v0.20.0

Breaking Changes

[!CAUTION]
With this update we introduce a new plugin system: integrations (Strava, Komoot, Hammerhead) now run as sandboxed WASM plugins, providing the foundation for third-party plugins (PR #1034).
If you host your own instance, you must now manually install the plugins you want your users to access:

1. Update docker-compose.yml: Map the new /data/plugins folder in your db service's volumes section to ensure plugins can be installed. Refer to the sample yml in the repository if necessary.

2. Install Plugins: Follow the documentation to download and activate your preferred plugins after updating.

Trail categories have been reworked into a refined category model with subcategories, a new category settings page, and the option to disable individual categories. Custom category that were added before v0.20.0 may need to be reviewed after the upgrade. (PR #1059)

Features

• New plugin system: integrations (Strava, Komoot, Hammerhead) now run as sandboxed WASM plugins, providing the foundation for third-party plugins. (PR #1034)
• Server-side map clustering via Meilisearch and Supercluster significantly improves map performance for large trail datasets. (PR #991, thanks @palhaland)
• Improved trail planning: route anchors can now be re-ordered via a new anchor list, and routes can be extended directly from search results or POI popups. (PR #1007)
• Waypoints can now be edited while drawing a route. (PR #1060)
• Actors (users) are now indexed in Meilisearch, improving user search. (PR #1048)
• Local resources now carry an IRI, improving federation consistency. (PR #1046)
• PWA favicon support added. (PR #1008, thanks @briannelson95)

Security

• Hardened ActivityPub federation and fixed an N+1 query in the follower fanout. (PR #1056)
• Fixed an unauthenticated SSRF in POST /api/v1/trail/download, which allowed the server to be tricked into fetching internal-network or cloud metadata endpoints via a user-supplied URL. (GHSA-7vqq-mjjr-h9j5, reported by @guwu1017, PR #1104)

Bug Fixes

• Public trails from users with private profiles no longer return a 404. (PR #1002, thanks @Guacam-Ole)
• Duplicated trails now keep their GPX data, completed state, thumbnail, waypoint distances, and summit logs; photos are only copied when duplicating your own trails. (PR #1080)
• On the trail edit page, the initial map zoom no longer hides the route behind the elevation profile, and a manually hidden elevation profile stays hidden while drawing. (PR #1081)
• Fixed self-federation issues. (PR #1044)
• Fixed the polyline database field size for long trails. (PR #1047)
• Fixed the waypoint actor in integrations. (PR #1049)
• Fixed the missing tmp directory in the Docker image. (PR #1069)
• Fixed duplicate feed entries created by repeated remote trail/list Update activities. (PR #1052, thanks @Guacam-Ole)
• Increased the plugin request size limit, fixing failures on large activity responses for long trails. (PR #1083)

Documentation

• Overhauled the documentation homepage and added a servers page. (PR #1084)

Maintenance

• Migrated the rich text editor (tiptap) to v3. (PR #1075)
• Updated web, docs, Go, and Docker dependencies as well as CI actions.
• Removed legacy self-hosted search Docker image sources, dropped since v0.14.0. (PR #1054)