • Reverse-geocoding flood: duplicate per-point enqueues are now coalesced for 24 h via a Redis dedup key, retries are capped at 3, and the nightly sweep bypasses (and clears) the dedup so points whose retries were exhausted — or whose key still lingers — are picked up on the next run.
  • Map v2 visits layer now honours the selected date range. Since 1.7.10 the viewport-bounded visits fetch silently dropped the start_at/end_at filter on the backend, so all visits inside the viewport were rendered regardless of the date filter. #2817
  • POST /api/v1/visits no longer links a new visit to a place owned by another user. Passing a foreign place_id is ignored — the visit gets a place owned by the requester at the requested coordinates, and the response no longer echoes the other user's place id or coordinates.
  • Map v2 settings panel: "Apply Settings" now actually saves your changes. Points rendering mode, speed-colored routes, live mode, and fog-of-war toggles all persist on click and reload. Apply/Reset buttons moved above the Transportation Mode section so they sit inside the outer form. #2680
  • The app no longer trips firewall blocks by repeatedly checking family status when you're not part of a family.

💙 This release is supported by Steven B., James Manolios, chenrik, aldumil, derpderpington, Chippie, dint, jhalpern, Lex Fradski, Schlufo, cyberswan.at, craftyklaus, Andre, hogenf, naraxius, Embrace, martin4861, Alex, evetters, GregF, Jon Coffee, Lukas, Robbie G, Kilian, Hans G, Chris, tabaha, Andre, Michael C, Chris, Jonah B., Dante, daallex, Tanner A., Milien M., Mathias, Travis S., Matthew F., Johnathan D., bleibdirtroy, no1etal, dixet, Bailey J., Alex D., Benjamin M., Daniel A., Florian, BeeHappy, ChemistryDachshund, OrangeWindies, Michelangelo V., Edward, Erazem Z., Denis Abt, Tony G., Andrew D., Lomky, Osamu Y., Simon van B., Linus T., Christian C., Sebastian, Jan K., Nathan T., Max G., Lars N., Karol B., Konstantin, Johannes H., t3hero, g3lin, Tim, Philipp M., Brand K., Pablo F. M., Jon H., fkB, Mikael, Dániel A., Hai_Tsung, ShooTex, GreenTentacle, PinkahPandah, David, Ken, Denna G., Andre, Hendl91, Jon H., MrRed, Arkadiusz Z., Jake, Bator T., Alex J. H., eps-dev, twiggu, Dragan V., Jerome G., Carsten M., Sheya B., ArnyminerZ, Gustav B., higgs01, Frank F., F. J. Kruz, Jon D., Alexander J. H., Daniel D., Gonzalo M., Ricardo T., Christof Z., Narrator, JohnSmith21, smartbert, A.M., Matthew Z., Dror T., Jonathan K., Henrik H., Kyle C., Mario B., Albin H., RN, Phillip S., Bernd, Tom, Brett J., Nick O., greeting7416, Dick, Brian R., Henning, Markus, TheSlimShady, on Patreon and KoFi 💙


What's Changed

  • 1.7.11 by @Freika in https://github.com/Freika/dawarich/pull/2818

Full Changelog: https://github.com/Freika/dawarich/compare/1.7.10...1.7.11

Security Fixes

  • Bumped bundled gems (aws-sdk, devise, jwt, httparty, etc.) to close 9 known CVEs

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track dawarich

Get notified when new releases ship.

Sign up free

About dawarich

Your favorite self-hostable alternative to Google Timeline (Google Location History)

All releases →

Related context

Earlier breaking changes

  • v1.7.9 Place deletion no longer deletes visits; sets dependent: :nullify.
  • v1.7.9 Visit detection creates one Place per visit, not 25 candidates.
  • v1.7.8 Places without linked visits are permanently deleted during ownership migration.
  • v1.7.8 `ALLOW_EMAIL_PASSWORD_REGISTRATION` no longer controls login; use `ALLOW_EMAIL_PASSWORD_LOGIN` (defaults true).
  • v1.7.8 Self-hosters must set ALLOW_EMAIL_PASSWORD_LOGIN=false for OIDC-only sign-in after upgrade.

Beta — feedback welcome: [email protected]