v0.20.0

v0.20.0

Breaking Changes

Caution

With this update we introduce a new plugin system: integrations (Strava, Komoot, Hammerhead) now run as sandboxed WASM plugins, providing the foundation for third-party plugins (PR #1034).
If you host your own instance, you must now manually install the plugins you want your users to access:

1. Update docker-compose.yml: Map the new /data/plugins folder in your db service's volumes section to ensure plugins can be installed. Refer to the sample yml in the repository if necessary.

2. Install Plugins: Follow the documentation to download and activate your preferred plugins after updating.

Trail categories have been reworked into a refined category model with subcategories, a new category settings page, and the option to disable individual categories. Custom category that were added before v0.20.0 may need to be reviewed after the upgrade. (PR #1059)

Features

• New plugin system: integrations (Strava, Komoot, Hammerhead) now run as sandboxed WASM plugins, providing the foundation for third-party plugins. (PR #1034)
• Server-side map clustering via Meilisearch and Supercluster significantly improves map performance for large trail datasets. (PR #991, thanks @palhaland)
• Improved trail planning: route anchors can now be re-ordered via a new anchor list, and routes can be extended directly from search results or POI popups. (PR #1007)
• Waypoints can now be edited while drawing a route. (PR #1060)
• Actors (users) are now indexed in Meilisearch, improving user search. (PR #1048)
• Local resources now carry an IRI, improving federation consistency. (PR #1046)
• PWA favicon support added. (PR #1008, thanks @briannelson95)

Security

• Hardened ActivityPub federation and fixed an N+1 query in the follower fanout. (PR #1056)
• Fixed an unauthenticated SSRF in POST /api/v1/trail/download, which allowed the server to be tricked into fetching internal-network or cloud metadata endpoints via a user-supplied URL. (GHSA-7vqq-mjjr-h9j5, reported by @guwu1017, PR #1104)

Bug Fixes

• Public trails from users with private profiles no longer return a 404. (PR #1002, thanks @Guacam-Ole)
• Duplicated trails now keep their GPX data, completed state, thumbnail, waypoint distances, and summit logs; photos are only copied when duplicating your own trails. (PR #1080)
• On the trail edit page, the initial map zoom no longer hides the route behind the elevation profile, and a manually hidden elevation profile stays hidden while drawing. (PR #1081)
• Fixed self-federation issues. (PR #1044)
• Fixed the polyline database field size for long trails. (PR #1047)
• Fixed the waypoint actor in integrations. (PR #1049)
• Fixed the missing tmp directory in the Docker image. (PR #1069)
• Fixed duplicate feed entries created by repeated remote trail/list Update activities. (PR #1052, thanks @Guacam-Ole)
• Increased the plugin request size limit, fixing failures on large activity responses for long trails. (PR #1083)

Documentation

• Overhauled the documentation homepage and added a servers page. (PR #1084)

Maintenance

• Migrated the rich text editor (tiptap) to v3. (PR #1075)
• Updated web, docs, Go, and Docker dependencies as well as CI actions.
• Removed legacy self-hosted search Docker image sources, dropped since v0.14.0. (PR #1054)

v0.19.3

0.19.3

Security

• Fixed unauthenticated IDOR on GET /activitypub/trail/{id} and GET /activitypub/comment/{id} — private records are now access-checked before being returned. (GHSA-9qg7-jr2x-prvh, reported by @de3erve-hunter)
• Fixed stored XSS via waypoint.icon in map markers — the icon value is now validated against an allowlist before being passed to insertAdjacentHTML. (GHSA-hx3v-rv4v-w875, reported by @de3erve-hunter)
• Fixed stored XSS via waypoint.name and waypoint.icon in the elevation profile — replaced unsafe innerHTML assignment with safe DOM construction. (GHSA-m7v2-6gj3-3g2p, reported by @de3erve-hunter)

v0.19.2

v0.19.2

Documentation

• Add CONTRIBUTING guidelines

Bug Fixes

• All photos from strava activities are now synced, instead of just the first one
• Shared trails are now displayed correctly in search results
• Fixes bug that caused trails to be indexed multiple times causing high server load
• Remaining likes are no correctly calculated when unliking a trail
• Fix waypoint creation from photos

v0.19.1

v0.19.1

Features

• Speed improvements for various database queries

Security

• Remote lists, remote trails, and remote trail comments now respect the visibility settings and shares of the respective list or trail. (PR #980)

Bug Fixes

• Federated remote trails now sync tags and create missing local tags when needed. (PR #987)
• Private profiles no longer prevent access to a user's own trails; inaccessible private profiles now return a proper 404. (PR #986)
• Comment access rules now correctly check the linked comment author via author.user. (PR #984)

v0.19.0

v0.19.0

Breaking Changes

• Bulk uploads no longer use UPLOAD_USER / UPLOAD_PASSWORD authentication. Uploads now require an API token; files must be placed in a subfolder of the upload directory named after the respective API token. For more information checkout the documentation (PR #886).
• Bulk uploads now run via a file watcher rather than on a cron schedule. Files placed in the upload folder while the container is not running will not be processed automatically. (PR #886)
• External service URLs have been moved from public frontend variables to server-side variables: VALHALLA_URL, NOMINATIM_URL, OVERPASS_API_URL. The old PUBLIC_* variables remain as a fallback but should be migrated. (PR #697)
• The waypoint data model has been extended for federation: waypoints now have an iri and reference their author via an ActivityPub actor. This only affects clients that access PocketBase collections directly, not the standard UI. (PR #930)
• ActivityPub actor counters have been renamed to follower_count and following_count. This only affects clients that access PocketBase collections directly. (PR #930)
• OpenAPI documentation is now generated from annotations and served as JSON (the YAML endpoint has been removed). (PR #927)

Security

• HTML content in descriptions, comments, summit logs, waypoints, and profile bios is now sanitised on the server to reduce the risk of cross-site scripting (XSS). Some custom HTML may be stripped on save. (PR #930)
• Anonymous user API endpoints have been removed. This only affects third-party applications that accessed user data without authentication. Regular users and the standard UI are unaffected. (PR #927)
• Additional CSRF/SSRF protections and rate limiting have been implemented for ActivityPub and outbound network calls. (PR #930)

Features

• Hammerhead integration added, including synchronisation of planned and completed tours, and manual trail sending. (PR #628)
• The federation has been significantly expanded and refactored to provide more robust remote content synchronisation and local caching for remote trails and lists. (PR #930)
• Trails can now be explicitly marked as completed. (PR #920)
• Geotagged waypoint photos are now automatically merged into existing or nearby waypoints within the configured merge radius of the category. (PR #457)
• The trail overview now has narrow and wide view modes, as well as improved multi-select. (PR #666, #921)
• Trails can be copied directly and their visibility can be changed more easily. (PR #571)
• External geocoding, routing, and Overpass calls now run on the server. (PR #697)
• New setting: optionally start drawing a new trail from the current location. (PR #592)
• GPX exports now include additional metadata for waypoints. (PR #919)
• FIT import now uses a more compatible parser. (PR #884)
• Frontpage performance has been improved. (PR #929)
• 3D terrain rendering has been improved. (PR #881)
• Improved saving of public lists. (PR #554)
• Multiple trails can now be merged into one trail with multiple summit logs. This feature is also available as an automatic option when importing trails via an integration (PR #627)
• API tokens have been added so that external tools and automations can interact with Wanderer. (PR #848)

Bug Fixes

• Fixed broken WebFinger requests. (PR #966)
• Theme detection fixed via corrected color-scheme query selector. (PR #957, thanks @mfortini)
• Hillshading visibility on the map has been fixed. (PR #942)
• Komoot sync now runs to completion. (PR #917, thanks @StefanSchloegl)
• Komoot integration now handles invalid photos more robustly. (PR #941)
• Mentions now work correctly when username and preferred_username differ. (PR #885)
• Fixed avatar updates. (PR #870)
• List descriptions in the selection modal are now fixed. (PR #869)
• Fixed double GPX upload when creating a trail. (PR #969)
• Fixed authentication issues after email change (PR #973)
• Fixed help links. (PR #938)
• Fixed a MapLibre layer manager issue that could prevent existing map layers from being tracked correctly after data updates. (PR #960, thanks @palhaland)
• Fixed search endpoints returning invalid errors in some failure cases. (PR #961, thanks @palhaland)

Translation

• The Norwegian translations have been updated. (PR #931, thanks @palhaland)

Maintenance

• Meilisearch, PocketBase, Go, web/docs dependencies, CI actions, and Docker build setup updated.

v0.18.5

v0.18.5

Security

• Fixes CVE-2022-39299 via xmldom upgrade (PR #820)

Features

• Persist trail list filter settings in local storage: filters are preserved on reload and when navigating back from a trail, and reset when - leaving the trail list (PR #814)

Bug Fixes

• Skip elevation correction when Valhalla returns invalid (null) elevation data; original GPX values are preserved (PR #821)
• Improved threshold handling for high-frequency GPX tracks to ensure correct ascent/descent calculation (PR #813)
• Fixes trail upload for new users without default privacy settings (PR #785)
• Fixes focus loss and duplicate “Cancel” button in trail filter search (Chrome) (PR #738)
• Fixes async state issue in list search modal (bulk assignment works again) (PR #816)
• Fixes locale errors and improved dynamic locale detection (PR #656)
• Fixes PDF/print layout so descriptions render correctly and no longer overlap waypoints(Thanks to @RobertClarke64) (PR #797)
• Corrected POCKETBASE_SMTP_SENDER_ADDRESS spelling (previously POCKETBASE_SMTP_SENDER_ADRESS, now deprecated but backwards compatible) (PR #769)
• Fixes amenity naming in stored map state, including migration (PR #768)
• Fixes race condition in map plugin that caused errors when printing a trail (PR #827)

Translation

• Added Czech language support (thanks @sheepa) (PR #774)

Dependencies

• Updated most dependencies, including security and maintenance updates

v0.18.4

v0.18.4

Bug fixes

• Tags can now properly be removed from trails
• Creating more than 29 lists does no longer prevent lists from loading
• Fixes a bug that caused the GPS data to be removed from summit logs after editing
• Fixes an issue that caused an infinite loop when creating a list with federation being active
• Fixes an issue where bicycle routing options were incorrectly applied to car routing, and vice versa
• Fixes an issue where filtering by multiple categories did not work as expected
• Fixes imported tracks being marked private despite public-by-default settings

Features

• Trails can now be added to multiple lists at once
• ActivityPub: External user access now requires authentication (401)

Translation

• Adds Norwegian translation (thanks @palhaland)

v0.18.3

v0.18.3

Bug fixes

• Fixes bug that prevented waypoints from being update or deleted in v0.18.2
• Return properly formatted error message when accessing a protected API route
• Fixes logo for OIDC 2 & 3 providers (thanks @wolffshots)
• Fixes bug that caused dropdown actions from a feed item on the homepage to cause a 404 error

Maintenance

• Updates pocketbase to v0.30.0

v0.18.2

Release 0.18.2

v0.18.1

v0.18.1

Bug fixes

• Fixes permission issues that prevented federation from working properly
• Trail categories are properly displayed in lists
• Fixes issue that prevented lists from saving

Documentation

• Improves docs for updating on bare-metal installations

Translation

• Adds Basque and Russian translations (thanks @aisaivia & @jeffscrum)