Skip to content

v0.6.75

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Oct 09:25
v0.6.75
811aa71
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.6.75 ~ "Road distance and ETAs from one routing engine, tenant-isolated profile accounts and App Review access for Navigator"

Highlights

  • Feature: one routing engine for order distance, ETAs and the map. An order's stored distance and time, its live ETAs and remaining distance, and the route drawn on the map now all come from the organization's routing engine. Before this, order distance defaulted to a straight-line estimate at a flat ~50 km/h; a reported ~30 km run was stored as 25.0 km / 30 min and is now 32.1 km / 32 min. The engine is chosen in order: the organization's routing engine, then the admin default, then the platform's Valhalla server, then the straight-line estimate. An engine only counts if it is allowed and configured. A failed road lookup falls back to the straight-line estimate and is logged, instead of storing 0. Road results are cached for 24 hours. (#406)
  • Feature: routing provider controls in Admin → Fleet-Ops → Routing. Administrators choose which providers organizations may use (Google, Valhalla, OSRM, VROOM), with per-organization exceptions. They also set the default routing and optimization engines, and whether server-side routing uses roads or only the straight-line estimate. Saved admin settings take precedence over environment variables. Google is off until an administrator enables it, for map routing, optimization, order distance and ETAs. The public OSRM demo server is never called by the server. The admin menu entry "Fleet-Ops Config" is now "Fleet-Ops". (#406)
  • Feature: the OSRM server is a setting, for the platform and per organization. Administrators set it in Admin → Fleet-Ops → Routing → OSRM Server; OSRM_HOST is now only the starting value. Organizations that route or optimize with OSRM can use their own server under Fleet-Ops Settings → Routing → OSRM Server, like the Valhalla and VROOM overrides. An organization host must be a public address (OSRM_ALLOW_PRIVATE_HOSTS=true lifts that on self-hosted installs). Order distance, ETAs, tracking and the console's OSRM routes and route control all use the resolved server. The public demo server still only draws map routes.
  • Security: an organization's routing host can't point at a private address. Order distance, ETAs and VROOM allocation ignore an organization's Valhalla or VROOM override whose host is loopback, a private or link-local network, cloud metadata or another non-public range, and use the system server instead. This also covers values saved before the Valhalla and VROOM extensions started rejecting them. (#417)
  • Security: a profile never links to another organization's login account. Creating a driver, customer or contact with an email or phone that belongs to another organization's account linked that account and exposed its name, email and phone. The new organization could then reset its password or deactivate it. Only accounts that already belong to the organization, or belong to no organization, are reused now. The refusal does not say whose account it is. POST /v1/drivers also ignores a company that is not the API credential's own. Logins already shared by the old behaviour can only be managed by their holder. (#414)
  • Fix: orders can be edited with a partial payload. PUT /v1/orders/{id} accepts a payload with only the parts that change, such as only entities or only a new dropoff. (#411)
  • Fix: addresses sent with coordinates keep their street. A place given as a street address plus latitude/longitude was reverse-geocoded and stored as a different nearby address. The street and the coordinates are now kept as sent, without a geocoding call. (#411)
  • Feature: idempotent order creation. POST /v1/orders accepts an Idempotency-Key header. A retry with the same key within 24 hours returns the order already created, with Idempotent-Replayed: true, and a concurrent duplicate gets 409. (#412)
  • Fix: scheduled_at keeps its UTC offset. 2026-10-21T11:00:00-07:00 is now stored as 18:00 UTC instead of 11:00, and PUT /v1/orders/{id}/schedule stores the UTC instant of a date and time in the company timezone. Rows written before this keep their old values. (#412)
  • Fix: service quotes. The currency filter works again, stored quotes expire after 48 hours by default (fleetops.service_quotes.ttl_minutes), and preview=1 prices a request without storing quote rows. (#412)
  • Fix: tracking numbers with a space can be looked up again. Since v0.6.72, a number such as AL 7796486490AE, generated for a company whose name has a space in its first three letters, got "not found". Single inner spaces are accepted now. New numbers only use letters and digits: the company prefix skips spaces and punctuation ("Al Noor" gives ALN), and a region such as "New York" becomes NEWYORK. (#413, #416)
  • Feature: App Review access for Navigator. Apple and Google reviewers can't receive the texted sign-in code. An organization can turn on Settings → Navigator App → App Review: reviewers sign in to its Navigator with the test number +1 202 555 0144 (a range kept for fiction, never texted) and a six-digit code the owner creates and enters in App Store Connect and Google Play Console. The code is stored hashed, shown once, and only works for that organization. The first sign-in adds an App Reviewer driver, which ad-hoc offers, nearest-driver assignment and the orchestrator always leave out. Built on core-api's App Review access; the NAVIGATOR_* review env settings still work on self-hosted installs. See docs/NAVIGATOR_APP_REVIEW.md. (#418)

Upgrading

  • Requires fleetbase/core-api v1.6.74 (composer.json now requires ^1.6.74), which adds App Review access and its review_accesses table: run php artisan migrate.
  • Routing defaults changed (#406). Review Admin → Fleet-Ops → Routing after upgrading:
    • The default routing engine is now Valhalla (it was OSRM). Without a Valhalla server (VALHALLA_HOST, or the Valhalla extension's settings), order distance and ETAs use the straight-line estimate. Self-hosters running their own OSRM can make it the default in the panel or with ROUTING_DISPLAY_ENGINE=osrm.
    • Google is off. Turn it on in the panel or set ROUTING_GOOGLE_ENABLED=true. DISTANCE_MATRIX_PROVIDER=google also enables it until the panel is saved.
    • Tracking follows the routing engine. TRACKING_PROVIDER and TRACKING_PROVIDER_FALLBACKS are no longer read, and saved tracking provider and fallback choices are ignored.
    • DISTANCE_MATRIX_PROVIDER only seeds the admin defaults now; it no longer overrides order distance.
    • New starting values, read until the panel is first saved: ROUTING_GOOGLE_ENABLED, ROUTING_DISPLAY_ENGINE, ROUTING_OPTIMIZATION_ENGINE, ROUTING_SERVER_ROUTING, plus VALHALLA_HOST, VALHALLA_API_KEY, VALHALLA_COSTING and VALHALLA_TIMEOUT.
    • Existing orders: started, unfinished orders from the last 2 days are re-measured by fleetops:update-estimations; unstarted orders pick up road distance at their next ready or edit; completed and cancelled orders keep their stored values. No migration.
  • OSRM server. Nothing to do: OSRM_HOST keeps working until a host is saved in Admin → Fleet-Ops → Routing. Organization OSRM servers are new and empty.
  • Private routing hosts (#417). On self-hosted installs, an organization override pointing at a private host (for example http://valhalla:8002) now falls back to the system server. Set VALHALLA_ALLOW_PRIVATE_HOSTS=true or VROOM_ALLOW_PRIVATE_HOSTS=true to allow it. System-level private hosts are unaffected.
  • Fleetbase Cloud. After deploying, set the Valhalla host to https://valhalla.routing.fleetbase.io with Cloud's gateway key, Google and OSRM off, and Valhalla as the default engine with road routing. Enter the gateway key only after fleetbase/valhalla v0.0.5 and fleetbase/vroom v0.0.5 ship (valhalla#9, vroom#8), because the extensions' settings endpoints return the key to any signed-in user until then.

Need help?

What's Changed

  • fix(orders): allow partial payload edits and keep addresses sent with coordinates by @roncodes in #411
  • fix(security): never link a profile to another organization's login account by @roncodes in #414
  • Allow single inner spaces in tracking number lookup (regression from #352) by @shivanathd in #413
  • fix(orders,quotes): idempotent order creation, UTC scheduling, quote currency, expiry and preview by @roncodes in #412
  • fix(tracking): generate tracking numbers from letters and digits only by @roncodes in #416
  • feat(navigator): App Review access, so app store reviewers can sign in to Navigator without SMS by @roncodes in #418
  • feat(routing): one routing engine for order distance, ETAs and the map; admin provider policy; Google off by default by @roncodes in #406
  • fix(routing): never call an organization routing host on a private address by @roncodes in #417
  • release: v0.6.75 by @roncodes in #415

New Contributors

Full Changelog: v0.6.74...v0.6.75

Contributors

roncodes and shivanathd
Assets 2
Loading