Skip to content

v3.1.0

Latest
Latest

Choose a tag to compare

View all tags
@mauriceboe mauriceboe released this 16 Jun 20:28
v3.1.0
f6af1d6
Release 3 1 0 (1)

TREK 3.1.0

TREK 3 — rebuilt from the inside out. A modern NestJS backend, a React 19 frontend, and an end-to-end shared Zod contract layer so the client and server can never drift. On top of that foundation: a Splitwise-style Costs rework, Passkey login, AirTrail flight sync, multi-leg flights, real road routing, a reworked dashboard, five new languages, and a comprehensive offline/PWA hardening pass.

This release also fixes 18 privately-reported security vulnerabilities — including a critical authentication bypass. Updating to 3.1.0 is strongly recommended for every self-hosted instance. See Security below.

⚠ Proxmox VE community-script users: please wait before updating to v3.1.0

v3.1.0 changes how TREK is built and run:

  • the repo is now an npm workspaces monorepo (client + server + new shared package) with a single root lockfile,
  • the server is now compiled (dist/) instead of run directly via tsx,
  • there are new build/runtime requirements (e.g. kitinerary-extractor for booking import).

The community-scripts (https://community-scripts.org/scripts/trek) LXC helper for TREK still targets the old 3.0.x layout. If you run its Update option right now, the build will fail and may leave your container in a broken state.

What to do: stay on your current version for now. An updated script is being submitted to ProxmoxVED and will roll out to ProxmoxVE after review — we'll post here once it's live. Your data (/opt/trek/data, /opt/trek/uploads) and .env are safe in the meantime.

Docker, Unraid, Helm and manual installs are not affected.

TREK 3 — NestJS + React 19

The biggest architectural change in TREK's history. The Express backend has been migrated to NestJS, the frontend upgraded to React 19, and both halves now share a single Zod contract package as the source of truth for every request and response.

  • NestJS backend — modular architecture with dependency injection, replacing the previous Express app (#1087, foundation harness #1050)
  • React 19 frontend — upgraded across the whole client
  • Shared Zod contracts — one typed, validated schema package consumed by both client and server, so API shapes stay in lockstep
  • Monorepo build pipeline — shared is now a properly built package; i18n moved into it so every surface reads from one translation set (#1056, #1066)
  • Pilot-then-migrate — the cutover started with a single module (/api/weather) to prove the harness before the full migration (#1053)

Migrations run automatically on startup — no manual steps.

Security — Update Strongly Recommended

This release closes 18 privately-reported vulnerabilities, disclosed through coordinated private reporting. They range from a critical authentication bypass down to low-severity hardening. All self-hosted instances should update to 3.1.0.

Critical

Advisory Issue
GHSA-mjh4-w6fq-54qm MFA bypass — the pre-2FA mfa_token was accepted as a full session token (JWT purpose confusion)

High

Advisory Issue
GHSA-fvgw-r58q-4cw4 OIDC account takeover — an SSO identity could be linked to an existing local account without email_verified
GHSA-627x-pmfq-98qv SQL injection via unvalidated column names in journey entry update

Medium

Advisory Issue
GHSA-xmqx-m462-52qr OIDC login CSRF / session fixation — state was not bound to the initiating browser
GHSA-6vv9-669j-468p Arbitrary file deletion under /uploads via attacker-controlled trip cover_image
GHSA-mggj-xgv8-95fp MCP share-link tools let a non-owner member mint a public trip share link
GHSA-jx25-7cj6-88hq Cross-trip IDOR — budget member paid-flag toggle not scoped to the trip
GHSA-p7pv-2jpm-qjx3 Journey share permission flags (timeline/gallery/map) enforced only client-side
GHSA-pfr2-fgv9-q5xv Stored HTML injection via reservation endpoint labels rendered into map markers
GHSA-h66w-m5g2-cqpc Path traversal in the public journey photo proxy (local provider) reads auth-gated uploads
GHSA-3frp-pcr3-w932 Stored HTML injection via journey entry story in the PDF export
GHSA-24x9-fcj9-vp6w IDOR in the journey photo proxy — a share token resolves arbitrary asset IDs
GHSA-6f5j-xgjg-h9q7 MCP tools bypass the admin-configurable RBAC permission system
GHSA-rrrf-7cf6-8736 A settings password change did not invalidate existing sessions / tokens
GHSA-f5vh-p2h5-x735 Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution
GHSA-mx6m-qxv8-w624 IDOR — any authenticated user could read another user's journey share token (full journey leak)

Low

Advisory Issue
GHSA-w6f3-fp9r-xp6p Admin backup restore extracted archives without a decompression-size limit (zip bomb)
GHSA-g8rf-gqrw-4qf9 Stored cross-user HTML injection via trip title in the Journey suggestion banner

Reported through coordinated private disclosure by @bytejmp, @tonghuaroot, @therawdev, and @shukla304. Thank you for reporting these responsibly.

Costs — Splitwise-Style Expense Splitting

Budget has been reworked into Costs: a proper shared-expense tracker built for group trips.

  • Splitwise-style splitting — record who paid and split a cost across trip members, with running per-person balances
  • Settle up — one-tap minimal-transfer settlement with persisted history and undo
  • Multi-currency — log expenses in any currency (#551)
  • Multi-payer support — costs aren't tied to a single payer
  • Fixed categories — a consistent category set for cleaner reporting
  • Mobile-first — redesigned for phone use end to end

Passkey (WebAuthn) Login

  • Passwordless sign-in — register a passkey and log in with Face ID / Touch ID / a security key (#297, #1111)
  • WebAuthn standard — platform and roaming authenticators supported
  • Coexists with existing auth — passkeys sit alongside password, SSO, and MFA

Authentication

  • Remember me option — Add a Remember me checkbox on login screen to extend session expiry (#1189)

AirTrail Integration

Two-way flight sync with AirTrail (#214, #1158).

  • Import flights — pull your flight history from AirTrail into TREK
  • Two-way sync — flights flow in both directions and stay aligned
  • Reservation-aware — imported flights land as transport reservations

Planner & Maps

  • Real road routes (OSRM) — when route display is enabled, day routes follow actual roads with travel-time connectors instead of straight-line estimates; the hidden route-calculation setting is gone, so enabled routes always use real road geometry (#1060, #1064)
  • Multi-leg (layover) flights — model connecting flights with layovers as a single booking (#872, #1146)
  • Reorder whole days + insert a day — drag entire days around and insert a new day into a trip (#589, #1148)
  • Explore places on the map — discover and add points of interest (OpenStreetMap / Overpass) directly from the planner map; instance-wide Mapbox token support (#1147)
  • More transport types — bus, taxi, bicycle, ferry and others (#1105)
  • Richer imported places — list-imported places are enriched via the Places API (#886, #1161)
  • Route optimization around accommodation + confirm-before-delete on notes (#1123)
  • Category-coloured markers — map marker borders reflect the place's category colour (#1062)
  • Mobile route tools — planner route tools are reachable from the mobile day-plan sheet (#1142)

Reservations

  • Native booking-confirmation import — drop in a booking confirmation and TREK extracts the details via KDE KItinerary (#1102)

Dashboard Rework

  • Boarding-pass hero — the next trip rendered as a boarding-pass-style hero card (#1079)
  • Atlas row & live widgets — visited-countries row, upcoming reservations, and travel stats (country / distance) on the dashboard
  • Mobile glass UI — frosted-glass styling and a context-aware bottom navigation
  • OIDC PKCE — PKCE on the OIDC login flow

Packing

  • Weight × quantity — bag and total weight calculations multiply item weight by quantity (#898)
  • More bag colours — sub-bags stop repeating colours (#1156)
  • Per-item quantity on bulk import — bulk import respects each item's quantity (#1157)

Internationalization

  • Five new languages — Japanese, Korean, Turkish, Ukrainian, and Greek (#829, #977, #1029, #1055, #1061, #1075)
  • i18n in the shared package — all locales now live in shared and are consumed by every surface (#1066)

Offline & PWA Overhaul

A focused hardening pass on the offline-first PWA, closing a series of sync, cache, and data-isolation issues.

  • Hardened sync — temporary IDs are remapped on flush, ID collisions are prevented, and failed mutations are surfaced instead of lost (#1175)
  • Reconnect re-hydration — the active trip store re-hydrates on reconnect / coming back online, and trip-scoped slices reset and hydrate uniformly in loadTrip (#1180, #1181, #1184)
  • Offline tiles for real trips — offline map tiles now cover the actual trip area with a coherent cap and zoom-clamp (#1177)
  • Bounded blob cache — the offline blob cache is scoped, evicted, and capped; place-photo caches no longer grow unbounded; Dexie is used as a fallback when a network read fails (#1178, #1179, #1174, H2/H3)
  • Idempotency for multi-day offline — idempotency-key TTL lengthened so it survives being offline for days (#1182)
  • Realtime dedup — corrected assignment:created echo de-duplication (#1183)
  • Persistent storage — offline storage is persisted and the Mapbox offline policy is honoured (#1184, #1058)
  • Security: cross-user offline data leak — fixed an offline data leak between users on a shared device (#1176)

Fixes & Hardening

  • Batched bug fixes — Atlas regions, planner overlays, imports, Safari modals, and more across several rounds (#1094, #1139, #1145, #1155)
  • Backend/frontend hardening & consistency cleanups (#1113)
  • Journey — PhotoLightbox z-index above the mobile entry view (#1101)
  • Various — 2FA autofocus, viewer-timezone times on shared views, duplicate-place guard (#1159)
  • Map/planner/dashboard polish plus small community-requested features (#1155)
  • Self-hosted fonts — app fonts switched to self-hosted Poppins / Geist, dropping the Google Fonts CDN dependency (#1106)

Contributors

Thanks to everyone who contributed to 3.1.0:

And to the security researchers who reported responsibly: @bytejmp, @tonghuaroot, @therawdev, @shukla304.

Stats

Metric Value
Commits 58
Merged PRs 45+
Files changed 1,750
Lines added 138,000+
Contributors 11

Upgrading

docker pull mauriceboe/trek:3.1.0
docker compose up -d

Migrations run automatically on startup. No manual steps required.

Security: because 3.1.0 fixes a critical authentication bypass and 17 other vulnerabilities, updating promptly is strongly recommended.

Contributors

gzor, Larinel, and 13 other contributors
Assets 2
Loading