v5.7.0

[dgraf-gh]

Reitti v5.7.0 Release Notes

Hey everyone, Daniel here! 👋

This release has a bit of everything: a brand new integration that gets your watch recordings into reitti without you touching a single file, two detection algorithms that got noticeably smarter, and a serious round of security hardening. Let's dive in.

New Integration: Intervals.icu

If you ride, run or hike with a watch and your data lives in Garmin Connect, this one is for you. reitti can now connect to Intervals.icu and pull your activities from there automatically: one historical import on setup, then a background sync that keeps new activities coming in. Imported activities go into a device of your choice, or straight into your timeline.

The chain looks like this: your watch → Garmin Connect → Intervals.icu → reitti. Intervals.icu does the hard part of talking to Garmin, and reitti just asks it for the results. No more downloading FIT files by hand.

Setup is short: grab your API key in Intervals.icu under Settings → Developer, then paste it into the new Intervals.icu integration on reitti's integrations settings page. That's it. This feature started as a feature request from u/mupete, who pointed out that Intervals.icu could be the middle man for Garmin data, so thank you, it turned out to be a very good idea. The integration also got a proper test suite in this release, covering historical import and incremental sync, so a future refactor cannot quietly break it.

Two things you should know before you connect it:

• Strava data is not available this way. Intervals.icu's API cannot serve Strava activities, because Strava's terms do not allow it. If your activities come from Strava, the chain stops at Intervals.icu for now. That is not something I can work around from my side.
• Garmin may change its mind. Intervals.icu noted in early October that Garmin updated its terms and conditions and may have to block Garmin data from its API at some point. If it comes to that, the sync simply stops producing new activities. Nothing breaks, but I would rather tell you up front than have you read it in an outage report.

Smarter Visits from Sparse Data: Now Based on Speed

When I reworked the handling of sparse data in v5.6.0, I built it on several space and time based guards to decide whether we need to "fake" a stationary visit. Someone in our IRC channel then had a much better idea: derive it from the speed between two points instead. I tried it, and it works so much better.

Comparing my own two setups, a GPSLogger phone and an OwnTracks config in significant move mode, the results are now really close to each other. They used to disagree in exactly the situations where you could not tell which one was right.

This applies to new incoming data. If you want your existing history reprocessed, trigger a recalculation the same way as last time: go to Settings > Visit Sensitivity, edit one of the existing settings and save — no changes need to be made. Reitti will ask if you want to recalculate all data.

⚠️ Be careful with recalculation. It is a destructive operation that clears out all places, visits and trips before it rebuilds them. Make a backup first.

Better Transportation Mode Detection

The multi-segment transport modes introduced in v5.3.0 got a new algorithm that tries to spot fluke data in between a single segment. We had something similar before, but it was tuned too fine, which led to a very specific kind of nonsense: getting stuck in a traffic jam on the Autobahn for a longer period and reitti deciding you were on a bike.

Your movements should now be reflected more accurately, including the annoying ones. And since all of this is based on my assumptions about how the world functions, it can also be completely off in your corner of it. If it works well, or if it fails, please leave a comment in the release discussion, that is the only way I get to see the cases I never thought about.

Security Hardening

Then there is this one: after the security release in v5.6.1, there was a whole series of security pull requests still open. I folded the work into a single PR, and this release ships the result. The main changes:

• CSRF protection is now on for everything except the API endpoints. The API authenticates with tokens, the web UI now has to prove that a request really came from the UI.
• Data between users is more strictly separated. Access checks were added across the location, visit, trip, H3 cell and token APIs, so one account cannot reach into another one's data.
• Only admins can set the role of a user. Regular users could previously promote themselves or demote the last remaining admin. Not anymore.
• Only admins can see and change the geocoding configuration.
• Login attempts are throttled, so guessing passwords gets slow and boring quickly.
• Cleaner error handling. Errors you can trigger through the UI deserve a real error message, everything else gets an error page instead of leaking internals.
• And probably a lot more that does not fit into a bullet list

I am genuinely thankful that other people read this project carefully enough to find these things, and I want those PRs. Opening sixteen of them at once is an effective way to make a maintainer nervous, but please keep them coming. Just make sure that they are self-contained and narrowly scoped. This makes my life easier in reviewing them.

Improvements

• Jobs are now scoped to the user. You only see your own running and finished jobs. Only admin users get to see the system-wide jobs on top of that. Less noise, and less information lying around that is not yours.
• Cleaner raw tracks. Now that sparse data handling works properly, it became visible that we were also sending synthetic points — the ones reitti generates internally to fill gaps — to the map. They are excluded from the raw location endpoint now. Your tracks show what you actually recorded, and the browser has fewer points to process, so rendering gets faster too.
• Failure of preview generation is detected and reported. Previously a broken preview just meant nothing happened. You now get a notification, so it is clear that something went wrong instead of looking like reitti forgot about you.

Bug Fixes

• Box selection in the workbench. Drawing a box to select points also grabbed hidden points from outside the time range you had open. Fixed.

Other Changes

• The avatar bubble on the map lost its animation. It looked ugly and provided no benefit, so I removed it.
• Fresh translations from Hosted Weblate. A big thank you to all translators!

Thank You

• u/mupete for pointing out that Intervals.icu could act as the middle man for Garmin data, which is where this whole integration started.
• @claudiusbirdwhistle for the security work in this release. This is the second release in a row that is better because of your review.
• jsixface in our IRC channel who suggested deriving sparse-data detection from speed. You were right, and it shows.
• All translators and everyone reporting issues.

Help Spread the Word

Word of mouth is what keeps reitti growing. If you know someone looking for a private Google Timeline alternative, a way to geotag their Immich library, or an open Street View to contribute to, mention reitti. I would much rather spend my time writing code than posting on social media, so every mention helps more than you know.

If you want to support the project financially, there are now two ways to do it:

---

Full Changelog: v5.6.1...v5.7.0

Getting Started

The latest docker-compose.yml is available in the GitHub release assets. Pull the new image, restart, done. No configuration changes are needed for the detection improvements — they apply to new data automatically. If you want them applied to your existing history, see the recalculation note above, and make a backup before you do it.

• GitHub: Report issues & view source
• Docs: https://www.dedicatedcode.com/projects/reitti/latest/
• RSS: Stay updated by adding .atom to the end of our releases URL
• Discuss: Join the conversation on Lemmy
• IRC: #reitti on libera.chat

If you have any questions, feel free to add them to the release discussion.

Thank you all for being part of this journey. Happy tracking!

— Daniel

Pull requests in this release

New features & improvements

• feature(#1309) Add Intervals.icu integration tests #1312 feature([Feature Request] Add intervals.icu integration #1309) Add Intervals.icu integration tests
• 1314 feature request add speed based sparse data detection #1317 1314 feature request add speed based sparse data detection
• feature(#1315) Improve transportation mode detection #1319 feature([Feature Request] Improve transportation mode detection #1315) Improve transportation mode detection
• feature(#1316) Enhance job metadata filtering and visibility logic #1318 feature([Feature Request] Scope Job Display to current user #1316) Enhance job metadata filtering and visibility logic
• cleanup: Exclude synthetic location points in raw location query #1323 cleanup: Exclude synthetic location points in raw location query
• feature(#1306) Remove animation from avatar bubble on the map #1313 feature([Feature Request] Remove animation from avatar bubble on the map #1306) Remove animation from avatar bubble on the map

Bug fixes

• bugfix(#1325) Ensure box-select only targets points within the select… #1326 bugfix([Bug] Box Select on the workbench selects unrelated points #1325) Ensure box-select only targets points within the selected range
• feature(#1320) Add preview failure detection and notification #1321 feature([Bug] Fix preview handling #1320) Add preview failure detection and notification

Security

• **security: Incorporate security related PRs ** #1310 security: Incorporate security related PRs (including security: access checks for the location, visit, trip and H3 cell APIs #1287, security: scope trip/visit metadata and transport modes to the owner; reject open redirects #1288, security: owner checks for API tokens, magic-link deletion, sharing colours and the job queue #1289, security: memory ownership, magic-link scope, storage confinement and image-only uploads #1290, security: throttle password guessing; trust X-Forwarded-* only from internal proxies #1297, bugfix(#1281) Keep renamed places and their visits together #1300)

Translations

• Translations update from Hosted Weblate #1322 Translations update from Hosted Weblate

---

This discussion was created from the release v5.7.0.