This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+1 more
Affected surfaces
ReleasePort's take
Moderate signalThe release updates the `oauth2` gem to 2.0.22, fixing a credential‑leak advisory (GHSA-pp92-crg2-gfv9) that affected Google/GitHub sign‑in flows.
Why it matters: Fixes a high‑severity (90) credential‑leak vulnerability in the Google/GitHub authentication path; upgrade immediately if you use this flow.
Summary
AI summaryUpdates GHSA-pp92-crg2-gfv9, https://www.patreon.com/freika, and Self-hosted across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Bumped the `oauth2` gem to 2.0.22 to close a known credential-leak advisory (GHSA-pp92-crg2-gfv9) on the Google/GitHub sign-in path Bumped the `oauth2` gem to 2.0.22 to close a known credential-leak advisory (GHSA-pp92-crg2-gfv9) on the Google/GitHub sign-in path Source: llm_adapter@2026-06-11 Confidence: high |
— |
| Feature | Low |
Fog of War (Map v2) can now reveal explored areas per hexagon instead of per point, using precalculated monthly statistics; switch between "Per point" and "Per hexagon" in the map settings panel (#2899) Fog of War (Map v2) can now reveal explored areas per hexagon instead of per point, using precalculated monthly statistics; switch between "Per point" and "Per hexagon" in the map settings panel (#2899) Source: llm_adapter@2026-06-11 Confidence: high |
— |
| Feature | Low |
Globe view is enabled by default for Pro and self‑hosted users Globe view is enabled by default for Pro and self‑hosted users Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
| Feature | Low |
Map v2 Replay plays back proportionally to real elapsed time (1x = one real minute per second) and skips long point‑free gaps quickly; speed multiplier compresses further (#2845) Map v2 Replay plays back proportionally to real elapsed time (1x = one real minute per second) and skips long point‑free gaps quickly; speed multiplier compresses further (#2845) Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
| Feature | Low |
Cloud Lite plan's 12‑month data window now applies to the Points page; "points outside your window" hint no longer caps visible points at the page size Cloud Lite plan's 12‑month data window now applies to the Points page; "points outside your window" hint no longer caps visible points at the page size Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
| Performance | Medium |
Loading points on the map is faster for large histories; the points API now uses a spatial index when filtering by visible area instead of scanning every point in the date range Loading points on the map is faster for large histories; the points API now uses a spatial index when filtering by visible area instead of scanning every point in the date range Source: llm_adapter@2026-06-11 Confidence: high |
— |
| Performance | Medium |
Monthly statistics calculation is lighter for point‑heavy months: hexagon aggregation reads coordinates in a single pass without instantiating database records and avoids re‑querying the whole month when falling back to lower resolution Monthly statistics calculation is lighter for point‑heavy months: hexagon aggregation reads coordinates in a single pass without instantiating database records and avoids re‑querying the whole month when falling back to lower resolution Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
| Performance | Low |
Timeline day view eliminates one extra database query per visit; initial map view bounds are computed in a single query instead of two Timeline day view eliminates one extra database query per visit; initial map view bounds are computed in a single query instead of two Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
| Performance | Low |
/admin/flipper feature‑flag UI is no longer rate‑limited, making it usable after multiple clicks (#2897) /admin/flipper feature‑flag UI is no longer rate‑limited, making it usable after multiple clicks (#2897) Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
| Bugfix | Medium |
Deleting an import no longer gets stuck on an endless spinner; failed deletions revert to a retriable state and show a retry button after over one hour (#2835) Deleting an import no longer gets stuck on an endless spinner; failed deletions revert to a retriable state and show a retry button after over one hour (#2835) Source: llm_adapter@2026-06-11 Confidence: high |
— |
| Bugfix | Medium |
Insights no longer report spurious "new country visited" entries caused by border‑crossing geocoding blips; yearly digest applies the same filter as monthly pages (#2727) Insights no longer report spurious "new country visited" entries caused by border‑crossing geocoding blips; yearly digest applies the same filter as monthly pages (#2727) Source: llm_adapter@2026-06-11 Confidence: high |
— |
| Bugfix | Medium |
Deleting points or anomaly points via the map's "Select Area" tool now removes them from the anomalies layer immediately, without requiring a page reload (#2790) Deleting points or anomaly points via the map's "Select Area" tool now removes them from the anomalies layer immediately, without requiring a page reload (#2790) Source: llm_adapter@2026-06-11 Confidence: high |
— |
| Bugfix | Medium |
OIDC login no longer fails with "undefined method 'with_indifferent_access'" when OIDC_ISSUER includes the /.well-known/openid-configuration suffix; the trailing path is now stripped automatically (#2056) OIDC login no longer fails with "undefined method 'with_indifferent_access'" when OIDC_ISSUER includes the /.well-known/openid-configuration suffix; the trailing path is now stripped automatically (#2056) Source: llm_adapter@2026-06-11 Confidence: high |
— |
| Bugfix | Medium |
Importing files with invalid UTF‑8 bytes (e.g., Windows‑encoded degree signs) no longer fails; JSON, OwnTracks, and TCX importers now handle such cases gracefully (#2772) Importing files with invalid UTF‑8 bytes (e.g., Windows‑encoded degree signs) no longer fails; JSON, OwnTracks, and TCX importers now handle such cases gracefully (#2772) Source: llm_adapter@2026-06-11 Confidence: high |
— |
| Bugfix | Medium |
Moving a point on Map v2 no longer drags unrelated route lines; routes are rebuilt from updated points instead of patching nearby vertices (#2150) Moving a point on Map v2 no longer drags unrelated route lines; routes are rebuilt from updated points instead of patching nearby vertices (#2150) Source: llm_adapter@2026-06-11 Confidence: high |
— |
| Bugfix | Medium |
Data recalculation no longer fails with "Year has already been taken" when duplicate year‑end digests exist; duplicates are cleaned up automatically (#2866) Data recalculation no longer fails with "Year has already been taken" when duplicate year‑end digests exist; duplicates are cleaned up automatically (#2866) Source: llm_adapter@2026-06-11 Confidence: high |
— |
| Bugfix | Low |
Months with very small distances on the Stats page now render a visible bar and show their tooltip; months without data no longer render a bar Months with very small distances on the Stats page now render a visible bar and show their tooltip; months without data no longer render a bar Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
| Bugfix | Low |
Weekday labels in the Insights "Activity Overview" heatmap now line up with their grid rows (#2896) Weekday labels in the Insights "Activity Overview" heatmap now line up with their grid rows (#2896) Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
| Bugfix | Low |
The replay marker now renders above track and route lines instead of being hidden beneath them The replay marker now renders above track and route lines instead of being hidden beneath them Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
| Bugfix | Low |
Deleting a family no longer fails with a 500 error when location‑sharing requests exist for it (#2916) Deleting a family no longer fails with a 500 error when location‑sharing requests exist for it (#2916) Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
| Bugfix | Low |
The Anomalies map layer now remembers being enabled across page reloads and day changes, like other layers (#2791) The Anomalies map layer now remembers being enabled across page reloads and day changes, like other layers (#2791) Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
| Bugfix | Low |
The suggested‑visit card no longer promises alternative suggestions that never arrive; it now points to the visit's search button for picking a different place (#2852) The suggested‑visit card no longer promises alternative suggestions that never arrive; it now points to the visit's search button for picking a different place (#2852) Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
| Refactor | Medium |
Post‑import steps (stats scheduling, anomaly filtering) no longer affect the import's status after successful point writes Post‑import steps (stats scheduling, anomaly filtering) no longer affect the import's status after successful point writes Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
Full changelog
Upgrade notes:
- A migration removes duplicate year-end digests that could accumulate before this release. If a yearly recap in Insights showed odd numbers, they may change after the upgrade — that's the duplicates being cleaned up.
Added
- Fog of War (Map v2) can now reveal explored areas per hexagon instead of per point, using precalculated monthly statistics. Switch between "Per point" and "Per hexagon" in the map settings panel. (#2899)
Changed
- The suggested-visit card no longer promises alternative suggestions that never arrive; it now points to the visit's search button for picking a different place (#2852)
- Loading points on the map is faster on large histories: the points API now uses the spatial index when filtering by the visible map area, instead of scanning every point in the date range
- Monthly statistics are lighter to calculate for point-heavy months: hexagon aggregation reads coordinates in a single pass without instantiating database records, and no longer re-queries the whole month when it has to fall back to a lower hexagon resolution
- The Timeline day view no longer issues one extra database query per visit, and the initial map view's bounds are computed in a single query instead of two
- Bumped the
oauth2gem to 2.0.22 to close a known credential-leak advisory (GHSA-pp92-crg2-gfv9) on the Google/GitHub sign-in path - CI now runs the full RSpec suite on every pull request; the previous workflow had been disabled
- Globe view is enabled by default for Pro and self-hosted users.
Fixed
- Deleting an import no longer gets stuck on an endless spinner: failed deletions revert to a retriable state, and imports stalled in "Deleting" for over an hour show a retry button (#2835)
- Insights no longer report a "new country visited" for border-crossing geocoding blips that the statistics pages already filter out; the yearly digest now applies the same rule as the monthly one (#2727)
- Deleting points or anomaly points via the map's "Select Area" tool now removes them from the anomalies layer immediately, without requiring a page reload (#2790)
- Months with very small distances on the Stats page now render a visible bar and show their tooltip; months without data no longer render a bar at all (#2864)
- Weekday labels in the Insights "Activity Overview" heatmap now line up with their grid rows (#2896)
- OIDC login no longer fails with "undefined method 'with_indifferent_access'" when OIDC_ISSUER is set to the full discovery URL — the trailing /.well-known/openid-configuration is now stripped automatically (#2056)
- Importing files containing invalid UTF-8 bytes (e.g. Windows-encoded degree signs in Google Timeline phone exports) no longer fails with "invalid byte sequence in UTF-8". Applies to the JSON-based importers as well as OwnTracks and TCX (#2772)
- Moving a point on Map v2 no longer drags unrelated route lines along with it; routes are rebuilt from the updated points instead of patching nearby line vertices (#2150)
- An import that finished successfully could still be marked "Failed" — with a failure notification — when a post-import step (stats scheduling, anomaly filtering) raised after all points were already written; post-import steps no longer affect the import's status
- Cloud only: the Lite plan's 12-month data window now applies to the Points page as well, and the "points outside your window" hint no longer caps the visible-points count at the page size
- Data recalculation no longer fails with "Year has already been taken" when duplicate year-end digests exist; duplicates are cleaned up automatically and can no longer be created (#2866)
- The Anomalies map layer now remembers being enabled across page reloads and day changes, like other layers (#2791)
- Map v2 Replay now plays back proportionally to real elapsed time (at 1x, one real minute per second; speed multiplier compresses further) instead of one point per tick, so slow and fast journeys of equal duration take equal playback time; long point-free gaps are skipped quickly instead of stalling (#2845)
- The replay marker now renders above track and route lines instead of being hidden beneath them
- Deleting a family no longer fails with a 500 error when location-sharing requests exist for it (#2916)
- Self-hosted: the /admin/flipper feature-flag UI is no longer rate-limited, which made it unusable after a few clicks (#2897)
💙 This release is supported by Steven B., James Manolios, chenrik, aldumil, derpderpington, Chippie, dint, jhalpern, Lex Fradski, Schlufo, cyberswan.at, craftyklaus, Andre, hogenf, naraxius, Embrace, martin4861, Alex, evetters, GregF, Jon Coffee, Lukas, Robbie G, Kilian, Hans G, Chris, tabaha, Andre, Michael C, Chris, Jonah B., Dante, daallex, Tanner A., Milien M., Mathias, Travis S., Matthew F., Johnathan D., bleibdirtroy, no1etal, dixet, Bailey J., Alex D., Benjamin M., Daniel A., Florian, BeeHappy, ChemistryDachshund, OrangeWindies, Michelangelo V., Edward, Erazem Z., Denis Abt, Tony G., Andrew D., Lomky, Osamu Y., Simon van B., Linus T., Christian C., Sebastian, Jan K., Nathan T., Max G., Lars N., Karol B., Konstantin, Johannes H., t3hero, g3lin, Tim, Philipp M., Brand K., Pablo F. M., Jon H., fkB, Mikael, Dániel A., Hai_Tsung, ShooTex, GreenTentacle, PinkahPandah, David, Ken, Denna G., Andre, Hendl91, Jon H., MrRed, Arkadiusz Z., Jake, Bator T., Alex J. H., eps-dev, twiggu, Dragan V., Jerome G., Sheya B., ArnyminerZ, Gustav B., higgs01, Frank F., F. J. Kruz, Jon D., Alexander J. H., Daniel D., Gonzalo M., Ricardo T., Christof Z., Narrator, JohnSmith21, smartbert, A.M., Matthew Z., Dror T., Jonathan K., Henrik H., Kyle C., Mario B., Albin H., Phillip S., Bernd, Tom, Brett J., Nick O., greeting7416, Dick, Brian R., Henning, Markus, TheSlimShady, Andrew M., Peter D., Mkpenguin, Mason B., Chance, GoogilyBoogily on Patreon and KoFi 💙
What's Changed
- 1.8.1 by @Freika in https://github.com/Freika/dawarich/pull/2914
Full Changelog: https://github.com/Freika/dawarich/compare/1.8.0...1.8.1
Security Fixes
- GHSA-pp92-crg2-gfv9 — credential‑leak advisory closed by bumping oauth2 gem to 2.0.22 on Google/GitHub sign‑in path
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About dawarich
Your favorite self-hostable alternative to Google Timeline (Google Location History)
Related context
Related tools
Earlier breaking changes
- v1.10.1 Drops legacy `latitude`/`longitude` columns on `points`; migrates to single `lonlat` column.
- v1.8.0 Changes declining a visit to delete the visit entirely; removes "Declined" filter and Restore action.
- v1.7.9 Place deletion no longer deletes visits; sets dependent: :nullify.
- v1.7.9 Visit detection creates one Place per visit, not 25 candidates.
- v1.7.8 Places without linked visits are permanently deleted during ownership migration.
Beta — feedback welcome: [email protected]