This release includes 4 security fixes for security teams reviewing exposed deployments.
Published 2mo
Productivity & Wikis
✓ No known CVEs patched
This release patches 4 known CVEs
Topics
budget-tracker
collaborative
opensource
packing-list
poi
real-time
+11 more
routes
self-hosted
travel
travel-app
travel-planner
traveling
trip
trip-planner
wanderlog
wanderlust
webapplication
Affected surfaces
auth
rce_ssrf
Summary
AI summaryCritical crash during backup restore fixed, ensuring DB connection always reopens.
Full changelog
Security Hardening
- JWT Secret: Empty default in docker-compose so auto-generation kicks in (prevents predictable secrets)
- OIDC: Token passed via URL fragment instead of query param (no longer in server logs/browser history)
- SVG Upload blocked: Photos, files and covers now reject SVG uploads (stored XSS prevention)
- Helmet: Added security headers middleware (HSTS, X-Frame-Options, nosniff, etc.)
- Body limit: Explicit 100kb JSON body size limit
- XSS fix: Escaped
image_urlin Leaflet map marker HTML - WebSocket: Removed verbose debug logging from client
Backup Restore Fix
- Critical: Fixed permanent server crash after backup restore — DB connection now always reopens via
try/finally - EBUSY fix: Uploads restored in-place instead of
rmSync(which failed becauseexpress.staticheld the directory) - DB proxy: Added null guard for clearer error messages during restore window
Restore Warning Modal
- Red warning popup before restoring a backup (replaces browser
confirm()) - Explains that all data will be permanently replaced
- Tip to create a backup before restoring
- Supports DE/EN and dark mode
Demo Banner
- Fixed i18n for demo login button (was hardcoded German)
- Fixed icon alignment in addon list
- Added addon management & OIDC to full version features
Security Fixes
- SVG uploads now blocked to prevent stored XSS
- OIDC token transmission moved from query param to URL fragment (no longer logged)
- Helmet middleware added providing HSTS, X-Frame-Options, nosniff headers
- JWT secret defaults removed; empty default forces auto‑generation
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Beta — feedback welcome: [email protected]