Release history
habitica releases
A habit tracker app which treats your goals like a Role Playing Game.
All releases
24 shown
Fixed inconsistent RSVPNeeded state when accepting quests.
Full changelog
API
- Fix: Apply rate limiting to /api/v4 requests and increase cost of account registration (@phillipthelen)
- Fix: Move quest accept operations to a transaction to avoid inconsistent state of RSVPNeeded field (@Hafizzle and @SabreCat)
- Chore: Locale files updated (@weblate contributors)
Client
- Fix: Correct z-index of task options dropdown vs other tasks in column (@SabreCat)
- Fix: Adjust tab order and focus highlighting when navigating across task elements with keyboard (@SabreCat)
Warns users about including sensitive personal information in task fields.
CSP whitelist expanded to include habitica.com literal domain alongside wildcard variants.
Fixed ability to join archived guilds, corrected group invite email variable names, and prevented duplicate tag creation from exact matches.
- Generate fresh IV for cryptography instead of static environment variable (GHSA-wj5m-v567-ph9j)
- Simplified Orb of Rebirth achievement stacking
- Revive lapsed Group Plans
- Emoji library overhaul with autocomplete
- Updated Group Plan selection flow
## API * Content: Gear, backgrounds, etc for March-May 2026 (@beffymaroo and @SabreCat)
- HTML and PNG export API routes removed
Optimized caching and MongoDB pool behavior to reduce resource spikes and prevent gibberish page loads during high traffic.
Fixed inconsistent templating characters in internationalization files causing errors in group, challenge, and miscellaneous strings.
- GET /api/v4/i18n/browser-script route sunset, replaced by /api/v4/i18n/core and /api/v3/i18n/content
- Anonymous PayPal subscription debug logging
- Customization item pinning support
Fixed username sanitization in Google and Apple authentication registration to handle disallowed usernames by providing randomized alternatives.
- Environment config to disable SSL/base URL checks
- Improved pagination for chat and inbox
## Client * Fix: Correct binding of dropdown in stat allocation so it saves as intended (@Hafizzle)
Fixed default analytics permission setting when opening privacy preferences modal.
- Automatic stat allocation reimplementation
- Modal-based confirmation dialogs