v4.13.6

What's Changed

• fix(tests): build the JavaScript test PDF without pypdf's removed add_js by @jeeves5454 in #56
• Update README with privacy and app information by @jeeves5454 in #55
• chore(ci): install the locked dependency set from uv.lock by @jeeves5454 in #57
• feat(contracts): Android app schema snapshot and drift check (YONDER-363) by @jeeves5454 in #58
• docs: SPEC-4.3, the Android companion spec (YONDER-364) by @jeeves5454 in #59
• chore: release 4.13.6 by @jeeves5454 in #60

Full Changelog: v4.13.5...v4.13.6

v4.13.5

What's Changed

• fix(places): pin from an address Photon files as place=house_number by @jeeves5454 in #53
• chore: release 4.13.5 by @jeeves5454 in #54

Full Changelog: v4.13.4...v4.13.5

v4.13.4

What's Changed

• feat(auth): built-in OAuth client for the Android app (D-223) by @jeeves5454 in #49
• fix: instants carry a UTC offset; journal times show in the zone they were written (D-224) by @jeeves5454 in #50
• chore(deps): Bump the python-minor-and-patch group with 3 updates by @dependabot[bot] in #51
• chore: release 4.13.4 by @jeeves5454 in #52

Full Changelog: v4.13.3...v4.13.4

v4.13.3

What's Changed

• chore(deps): Bump pypdf from 6.21.2 to 6.21.4 by @dependabot[bot] in #43
• docs: D-222 Notebook groups Journal and Places (YONDER-348) by @jeeves5454 in #45
• feat(demo): seed Jane's saved places on the demo server (YONDER-351) by @jeeves5454 in #44
• feat(web): group Journal and Places under a Notebook label (D-222) by @jeeves5454 in #46
• chore: release 4.13.3 by @jeeves5454 in #47

Full Changelog: v4.13.2...v4.13.3

v4.13.2

What's Changed

• fix(trips): escape AdventureLog push errors; linear route split by @jeeves5454 in #41
• chore: release 4.13.2 by @jeeves5454 in #42

Full Changelog: v4.13.1...v4.13.2

v4.13.1

What's Changed

• fix: launch bugs — traveller roster, date-only stays, self-service rename, journal title by @jeeves5454 in #39
• chore: release 4.13.1 by @jeeves5454 in #40

Full Changelog: v4.13.0...v4.13.1

v4.13.0

What's Changed

• chore(deps): Bump the python-minor-and-patch group with 4 updates by @dependabot[bot] in #33
• chore(ci): Bump the actions group with 4 updates by @dependabot[bot] in #34
• fix(places): saved places get their pin from the address (YONDER-339) by @jeeves5454 in #35
• feat(places): the Map lens (SPEC-11 phase 3, D-218) by @jeeves5454 in #36
• docs: launch-readiness fixes before the repo goes public by @jeeves5454 in #37
• chore: release 4.13.0 by @jeeves5454 in #38

Full Changelog: v4.12.13...v4.13.0

v4.12.13

What's Changed

• fix(places): the address saves on change and can place the pin by @jeeves5454 in #31
• chore: release 4.12.13 by @jeeves5454 in #32

Full Changelog: v4.12.12...v4.12.13

v4.12.12

Run·dere 4.12.12 ends admins' standing access to other people's data, opens the new Places page, and renames the Capture page to the Capture Hub. Please read Before you upgrade: what admins can see and do changes for everyone.

Before you upgrade

• A database migration runs on start (0046, two columns for support access). Back up first as usual.
• Admins lose their standing access to other people's data (D-211).
  • Today's sharers: anyone who shares with admins keeps a standing grant, but it's now read-only. Admins can view that person's trips and Inbox, and can't change anything or see their journal.
  • Telling them: each person sees a one-time banner explaining the change. Those with an email are also emailed once by the daily sweep, if server email is set up.
  • Accounts: admins can no longer set another person's password or email. A reset link for someone else is always emailed to them. On a server without email, a forgotten password can only be reset from the command line (python -m app.cli set-password).
• The sidebar's "Capture" link is now "Capture Hub" (D-221). The URL is still /capture, so bookmarks and the bookmarklet keep working.
• If you skipped it at 4.12.11, run python -m app.cli places-backfill once. It fills in the city, country and search text for saved places, and it's safe to run again.

Admins and privacy (D-211)

• Admins run the server; they don't read people's trips. An admin sees someone's trip only if that person put them on its roster or shared it, like anyone else. Other people's Inbox captures and journals are never visible to an admin just for being one. (YONDER-336)
• Support access, turned on by the person. Under Settings → Account, "Let admins look" gives admins read-only access to your trips and Inbox for 24 hours, 7 days or until you turn it off.
  • What they can't do: edit, approve, file or delete anything, or see your journal or profiles.
  • What you see: turning it on is emailed to you. Your account page lists each day an admin looked, and a timed grant ends on its own.
• The journal is closed to admins. Before this release, an admin could read the journal of anyone who shared with admins. That's fixed.
• Bulk buttons stay in their lane. An admin's Process, Reprocess and Commit buttons now touch only the admin's own captures and ownerless ones, never a supported person's.
• Sharing a trip is for its owner, or for an admin when the trip has no owner. Everyone is now told when an admin changes their account.
• For the iOS app: PUT /api/v1/auth/me/sharing takes a duration (24h, 7d or standing), and the user payload gains support_until. Trips seen under support access have my_role: "viewer".

The Places page (YONDER-314)

• One search box over all your places, updating as you type. Narrow it with chips: must, someday, visited, kind:restaurant, list:Want, city:Lisbon or country:pt.
• Four views:
  • Unsorted: new places that aren't in a list or on a trip yet, plus a "Needs a pin" section;
  • Atlas: continent → country → city cards, each with counts, the mix of types and a small map;
  • Lists: your own lists. Deleting a list keeps its places;
  • All: everything, newest first.
• A panel for each place: its name and type (restaurant, tour, lodging, event or note: every place used to show as "Tour"), Must go or Someday, where it is, what to do there, notes, the date you went, your lists and the trips it's on, and Add to a trip.
• A first guess at the type when a Maps link carries no category: "…Café" becomes a restaurant and "…Inn" lodging. It never replaces a type you chose.
• Keyboard: / searches, j and k move between places, and Enter opens one.

Capture Hub (D-221)

• The Capture page is now the Capture Hub, with a line saying what it holds: every way to get bookings in, in one place.
• The global Capture button keeps its name. It captures one thing from wherever you are, which is the distinction this release draws.

Other changes

• Dependencies: Mako 1.4.3 (it comes in through Alembic), for a Windows-only path-traversal advisory (Dependabot alert, moderate).
• README: badges, an Updating section, "A few things to know", and an AI usage section, ahead of the public release.

Full Changelog: v4.12.11...v4.12.12

v4.12.11

Run·dere 4.12.11 makes new accounts private, requires an email on local accounts, and starts the Places Library: a saved place now stays in your library after you add it to a trip. Please read Before you upgrade: people with a local account and no email will be asked for one.

Before you upgrade

• Two database migrations run on start. Back up first as usual.
  • 0044 adds the Places Library tables and columns. Places already filed to a trip go back into your saved places, still linked to their trip where it can be found.
  • 0045 makes new accounts private by default. It changes only the default; no existing account changes.
• Run this once after the upgrade:

  python -m app.cli places-backfill

  It fills in the city, country and search text for existing saved places, using Photon if it's configured and the bundled airport list otherwise. Without it, each person's places are filled in the first time a library view needs them, from the airport list only. It's safe to run again.
• Local accounts without an email will be asked for one. At their next visit on the web, they see "Add your email" and must enter an address and their password before they can continue. SSO and proxy accounts aren't affected. (D-220)

Accounts: private by default (D-220)

• New accounts are private. Admins see only the trips a person puts them on, never their Inbox captures, batches or journal, until that person opts in under Settings → Account. This applies however the account is made: by an admin (web or CLI), by sign-up, through SSO or the proxy header, or the demo login. Existing accounts keep their current choice. (YONDER-335)
• The first sign-in question now pre-selects "Keep my data to myself". A blank answer stays private.
• Opting in or out takes effect at once. Nothing is copied: what admins see follows the setting, and every change is recorded in the account log.
• A local account always has an email. It's where password resets go, since an admin never sees a private person's reset link.
  • Sign-up and first-run setup require one.
  • An account without one is asked at every web visit until it adds one.
  • You can change your email, but not remove it.
• Going private no longer needs server email. On a server without email, the account page says that a forgotten password can only be reset by whoever runs the server (python -m app.cli set-password).
• For the iOS app: the user payload has two new fields, email_required and reset_note. opt_out_blocker is now always empty.

Saved places become a library (YONDER-314)

• A saved place stays after you file it. It can go on any number of trips. Filing it onto the same trip twice is still refused, and deleting the activity or the trip takes it off that trip. (D-212)
• New details on each place: what to do there, must or someday, the date you went, and its city, region and country. (D-214, D-215)
• The data for the library views is in place: search, an Atlas by continent, country and city, map clusters, places near a trip, and your own lists. The new Places page that shows them comes in the next release. (D-213, D-216)
• MCP: list_saved_places can search by words, country, city and priority, and update_saved_place takes a to-do, priority and visit date.
• New command: python -m app.cli places-backfill (see above).

Fixes

• Places shared from a Maps app reach Saved Places. A place shared as text (name, address, then the link) was captured as a booking or refused. A Safari share that also carried the page was treated as a web page. A short link that landed on Google's consent page lost the place. All three now save the place. A booking email that merely contains a map link is still a booking. (YONDER-314)

Full Changelog: v4.12.10...v4.12.11