v0.13.0

Upgrade Notes

• Database migrations run on start: AddRdwLookups, DropRawTopic, AddCommutePlaceNotify and AddTripIsHidden. Dropping the telemetry's raw topic column is instant in PostgreSQL. Its space comes back gradually, or at once with VACUUM FULL "TelemetrySnapshots"; (#518, #519, #521)
• GET /api/vehicles/{vin}/topics is removed. This undocumented diagnostic endpoint was the only reader of the raw topic column, which stored the MG account's email address in every telemetry row (#519)
• New variables for the Dutch registration lookup: RDW_ENABLED (default false), RDW_REFRESH_HOURS (default 24) and RDW_APP_TOKEN (optional). Nothing changes until you switch it on (#518)
• Home Assistant through a Mosquitto bridge: add topic garagestack/# in 0 to the bridge so GarageStack's own sensors reach Home Assistant. A broker GarageStack talks to directly needs nothing (#521)
• ForwardedHeaders__TrustedProxies__* now accepts ranges such as 172.18.0.0/16. Behind a reverse proxy on a Docker network, list the network as a range so the frontend container stays trusted when it gets a new address. Entries GarageStack cannot read, and forwarded headers from a proxy it does not trust, are now logged (#526)

Features

• Dutch registration lookup (RDW). For a car with a Dutch plate, GarageStack shows what the RDW has on record: when the APK runs out, open recalls with their risk and repair, and whether the car has WAM insurance. It adds a dashboard card, a licence plate field in Settings, and notifications for open recalls, the APK 30 and 7 days ahead, an expired APK and missing insurance. It is off by default, and the plate is the only thing that leaves your network. No API key is needed (#518)
• Arrival and departure alerts. Home or work can notify you when the car arrives or leaves (Notify on arrival and departure). Warming the car up at home sends nothing (#521)
• Hide a trip, or join two. Hide a trip caused by a positioning glitch: it drops out of the map, the statistics, the dashboard and the trip log's totals and export, and stays listed under Show hidden trips. Join with next trip joins two trips that a short stop, such as a fuel station, split in two (#521)
• Show a trip from the trip log on the map. Each trip has a Show on map button that opens the map with that trip selected and framed. A trip older than the map's period is shown with the rest of its day (#529)
• APK, recalls, next maintenance and last trip in Home Assistant and the Homepage widget. Home Assistant picks them up over MQTT discovery on the car's existing device (#521)
• The OpenAPI document is served in every deployment at /api/openapi/v1.json, to signed-in users and read-only tokens (#521)
• More home screen shortcuts. Long-pressing the installed app now offers Trip log, Climate schedules, Maintenance and Logs alongside Map and Statistics (#530)
• Compact trip format for the map. GET .../trips?format=compact sends trips as an encoded polyline, about half the size. The map uses it. The plain format stays the default, so scripts reading /trips are not affected (#522)

Bug Fixes

• Live data after a reconnect. Telemetry pushed while the live connection was down now shows once it reconnects (#519)
• Unknown addresses in the app now redirect to the dashboard instead of showing an empty page (#519)
• Moved-while-parked warning no longer goes off for a GPS fix that strays from a garage, a multi-storey or between tall buildings: the margin is now 1.5 km instead of 300 m (#523)
• OIDC behind a reverse proxy on a Docker network. With only the host's address in TrustedProxies, the API ignored the proxy's https, sent an http:// redirect URI and the identity provider refused it. See Upgrade Notes for the range syntax that fixes this (#526)
• Push notification icon on Android shows as a car silhouette instead of a solid square (#525)
• Pale car paints and the road on the overview. A white or silver car now stands out on the light card, and the road shown while driving looks like asphalt with lane markings (#528)
• Map selection on a cold load. A selected trip stays drawn on its own and framed, however the trips and the map load, and its row is brought into view in the sidebar. Whether the speed key is open or folded is now remembered on each device (#529)
• Trip log on phones is less crowded: the route reads from and to, one under the other, and the notes share a row with icon-only map, hide and join buttons (#531)
• Quieter Worker logs. Home Assistant discovery no longer logs a line, and writes to the database, for every entity the gateway announces. A database restart now logs the first failure in full, a warning every 5 minutes while it lasts, and one line on recovery, instead of a stack trace every 15 seconds (#524)

Security

• certifi 2026.10.19 in the all-in-one image (critical, GHSA-6q48-6c7w-9gw2). The SAIC gateway ships certifi 2026.2.25, whose CA bundle still trusts emSign roots with compromised intermediate CA keys. The image now upgrades it in the gateway's environment (#531)
• The MG account's email address is no longer stored in every telemetry row. It was part of the raw MQTT topic, which is now dropped (#519)

Performance

• Lighter dashboard. The tyre and level history dialogs, and Chart.js with them (about 67 KB gzipped), load on their first tap instead of on every dashboard visit (#519)
• Faster telemetry writes. Merging an MQTT message into its row sends one UPDATE of just the fields the message carried, without reading the row first (#520)
• Faster statistics. Finished days are kept in memory, so opening the statistics again reads today rather than the whole period (#520)
• Prebuilt compression. The frontend and all-in-one nginx configs share one server block and serve files gzipped at build time, at the highest level, instead of compressing each response (#520)
• Outside services back off as long as their Retry-After asks: Nominatim, Valhalla, Overpass, Open Charge Map and the RDW (#519)

Documentation

• README: a contents list, a "What leaves your network" table, and sections for the RDW lookup, climate schedules and maintenance (#518, #519, #521)
• Every screenshot was retaken, Climate schedules was added, and pnpm screenshots retakes them from a demo stack (#521)
• How the all-in-one image moves to a new PostgreSQL major version (#521)
• CONFIGURATION.md: listing the frontend container in TrustedProxies, and giving a Docker network as a range (#526)

Internal

• Repository tests against a real PostgreSQL in CI, and specs for the dashboard, statistics, trip log and map views and the map layers (#522)
• One shared send path for the outside-service clients (#520)
• CodeQL action steps bumped together, as one Dependabot group (#513)

Dependencies

• .NET packages (ASP.NET Core, EF Core, Microsoft.Extensions) 10.0.12 to 10.0.13, and dotnet-ef 10.0.12 to 10.0.13 (#516)
• certifi 2026.2.25 to 2026.10.19 in the SAIC gateway's environment in the all-in-one image (#531)
• pinia 4.0.3 to 4.1.0 (#514)
• flag-icons 7.5.0 to 7.6.0 (#517)
• Development and CI only: vitest 5.0.3 to 5.0.5, jsdom 30.1.2 to 30.1.3, @playwright/test 1.64.0 to 1.64.1, eslint-plugin-oxlint 1.87.0 to 1.88.0, Microsoft.NET.Test.Sdk 18.10.1 to 18.11.0, github/codeql-action 4.38.3 to 4.39.0 (#506, #507, #508, #510, #512, #513, #515)

Full Changelog

v0.12.3...v0.13.0: v0.12.3...v0.13.0