TREK

8,000 stars — thank you 🌟

TREK just passed 8,000 GitHub stars. For a self-hosted travel planner that started as a side project, that's genuinely humbling — and it's all of you: the bug reports, the translations, the pull requests, and everyone quietly running TREK on a NAS or a Pi in a closet somewhere.

A patch release is normally fixes only. As a small thank-you, 3.1.3 ships a few new features too — alongside the usual pile of fixes. Keep the issues and PRs coming. 💛

✨ New features

• Distance unit — metric or imperial. A per-user setting so distances render in kilometres or miles, mirroring the temperature unit. Default stays metric. (#1300 — thanks @mvanhorn)
• MapLibre + OpenFreeMap map provider. A third, fully self-hostable and API-key-free map provider alongside Leaflet/OSM and Mapbox. The GL engine is code-split, so Leaflet-only setups never download it. (#1317 — thanks @hykilpikonna)
• Places sidebar follows the map. Click a marker and the places list scrolls straight to it. (#1315 — thanks @hykilpikonna)
• Precise Google Maps links. The "Google Maps" button now resolves to the actual place via its feature ID instead of dropping a raw-coordinate pin. (#554 — thanks @hykilpikonna)

🔒 Security

This release also closes one privately-reported vulnerability. Updating is recommended.

| Advisory | Severity | Issue |
|---|---|---|
| GHSA-r4cp-666p-8f69 | Medium (CVSS 4.3) | Cross-trip reservation title disclosure — a member of one trip could reference another private trip's reservation id (on file upload, update or link) and read its title back through the file's reservation join. Cross-trip references are now rejected on every file write path. (CWE-639) |

Changelog

• feat: distance unit (metric/imperial) display setting (#1300)
• feat(maps): MapLibre + OpenFreeMap as a self-hostable map provider (#1317)
• feat(planner): seek the places sidebar to the selected map marker (#1315)
• feat(maps): precise Google Maps place links via feature IDs (#554)
• fix(map): drop the phantom hotel leg to/from a transport endpoint on arrival days (#1321)
• fix(map): draw the hotel-to-hotel leg on a transfer day with no activities (#1297)
• fix(map): pin the GL basemap label language to the UI language (#1299)
• fix(planner): show the route tools for a single place when optimizing from accommodation (#1330)
• fix(maps): make Overpass endpoints configurable and harden the POI search (#1309)
• fix(atlas): assign border places by polygon, not just bounding box (#1331)
• fix(reservations): keep dated bookings on their date when the trip range shifts (#1288)
• fix(costs): freeze the FX rate so settled expenses don't reopen when rates drift (#1335)
• fix(airtrail): import the airline name, not the ICAO code (#1334)
• fix(dashboard): persist the currency & timezone widgets so an upgrade keeps them (#1311)
• fix(places): guide single-place links to the right importer (#1304)
• fix(share): translate the day label on the public share page (#1296)
• fix(pwa): use the self-contained app icon for the favicon so it shows on dark tabs (#1328)
• fix(files): reject cross-trip reservation/place/assignment links — GHSA-r4cp-666p-8f69
• i18n: new Swedish translation + refreshed Dutch translations
• chore: replace the 3.0 upgrade notices with a thank-you / support modal
• docs(wiki): document all environment variables and fix the kitinerary install steps

What's Changed

Released by @mauriceboe in https://github.com/mauriceboe/TREK/pull/1324, with community contributions from @hykilpikonna, @mvanhorn, @olsson82, @eindpunt, @Hardik-369, @jubnl and @CooperSheroy. Thank you all. 🙌

Full Changelog: https://github.com/mauriceboe/TREK/compare/v3.1.2...v3.1.3