Download Latest Version 1.15.3 source code.zip (40.4 MB) Google Add to Preferred Sources
Home / 1.14.5
Name Modified Size InfoDownloads / Week
Parent folder
docker-compose.yml 2026-09-13 6.5 kB
0
1.14.5 source code.tar.gz 2026-09-13 28.5 MB
0
1.14.5 source code.zip 2026-09-13 30.1 MB
0
README.md 2026-09-13 9.7 kB
0
Totals: 4 Items   58.6 MB 0

Security

  • Self-hosted registration bypass (GHSA-x483-3xv3-vp52, medium). On self-hosted instances with email/password registration disabled, which is the default, anyone who could reach the instance could create an active account through the mobile app registration endpoint (POST /api/v1/auth/register). A family invitation could also be used to register an email address other than the one it was sent to. Versions 1.7.1 through 1.14.4 are affected.
  • Upgrade to 1.14.5. If you can't upgrade right away, block POST /api/v1/auth/register at your reverse proxy.
  • If your instance is reachable from the internet, check Settings → Users for accounts you don't recognize and delete them.
  • Thanks to @y4poo for reporting this responsibly.

Added

  • Video Studio can select exact start and end times for map ranges.
  • Family members can consent to sharing location history recorded before they started sharing.
  • The import edit page can change or clear an import's source.

Changed

  • Visit detection no longer sends a notification for every new suggested visit.
  • Poster Studio waits for the map to load the selected date range and disables the studio switch while loading.

Fixed

  • Yearly digests for cloud-Lite users read seasonality and country time spent from the same data window as monthly distances and toponyms.
  • The per-email API login brute-force throttle now counts application/json request bodies, so password grinding against POST /api/v1/auth/login is bounded per account even when an attacker rotates source IPs.
  • API sign-in ignores leading and trailing spaces in the email address.
  • Manual OIDC configuration falls back to the default port when OIDC_PORT is blank, non-numeric or out of range.
  • OAuth account linking reports when a verification email was not re-sent because of rate limiting, with the real remaining wait.
  • Signing up through an OAuth provider without a name claim no longer saves the username or email as the first name.
  • SMTP_AUTHENTICATION=none no longer sends credentials when SMTP_USERNAME is set.
  • Cloud Lite subscribers in a paid Family can use the map features the Family plan includes.
  • Users whose trial has ended are no longer shown an import form they cannot submit.
  • GPX imports continue past recoverable XML errors instead of aborting.
  • OwnTracks .rec imports skip malformed lines instead of aborting.
  • Google Phone Timeline imports no longer drop or reorder points when groups of identical timestamps sit close together.
  • Transportation mode backfill uses activity data from Google Phone Timeline imports.
  • Track generation keeps each tracker's points on its own track when several tracks share a time window.
  • Reverse geocoding keeps the identity of places created by imports, so re-imports no longer duplicate them.
  • Visit names use nearby points of interest on Photon and Geoapify instead of falling back to addresses.
  • Place search results from Geoapify include OpenStreetMap IDs.
  • Restoring a user archive no longer fails or keeps empty records when the export could not include some raw data archive files.
  • The web digest page no longer generates a year-end digest for the year still in progress.
  • Unauthorized visits to Sidekiq no longer leave browsers caching a permanent redirect.
  • Map and trip pages handle timezones saved under legacy names such as Berlin.
  • The map's date range fields follow day navigation from the timeline.
  • Self-hosted registration settings apply to mobile app sign-ups, and a family invitation only admits the email address it was sent to.

💙 This release is supported by Steven B., James Manolios, chenrik, aldumil, derpderpington, Chippie, dint, jhalpern, Lex Fradski, Schlufo, cyberswan.at, craftyklaus, Andre, hogenf, naraxius, Embrace, martin4861, Alex, evetters, GregF, Jon Coffee, Lukas, Robbie G, Kilian, Hans G, Chris, tabaha, Andre, Michael C, Chris, Jonah B., Dante, daallex, Tanner A., Milien M., Mathias, Travis S., Matthew F., Johnathan D., bleibdirtroy, no1etal, dixet, Bailey J., Alex D., Benjamin M., Daniel A., Florian, BeeHappy, ChemistryDachshund, OrangeWindies, Michelangelo V., Edward, Erazem Z., Denis Abt, Tony G., Lomky, Osamu Y., Linus T., Christian C., Sebastian, Jan K., Nathan T., Max G., Karol B., Konstantin, Johannes H., t3hero, g3lin, Tim, Philipp M., Brand K., Pablo F. M., Jon H., fkB, Mikael, Dániel A., Hai_Tsung, ShooTex, GreenTentacle, PinkahPandah, David, Ken, Denna G., Andre, Hendl91, Jon H., MrRed, Arkadiusz Z., Jake, Bator T., Alex J. H., eps-dev, twiggu, Dragan V., Jerome G., Sheya B., Gustav B., higgs01, Frank F., F. J. Kruz, Jon D., Alexander J. H., Daniel D., Gonzalo M., Ricardo T., Christof Z., Narrator, JohnSmith21, smartbert, A.M., Matthew Z., Dror T., Jonathan K., Kyle C., Mario B., Albin H., Phillip S., Bernd, Tom, Nick O., greeting7416, Dick, Brian R., Markus, TheSlimShady, Andrew M., Mason B., Chance, GoogilyBoogily, Dragon, Oliver, HexitNiels, Michael G., Pablo A., Leo L., Daniel D., DSKun, Jonathan K., Erik K., Tiebolt v. d. L., Steven, Mathias, Sam B., Manuel F., K8BCO, Samuel D., duckduck, David, heydabop, Riccardo N., Tim. S., Jonas, Kenji I. Pascal M., Raymond W., Julien, Roman, Mario B., Talis and Andreas R. on Patreon and KoFi 💙

What's Changed

Full Changelog: https://github.com/Freika/dawarich/compare/1.14.4...1.14.5

Source: README.md, updated 2026-09-13