Fix duplicated shared-list rendering by snowyukitty · Pull Request #1134 · open-wanderer/wanderer

snowyukitty · 2026-07-29T08:24:03Z

What changed

Build long collapsed descriptions as escaped plain text instead of injecting
a raw HTML string cut at character 100.
Count the first 100 Unicode code points of the formatted plain-text preview
and decode supported HTML entities exactly once.
Render the complete existing rich text only when the description does not
need a preview or after the user selects Read more.
Add an end-to-end regression that creates bold and italic content whose raw
HTML is cut inside both inline elements, opens the shared-list route, and
checks the resulting page structure and preview.

Why

The previous collapsed state used description.substring(0, 100) inside
{@html}. When that cutoff lands inside an inline element, the browser repairs
the incomplete SSR markup differently from the client render.

On the exact pre-change main revision, a description cut inside nested
<strong> and <em> elements reproduced the reported failure in three out of
three runs:

main: 2
.list-list: 2
#trail-map: 2

That reproduction does not emit hydration_mismatch, so the regression asserts
the page-section counts directly rather than relying only on console output.
The candidate produced one of each section in every focused run.

How it was tested

Exact-base regression: reproduced the duplicate layout in 3/3 runs.
Candidate focused regression: passed 3/3 before mutation testing.
Final focused --repeat-each=10 --retries=0: 10/10 passed.
Mutation checks detected:
- restoration of raw truncated HTML;
- a Read more control moved into an overflow-hidden container;
- the existing 20 px first-paragraph spacing regression;
- removal of preview tag stripping;
- an inline-markup fallback to raw truncated HTML;
- chained entity replacements that decode text twice; and
- UTF-16 slicing that splits an astral character at the cutoff.
npm run check: 0 errors, 0 warnings.
Vitest: 3/3 passed.
npm run build: passed.
git diff --check: passed.
No-cache web and database image builds: passed, with running container image
IDs verified.

The repository's existing shows a list card Playwright case timed out at
lists_page.ts:65 while waiting 10 seconds for .list-list-item. The same
timeout reproduced on the untouched base and passed on retry. The full
Playwright project completed with 8 passed and 1 flaky. The new regression
passed 10/10 with retries disabled and deletes its exact record by ID.

Known limitations

A collapsed long description is intentionally plain text. Links and inline
formatting become active only after Read more is selected.
The former 96 px max-h-24 overflow-hidden cap is removed. Long previews are
bounded to 100 Unicode code points; descriptions at or below that length
render their complete rich text and can therefore be taller than before
instead of being silently clipped.
This patch is intentionally atomic to
components/list/list_panel.svelte. Similar raw-rich-text truncation remains
in routes/profile/[handle]/+page.svelte,
waypoint/waypoint_card.svelte, trail/trail_timeline.svelte, and
trail/trail_info_panel.svelte. Those sites need separate reproduction and
collision review; trail_info_panel.svelte is currently also modified by
open PR Add asset plugin type and first-party Immich plugin #948.

The shared list fix duplicated logic that formatHTMLAsText already owned, and only covered one of the four places that truncate rich text. Fixes #1128.

Flomp · 2026-08-07T17:34:15Z

Thanks a lot for this.
I've built on top of your commit rather than merging it as-is, for two reasons:

1. We already had a helper for this. formatHTMLAsText in format_util.ts does the HTML-to-text conversion, and a couple of components already use it for previews. I've made that helper work on both the server and the client instead.

2. The same bug exists in three other places. Trail descriptions, activity cards and feed cards all truncate rich text the same way. All four now go through one shared helper, so this can't drift apart again.

…ions Control+a does not select on macOS, and getByText resolved to the inline element itself rather than its container.

* Update Italian translations in it.json (#1135) Co-authored-by: Flomp <[email protected]> * Rebase and clean up (#1099) * Fix duplicated shared-list rendering (#1134) * fix: prevent duplicated shared-list rendering * refactor: consolidate rich text previews into formatHTMLAsText The shared list fix duplicated logic that formatHTMLAsText already owned, and only covered one of the four places that truncate rich text. Fixes #1128. * fix test * fix(test): select-all across platforms and scope the rich text assertions Control+a does not select on macOS, and getByText resolved to the inline element itself rather than its container. --------- Co-authored-by: snowyukitty <[email protected]> Co-authored-by: Flomp <[email protected]> Co-authored-by: Christian Beutel <> * optimize mime type and error handling, fix limit hanlding (#1115) * Bump nanoid from 3.3.15 to 3.3.18 in /web (#1161) Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.15 to 3.3.18. - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](ai/nanoid@3.3.15...3.3.18) --- updated-dependencies: - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump nanoid from 3.3.15 to 3.3.18 in /docs (#1160) Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.15 to 3.3.18. - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](ai/nanoid@3.3.15...3.3.18) --- updated-dependencies: - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * New Crowdin updates (#1155) * New translations en.json (French) [ci skip] * New translations en.json (Spanish) [ci skip] * New translations en.json (Czech) [ci skip] * New translations en.json (German) [ci skip] * New translations en.json (Basque) [ci skip] * New translations en.json (Hungarian) [ci skip] * New translations en.json (Italian) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (Norwegian) [ci skip] * New translations en.json (Polish) [ci skip] * New translations en.json (Portuguese) [ci skip] * New translations en.json (Russian) [ci skip] * New translations en.json (Chinese Simplified) [ci skip] * New translations en.json (Italian) [ci skip] * fix: 500 on list pages owned by a private profile (#1156) Opening /lists/@handle/{id} for a user whose account privacy is set to "private" returned a 500 ("Failed to resolve trail.") for every visitor but the owner, including for lists that are public. findLocalListByRemoteInfo treated federation.ErrProfilePrivate as a resolution failure. GetActorByHandle returns that error alongside a perfectly valid actor record - it means "this profile is private", not "this actor could not be resolved". The list's own ViewRule is what decides visibility, and it already does. findLocalTrailByRemoteInfo has tolerated this since #986 ("Fix trails being unavailable when profile is private"), which is why trail URLs kept working while the equivalent list URLs 500'd. Mirror that handling here, and map a genuinely unresolvable private profile to a 404 rather than a 500. Also corrects the copy-pasted "Failed to resolve trail" message in the list handler. Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> Co-authored-by: slothful-vassal <[email protected]> * fix(web): preserve share token in fullscreen map (#1172) * Re-add Further Heights to the server list (#1171) Re-adding furtherheights.com (originally shared in discussion #361, image already in server/imgs/). The instance is on wanderer 0.20.0. Co-authored-by: slothful-vassal <[email protected]> * plugin info modal added (#1166) * plugin info modal added * add homepage link, small fixes * fix issues (see comment) --------- Co-authored-by: Christian Beutel <> * fix: actor endpoint fails on bios with subdivision flag emoji (#1186) The users_anonymous view selected bio unqualified. SQLite resolves that to settings.bio, but PocketBase's view field inference only looks at the main table (users), finds no bio field and falls back to a json field. Reading plain text through a json field runs it through strconv.Quote, which escapes non-printable runes above U+FFFF as \U0001abcd. That is not valid JSON, so marshalling the record fails after the 200 header has been written and the client receives an empty body. The JS SDK turns the unparseable body into an empty record, and the ActivityPub actor endpoint then fails with "Invalid time value" on the missing created field. Qualifying bio as settings.bio lets it resolve to the underlying text field. PocketBase regenerates a view's fields from its query on save. Fixes #1164 Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> Co-authored-by: slothful-vassal <[email protected]> * Bump supercluster from 8.0.1 to 9.0.0 in /web (#1183) Bumps [supercluster](https://github.com/mapbox/supercluster) from 8.0.1 to 9.0.0. - [Release notes](https://github.com/mapbox/supercluster/releases) - [Commits](mapbox/supercluster@v8.0.1...v9.0.0) --- updated-dependencies: - dependency-name: supercluster dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump fast-uri from 3.1.3 to 3.1.7 in /docs (#1187) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.3 to 3.1.7. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.3...v3.1.7) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump fast-uri from 3.1.3 to 3.1.7 in /web (#1188) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.3 to 3.1.7. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.3...v3.1.7) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump browserslist from 4.28.4 to 4.28.8 in /web (#1189) Bumps [browserslist](https://github.com/browserslist/browserslist) from 4.28.4 to 4.28.8. - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.4...4.28.8) --- updated-dependencies: - dependency-name: browserslist dependency-version: 4.28.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump @tiptap from 3.27.1 to 3.30.4 in /web (#1191) * chore(deps): bump @xmldom/xmldom from 0.9.10 to 0.9.12 in /web (#1190) Bumps [@xmldom/xmldom](https://github.com/xmldom/xmldom) from 0.9.10 to 0.9.12. - [Release notes](https://github.com/xmldom/xmldom/releases) - [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md) - [Commits](xmldom/xmldom@0.9.10...0.9.12) --- updated-dependencies: - dependency-name: "@xmldom/xmldom" dependency-version: 0.9.12 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * New Crowdin updates (#1178) * New translations en.json (Spanish) [ci skip] * New translations en.json (Spanish) [ci skip] * New translations en.json (French) [ci skip] * New translations en.json (Czech) [ci skip] * New translations en.json (German) [ci skip] * New translations en.json (Basque) [ci skip] * New translations en.json (Hungarian) [ci skip] * New translations en.json (Italian) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (Norwegian) [ci skip] * New translations en.json (Polish) [ci skip] * New translations en.json (Portuguese) [ci skip] * New translations en.json (Russian) [ci skip] * New translations en.json (Chinese Simplified) [ci skip] * New translations en.json (Czech) [ci skip] --------- Co-authored-by: slothful-vassal <[email protected]> * upgrade go to 1.26 (#1195) * Security fixes: ActivityPub delete authorization, inbox proxy trust, collection create rules, IPv6 SSRF bypass (#1205) * fix GHSA-xcwc-jhv2-w4h6 * fix GHSA-mr29-2qg5-m4fw * fix GHSA-vj82-xj83-jp85 * fix GHSA-332v-mq7g-5hqf * fix GHSA-8j93-xvwx-jjg3 * allow dots and hyphens in the inbox path username segment The pattern only admitted [a-z0-9_]+, but local usernames may also contain dots and hyphens (users collection: ^[\w][\w.\-]*$, 3-150 chars), so valid inboxes were rejected. Mirror that alphabet and its length bounds; a leading dot or hyphen stays disallowed, keeping . and .. unmatchable. * fixes ruleset --------- Co-authored-by: Christian Beutel <> * improve statistics page (#1162) * improve statistics page * improve layout * several fixes, improvements and re-designs * fix issues (see comment) * several fixes and optimizations * filter test added * fix test --------- Co-authored-by: Christian Beutel <> * Bump @sveltejs/kit from 2.68.0 to 2.70.2 in /web (#1157) Bumps [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit) from 2.68.0 to 2.70.2. - [Release notes](https://github.com/sveltejs/kit/releases) - [Changelog](https://github.com/sveltejs/kit/blob/version-3/packages/kit/CHANGELOG.md) - [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/[email protected]/packages/kit) --- updated-dependencies: - dependency-name: "@sveltejs/kit" dependency-version: 2.70.2 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump svgo from 4.0.1 to 4.1.0 in /docs (#1210) Bumps [svgo](https://github.com/svg/svgo) from 4.0.1 to 4.1.0. - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v4.0.1...v4.1.0) --- updated-dependencies: - dependency-name: svgo dependency-version: 4.1.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump @vitest/mocker and vitest in /web (#1214) Bumps [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) to 4.1.11 and updates ancestor dependency [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). These dependencies need to be updated together. Updates `@vitest/mocker` from 4.1.9 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/mocker) Updates `vitest` from 4.1.9 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: "@vitest/mocker" dependency-version: 4.1.11 dependency-type: indirect - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump astro from 7.0.4 to 7.3.2 in /docs (#1213) Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) from 7.0.4 to 7.3.2. - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/[email protected]/packages/astro) --- updated-dependencies: - dependency-name: astro dependency-version: 7.3.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump smol-toml from 1.7.0 to 1.8.0 in /docs (#1215) Bumps [smol-toml](https://github.com/squirrelchat/smol-toml) from 1.7.0 to 1.8.0. - [Release notes](https://github.com/squirrelchat/smol-toml/releases) - [Commits](squirrelchat/smol-toml@v1.7.0...v1.8.0) --- updated-dependencies: - dependency-name: smol-toml dependency-version: 1.8.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.2 in /web (#1217) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 4.3.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.0...4.3.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump js-yaml from 4.3.0 to 4.3.2 in /docs (#1218) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 4.3.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.0...4.3.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump the docker-backward-compatible group across 1 directory with 10 updates (#1220) Bumps the docker-backward-compatible group with 9 updates in the /docs directory: | Package | From | To | | --- | --- | --- | | [@astrojs/check](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/astro-check) | `0.9.9` | `0.9.10` | | [@astrojs/node](https://github.com/withastro/astro/tree/HEAD/packages/integrations/node) | `11.0.0` | `11.1.5` | | [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.41.1` | `0.42.0` | | [@astrojs/svelte](https://github.com/withastro/astro/tree/HEAD/packages/integrations/svelte) | `9.0.0` | `9.0.1` | | [@fontsource/ibm-plex-mono](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/ibm-plex-mono) | `5.2.7` | `5.3.0` | | [@fontsource/ibm-plex-sans](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/ibm-plex-sans) | `5.2.8` | `5.3.0` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.2` | `4.3.3` | | [starlight-openapi](https://github.com/HiDeoo/starlight-openapi/tree/HEAD/packages/starlight-openapi) | `0.26.0` | `0.26.2` | | [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.56.4` | `5.57.0` | Updates `@astrojs/check` from 0.9.9 to 0.9.10 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/astro-check/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/language-tools/astro-check) Updates `@astrojs/node` from 11.0.0 to 11.1.5 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/node/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/integrations/node) Updates `@astrojs/starlight` from 0.41.1 to 0.42.0 - [Release notes](https://github.com/withastro/starlight/releases) - [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md) - [Commits](https://github.com/withastro/starlight/commits/@astrojs/[email protected]/packages/starlight) Updates `@astrojs/svelte` from 9.0.0 to 9.0.1 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/svelte/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/integrations/svelte) Updates `@fontsource/ibm-plex-mono` from 5.2.7 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/ibm-plex-mono) Updates `@fontsource/ibm-plex-sans` from 5.2.8 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/ibm-plex-sans) Updates `@tailwindcss/vite` from 4.3.2 to 4.3.3 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/@tailwindcss-vite) Updates `starlight-openapi` from 0.26.0 to 0.26.2 - [Release notes](https://github.com/HiDeoo/starlight-openapi/releases) - [Changelog](https://github.com/HiDeoo/starlight-openapi/blob/main/packages/starlight-openapi/CHANGELOG.md) - [Commits](https://github.com/HiDeoo/starlight-openapi/commits/[email protected]/packages/starlight-openapi) Updates `svelte` from 5.56.4 to 5.57.0 - [Release notes](https://github.com/sveltejs/svelte/releases) - [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md) - [Commits](https://github.com/sveltejs/svelte/commits/[email protected]/packages/svelte) Updates `tailwindcss` from 4.3.2 to 4.3.3 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/tailwindcss) --- updated-dependencies: - dependency-name: "@astrojs/check" dependency-version: 0.9.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: "@astrojs/node" dependency-version: 11.1.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: "@astrojs/starlight" dependency-version: 0.42.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: "@astrojs/svelte" dependency-version: 9.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: "@fontsource/ibm-plex-mono" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: "@fontsource/ibm-plex-sans" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: starlight-openapi dependency-version: 0.26.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: svelte dependency-version: 5.57.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: tailwindcss dependency-version: 4.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump maplibre-gl from 5.24.0 to 6.4.1 in /web (#1211) * chore(deps): bump maplibre-gl from 5.24.0 to 6.4.1 in /web Bumps [maplibre-gl](https://github.com/maplibre/maplibre-gl-js) from 5.24.0 to 6.4.1. - [Release notes](https://github.com/maplibre/maplibre-gl-js/releases) - [Changelog](https://github.com/maplibre/maplibre-gl-js/blob/main/CHANGELOG.md) - [Commits](maplibre/maplibre-gl-js@v5.24.0...v6.4.1) --- updated-dependencies: - dependency-name: maplibre-gl dependency-version: 6.4.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> * fix(web): adapt maplibre_util to maplibre-gl v6 ESM API maplibre-gl 6 ships pure ESM with named exports only, so the default import in maplibre_util broke the production build. Use the namespace import every other module already uses, and type the anchor marker drag callbacks with the now-exported MarkerDragEvent. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> * fix: fall back to cached trail/list when remote actor fetch fails (#1103) * fix: fall back to cached trail/list when remote actor fetch fails findLocalTrailByRemoteInfo and findLocalListByRemoteInfo discarded any previously-cached actor record whenever the live actor lookup returned an error (e.g. remote instance unreachable), turning what should be a graceful degrade to cached content into a 500. Reorder the checks to use a non-nil (possibly stale) actor or a plain local ID lookup before giving up, mirroring the existing pattern in ActivitypubActorGet. Also adds the missing ErrProfilePrivate 404 handling to RemoteListGet and fixes a copy-pasted "Failed to resolve trail" error message there. * return cached record if instance is unavailable * add full_sync_completed and guard --------- Co-authored-by: Christian Beutel <> Co-authored-by: slothful-vassal <[email protected]> * fix(api): address form/{id} updates by the path id (#1225) POST /api/v1/{trail,list,summit-log}/form/{id} ignored the path and read the record id from the multipart body: omitting it produced a 500 ("data has no id") and sending a different one updated that other record instead. uploadUpdate() now validates and uses the path id. A body id remains optional for existing callers but must match the path, otherwise the request is rejected with 400 id_mismatch. The OpenAPI descriptions document this. Fixes #1198 Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> * New Crowdin updates (#1208) * New translations en.json (French) [ci skip] * New translations en.json (Spanish) [ci skip] * New translations en.json (French) [ci skip] * New translations en.json (Czech) [ci skip] * New translations en.json (German) [ci skip] * New translations en.json (Basque) [ci skip] * New translations en.json (Hungarian) [ci skip] * New translations en.json (Italian) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (Norwegian) [ci skip] * New translations en.json (Polish) [ci skip] * New translations en.json (Portuguese) [ci skip] * New translations en.json (Russian) [ci skip] * New translations en.json (Chinese Simplified) [ci skip] * fix(media): disable video autoplay in lightbox and header galleries (#1209) * Update options.ts * Update trail_info_panel.svelte Removed autoplay --------- Co-authored-by: slothful-vassal <[email protected]> * fix(security): prevent share updates from granting access to foreign targets (#1234) * fix(security): keep share targets immutable on update * test: add share target update tests for various collections * fix(sharing): reject private cross-instance shares and handle mixed lists (#1222) * fix(sharing): block private shares with remote actors Add a server-side guard to trail and list share handlers that rejects sharing private objects with actors on other instances, preventing federated recipients from storing them as public. Include tests for local, remote, public, private, and unresolved-reference cases. * fix(sharing): validate remote recipients on share updates * fix(sharing): skip private trail grants for remote list recipients * test: remove outdated share guard tests and add new share guard tests for records API * unify share guard hooks * remove list-share-warning i18n key --------- Co-authored-by: Christian Beutel <> * fix(security): guard anonymous collection read rules (#1232) * fix(security): reject anonymous empty-user ownership matches Require authentication for ownership and recipient checks in collection read rules, including private trail metadata, remote-owned content, link tokens, feeds, and per-user views. Preserve public and token-based access, locked rules, and write permissions. Guard summit-log recipient checks independently of share-link expansion. Test the actual migration sequence, current schema behavior and exact rollbacks without configuring external Meilisearch indexes. * refactor(tests): reorganize and consolidate permission-related test files * fix(api): enforce caller view rules for remote expansions (#1223) * fix(api): enforce caller view rules for remote expansions Rebuild trail, list and comment response expansions with PocketBase enrichment. Clear expansions loaded from remote payloads or indexing hooks before applying caller view rules, including nested expansions and requests without expand. Allow anonymous tag views while retaining authenticated catalog listing. Add summit-log share-link access after the anonymous read-rule guards. Cover the route behavior and actual migration rules with regression tests. Co-authored-by: slothful-vassal <[email protected]> * fix(federation): isolate background sync from response records Give each background trail/list synchronization a fresh record copy so remote payloads and save hooks cannot mutate fields or expansions while the request checks permissions and serializes its response. * fix(tests): refactor test setup and add remote get handlers expansion view rules * fix(tests): add tests for anonymous read rules with tag expansions * fix(sync): preserve local sync state and isolate background records (#1224) * fix(sync): preserve local full-sync state for remote data Exclude needs_full_sync and full_sync_completed from imported trail and list metadata. Keep new placeholders pending and preserve completed cached copies during later metadata refreshes. Cover persisted trail sync flags, cache fallback eligibility, and conflicting remote list flags with regression tests. * fix(federation): isolate background sync from response records Give each background trail/list synchronization a fresh record copy so remote payloads and save hooks cannot mutate fields or expansions while the request checks permissions and serializes its response. * fix(sync): replace SafeHTTPClient with newRemoteSyncHTTPClient for full sync operations --------- Co-authored-by: Flomp <[email protected]> * chore(deps): remove unused PDFKit dependency (#1236) Co-authored-by: Flomp <[email protected]> * New Crowdin updates (#1241) * New translations en.json (Spanish) [ci skip] * New translations en.json (French) [ci skip] * New translations en.json (Czech) [ci skip] * New translations en.json (Basque) [ci skip] * New translations en.json (Hungarian) [ci skip] * New translations en.json (Italian) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (Norwegian) [ci skip] * New translations en.json (Polish) [ci skip] * New translations en.json (Portuguese) [ci skip] * New translations en.json (Russian) [ci skip] * New translations en.json (Chinese Simplified) [ci skip] * fix(security): guard anonymous collection write rules (#1238) * fix(security): reject anonymous empty-user matches in write rules * test: cover anonymous and stranger write access to federated content * test(permissions): enforce explicit anonymous write rules Validate nil write rules instead of skipping them, and define per-record owner update and delete expectations for likes, settings, and API tokens. --------- Co-authored-by: Christian Beutel <> Co-authored-by: slothful-vassal <[email protected]> * fix(api): reject misnamed file uploads instead of silently no-oping (#1226) * fix(api): stop file uploads from silently no-oping on a misnamed part POST /api/v1/{trail,waypoint,user,list,summit-log}/{id}/file forwarded the multipart body straight to PocketBase, which drops parts whose name does not match a collection field and returns the unchanged record. Combined with the API reference documenting the part as `file` (the real fields are `gpx`, `photos`, `avatar`), following the docs produced a 200 that changed nothing. The trail, list and summit-log variants duplicated POST {entity}/form/{id} with a strict subset of its behaviour and had no first-party callers. They are now deprecated aliases that re-export the form handler, so there is one multipart update path per entity, and their docs point to form/{id}. Waypoint and user have no form counterpart, so their /file endpoints stay. The shared upload() helper now takes the collection's file fields and answers 400 `missing_file` (listing the expected names, allowing PocketBase's `+`/`-` modifiers) when none is present, their OpenAPI blocks name the real fields, and the user handler uses handleError() like its siblings instead of re-throwing through error(), which broke on non-HTTP errors. Fixes #1197 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * fix(api): validate file parts on the deprecated /file aliases, skip empty waypoint uploads --------- Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> * fix(api): answer unknown /api paths and wrong methods with JSON (#1227) * fix (api): return errors as json for API routes * fix(api): answer unauthenticated trail uploads with 401 PUT /api/v1/trail/upload is not among the routes the auth hook guards, so an unauthenticated request reached the handler and crashed on event.locals.settings ("Cannot read properties of undefined (reading 'privacy')"), producing a 500. Guard it like /trail/download and answer 401 Unauthorized. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * fix(api): keep response headers when turning a 405 into JSON --------- Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> * fix(api): derive trail and summit log statistics when a track is replaced (#1228) * fix (api): return errors as json for API routes * fix(api): derive trail statistics when a track is replaced Replacing a trail's gpx through POST /api/v1/trail/form/{id} stored the new file and let the Go hook recompute the polyline and bounding box, but distance, duration and elevation gain/loss kept the values of the previous track, because those are only derived by PUT /api/v1/trail/upload. The form endpoint now runs a gpx part through the same pipeline as upload: the file is converted to GPX (FIT/KML/KMZ/TCX accepted, so the Go hook can parse what is stored) and distance, duration, elevation_gain, elevation_loss, lat and lon are derived from it for every field the request does not set explicitly. Fields sent by the client always win, so the web UI and clients with their own measurements are unaffected. The deprecated /file alias inherits the behaviour. Fixes #1199 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * fix(api): derive summit log statistics when its track is replaced Summit logs carry the same gpx/distance/duration/elevation fields as trails and POST /api/v1/summit-log/form/{id} had the same gap: a replaced track left the statistics of the previous one in place. The helper now takes the list of fields to derive, and the summit log form endpoint derives distance, duration, elevation_gain and elevation_loss for every field the request does not set explicitly, as the trail endpoint does. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * fix review issues * fix(api): drop hook definitions duplicated by the rebase hooks.server.ts kept the local isApiRequest/apiErrorsAsJson alongside the import from $lib/server/api_errors after rebasing onto #1227, which broke svelte-check. The file now matches #1227's version. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * fix(gpx): only strip prefixes bound to the GPX namespace --------- Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> * New translations en.json (Czech) (#1245) [ci skip] * fix(web): point MapLibre 6 at its worker so vector styles render (#1243) MapLibre 6 ships its worker as a separate ES module and resolves it relative to import.meta.url. Under Vite that URL points at the pre-bundled or chunked copy of maplibre-gl, where no worker file exists, so the request 404s and every vector style (OpenFreeMap, Carto) stays blank while raster styles keep working. Import the worker through Vite's ?worker&url and hand the resulting URL to setWorkerUrl() before any map is created. Co-authored-by: Christian Beutel <> * feat(db): allow overriding OIDC scopes via OIDC_SCOPES (#1027) * feat(db): allow overriding OIDC scopes via OIDC_SCOPES wanderer requests openid, profile and email from every OIDC provider. Some providers reject an authorization request carrying scopes they do not know rather than ignoring them, so login fails before the consent screen is shown. OpenStreetMap accepts neither profile nor email and is therefore unusable as an OIDC provider today. Setting OIDC_SCOPES to a comma separated list replaces the scopes for the oidc, oidc2 and oidc3 providers. When unset, the PocketBase defaults are kept. * docs: make OpenStreetMap discoverable as an OIDC provider * docs: note the generated username caveat for OSM accounts * feat(db): set OIDC scopes per provider --------- Co-authored-by: slothful-vassal <[email protected]> * fix(db): keep the OAuth2 provider username on signup (#1159) * fix(db): keep the OAuth2 provider username on signup PocketBase only maps the provider username when the raw value already satisfies users.username (^[\w][\w.\-]*$, min 3), so OSM display names with spaces or umlauts get a generated usersNNNNNN name instead. Transliterate accented characters, replace what is left over, and resolve collisions before assigning. Assigning the raw value fails record validation and breaks signup entirely. * fix(db): let PocketBase assign the cleaned OAuth2 username --------- Co-authored-by: slothful-vassal <[email protected]> * fix(web): parse HTML and GPX structurally (#1247) * fix(web): parse HTML and GPX structurally * fix(gpx): preserve import compatibility with a single XML parse * fix(web): bind and normalize trail list pagination (#1250) Make pagination bindable and centralize item-count rounding for card and list displays. Persist normalized page sizes consistently and isolate component specs in a dedicated Playwright project. Co-authored-by: Flomp <[email protected]> * chore(deps): bump devalue from 5.8.1 to 5.9.2 in /web (#1252) Bumps [devalue](https://github.com/sveltejs/devalue) from 5.8.1 to 5.9.2. - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.8.1...v5.9.2) --- updated-dependencies: - dependency-name: devalue dependency-version: 5.9.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump devalue from 5.8.1 to 5.9.2 in /docs (#1251) Bumps [devalue](https://github.com/sveltejs/devalue) from 5.8.1 to 5.9.2. - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.8.1...v5.9.2) --- updated-dependencies: - dependency-name: devalue dependency-version: 5.9.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Add a privacy policy at /privacy (#1203) * add privacy policy * fix(db): let accounts with comments be deleted, and retract cascaded content * fix(db): route incoming activities by IRI path, not by keyword search * feat(db): announce account deletion, and act on it when it arrives * docs: harden the privacy policy against PR #1203 review * fix(db): announce account deletion only after the transaction commits * fix(db): notify everyone holding a deleted account's content, not only followers * fix(db): tell a summit log's followers about its deletion even when its trail is already gone * fix(db): send a comment's deletion to everyone its text was sent to * fix: pull mention recipients from activity log * update policy * fix: delete activities on account deletion * fix: trail delete processing * fix(federation): send trail and summit log deletions to mentioned actors * fix(federation): retract deleted trails and lists from everyone holding a copy * fix(federation): attribute a trail fetched for a reply to its author * fix(federation): accept the Delete of a comment from other software * fix(routes): drop the copy of a remote trail or list its origin reports gone * docs(privacy): describe unpublishing and the deletion audience as they now work --------- Co-authored-by: Christian Beutel <> Co-authored-by: slothful-vassal <[email protected]> * fix: keep trail and list shares in sync with search (#1257) * fix: use elevation loss limit in map filters (#1258) * fix(search): validate radius filters and preserve zero coordinates (#1259) Co-authored-by: Flomp <[email protected]> * fix: pass retrieved trail fields through search options (#1261) * docs: mobile app beta documentation (#1256) * update docs with app data (cherry picked from commit 2b58c8e) * add app landing page (cherry picked from commit 1af7ed5) * add apps page to docs nav (cherry picked from commit 7954359) * add new screenshots (cherry picked from commit babf229) * docs(app): fix navigation, recording, trail detail and offline accuracy (cherry picked from commit d71c620) * docs(app): add app vs web comparison page and app bug report template (cherry picked from commit 0b36fec) * docs(app): install instructions for the beta on /app and getting started (cherry picked from commit a51ab7c) * docs(app): settings, find trails, planner, lists and profile accuracy fixes (cherry picked from commit 784f025) * docs(app): add trail editor and troubleshooting pages (cherry picked from commit 1750f89) * docs: app-development and region-catalogue fixes for the app beta (cherry picked from commit 26b2ed3) * docs(site): announce the app beta on the homepage and docs pages (cherry picked from commit 4640273) * docs(site): drop the app beta banner from docs pages (cherry picked from commit 960e8c0) * docs: replace region sizing table with density/relief guidance (cherry picked from commit 119fefe) * docs: remove em-dashes from the app beta documentation (cherry picked from commit 0f9c333) * docs(site): remove em-dashes from the homepage (cherry picked from commit cbccdcd) * docs(app): reduce the what-works-where tables to plain checks and crosses (cherry picked from commit 88b770e) * docs(app): show the full beta disclaimer on every app page (cherry picked from commit 23af400) * docs(run): add mobile app support page for instance admins (cherry picked from commit aaf7bc0) * small docs improvements (cherry picked from commit 415e824) * docs: add origin caution box to app development page --------- Co-authored-by: Christian Beutel <> * fix: refresh trail search tags after tag renames (#1262) * fix: detect upload duplicates with a targeted search (#1263) * fix: use UTC calendar days for trail date filters (#1260) * feat(plugins): import the provider's difficulty rating (#1266) * perf(images): use pocketbase thumbnails for cards, galleries, and avatars (#1268) * perf(images): use pocketbase thumbnails for cards, galleries, and avatars - Use 600x0 thumbnails for trail banners, gallery previews, map popups, and edit grids - Use 100x100 / 300x300 thumbnails for user and list avatars - Keep original full-resolution files for PhotoSwipe lightbox zoom and ZIP exports - Prevent appending ?thumb= to video URLs in getFileURL - Add unit tests for getFileURL * fix(db): register the thumbnail sizes the web UI requests * fix(web): detect video files by extension instead of substring --------- Co-authored-by: fparadise <[email protected]> Co-authored-by: Flomp <[email protected]> Co-authored-by: Christian Beutel <> * perf(elevation): optimize `smoothElevations` moving average without array allocations (#1267) * perf(elevation): optimize smoothElevations moving average without array allocations Avoid creating millions of intermediate array slices and mapped objects when computing elevation smoothing for dense GPX tracks. The moving average algorithm remains mathematically identical with zero loss of precision. * test(elevation): pin smoothElevations to the implementation it replaced --------- Co-authored-by: fparadise <[email protected]> Co-authored-by: Flomp <[email protected]> Co-authored-by: Christian Beutel <> * fix(web): keep a single xmlns when writing GPX 1.0 files (#1271) * App beta release workflow and Play open-test link (#1265) * ci: add manual app beta release workflow * ci: hard-code the TestFlight group * docs: add Google Play open-testing link to app install page * docs: point the APK button at app releases --------- Co-authored-by: Christian Beutel <> * ci: keep Play release notes within 500 characters (#1274) Co-authored-by: Christian Beutel <> * fix: prevent missing authors from crashing search initialization (#1273) * ci: attach the APK to a draft before publishing the app release (#1275) Co-authored-by: Christian Beutel <> * ci: cut release branches from dev instead of rebasing onto main (#1278) Co-authored-by: Christian Beutel <> * chore: release v0.21.0 * add changelog --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Matteo Fortini <[email protected]> Co-authored-by: Flomp <[email protected]> Co-authored-by: Henri <[email protected]> Co-authored-by: snowyukitty <[email protected]> Co-authored-by: snowyukitty <[email protected]> Co-authored-by: slothful-vassal <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> Co-authored-by: pttydou <[email protected]> Co-authored-by: Robin Monks <[email protected]> Co-authored-by: fparadise <[email protected]> Co-authored-by: Marcel Fuhrmann <[email protected]> Co-authored-by: fparadise <[email protected]> Co-authored-by: mrhard9090 <[email protected]> Co-authored-by: Matt Van Horn <[email protected]> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Christian Beutel <>

* Update Italian translations in it.json (#1135) * Rebase and clean up (#1099) * Fix duplicated shared-list rendering (#1134) * fix: prevent duplicated shared-list rendering * refactor: consolidate rich text previews into formatHTMLAsText The shared list fix duplicated logic that formatHTMLAsText already owned, and only covered one of the four places that truncate rich text. Fixes #1128. * fix test * fix(test): select-all across platforms and scope the rich text assertions Control+a does not select on macOS, and getByText resolved to the inline element itself rather than its container. --------- Co-authored-by: Christian Beutel <> * optimize mime type and error handling, fix limit hanlding (#1115) * Bump nanoid from 3.3.15 to 3.3.18 in /web (#1161) Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.15 to 3.3.18. - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](ai/nanoid@3.3.15...3.3.18) --- updated-dependencies: - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect ... * Bump nanoid from 3.3.15 to 3.3.18 in /docs (#1160) Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.15 to 3.3.18. - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](ai/nanoid@3.3.15...3.3.18) --- updated-dependencies: - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect ... * New Crowdin updates (#1155) * New translations en.json (French) [ci skip] * New translations en.json (Spanish) [ci skip] * New translations en.json (Czech) [ci skip] * New translations en.json (German) [ci skip] * New translations en.json (Basque) [ci skip] * New translations en.json (Hungarian) [ci skip] * New translations en.json (Italian) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (Norwegian) [ci skip] * New translations en.json (Polish) [ci skip] * New translations en.json (Portuguese) [ci skip] * New translations en.json (Russian) [ci skip] * New translations en.json (Chinese Simplified) [ci skip] * New translations en.json (Italian) [ci skip] * fix: 500 on list pages owned by a private profile (#1156) Opening /lists/@handle/{id} for a user whose account privacy is set to "private" returned a 500 ("Failed to resolve trail.") for every visitor but the owner, including for lists that are public. findLocalListByRemoteInfo treated federation.ErrProfilePrivate as a resolution failure. GetActorByHandle returns that error alongside a perfectly valid actor record - it means "this profile is private", not "this actor could not be resolved". The list's own ViewRule is what decides visibility, and it already does. findLocalTrailByRemoteInfo has tolerated this since #986 ("Fix trails being unavailable when profile is private"), which is why trail URLs kept working while the equivalent list URLs 500'd. Mirror that handling here, and map a genuinely unresolvable private profile to a 404 rather than a 500. Also corrects the copy-pasted "Failed to resolve trail" message in the list handler. Co-authored-by: Christian Beutel <> * fix(web): preserve share token in fullscreen map (#1172) * Re-add Further Heights to the server list (#1171) Re-adding furtherheights.com (originally shared in discussion #361, image already in server/imgs/). The instance is on wanderer 0.20.0. * plugin info modal added (#1166) * plugin info modal added * add homepage link, small fixes * fix issues (see comment) --------- Co-authored-by: Christian Beutel <> * fix: actor endpoint fails on bios with subdivision flag emoji (#1186) The users_anonymous view selected bio unqualified. SQLite resolves that to settings.bio, but PocketBase's view field inference only looks at the main table (users), finds no bio field and falls back to a json field. Reading plain text through a json field runs it through strconv.Quote, which escapes non-printable runes above U+FFFF as \U0001abcd. That is not valid JSON, so marshalling the record fails after the 200 header has been written and the client receives an empty body. The JS SDK turns the unparseable body into an empty record, and the ActivityPub actor endpoint then fails with "Invalid time value" on the missing created field. Qualifying bio as settings.bio lets it resolve to the underlying text field. PocketBase regenerates a view's fields from its query on save. Fixes #1164 Co-authored-by: Christian Beutel <> * Bump supercluster from 8.0.1 to 9.0.0 in /web (#1183) Bumps [supercluster](https://github.com/mapbox/supercluster) from 8.0.1 to 9.0.0. - [Release notes](https://github.com/mapbox/supercluster/releases) - [Commits](mapbox/supercluster@v8.0.1...v9.0.0) --- updated-dependencies: - dependency-name: supercluster dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major ... * chore(deps): bump fast-uri from 3.1.3 to 3.1.7 in /docs (#1187) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.3 to 3.1.7. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.3...v3.1.7) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect ... * chore(deps-dev): bump fast-uri from 3.1.3 to 3.1.7 in /web (#1188) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.3 to 3.1.7. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.3...v3.1.7) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect ... * chore(deps): bump browserslist from 4.28.4 to 4.28.8 in /web (#1189) Bumps [browserslist](https://github.com/browserslist/browserslist) from 4.28.4 to 4.28.8. - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.4...4.28.8) --- updated-dependencies: - dependency-name: browserslist dependency-version: 4.28.8 dependency-type: indirect ... * chore(deps): bump @tiptap from 3.27.1 to 3.30.4 in /web (#1191) * chore(deps): bump @xmldom/xmldom from 0.9.10 to 0.9.12 in /web (#1190) Bumps [@xmldom/xmldom](https://github.com/xmldom/xmldom) from 0.9.10 to 0.9.12. - [Release notes](https://github.com/xmldom/xmldom/releases) - [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md) - [Commits](xmldom/xmldom@0.9.10...0.9.12) --- updated-dependencies: - dependency-name: "@xmldom/xmldom" dependency-version: 0.9.12 dependency-type: direct:production ... * New Crowdin updates (#1178) * New translations en.json (Spanish) [ci skip] * New translations en.json (Spanish) [ci skip] * New translations en.json (French) [ci skip] * New translations en.json (Czech) [ci skip] * New translations en.json (German) [ci skip] * New translations en.json (Basque) [ci skip] * New translations en.json (Hungarian) [ci skip] * New translations en.json (Italian) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (Norwegian) [ci skip] * New translations en.json (Polish) [ci skip] * New translations en.json (Portuguese) [ci skip] * New translations en.json (Russian) [ci skip] * New translations en.json (Chinese Simplified) [ci skip] * New translations en.json (Czech) [ci skip] --------- * upgrade go to 1.26 (#1195) * Security fixes: ActivityPub delete authorization, inbox proxy trust, collection create rules, IPv6 SSRF bypass (#1205) * fix GHSA-xcwc-jhv2-w4h6 * fix GHSA-mr29-2qg5-m4fw * fix GHSA-vj82-xj83-jp85 * fix GHSA-332v-mq7g-5hqf * fix GHSA-8j93-xvwx-jjg3 * allow dots and hyphens in the inbox path username segment The pattern only admitted [a-z0-9_]+, but local usernames may also contain dots and hyphens (users collection: ^[\w][\w.\-]*$, 3-150 chars), so valid inboxes were rejected. Mirror that alphabet and its length bounds; a leading dot or hyphen stays disallowed, keeping . and .. unmatchable. * fixes ruleset --------- Co-authored-by: Christian Beutel <> * improve statistics page (#1162) * improve statistics page * improve layout * several fixes, improvements and re-designs * fix issues (see comment) * several fixes and optimizations * filter test added * fix test --------- Co-authored-by: Christian Beutel <> * Bump @sveltejs/kit from 2.68.0 to 2.70.2 in /web (#1157) Bumps [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit) from 2.68.0 to 2.70.2. - [Release notes](https://github.com/sveltejs/kit/releases) - [Changelog](https://github.com/sveltejs/kit/blob/version-3/packages/kit/CHANGELOG.md) - [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/[email protected]/packages/kit) --- updated-dependencies: - dependency-name: "@sveltejs/kit" dependency-version: 2.70.2 dependency-type: direct:development ... * chore(deps): bump svgo from 4.0.1 to 4.1.0 in /docs (#1210) Bumps [svgo](https://github.com/svg/svgo) from 4.0.1 to 4.1.0. - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v4.0.1...v4.1.0) --- updated-dependencies: - dependency-name: svgo dependency-version: 4.1.0 dependency-type: indirect ... * chore(deps): bump @vitest/mocker and vitest in /web (#1214) Bumps [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) to 4.1.11 and updates ancestor dependency [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). These dependencies need to be updated together. Updates `@vitest/mocker` from 4.1.9 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/mocker) Updates `vitest` from 4.1.9 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: "@vitest/mocker" dependency-version: 4.1.11 dependency-type: indirect - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:production ... * chore(deps): bump astro from 7.0.4 to 7.3.2 in /docs (#1213) Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) from 7.0.4 to 7.3.2. - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/[email protected]/packages/astro) --- updated-dependencies: - dependency-name: astro dependency-version: 7.3.2 dependency-type: direct:production ... * chore(deps): bump smol-toml from 1.7.0 to 1.8.0 in /docs (#1215) Bumps [smol-toml](https://github.com/squirrelchat/smol-toml) from 1.7.0 to 1.8.0. - [Release notes](https://github.com/squirrelchat/smol-toml/releases) - [Commits](squirrelchat/smol-toml@v1.7.0...v1.8.0) --- updated-dependencies: - dependency-name: smol-toml dependency-version: 1.8.0 dependency-type: indirect ... * chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.2 in /web (#1217) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 4.3.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.0...4.3.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect ... * chore(deps): bump js-yaml from 4.3.0 to 4.3.2 in /docs (#1218) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 4.3.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.0...4.3.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect ... * chore(deps): bump the docker-backward-compatible group across 1 directory with 10 updates (#1220) Bumps the docker-backward-compatible group with 9 updates in the /docs directory: | Package | From | To | | --- | --- | --- | | [@astrojs/check](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/astro-check) | `0.9.9` | `0.9.10` | | [@astrojs/node](https://github.com/withastro/astro/tree/HEAD/packages/integrations/node) | `11.0.0` | `11.1.5` | | [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.41.1` | `0.42.0` | | [@astrojs/svelte](https://github.com/withastro/astro/tree/HEAD/packages/integrations/svelte) | `9.0.0` | `9.0.1` | | [@fontsource/ibm-plex-mono](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/ibm-plex-mono) | `5.2.7` | `5.3.0` | | [@fontsource/ibm-plex-sans](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/ibm-plex-sans) | `5.2.8` | `5.3.0` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.2` | `4.3.3` | | [starlight-openapi](https://github.com/HiDeoo/starlight-openapi/tree/HEAD/packages/starlight-openapi) | `0.26.0` | `0.26.2` | | [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.56.4` | `5.57.0` | Updates `@astrojs/check` from 0.9.9 to 0.9.10 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/astro-check/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/language-tools/astro-check) Updates `@astrojs/node` from 11.0.0 to 11.1.5 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/node/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/integrations/node) Updates `@astrojs/starlight` from 0.41.1 to 0.42.0 - [Release notes](https://github.com/withastro/starlight/releases) - [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md) - [Commits](https://github.com/withastro/starlight/commits/@astrojs/[email protected]/packages/starlight) Updates `@astrojs/svelte` from 9.0.0 to 9.0.1 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/svelte/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/integrations/svelte) Updates `@fontsource/ibm-plex-mono` from 5.2.7 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/ibm-plex-mono) Updates `@fontsource/ibm-plex-sans` from 5.2.8 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/ibm-plex-sans) Updates `@tailwindcss/vite` from 4.3.2 to 4.3.3 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/@tailwindcss-vite) Updates `starlight-openapi` from 0.26.0 to 0.26.2 - [Release notes](https://github.com/HiDeoo/starlight-openapi/releases) - [Changelog](https://github.com/HiDeoo/starlight-openapi/blob/main/packages/starlight-openapi/CHANGELOG.md) - [Commits](https://github.com/HiDeoo/starlight-openapi/commits/[email protected]/packages/starlight-openapi) Updates `svelte` from 5.56.4 to 5.57.0 - [Release notes](https://github.com/sveltejs/svelte/releases) - [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md) - [Commits](https://github.com/sveltejs/svelte/commits/[email protected]/packages/svelte) Updates `tailwindcss` from 4.3.2 to 4.3.3 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/tailwindcss) --- updated-dependencies: - dependency-name: "@astrojs/check" dependency-version: 0.9.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: "@astrojs/node" dependency-version: 11.1.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: "@astrojs/starlight" dependency-version: 0.42.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: "@astrojs/svelte" dependency-version: 9.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: "@fontsource/ibm-plex-mono" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: "@fontsource/ibm-plex-sans" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: starlight-openapi dependency-version: 0.26.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: svelte dependency-version: 5.57.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: tailwindcss dependency-version: 4.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible ... * chore(deps): bump maplibre-gl from 5.24.0 to 6.4.1 in /web (#1211) * chore(deps): bump maplibre-gl from 5.24.0 to 6.4.1 in /web Bumps [maplibre-gl](https://github.com/maplibre/maplibre-gl-js) from 5.24.0 to 6.4.1. - [Release notes](https://github.com/maplibre/maplibre-gl-js/releases) - [Changelog](https://github.com/maplibre/maplibre-gl-js/blob/main/CHANGELOG.md) - [Commits](maplibre/maplibre-gl-js@v5.24.0...v6.4.1) --- updated-dependencies: - dependency-name: maplibre-gl dependency-version: 6.4.1 dependency-type: direct:production ... * fix(web): adapt maplibre_util to maplibre-gl v6 ESM API maplibre-gl 6 ships pure ESM with named exports only, so the default import in maplibre_util broke the production build. Use the namespace import every other module already uses, and type the anchor marker drag callbacks with the now-exported MarkerDragEvent. --------- Co-authored-by: Christian Beutel <> * fix: fall back to cached trail/list when remote actor fetch fails (#1103) * fix: fall back to cached trail/list when remote actor fetch fails findLocalTrailByRemoteInfo and findLocalListByRemoteInfo discarded any previously-cached actor record whenever the live actor lookup returned an error (e.g. remote instance unreachable), turning what should be a graceful degrade to cached content into a 500. Reorder the checks to use a non-nil (possibly stale) actor or a plain local ID lookup before giving up, mirroring the existing pattern in ActivitypubActorGet. Also adds the missing ErrProfilePrivate 404 handling to RemoteListGet and fixes a copy-pasted "Failed to resolve trail" error message there. * return cached record if instance is unavailable * add full_sync_completed and guard --------- Co-authored-by: Christian Beutel <> * fix(api): address form/{id} updates by the path id (#1225) POST /api/v1/{trail,list,summit-log}/form/{id} ignored the path and read the record id from the multipart body: omitting it produced a 500 ("data has no id") and sending a different one updated that other record instead. uploadUpdate() now validates and uses the path id. A body id remains optional for existing callers but must match the path, otherwise the request is rejected with 400 id_mismatch. The OpenAPI descriptions document this. Fixes #1198 Co-authored-by: Christian Beutel <> * New Crowdin updates (#1208) * New translations en.json (French) [ci skip] * New translations en.json (Spanish) [ci skip] * New translations en.json (French) [ci skip] * New translations en.json (Czech) [ci skip] * New translations en.json (German) [ci skip] * New translations en.json (Basque) [ci skip] * New translations en.json (Hungarian) [ci skip] * New translations en.json (Italian) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (Norwegian) [ci skip] * New translations en.json (Polish) [ci skip] * New translations en.json (Portuguese) [ci skip] * New translations en.json (Russian) [ci skip] * New translations en.json (Chinese Simplified) [ci skip] * fix(media): disable video autoplay in lightbox and header galleries (#1209) * Update options.ts * Update trail_info_panel.svelte Removed autoplay --------- * fix(security): prevent share updates from granting access to foreign targets (#1234) * fix(security): keep share targets immutable on update * test: add share target update tests for various collections * fix(sharing): reject private cross-instance shares and handle mixed lists (#1222) * fix(sharing): block private shares with remote actors Add a server-side guard to trail and list share handlers that rejects sharing private objects with actors on other instances, preventing federated recipients from storing them as public. Include tests for local, remote, public, private, and unresolved-reference cases. * fix(sharing): validate remote recipients on share updates * fix(sharing): skip private trail grants for remote list recipients * test: remove outdated share guard tests and add new share guard tests for records API * unify share guard hooks * remove list-share-warning i18n key --------- Co-authored-by: Christian Beutel <> * fix(security): guard anonymous collection read rules (#1232) * fix(security): reject anonymous empty-user ownership matches Require authentication for ownership and recipient checks in collection read rules, including private trail metadata, remote-owned content, link tokens, feeds, and per-user views. Preserve public and token-based access, locked rules, and write permissions. Guard summit-log recipient checks independently of share-link expansion. Test the actual migration sequence, current schema behavior and exact rollbacks without configuring external Meilisearch indexes. * refactor(tests): reorganize and consolidate permission-related test files * fix(api): enforce caller view rules for remote expansions (#1223) * fix(api): enforce caller view rules for remote expansions Rebuild trail, list and comment response expansions with PocketBase enrichment. Clear expansions loaded from remote payloads or indexing hooks before applying caller view rules, including nested expansions and requests without expand. Allow anonymous tag views while retaining authenticated catalog listing. Add summit-log share-link access after the anonymous read-rule guards. Cover the route behavior and actual migration rules with regression tests. * fix(federation): isolate background sync from response records Give each background trail/list synchronization a fresh record copy so remote payloads and save hooks cannot mutate fields or expansions while the request checks permissions and serializes its response. * fix(tests): refactor test setup and add remote get handlers expansion view rules * fix(tests): add tests for anonymous read rules with tag expansions * fix(sync): preserve local sync state and isolate background records (#1224) * fix(sync): preserve local full-sync state for remote data Exclude needs_full_sync and full_sync_completed from imported trail and list metadata. Keep new placeholders pending and preserve completed cached copies during later metadata refreshes. Cover persisted trail sync flags, cache fallback eligibility, and conflicting remote list flags with regression tests. * fix(federation): isolate background sync from response records Give each background trail/list synchronization a fresh record copy so remote payloads and save hooks cannot mutate fields or expansions while the request checks permissions and serializes its response. * fix(sync): replace SafeHTTPClient with newRemoteSyncHTTPClient for full sync operations --------- * chore(deps): remove unused PDFKit dependency (#1236) * New Crowdin updates (#1241) * New translations en.json (Spanish) [ci skip] * New translations en.json (French) [ci skip] * New translations en.json (Czech) [ci skip] * New translations en.json (Basque) [ci skip] * New translations en.json (Hungarian) [ci skip] * New translations en.json (Italian) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (Norwegian) [ci skip] * New translations en.json (Polish) [ci skip] * New translations en.json (Portuguese) [ci skip] * New translations en.json (Russian) [ci skip] * New translations en.json (Chinese Simplified) [ci skip] * fix(security): guard anonymous collection write rules (#1238) * fix(security): reject anonymous empty-user matches in write rules * test: cover anonymous and stranger write access to federated content * test(permissions): enforce explicit anonymous write rules Validate nil write rules instead of skipping them, and define per-record owner update and delete expectations for likes, settings, and API tokens. --------- Co-authored-by: Christian Beutel <> * fix(api): reject misnamed file uploads instead of silently no-oping (#1226) * fix(api): stop file uploads from silently no-oping on a misnamed part POST /api/v1/{trail,waypoint,user,list,summit-log}/{id}/file forwarded the multipart body straight to PocketBase, which drops parts whose name does not match a collection field and returns the unchanged record. Combined with the API reference documenting the part as `file` (the real fields are `gpx`, `photos`, `avatar`), following the docs produced a 200 that changed nothing. The trail, list and summit-log variants duplicated POST {entity}/form/{id} with a strict subset of its behaviour and had no first-party callers. They are now deprecated aliases that re-export the form handler, so there is one multipart update path per entity, and their docs point to form/{id}. Waypoint and user have no form counterpart, so their /file endpoints stay. The shared upload() helper now takes the collection's file fields and answers 400 `missing_file` (listing the expected names, allowing PocketBase's `+`/`-` modifiers) when none is present, their OpenAPI blocks name the real fields, and the user handler uses handleError() like its siblings instead of re-throwing through error(), which broke on non-HTTP errors. Fixes #1197 * fix(api): validate file parts on the deprecated /file aliases, skip empty waypoint uploads --------- Co-authored-by: Christian Beutel <> * fix(api): answer unknown /api paths and wrong methods with JSON (#1227) * fix (api): return errors as json for API routes * fix(api): answer unauthenticated trail uploads with 401 PUT /api/v1/trail/upload is not among the routes the auth hook guards, so an unauthenticated request reached the handler and crashed on event.locals.settings ("Cannot read properties of undefined (reading 'privacy')"), producing a 500. Guard it like /trail/download and answer 401 Unauthorized. * fix(api): keep response headers when turning a 405 into JSON --------- Co-authored-by: Christian Beutel <> * fix(api): derive trail and summit log statistics when a track is replaced (#1228) * fix (api): return errors as json for API routes * fix(api): derive trail statistics when a track is replaced Replacing a trail's gpx through POST /api/v1/trail/form/{id} stored the new file and let the Go hook recompute the polyline and bounding box, but distance, duration and elevation gain/loss kept the values of the previous track, because those are only derived by PUT /api/v1/trail/upload. The form endpoint now runs a gpx part through the same pipeline as upload: the file is converted to GPX (FIT/KML/KMZ/TCX accepted, so the Go hook can parse what is stored) and distance, duration, elevation_gain, elevation_loss, lat and lon are derived from it for every field the request does not set explicitly. Fields sent by the client always win, so the web UI and clients with their own measurements are unaffected. The deprecated /file alias inherits the behaviour. Fixes #1199 * fix(api): derive summit log statistics when its track is replaced Summit logs carry the same gpx/distance/duration/elevation fields as trails and POST /api/v1/summit-log/form/{id} had the same gap: a replaced track left the statistics of the previous one in place. The helper now takes the list of fields to derive, and the summit log form endpoint derives distance, duration, elevation_gain and elevation_loss for every field the request does not set explicitly, as the trail endpoint does. * fix review issues * fix(api): drop hook definitions duplicated by the rebase hooks.server.ts kept the local isApiRequest/apiErrorsAsJson alongside the import from $lib/server/api_errors after rebasing onto #1227, which broke svelte-check. The file now matches #1227's version. * fix(gpx): only strip prefixes bound to the GPX namespace --------- Co-authored-by: Christian Beutel <> * New translations en.json (Czech) (#1245) [ci skip] * fix(web): point MapLibre 6 at its worker so vector styles render (#1243) MapLibre 6 ships its worker as a separate ES module and resolves it relative to import.meta.url. Under Vite that URL points at the pre-bundled or chunked copy of maplibre-gl, where no worker file exists, so the request 404s and every vector style (OpenFreeMap, Carto) stays blank while raster styles keep working. Import the worker through Vite's ?worker&url and hand the resulting URL to setWorkerUrl() before any map is created. Co-authored-by: Christian Beutel <> * feat(db): allow overriding OIDC scopes via OIDC_SCOPES (#1027) * feat(db): allow overriding OIDC scopes via OIDC_SCOPES wanderer requests openid, profile and email from every OIDC provider. Some providers reject an authorization request carrying scopes they do not know rather than ignoring them, so login fails before the consent screen is shown. OpenStreetMap accepts neither profile nor email and is therefore unusable as an OIDC provider today. Setting OIDC_SCOPES to a comma separated list replaces the scopes for the oidc, oidc2 and oidc3 providers. When unset, the PocketBase defaults are kept. * docs: make OpenStreetMap discoverable as an OIDC provider * docs: note the generated username caveat for OSM accounts * feat(db): set OIDC scopes per provider --------- * fix(db): keep the OAuth2 provider username on signup (#1159) * fix(db): keep the OAuth2 provider username on signup PocketBase only maps the provider username when the raw value already satisfies users.username (^[\w][\w.\-]*$, min 3), so OSM display names with spaces or umlauts get a generated usersNNNNNN name instead. Transliterate accented characters, replace what is left over, and resolve collisions before assigning. Assigning the raw value fails record validation and breaks signup entirely. * fix(db): let PocketBase assign the cleaned OAuth2 username --------- * fix(web): parse HTML and GPX structurally (#1247) * fix(web): parse HTML and GPX structurally * fix(gpx): preserve import compatibility with a single XML parse * fix(web): bind and normalize trail list pagination (#1250) Make pagination bindable and centralize item-count rounding for card and list displays. Persist normalized page sizes consistently and isolate component specs in a dedicated Playwright project. * chore(deps): bump devalue from 5.8.1 to 5.9.2 in /web (#1252) Bumps [devalue](https://github.com/sveltejs/devalue) from 5.8.1 to 5.9.2. - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.8.1...v5.9.2) --- updated-dependencies: - dependency-name: devalue dependency-version: 5.9.2 dependency-type: indirect ... * chore(deps): bump devalue from 5.8.1 to 5.9.2 in /docs (#1251) Bumps [devalue](https://github.com/sveltejs/devalue) from 5.8.1 to 5.9.2. - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.8.1...v5.9.2) --- updated-dependencies: - dependency-name: devalue dependency-version: 5.9.2 dependency-type: indirect ... * Add a privacy policy at /privacy (#1203) * add privacy policy * fix(db): let accounts with comments be deleted, and retract cascaded content * fix(db): route incoming activities by IRI path, not by keyword search * feat(db): announce account deletion, and act on it when it arrives * docs: harden the privacy policy against PR #1203 review * fix(db): announce account deletion only after the transaction commits * fix(db): notify everyone holding a deleted account's content, not only followers * fix(db): tell a summit log's followers about its deletion even when its trail is already gone * fix(db): send a comment's deletion to everyone its text was sent to * fix: pull mention recipients from activity log * update policy * fix: delete activities on account deletion * fix: trail delete processing * fix(federation): send trail and summit log deletions to mentioned actors * fix(federation): retract deleted trails and lists from everyone holding a copy * fix(federation): attribute a trail fetched for a reply to its author * fix(federation): accept the Delete of a comment from other software * fix(routes): drop the copy of a remote trail or list its origin reports gone * docs(privacy): describe unpublishing and the deletion audience as they now work --------- Co-authored-by: Christian Beutel <> * fix: keep trail and list shares in sync with search (#1257) * fix: use elevation loss limit in map filters (#1258) * fix(search): validate radius filters and preserve zero coordinates (#1259) * fix: pass retrieved trail fields through search options (#1261) * docs: mobile app beta documentation (#1256) * update docs with app data (cherry picked from commit 2b58c8e) * add app landing page (cherry picked from commit 1af7ed5) * add apps page to docs nav (cherry picked from commit 7954359) * add new screenshots (cherry picked from commit babf229) * docs(app): fix navigation, recording, trail detail and offline accuracy (cherry picked from commit d71c620) * docs(app): add app vs web comparison page and app bug report template (cherry picked from commit 0b36fec) * docs(app): install instructions for the beta on /app and getting started (cherry picked from commit a51ab7c) * docs(app): settings, find trails, planner, lists and profile accuracy fixes (cherry picked from commit 784f025) * docs(app): add trail editor and troubleshooting pages (cherry picked from commit 1750f89) * docs: app-development and region-catalogue fixes for the app beta (cherry picked from commit 26b2ed3) * docs(site): announce the app beta on the homepage and docs pages (cherry picked from commit 4640273) * docs(site): drop the app beta banner from docs pages (cherry picked from commit 960e8c0) * docs: replace region sizing table with density/relief guidance (cherry picked from commit 119fefe) * docs: remove em-dashes from the app beta documentation (cherry picked from commit 0f9c333) * docs(site): remove em-dashes from the homepage (cherry picked from commit cbccdcd) * docs(app): reduce the what-works-where tables to plain checks and crosses (cherry picked from commit 88b770e) * docs(app): show the full beta disclaimer on every app page (cherry picked from commit 23af400) * docs(run): add mobile app support page for instance admins (cherry picked from commit aaf7bc0) * small docs improvements (cherry picked from commit 415e824) * docs: add origin caution box to app development page --------- Co-authored-by: Christian Beutel <> * fix: refresh trail search tags after tag renames (#1262) * fix: detect upload duplicates with a targeted search (#1263) * fix: use UTC calendar days for trail date filters (#1260) * feat(plugins): import the provider's difficulty rating (#1266) * perf(images): use pocketbase thumbnails for cards, galleries, and avatars (#1268) * perf(images): use pocketbase thumbnails for cards, galleries, and avatars - Use 600x0 thumbnails for trail banners, gallery previews, map popups, and edit grids - Use 100x100 / 300x300 thumbnails for user and list avatars - Keep original full-resolution files for PhotoSwipe lightbox zoom and ZIP exports - Prevent appending ?thumb= to video URLs in getFileURL - Add unit tests for getFileURL * fix(db): register the thumbnail sizes the web UI requests * fix(web): detect video files by extension instead of substring --------- Co-authored-by: Christian Beutel <> * perf(elevation): optimize `smoothElevations` moving average without array allocations (#1267) * perf(elevation): optimize smoothElevations moving average without array allocations Avoid creating millions of intermediate array slices and mapped objects when computing elevation smoothing for dense GPX tracks. The moving average algorithm remains mathematically identical with zero loss of precision. * test(elevation): pin smoothElevations to the implementation it replaced --------- Co-authored-by: Christian Beutel <> * fix(web): keep a single xmlns when writing GPX 1.0 files (#1271) * App beta release workflow and Play open-test link (#1265) * ci: add manual app beta release workflow * ci: hard-code the TestFlight group * docs: add Google Play open-testing link to app install page * docs: point the APK button at app releases --------- Co-authored-by: Christian Beutel <> * ci: keep Play release notes within 500 characters (#1274) Co-authored-by: Christian Beutel <> * fix: prevent missing authors from crashing search initialization (#1273) * ci: attach the APK to a draft before publishing the app release (#1275) Co-authored-by: Christian Beutel <> * ci: cut release branches from dev instead of rebasing onto main (#1278) Co-authored-by: Christian Beutel <> * chore: release v0.21.0 * add changelog --------- Co-authored-by: Christian Beutel <> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Matteo Fortini <[email protected]> Co-authored-by: Henri <[email protected]> Co-authored-by: snowyukitty <[email protected]> Co-authored-by: snowyukitty <[email protected]> Co-authored-by: slothful-vassal <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> Co-authored-by: pttydou <[email protected]> Co-authored-by: Robin Monks <[email protected]> Co-authored-by: fparadise <[email protected]> Co-authored-by: Marcel Fuhrmann <[email protected]> Co-authored-by: fparadise <[email protected]> Co-authored-by: mrhard9090 <[email protected]> Co-authored-by: Matt Van Horn <[email protected]> Co-authored-by: Christian Beutel <>

* Update Italian translations in it.json (open-wanderer#1135) Co-authored-by: Flomp <[email protected]> * Rebase and clean up (open-wanderer#1099) * Fix duplicated shared-list rendering (open-wanderer#1134) * fix: prevent duplicated shared-list rendering * refactor: consolidate rich text previews into formatHTMLAsText The shared list fix duplicated logic that formatHTMLAsText already owned, and only covered one of the four places that truncate rich text. Fixes open-wanderer#1128. * fix test * fix(test): select-all across platforms and scope the rich text assertions Control+a does not select on macOS, and getByText resolved to the inline element itself rather than its container. --------- Co-authored-by: snowyukitty <[email protected]> Co-authored-by: Flomp <[email protected]> Co-authored-by: Christian Beutel <> * optimize mime type and error handling, fix limit hanlding (open-wanderer#1115) * Bump nanoid from 3.3.15 to 3.3.18 in /web (open-wanderer#1161) Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.15 to 3.3.18. - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](ai/nanoid@3.3.15...3.3.18) --- updated-dependencies: - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump nanoid from 3.3.15 to 3.3.18 in /docs (open-wanderer#1160) Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.15 to 3.3.18. - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](ai/nanoid@3.3.15...3.3.18) --- updated-dependencies: - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * New Crowdin updates (open-wanderer#1155) * New translations en.json (French) [ci skip] * New translations en.json (Spanish) [ci skip] * New translations en.json (Czech) [ci skip] * New translations en.json (German) [ci skip] * New translations en.json (Basque) [ci skip] * New translations en.json (Hungarian) [ci skip] * New translations en.json (Italian) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (Norwegian) [ci skip] * New translations en.json (Polish) [ci skip] * New translations en.json (Portuguese) [ci skip] * New translations en.json (Russian) [ci skip] * New translations en.json (Chinese Simplified) [ci skip] * New translations en.json (Italian) [ci skip] * fix: 500 on list pages owned by a private profile (open-wanderer#1156) Opening /lists/@handle/{id} for a user whose account privacy is set to "private" returned a 500 ("Failed to resolve trail.") for every visitor but the owner, including for lists that are public. findLocalListByRemoteInfo treated federation.ErrProfilePrivate as a resolution failure. GetActorByHandle returns that error alongside a perfectly valid actor record - it means "this profile is private", not "this actor could not be resolved". The list's own ViewRule is what decides visibility, and it already does. findLocalTrailByRemoteInfo has tolerated this since open-wanderer#986 ("Fix trails being unavailable when profile is private"), which is why trail URLs kept working while the equivalent list URLs 500'd. Mirror that handling here, and map a genuinely unresolvable private profile to a 404 rather than a 500. Also corrects the copy-pasted "Failed to resolve trail" message in the list handler. Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> Co-authored-by: slothful-vassal <[email protected]> * fix(web): preserve share token in fullscreen map (open-wanderer#1172) * Re-add Further Heights to the server list (open-wanderer#1171) Re-adding furtherheights.com (originally shared in discussion #361, image already in server/imgs/). The instance is on wanderer 0.20.0. Co-authored-by: slothful-vassal <[email protected]> * plugin info modal added (open-wanderer#1166) * plugin info modal added * add homepage link, small fixes * fix issues (see comment) --------- Co-authored-by: Christian Beutel <> * fix: actor endpoint fails on bios with subdivision flag emoji (open-wanderer#1186) The users_anonymous view selected bio unqualified. SQLite resolves that to settings.bio, but PocketBase's view field inference only looks at the main table (users), finds no bio field and falls back to a json field. Reading plain text through a json field runs it through strconv.Quote, which escapes non-printable runes above U+FFFF as \U0001abcd. That is not valid JSON, so marshalling the record fails after the 200 header has been written and the client receives an empty body. The JS SDK turns the unparseable body into an empty record, and the ActivityPub actor endpoint then fails with "Invalid time value" on the missing created field. Qualifying bio as settings.bio lets it resolve to the underlying text field. PocketBase regenerates a view's fields from its query on save. Fixes open-wanderer#1164 Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> Co-authored-by: slothful-vassal <[email protected]> * Bump supercluster from 8.0.1 to 9.0.0 in /web (open-wanderer#1183) Bumps [supercluster](https://github.com/mapbox/supercluster) from 8.0.1 to 9.0.0. - [Release notes](https://github.com/mapbox/supercluster/releases) - [Commits](mapbox/supercluster@v8.0.1...v9.0.0) --- updated-dependencies: - dependency-name: supercluster dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump fast-uri from 3.1.3 to 3.1.7 in /docs (open-wanderer#1187) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.3 to 3.1.7. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.3...v3.1.7) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump fast-uri from 3.1.3 to 3.1.7 in /web (open-wanderer#1188) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.3 to 3.1.7. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.3...v3.1.7) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump browserslist from 4.28.4 to 4.28.8 in /web (open-wanderer#1189) Bumps [browserslist](https://github.com/browserslist/browserslist) from 4.28.4 to 4.28.8. - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.4...4.28.8) --- updated-dependencies: - dependency-name: browserslist dependency-version: 4.28.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump @tiptap from 3.27.1 to 3.30.4 in /web (open-wanderer#1191) * chore(deps): bump @xmldom/xmldom from 0.9.10 to 0.9.12 in /web (open-wanderer#1190) Bumps [@xmldom/xmldom](https://github.com/xmldom/xmldom) from 0.9.10 to 0.9.12. - [Release notes](https://github.com/xmldom/xmldom/releases) - [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md) - [Commits](xmldom/xmldom@0.9.10...0.9.12) --- updated-dependencies: - dependency-name: "@xmldom/xmldom" dependency-version: 0.9.12 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * New Crowdin updates (open-wanderer#1178) * New translations en.json (Spanish) [ci skip] * New translations en.json (Spanish) [ci skip] * New translations en.json (French) [ci skip] * New translations en.json (Czech) [ci skip] * New translations en.json (German) [ci skip] * New translations en.json (Basque) [ci skip] * New translations en.json (Hungarian) [ci skip] * New translations en.json (Italian) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (Norwegian) [ci skip] * New translations en.json (Polish) [ci skip] * New translations en.json (Portuguese) [ci skip] * New translations en.json (Russian) [ci skip] * New translations en.json (Chinese Simplified) [ci skip] * New translations en.json (Czech) [ci skip] --------- Co-authored-by: slothful-vassal <[email protected]> * upgrade go to 1.26 (open-wanderer#1195) * Security fixes: ActivityPub delete authorization, inbox proxy trust, collection create rules, IPv6 SSRF bypass (open-wanderer#1205) * fix GHSA-xcwc-jhv2-w4h6 * fix GHSA-mr29-2qg5-m4fw * fix GHSA-vj82-xj83-jp85 * fix GHSA-332v-mq7g-5hqf * fix GHSA-8j93-xvwx-jjg3 * allow dots and hyphens in the inbox path username segment The pattern only admitted [a-z0-9_]+, but local usernames may also contain dots and hyphens (users collection: ^[\w][\w.\-]*$, 3-150 chars), so valid inboxes were rejected. Mirror that alphabet and its length bounds; a leading dot or hyphen stays disallowed, keeping . and .. unmatchable. * fixes ruleset --------- Co-authored-by: Christian Beutel <> * improve statistics page (open-wanderer#1162) * improve statistics page * improve layout * several fixes, improvements and re-designs * fix issues (see comment) * several fixes and optimizations * filter test added * fix test --------- Co-authored-by: Christian Beutel <> * Bump @sveltejs/kit from 2.68.0 to 2.70.2 in /web (open-wanderer#1157) Bumps [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit) from 2.68.0 to 2.70.2. - [Release notes](https://github.com/sveltejs/kit/releases) - [Changelog](https://github.com/sveltejs/kit/blob/version-3/packages/kit/CHANGELOG.md) - [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/[email protected]/packages/kit) --- updated-dependencies: - dependency-name: "@sveltejs/kit" dependency-version: 2.70.2 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump svgo from 4.0.1 to 4.1.0 in /docs (open-wanderer#1210) Bumps [svgo](https://github.com/svg/svgo) from 4.0.1 to 4.1.0. - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v4.0.1...v4.1.0) --- updated-dependencies: - dependency-name: svgo dependency-version: 4.1.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump @vitest/mocker and vitest in /web (open-wanderer#1214) Bumps [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) to 4.1.11 and updates ancestor dependency [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). These dependencies need to be updated together. Updates `@vitest/mocker` from 4.1.9 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/mocker) Updates `vitest` from 4.1.9 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: "@vitest/mocker" dependency-version: 4.1.11 dependency-type: indirect - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump astro from 7.0.4 to 7.3.2 in /docs (open-wanderer#1213) Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) from 7.0.4 to 7.3.2. - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/[email protected]/packages/astro) --- updated-dependencies: - dependency-name: astro dependency-version: 7.3.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump smol-toml from 1.7.0 to 1.8.0 in /docs (open-wanderer#1215) Bumps [smol-toml](https://github.com/squirrelchat/smol-toml) from 1.7.0 to 1.8.0. - [Release notes](https://github.com/squirrelchat/smol-toml/releases) - [Commits](squirrelchat/smol-toml@v1.7.0...v1.8.0) --- updated-dependencies: - dependency-name: smol-toml dependency-version: 1.8.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.2 in /web (open-wanderer#1217) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 4.3.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.0...4.3.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump js-yaml from 4.3.0 to 4.3.2 in /docs (open-wanderer#1218) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 4.3.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.0...4.3.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump the docker-backward-compatible group across 1 directory with 10 updates (open-wanderer#1220) Bumps the docker-backward-compatible group with 9 updates in the /docs directory: | Package | From | To | | --- | --- | --- | | [@astrojs/check](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/astro-check) | `0.9.9` | `0.9.10` | | [@astrojs/node](https://github.com/withastro/astro/tree/HEAD/packages/integrations/node) | `11.0.0` | `11.1.5` | | [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.41.1` | `0.42.0` | | [@astrojs/svelte](https://github.com/withastro/astro/tree/HEAD/packages/integrations/svelte) | `9.0.0` | `9.0.1` | | [@fontsource/ibm-plex-mono](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/ibm-plex-mono) | `5.2.7` | `5.3.0` | | [@fontsource/ibm-plex-sans](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/ibm-plex-sans) | `5.2.8` | `5.3.0` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.2` | `4.3.3` | | [starlight-openapi](https://github.com/HiDeoo/starlight-openapi/tree/HEAD/packages/starlight-openapi) | `0.26.0` | `0.26.2` | | [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.56.4` | `5.57.0` | Updates `@astrojs/check` from 0.9.9 to 0.9.10 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/astro-check/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/language-tools/astro-check) Updates `@astrojs/node` from 11.0.0 to 11.1.5 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/node/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/integrations/node) Updates `@astrojs/starlight` from 0.41.1 to 0.42.0 - [Release notes](https://github.com/withastro/starlight/releases) - [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md) - [Commits](https://github.com/withastro/starlight/commits/@astrojs/[email protected]/packages/starlight) Updates `@astrojs/svelte` from 9.0.0 to 9.0.1 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/svelte/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/integrations/svelte) Updates `@fontsource/ibm-plex-mono` from 5.2.7 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/ibm-plex-mono) Updates `@fontsource/ibm-plex-sans` from 5.2.8 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/ibm-plex-sans) Updates `@tailwindcss/vite` from 4.3.2 to 4.3.3 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/@tailwindcss-vite) Updates `starlight-openapi` from 0.26.0 to 0.26.2 - [Release notes](https://github.com/HiDeoo/starlight-openapi/releases) - [Changelog](https://github.com/HiDeoo/starlight-openapi/blob/main/packages/starlight-openapi/CHANGELOG.md) - [Commits](https://github.com/HiDeoo/starlight-openapi/commits/[email protected]/packages/starlight-openapi) Updates `svelte` from 5.56.4 to 5.57.0 - [Release notes](https://github.com/sveltejs/svelte/releases) - [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md) - [Commits](https://github.com/sveltejs/svelte/commits/[email protected]/packages/svelte) Updates `tailwindcss` from 4.3.2 to 4.3.3 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/tailwindcss) --- updated-dependencies: - dependency-name: "@astrojs/check" dependency-version: 0.9.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: "@astrojs/node" dependency-version: 11.1.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: "@astrojs/starlight" dependency-version: 0.42.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: "@astrojs/svelte" dependency-version: 9.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: "@fontsource/ibm-plex-mono" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: "@fontsource/ibm-plex-sans" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: starlight-openapi dependency-version: 0.26.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: svelte dependency-version: 5.57.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: tailwindcss dependency-version: 4.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump maplibre-gl from 5.24.0 to 6.4.1 in /web (open-wanderer#1211) * chore(deps): bump maplibre-gl from 5.24.0 to 6.4.1 in /web Bumps [maplibre-gl](https://github.com/maplibre/maplibre-gl-js) from 5.24.0 to 6.4.1. - [Release notes](https://github.com/maplibre/maplibre-gl-js/releases) - [Changelog](https://github.com/maplibre/maplibre-gl-js/blob/main/CHANGELOG.md) - [Commits](maplibre/maplibre-gl-js@v5.24.0...v6.4.1) --- updated-dependencies: - dependency-name: maplibre-gl dependency-version: 6.4.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> * fix(web): adapt maplibre_util to maplibre-gl v6 ESM API maplibre-gl 6 ships pure ESM with named exports only, so the default import in maplibre_util broke the production build. Use the namespace import every other module already uses, and type the anchor marker drag callbacks with the now-exported MarkerDragEvent. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> * fix: fall back to cached trail/list when remote actor fetch fails (open-wanderer#1103) * fix: fall back to cached trail/list when remote actor fetch fails findLocalTrailByRemoteInfo and findLocalListByRemoteInfo discarded any previously-cached actor record whenever the live actor lookup returned an error (e.g. remote instance unreachable), turning what should be a graceful degrade to cached content into a 500. Reorder the checks to use a non-nil (possibly stale) actor or a plain local ID lookup before giving up, mirroring the existing pattern in ActivitypubActorGet. Also adds the missing ErrProfilePrivate 404 handling to RemoteListGet and fixes a copy-pasted "Failed to resolve trail" error message there. * return cached record if instance is unavailable * add full_sync_completed and guard --------- Co-authored-by: Christian Beutel <> Co-authored-by: slothful-vassal <[email protected]> * fix(api): address form/{id} updates by the path id (open-wanderer#1225) POST /api/v1/{trail,list,summit-log}/form/{id} ignored the path and read the record id from the multipart body: omitting it produced a 500 ("data has no id") and sending a different one updated that other record instead. uploadUpdate() now validates and uses the path id. A body id remains optional for existing callers but must match the path, otherwise the request is rejected with 400 id_mismatch. The OpenAPI descriptions document this. Fixes open-wanderer#1198 Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> * New Crowdin updates (open-wanderer#1208) * New translations en.json (French) [ci skip] * New translations en.json (Spanish) [ci skip] * New translations en.json (French) [ci skip] * New translations en.json (Czech) [ci skip] * New translations en.json (German) [ci skip] * New translations en.json (Basque) [ci skip] * New translations en.json (Hungarian) [ci skip] * New translations en.json (Italian) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (Norwegian) [ci skip] * New translations en.json (Polish) [ci skip] * New translations en.json (Portuguese) [ci skip] * New translations en.json (Russian) [ci skip] * New translations en.json (Chinese Simplified) [ci skip] * fix(media): disable video autoplay in lightbox and header galleries (open-wanderer#1209) * Update options.ts * Update trail_info_panel.svelte Removed autoplay --------- Co-authored-by: slothful-vassal <[email protected]> * fix(security): prevent share updates from granting access to foreign targets (open-wanderer#1234) * fix(security): keep share targets immutable on update * test: add share target update tests for various collections * fix(sharing): reject private cross-instance shares and handle mixed lists (open-wanderer#1222) * fix(sharing): block private shares with remote actors Add a server-side guard to trail and list share handlers that rejects sharing private objects with actors on other instances, preventing federated recipients from storing them as public. Include tests for local, remote, public, private, and unresolved-reference cases. * fix(sharing): validate remote recipients on share updates * fix(sharing): skip private trail grants for remote list recipients * test: remove outdated share guard tests and add new share guard tests for records API * unify share guard hooks * remove list-share-warning i18n key --------- Co-authored-by: Christian Beutel <> * fix(security): guard anonymous collection read rules (open-wanderer#1232) * fix(security): reject anonymous empty-user ownership matches Require authentication for ownership and recipient checks in collection read rules, including private trail metadata, remote-owned content, link tokens, feeds, and per-user views. Preserve public and token-based access, locked rules, and write permissions. Guard summit-log recipient checks independently of share-link expansion. Test the actual migration sequence, current schema behavior and exact rollbacks without configuring external Meilisearch indexes. * refactor(tests): reorganize and consolidate permission-related test files * fix(api): enforce caller view rules for remote expansions (open-wanderer#1223) * fix(api): enforce caller view rules for remote expansions Rebuild trail, list and comment response expansions with PocketBase enrichment. Clear expansions loaded from remote payloads or indexing hooks before applying caller view rules, including nested expansions and requests without expand. Allow anonymous tag views while retaining authenticated catalog listing. Add summit-log share-link access after the anonymous read-rule guards. Cover the route behavior and actual migration rules with regression tests. Co-authored-by: slothful-vassal <[email protected]> * fix(federation): isolate background sync from response records Give each background trail/list synchronization a fresh record copy so remote payloads and save hooks cannot mutate fields or expansions while the request checks permissions and serializes its response. * fix(tests): refactor test setup and add remote get handlers expansion view rules * fix(tests): add tests for anonymous read rules with tag expansions * fix(sync): preserve local sync state and isolate background records (open-wanderer#1224) * fix(sync): preserve local full-sync state for remote data Exclude needs_full_sync and full_sync_completed from imported trail and list metadata. Keep new placeholders pending and preserve completed cached copies during later metadata refreshes. Cover persisted trail sync flags, cache fallback eligibility, and conflicting remote list flags with regression tests. * fix(federation): isolate background sync from response records Give each background trail/list synchronization a fresh record copy so remote payloads and save hooks cannot mutate fields or expansions while the request checks permissions and serializes its response. * fix(sync): replace SafeHTTPClient with newRemoteSyncHTTPClient for full sync operations --------- Co-authored-by: Flomp <[email protected]> * chore(deps): remove unused PDFKit dependency (open-wanderer#1236) Co-authored-by: Flomp <[email protected]> * New Crowdin updates (open-wanderer#1241) * New translations en.json (Spanish) [ci skip] * New translations en.json (French) [ci skip] * New translations en.json (Czech) [ci skip] * New translations en.json (Basque) [ci skip] * New translations en.json (Hungarian) [ci skip] * New translations en.json (Italian) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (Norwegian) [ci skip] * New translations en.json (Polish) [ci skip] * New translations en.json (Portuguese) [ci skip] * New translations en.json (Russian) [ci skip] * New translations en.json (Chinese Simplified) [ci skip] * fix(security): guard anonymous collection write rules (open-wanderer#1238) * fix(security): reject anonymous empty-user matches in write rules * test: cover anonymous and stranger write access to federated content * test(permissions): enforce explicit anonymous write rules Validate nil write rules instead of skipping them, and define per-record owner update and delete expectations for likes, settings, and API tokens. --------- Co-authored-by: Christian Beutel <> Co-authored-by: slothful-vassal <[email protected]> * fix(api): reject misnamed file uploads instead of silently no-oping (open-wanderer#1226) * fix(api): stop file uploads from silently no-oping on a misnamed part POST /api/v1/{trail,waypoint,user,list,summit-log}/{id}/file forwarded the multipart body straight to PocketBase, which drops parts whose name does not match a collection field and returns the unchanged record. Combined with the API reference documenting the part as `file` (the real fields are `gpx`, `photos`, `avatar`), following the docs produced a 200 that changed nothing. The trail, list and summit-log variants duplicated POST {entity}/form/{id} with a strict subset of its behaviour and had no first-party callers. They are now deprecated aliases that re-export the form handler, so there is one multipart update path per entity, and their docs point to form/{id}. Waypoint and user have no form counterpart, so their /file endpoints stay. The shared upload() helper now takes the collection's file fields and answers 400 `missing_file` (listing the expected names, allowing PocketBase's `+`/`-` modifiers) when none is present, their OpenAPI blocks name the real fields, and the user handler uses handleError() like its siblings instead of re-throwing through error(), which broke on non-HTTP errors. Fixes open-wanderer#1197 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * fix(api): validate file parts on the deprecated /file aliases, skip empty waypoint uploads --------- Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> * fix(api): answer unknown /api paths and wrong methods with JSON (open-wanderer#1227) * fix (api): return errors as json for API routes * fix(api): answer unauthenticated trail uploads with 401 PUT /api/v1/trail/upload is not among the routes the auth hook guards, so an unauthenticated request reached the handler and crashed on event.locals.settings ("Cannot read properties of undefined (reading 'privacy')"), producing a 500. Guard it like /trail/download and answer 401 Unauthorized. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * fix(api): keep response headers when turning a 405 into JSON --------- Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> * fix(api): derive trail and summit log statistics when a track is replaced (open-wanderer#1228) * fix (api): return errors as json for API routes * fix(api): derive trail statistics when a track is replaced Replacing a trail's gpx through POST /api/v1/trail/form/{id} stored the new file and let the Go hook recompute the polyline and bounding box, but distance, duration and elevation gain/loss kept the values of the previous track, because those are only derived by PUT /api/v1/trail/upload. The form endpoint now runs a gpx part through the same pipeline as upload: the file is converted to GPX (FIT/KML/KMZ/TCX accepted, so the Go hook can parse what is stored) and distance, duration, elevation_gain, elevation_loss, lat and lon are derived from it for every field the request does not set explicitly. Fields sent by the client always win, so the web UI and clients with their own measurements are unaffected. The deprecated /file alias inherits the behaviour. Fixes open-wanderer#1199 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * fix(api): derive summit log statistics when its track is replaced Summit logs carry the same gpx/distance/duration/elevation fields as trails and POST /api/v1/summit-log/form/{id} had the same gap: a replaced track left the statistics of the previous one in place. The helper now takes the list of fields to derive, and the summit log form endpoint derives distance, duration, elevation_gain and elevation_loss for every field the request does not set explicitly, as the trail endpoint does. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * fix review issues * fix(api): drop hook definitions duplicated by the rebase hooks.server.ts kept the local isApiRequest/apiErrorsAsJson alongside the import from $lib/server/api_errors after rebasing onto open-wanderer#1227, which broke svelte-check. The file now matches open-wanderer#1227's version. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * fix(gpx): only strip prefixes bound to the GPX namespace --------- Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> * New translations en.json (Czech) (open-wanderer#1245) [ci skip] * fix(web): point MapLibre 6 at its worker so vector styles render (open-wanderer#1243) MapLibre 6 ships its worker as a separate ES module and resolves it relative to import.meta.url. Under Vite that URL points at the pre-bundled or chunked copy of maplibre-gl, where no worker file exists, so the request 404s and every vector style (OpenFreeMap, Carto) stays blank while raster styles keep working. Import the worker through Vite's ?worker&url and hand the resulting URL to setWorkerUrl() before any map is created. Co-authored-by: Christian Beutel <> * feat(db): allow overriding OIDC scopes via OIDC_SCOPES (open-wanderer#1027) * feat(db): allow overriding OIDC scopes via OIDC_SCOPES wanderer requests openid, profile and email from every OIDC provider. Some providers reject an authorization request carrying scopes they do not know rather than ignoring them, so login fails before the consent screen is shown. OpenStreetMap accepts neither profile nor email and is therefore unusable as an OIDC provider today. Setting OIDC_SCOPES to a comma separated list replaces the scopes for the oidc, oidc2 and oidc3 providers. When unset, the PocketBase defaults are kept. * docs: make OpenStreetMap discoverable as an OIDC provider * docs: note the generated username caveat for OSM accounts * feat(db): set OIDC scopes per provider --------- Co-authored-by: slothful-vassal <[email protected]> * fix(db): keep the OAuth2 provider username on signup (open-wanderer#1159) * fix(db): keep the OAuth2 provider username on signup PocketBase only maps the provider username when the raw value already satisfies users.username (^[\w][\w.\-]*$, min 3), so OSM display names with spaces or umlauts get a generated usersNNNNNN name instead. Transliterate accented characters, replace what is left over, and resolve collisions before assigning. Assigning the raw value fails record validation and breaks signup entirely. * fix(db): let PocketBase assign the cleaned OAuth2 username --------- Co-authored-by: slothful-vassal <[email protected]> * fix(web): parse HTML and GPX structurally (open-wanderer#1247) * fix(web): parse HTML and GPX structurally * fix(gpx): preserve import compatibility with a single XML parse * fix(web): bind and normalize trail list pagination (open-wanderer#1250) Make pagination bindable and centralize item-count rounding for card and list displays. Persist normalized page sizes consistently and isolate component specs in a dedicated Playwright project. Co-authored-by: Flomp <[email protected]> * chore(deps): bump devalue from 5.8.1 to 5.9.2 in /web (open-wanderer#1252) Bumps [devalue](https://github.com/sveltejs/devalue) from 5.8.1 to 5.9.2. - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.8.1...v5.9.2) --- updated-dependencies: - dependency-name: devalue dependency-version: 5.9.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump devalue from 5.8.1 to 5.9.2 in /docs (open-wanderer#1251) Bumps [devalue](https://github.com/sveltejs/devalue) from 5.8.1 to 5.9.2. - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.8.1...v5.9.2) --- updated-dependencies: - dependency-name: devalue dependency-version: 5.9.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Add a privacy policy at /privacy (open-wanderer#1203) * add privacy policy * fix(db): let accounts with comments be deleted, and retract cascaded content * fix(db): route incoming activities by IRI path, not by keyword search * feat(db): announce account deletion, and act on it when it arrives * docs: harden the privacy policy against PR open-wanderer#1203 review * fix(db): announce account deletion only after the transaction commits * fix(db): notify everyone holding a deleted account's content, not only followers * fix(db): tell a summit log's followers about its deletion even when its trail is already gone * fix(db): send a comment's deletion to everyone its text was sent to * fix: pull mention recipients from activity log * update policy * fix: delete activities on account deletion * fix: trail delete processing * fix(federation): send trail and summit log deletions to mentioned actors * fix(federation): retract deleted trails and lists from everyone holding a copy * fix(federation): attribute a trail fetched for a reply to its author * fix(federation): accept the Delete of a comment from other software * fix(routes): drop the copy of a remote trail or list its origin reports gone * docs(privacy): describe unpublishing and the deletion audience as they now work --------- Co-authored-by: Christian Beutel <> Co-authored-by: slothful-vassal <[email protected]> * fix: keep trail and list shares in sync with search (open-wanderer#1257) * fix: use elevation loss limit in map filters (open-wanderer#1258) * fix(search): validate radius filters and preserve zero coordinates (open-wanderer#1259) Co-authored-by: Flomp <[email protected]> * fix: pass retrieved trail fields through search options (open-wanderer#1261) * docs: mobile app beta documentation (open-wanderer#1256) * update docs with app data (cherry picked from commit 2b58c8e) * add app landing page (cherry picked from commit 1af7ed5) * add apps page to docs nav (cherry picked from commit 7954359) * add new screenshots (cherry picked from commit babf229) * docs(app): fix navigation, recording, trail detail and offline accuracy (cherry picked from commit d71c620) * docs(app): add app vs web comparison page and app bug report template (cherry picked from commit 0b36fec) * docs(app): install instructions for the beta on /app and getting started (cherry picked from commit a51ab7c) * docs(app): settings, find trails, planner, lists and profile accuracy fixes (cherry picked from commit 784f025) * docs(app): add trail editor and troubleshooting pages (cherry picked from commit 1750f89) * docs: app-development and region-catalogue fixes for the app beta (cherry picked from commit 26b2ed3) * docs(site): announce the app beta on the homepage and docs pages (cherry picked from commit 4640273) * docs(site): drop the app beta banner from docs pages (cherry picked from commit 960e8c0) * docs: replace region sizing table with density/relief guidance (cherry picked from commit 119fefe) * docs: remove em-dashes from the app beta documentation (cherry picked from commit 0f9c333) * docs(site): remove em-dashes from the homepage (cherry picked from commit cbccdcd) * docs(app): reduce the what-works-where tables to plain checks and crosses (cherry picked from commit 88b770e) * docs(app): show the full beta disclaimer on every app page (cherry picked from commit 23af400) * docs(run): add mobile app support page for instance admins (cherry picked from commit aaf7bc0) * small docs improvements (cherry picked from commit 415e824) * docs: add origin caution box to app development page --------- Co-authored-by: Christian Beutel <> * fix: refresh trail search tags after tag renames (open-wanderer#1262) * fix: detect upload duplicates with a targeted search (open-wanderer#1263) * fix: use UTC calendar days for trail date filters (open-wanderer#1260) * feat(plugins): import the provider's difficulty rating (open-wanderer#1266) * perf(images): use pocketbase thumbnails for cards, galleries, and avatars (open-wanderer#1268) * perf(images): use pocketbase thumbnails for cards, galleries, and avatars - Use 600x0 thumbnails for trail banners, gallery previews, map popups, and edit grids - Use 100x100 / 300x300 thumbnails for user and list avatars - Keep original full-resolution files for PhotoSwipe lightbox zoom and ZIP exports - Prevent appending ?thumb= to video URLs in getFileURL - Add unit tests for getFileURL * fix(db): register the thumbnail sizes the web UI requests * fix(web): detect video files by extension instead of substring --------- Co-authored-by: fparadise <[email protected]> Co-authored-by: Flomp <[email protected]> Co-authored-by: Christian Beutel <> * perf(elevation): optimize `smoothElevations` moving average without array allocations (open-wanderer#1267) * perf(elevation): optimize smoothElevations moving average without array allocations Avoid creating millions of intermediate array slices and mapped objects when computing elevation smoothing for dense GPX tracks. The moving average algorithm remains mathematically identical with zero loss of precision. * test(elevation): pin smoothElevations to the implementation it replaced --------- Co-authored-by: fparadise <[email protected]> Co-authored-by: Flomp <[email protected]> Co-authored-by: Christian Beutel <> * fix(web): keep a single xmlns when writing GPX 1.0 files (open-wanderer#1271) * App beta release workflow and Play open-test link (open-wanderer#1265) * ci: add manual app beta release workflow * ci: hard-code the TestFlight group * docs: add Google Play open-testing link to app install page * docs: point the APK button at app releases --------- Co-authored-by: Christian Beutel <> * ci: keep Play release notes within 500 characters (open-wanderer#1274) Co-authored-by: Christian Beutel <> * fix: prevent missing authors from crashing search initialization (open-wanderer#1273) * ci: attach the APK to a draft before publishing the app release (open-wanderer#1275) Co-authored-by: Christian Beutel <> * ci: cut release branches from dev instead of rebasing onto main (open-wanderer#1278) Co-authored-by: Christian Beutel <> * chore: release v0.21.0 * add changelog --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Matteo Fortini <[email protected]> Co-authored-by: Flomp <[email protected]> Co-authored-by: Henri <[email protected]> Co-authored-by: snowyukitty <[email protected]> Co-authored-by: snowyukitty <[email protected]> Co-authored-by: slothful-vassal <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> Co-authored-by: pttydou <[email protected]> Co-authored-by: Robin Monks <[email protected]> Co-authored-by: fparadise <[email protected]> Co-authored-by: Marcel Fuhrmann <[email protected]> Co-authored-by: fparadise <[email protected]> Co-authored-by: mrhard9090 <[email protected]> Co-authored-by: Matt Van Horn <[email protected]> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Christian Beutel <>

* Release v0.21.0 (#1279) * Update Italian translations in it.json (#1135) Co-authored-by: Flomp <[email protected]> * Rebase and clean up (#1099) * Fix duplicated shared-list rendering (#1134) * fix: prevent duplicated shared-list rendering * refactor: consolidate rich text previews into formatHTMLAsText The shared list fix duplicated logic that formatHTMLAsText already owned, and only covered one of the four places that truncate rich text. Fixes #1128. * fix test * fix(test): select-all across platforms and scope the rich text assertions Control+a does not select on macOS, and getByText resolved to the inline element itself rather than its container. --------- Co-authored-by: snowyukitty <[email protected]> Co-authored-by: Flomp <[email protected]> Co-authored-by: Christian Beutel <> * optimize mime type and error handling, fix limit hanlding (#1115) * Bump nanoid from 3.3.15 to 3.3.18 in /web (#1161) Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.15 to 3.3.18. - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](ai/nanoid@3.3.15...3.3.18) --- updated-dependencies: - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump nanoid from 3.3.15 to 3.3.18 in /docs (#1160) Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.15 to 3.3.18. - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](ai/nanoid@3.3.15...3.3.18) --- updated-dependencies: - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * New Crowdin updates (#1155) * New translations en.json (French) [ci skip] * New translations en.json (Spanish) [ci skip] * New translations en.json (Czech) [ci skip] * New translations en.json (German) [ci skip] * New translations en.json (Basque) [ci skip] * New translations en.json (Hungarian) [ci skip] * New translations en.json (Italian) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (Norwegian) [ci skip] * New translations en.json (Polish) [ci skip] * New translations en.json (Portuguese) [ci skip] * New translations en.json (Russian) [ci skip] * New translations en.json (Chinese Simplified) [ci skip] * New translations en.json (Italian) [ci skip] * fix: 500 on list pages owned by a private profile (#1156) Opening /lists/@handle/{id} for a user whose account privacy is set to "private" returned a 500 ("Failed to resolve trail.") for every visitor but the owner, including for lists that are public. findLocalListByRemoteInfo treated federation.ErrProfilePrivate as a resolution failure. GetActorByHandle returns that error alongside a perfectly valid actor record - it means "this profile is private", not "this actor could not be resolved". The list's own ViewRule is what decides visibility, and it already does. findLocalTrailByRemoteInfo has tolerated this since #986 ("Fix trails being unavailable when profile is private"), which is why trail URLs kept working while the equivalent list URLs 500'd. Mirror that handling here, and map a genuinely unresolvable private profile to a 404 rather than a 500. Also corrects the copy-pasted "Failed to resolve trail" message in the list handler. Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> Co-authored-by: slothful-vassal <[email protected]> * fix(web): preserve share token in fullscreen map (#1172) * Re-add Further Heights to the server list (#1171) Re-adding furtherheights.com (originally shared in discussion #361, image already in server/imgs/). The instance is on wanderer 0.20.0. Co-authored-by: slothful-vassal <[email protected]> * plugin info modal added (#1166) * plugin info modal added * add homepage link, small fixes * fix issues (see comment) --------- Co-authored-by: Christian Beutel <> * fix: actor endpoint fails on bios with subdivision flag emoji (#1186) The users_anonymous view selected bio unqualified. SQLite resolves that to settings.bio, but PocketBase's view field inference only looks at the main table (users), finds no bio field and falls back to a json field. Reading plain text through a json field runs it through strconv.Quote, which escapes non-printable runes above U+FFFF as \U0001abcd. That is not valid JSON, so marshalling the record fails after the 200 header has been written and the client receives an empty body. The JS SDK turns the unparseable body into an empty record, and the ActivityPub actor endpoint then fails with "Invalid time value" on the missing created field. Qualifying bio as settings.bio lets it resolve to the underlying text field. PocketBase regenerates a view's fields from its query on save. Fixes #1164 Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> Co-authored-by: slothful-vassal <[email protected]> * Bump supercluster from 8.0.1 to 9.0.0 in /web (#1183) Bumps [supercluster](https://github.com/mapbox/supercluster) from 8.0.1 to 9.0.0. - [Release notes](https://github.com/mapbox/supercluster/releases) - [Commits](mapbox/supercluster@v8.0.1...v9.0.0) --- updated-dependencies: - dependency-name: supercluster dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump fast-uri from 3.1.3 to 3.1.7 in /docs (#1187) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.3 to 3.1.7. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.3...v3.1.7) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump fast-uri from 3.1.3 to 3.1.7 in /web (#1188) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.3 to 3.1.7. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.3...v3.1.7) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump browserslist from 4.28.4 to 4.28.8 in /web (#1189) Bumps [browserslist](https://github.com/browserslist/browserslist) from 4.28.4 to 4.28.8. - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.4...4.28.8) --- updated-dependencies: - dependency-name: browserslist dependency-version: 4.28.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump @tiptap from 3.27.1 to 3.30.4 in /web (#1191) * chore(deps): bump @xmldom/xmldom from 0.9.10 to 0.9.12 in /web (#1190) Bumps [@xmldom/xmldom](https://github.com/xmldom/xmldom) from 0.9.10 to 0.9.12. - [Release notes](https://github.com/xmldom/xmldom/releases) - [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md) - [Commits](xmldom/xmldom@0.9.10...0.9.12) --- updated-dependencies: - dependency-name: "@xmldom/xmldom" dependency-version: 0.9.12 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * New Crowdin updates (#1178) * New translations en.json (Spanish) [ci skip] * New translations en.json (Spanish) [ci skip] * New translations en.json (French) [ci skip] * New translations en.json (Czech) [ci skip] * New translations en.json (German) [ci skip] * New translations en.json (Basque) [ci skip] * New translations en.json (Hungarian) [ci skip] * New translations en.json (Italian) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (Norwegian) [ci skip] * New translations en.json (Polish) [ci skip] * New translations en.json (Portuguese) [ci skip] * New translations en.json (Russian) [ci skip] * New translations en.json (Chinese Simplified) [ci skip] * New translations en.json (Czech) [ci skip] --------- Co-authored-by: slothful-vassal <[email protected]> * upgrade go to 1.26 (#1195) * Security fixes: ActivityPub delete authorization, inbox proxy trust, collection create rules, IPv6 SSRF bypass (#1205) * fix GHSA-xcwc-jhv2-w4h6 * fix GHSA-mr29-2qg5-m4fw * fix GHSA-vj82-xj83-jp85 * fix GHSA-332v-mq7g-5hqf * fix GHSA-8j93-xvwx-jjg3 * allow dots and hyphens in the inbox path username segment The pattern only admitted [a-z0-9_]+, but local usernames may also contain dots and hyphens (users collection: ^[\w][\w.\-]*$, 3-150 chars), so valid inboxes were rejected. Mirror that alphabet and its length bounds; a leading dot or hyphen stays disallowed, keeping . and .. unmatchable. * fixes ruleset --------- Co-authored-by: Christian Beutel <> * improve statistics page (#1162) * improve statistics page * improve layout * several fixes, improvements and re-designs * fix issues (see comment) * several fixes and optimizations * filter test added * fix test --------- Co-authored-by: Christian Beutel <> * Bump @sveltejs/kit from 2.68.0 to 2.70.2 in /web (#1157) Bumps [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit) from 2.68.0 to 2.70.2. - [Release notes](https://github.com/sveltejs/kit/releases) - [Changelog](https://github.com/sveltejs/kit/blob/version-3/packages/kit/CHANGELOG.md) - [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/[email protected]/packages/kit) --- updated-dependencies: - dependency-name: "@sveltejs/kit" dependency-version: 2.70.2 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump svgo from 4.0.1 to 4.1.0 in /docs (#1210) Bumps [svgo](https://github.com/svg/svgo) from 4.0.1 to 4.1.0. - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v4.0.1...v4.1.0) --- updated-dependencies: - dependency-name: svgo dependency-version: 4.1.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump @vitest/mocker and vitest in /web (#1214) Bumps [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) to 4.1.11 and updates ancestor dependency [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). These dependencies need to be updated together. Updates `@vitest/mocker` from 4.1.9 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/mocker) Updates `vitest` from 4.1.9 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: "@vitest/mocker" dependency-version: 4.1.11 dependency-type: indirect - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump astro from 7.0.4 to 7.3.2 in /docs (#1213) Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) from 7.0.4 to 7.3.2. - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/[email protected]/packages/astro) --- updated-dependencies: - dependency-name: astro dependency-version: 7.3.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump smol-toml from 1.7.0 to 1.8.0 in /docs (#1215) Bumps [smol-toml](https://github.com/squirrelchat/smol-toml) from 1.7.0 to 1.8.0. - [Release notes](https://github.com/squirrelchat/smol-toml/releases) - [Commits](squirrelchat/smol-toml@v1.7.0...v1.8.0) --- updated-dependencies: - dependency-name: smol-toml dependency-version: 1.8.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.2 in /web (#1217) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 4.3.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.0...4.3.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump js-yaml from 4.3.0 to 4.3.2 in /docs (#1218) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 4.3.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.0...4.3.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump the docker-backward-compatible group across 1 directory with 10 updates (#1220) Bumps the docker-backward-compatible group with 9 updates in the /docs directory: | Package | From | To | | --- | --- | --- | | [@astrojs/check](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/astro-check) | `0.9.9` | `0.9.10` | | [@astrojs/node](https://github.com/withastro/astro/tree/HEAD/packages/integrations/node) | `11.0.0` | `11.1.5` | | [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.41.1` | `0.42.0` | | [@astrojs/svelte](https://github.com/withastro/astro/tree/HEAD/packages/integrations/svelte) | `9.0.0` | `9.0.1` | | [@fontsource/ibm-plex-mono](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/ibm-plex-mono) | `5.2.7` | `5.3.0` | | [@fontsource/ibm-plex-sans](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/ibm-plex-sans) | `5.2.8` | `5.3.0` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.2` | `4.3.3` | | [starlight-openapi](https://github.com/HiDeoo/starlight-openapi/tree/HEAD/packages/starlight-openapi) | `0.26.0` | `0.26.2` | | [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.56.4` | `5.57.0` | Updates `@astrojs/check` from 0.9.9 to 0.9.10 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/astro-check/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/language-tools/astro-check) Updates `@astrojs/node` from 11.0.0 to 11.1.5 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/node/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/integrations/node) Updates `@astrojs/starlight` from 0.41.1 to 0.42.0 - [Release notes](https://github.com/withastro/starlight/releases) - [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md) - [Commits](https://github.com/withastro/starlight/commits/@astrojs/[email protected]/packages/starlight) Updates `@astrojs/svelte` from 9.0.0 to 9.0.1 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/svelte/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/integrations/svelte) Updates `@fontsource/ibm-plex-mono` from 5.2.7 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/ibm-plex-mono) Updates `@fontsource/ibm-plex-sans` from 5.2.8 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/ibm-plex-sans) Updates `@tailwindcss/vite` from 4.3.2 to 4.3.3 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/@tailwindcss-vite) Updates `starlight-openapi` from 0.26.0 to 0.26.2 - [Release notes](https://github.com/HiDeoo/starlight-openapi/releases) - [Changelog](https://github.com/HiDeoo/starlight-openapi/blob/main/packages/starlight-openapi/CHANGELOG.md) - [Commits](https://github.com/HiDeoo/starlight-openapi/commits/[email protected]/packages/starlight-openapi) Updates `svelte` from 5.56.4 to 5.57.0 - [Release notes](https://github.com/sveltejs/svelte/releases) - [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md) - [Commits](https://github.com/sveltejs/svelte/commits/[email protected]/packages/svelte) Updates `tailwindcss` from 4.3.2 to 4.3.3 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/tailwindcss) --- updated-dependencies: - dependency-name: "@astrojs/check" dependency-version: 0.9.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: "@astrojs/node" dependency-version: 11.1.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: "@astrojs/starlight" dependency-version: 0.42.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: "@astrojs/svelte" dependency-version: 9.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: "@fontsource/ibm-plex-mono" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: "@fontsource/ibm-plex-sans" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: starlight-openapi dependency-version: 0.26.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: svelte dependency-version: 5.57.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: tailwindcss dependency-version: 4.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump maplibre-gl from 5.24.0 to 6.4.1 in /web (#1211) * chore(deps): bump maplibre-gl from 5.24.0 to 6.4.1 in /web Bumps [maplibre-gl](https://github.com/maplibre/maplibre-gl-js) from 5.24.0 to 6.4.1. - [Release notes](https://github.com/maplibre/maplibre-gl-js/releases) - [Changelog](https://github.com/maplibre/maplibre-gl-js/blob/main/CHANGELOG.md) - [Commits](maplibre/maplibre-gl-js@v5.24.0...v6.4.1) --- updated-dependencies: - dependency-name: maplibre-gl dependency-version: 6.4.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> * fix(web): adapt maplibre_util to maplibre-gl v6 ESM API maplibre-gl 6 ships pure ESM with named exports only, so the default import in maplibre_util broke the production build. Use the namespace import every other module already uses, and type the anchor marker drag callbacks with the now-exported MarkerDragEvent. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> * fix: fall back to cached trail/list when remote actor fetch fails (#1103) * fix: fall back to cached trail/list when remote actor fetch fails findLocalTrailByRemoteInfo and findLocalListByRemoteInfo discarded any previously-cached actor record whenever the live actor lookup returned an error (e.g. remote instance unreachable), turning what should be a graceful degrade to cached content into a 500. Reorder the checks to use a non-nil (possibly stale) actor or a plain local ID lookup before giving up, mirroring the existing pattern in ActivitypubActorGet. Also adds the missing ErrProfilePrivate 404 handling to RemoteListGet and fixes a copy-pasted "Failed to resolve trail" error message there. * return cached record if instance is unavailable * add full_sync_completed and guard --------- Co-authored-by: Christian Beutel <> Co-authored-by: slothful-vassal <[email protected]> * fix(api): address form/{id} updates by the path id (#1225) POST /api/v1/{trail,list,summit-log}/form/{id} ignored the path and read the record id from the multipart body: omitting it produced a 500 ("data has no id") and sending a different one updated that other record instead. uploadUpdate() now validates and uses the path id. A body id remains optional for existing callers but must match the path, otherwise the request is rejected with 400 id_mismatch. The OpenAPI descriptions document this. Fixes #1198 Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> * New Crowdin updates (#1208) * New translations en.json (French) [ci skip] * New translations en.json (Spanish) [ci skip] * New translations en.json (French) [ci skip] * New translations en.json (Czech) [ci skip] * New translations en.json (German) [ci skip] * New translations en.json (Basque) [ci skip] * New translations en.json (Hungarian) [ci skip] * New translations en.json (Italian) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (Norwegian) [ci skip] * New translations en.json (Polish) [ci skip] * New translations en.json (Portuguese) [ci skip] * New translations en.json (Russian) [ci skip] * New translations en.json (Chinese Simplified) [ci skip] * fix(media): disable video autoplay in lightbox and header galleries (#1209) * Update options.ts * Update trail_info_panel.svelte Removed autoplay --------- Co-authored-by: slothful-vassal <[email protected]> * fix(security): prevent share updates from granting access to foreign targets (#1234) * fix(security): keep share targets immutable on update * test: add share target update tests for various collections * fix(sharing): reject private cross-instance shares and handle mixed lists (#1222) * fix(sharing): block private shares with remote actors Add a server-side guard to trail and list share handlers that rejects sharing private objects with actors on other instances, preventing federated recipients from storing them as public. Include tests for local, remote, public, private, and unresolved-reference cases. * fix(sharing): validate remote recipients on share updates * fix(sharing): skip private trail grants for remote list recipients * test: remove outdated share guard tests and add new share guard tests for records API * unify share guard hooks * remove list-share-warning i18n key --------- Co-authored-by: Christian Beutel <> * fix(security): guard anonymous collection read rules (#1232) * fix(security): reject anonymous empty-user ownership matches Require authentication for ownership and recipient checks in collection read rules, including private trail metadata, remote-owned content, link tokens, feeds, and per-user views. Preserve public and token-based access, locked rules, and write permissions. Guard summit-log recipient checks independently of share-link expansion. Test the actual migration sequence, current schema behavior and exact rollbacks without configuring external Meilisearch indexes. * refactor(tests): reorganize and consolidate permission-related test files * fix(api): enforce caller view rules for remote expansions (#1223) * fix(api): enforce caller view rules for remote expansions Rebuild trail, list and comment response expansions with PocketBase enrichment. Clear expansions loaded from remote payloads or indexing hooks before applying caller view rules, including nested expansions and requests without expand. Allow anonymous tag views while retaining authenticated catalog listing. Add summit-log share-link access after the anonymous read-rule guards. Cover the route behavior and actual migration rules with regression tests. Co-authored-by: slothful-vassal <[email protected]> * fix(federation): isolate background sync from response records Give each background trail/list synchronization a fresh record copy so remote payloads and save hooks cannot mutate fields or expansions while the request checks permissions and serializes its response. * fix(tests): refactor test setup and add remote get handlers expansion view rules * fix(tests): add tests for anonymous read rules with tag expansions * fix(sync): preserve local sync state and isolate background records (#1224) * fix(sync): preserve local full-sync state for remote data Exclude needs_full_sync and full_sync_completed from imported trail and list metadata. Keep new placeholders pending and preserve completed cached copies during later metadata refreshes. Cover persisted trail sync flags, cache fallback eligibility, and conflicting remote list flags with regression tests. * fix(federation): isolate background sync from response records Give each background trail/list synchronization a fresh record copy so remote payloads and save hooks cannot mutate fields or expansions while the request checks permissions and serializes its response. * fix(sync): replace SafeHTTPClient with newRemoteSyncHTTPClient for full sync operations --------- Co-authored-by: Flomp <[email protected]> * chore(deps): remove unused PDFKit dependency (#1236) Co-authored-by: Flomp <[email protected]> * New Crowdin updates (#1241) * New translations en.json (Spanish) [ci skip] * New translations en.json (French) [ci skip] * New translations en.json (Czech) [ci skip] * New translations en.json (Basque) [ci skip] * New translations en.json (Hungarian) [ci skip] * New translations en.json (Italian) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (Norwegian) [ci skip] * New translations en.json (Polish) [ci skip] * New translations en.json (Portuguese) [ci skip] * New translations en.json (Russian) [ci skip] * New translations en.json (Chinese Simplified) [ci skip] * fix(security): guard anonymous collection write rules (#1238) * fix(security): reject anonymous empty-user matches in write rules * test: cover anonymous and stranger write access to federated content * test(permissions): enforce explicit anonymous write rules Validate nil write rules instead of skipping them, and define per-record owner update and delete expectations for likes, settings, and API tokens. --------- Co-authored-by: Christian Beutel <> Co-authored-by: slothful-vassal <[email protected]> * fix(api): reject misnamed file uploads instead of silently no-oping (#1226) * fix(api): stop file uploads from silently no-oping on a misnamed part POST /api/v1/{trail,waypoint,user,list,summit-log}/{id}/file forwarded the multipart body straight to PocketBase, which drops parts whose name does not match a collection field and returns the unchanged record. Combined with the API reference documenting the part as `file` (the real fields are `gpx`, `photos`, `avatar`), following the docs produced a 200 that changed nothing. The trail, list and summit-log variants duplicated POST {entity}/form/{id} with a strict subset of its behaviour and had no first-party callers. They are now deprecated aliases that re-export the form handler, so there is one multipart update path per entity, and their docs point to form/{id}. Waypoint and user have no form counterpart, so their /file endpoints stay. The shared upload() helper now takes the collection's file fields and answers 400 `missing_file` (listing the expected names, allowing PocketBase's `+`/`-` modifiers) when none is present, their OpenAPI blocks name the real fields, and the user handler uses handleError() like its siblings instead of re-throwing through error(), which broke on non-HTTP errors. Fixes #1197 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * fix(api): validate file parts on the deprecated /file aliases, skip empty waypoint uploads --------- Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> * fix(api): answer unknown /api paths and wrong methods with JSON (#1227) * fix (api): return errors as json for API routes * fix(api): answer unauthenticated trail uploads with 401 PUT /api/v1/trail/upload is not among the routes the auth hook guards, so an unauthenticated request reached the handler and crashed on event.locals.settings ("Cannot read properties of undefined (reading 'privacy')"), producing a 500. Guard it like /trail/download and answer 401 Unauthorized. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * fix(api): keep response headers when turning a 405 into JSON --------- Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> * fix(api): derive trail and summit log statistics when a track is replaced (#1228) * fix (api): return errors as json for API routes * fix(api): derive trail statistics when a track is replaced Replacing a trail's gpx through POST /api/v1/trail/form/{id} stored the new file and let the Go hook recompute the polyline and bounding box, but distance, duration and elevation gain/loss kept the values of the previous track, because those are only derived by PUT /api/v1/trail/upload. The form endpoint now runs a gpx part through the same pipeline as upload: the file is converted to GPX (FIT/KML/KMZ/TCX accepted, so the Go hook can parse what is stored) and distance, duration, elevation_gain, elevation_loss, lat and lon are derived from it for every field the request does not set explicitly. Fields sent by the client always win, so the web UI and clients with their own measurements are unaffected. The deprecated /file alias inherits the behaviour. Fixes #1199 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * fix(api): derive summit log statistics when its track is replaced Summit logs carry the same gpx/distance/duration/elevation fields as trails and POST /api/v1/summit-log/form/{id} had the same gap: a replaced track left the statistics of the previous one in place. The helper now takes the list of fields to derive, and the summit log form endpoint derives distance, duration, elevation_gain and elevation_loss for every field the request does not set explicitly, as the trail endpoint does. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * fix review issues * fix(api): drop hook definitions duplicated by the rebase hooks.server.ts kept the local isApiRequest/apiErrorsAsJson alongside the import from $lib/server/api_errors after rebasing onto #1227, which broke svelte-check. The file now matches #1227's version. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * fix(gpx): only strip prefixes bound to the GPX namespace --------- Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> * New translations en.json (Czech) (#1245) [ci skip] * fix(web): point MapLibre 6 at its worker so vector styles render (#1243) MapLibre 6 ships its worker as a separate ES module and resolves it relative to import.meta.url. Under Vite that URL points at the pre-bundled or chunked copy of maplibre-gl, where no worker file exists, so the request 404s and every vector style (OpenFreeMap, Carto) stays blank while raster styles keep working. Import the worker through Vite's ?worker&url and hand the resulting URL to setWorkerUrl() before any map is created. Co-authored-by: Christian Beutel <> * feat(db): allow overriding OIDC scopes via OIDC_SCOPES (#1027) * feat(db): allow overriding OIDC scopes via OIDC_SCOPES wanderer requests openid, profile and email from every OIDC provider. Some providers reject an authorization request carrying scopes they do not know rather than ignoring them, so login fails before the consent screen is shown. OpenStreetMap accepts neither profile nor email and is therefore unusable as an OIDC provider today. Setting OIDC_SCOPES to a comma separated list replaces the scopes for the oidc, oidc2 and oidc3 providers. When unset, the PocketBase defaults are kept. * docs: make OpenStreetMap discoverable as an OIDC provider * docs: note the generated username caveat for OSM accounts * feat(db): set OIDC scopes per provider --------- Co-authored-by: slothful-vassal <[email protected]> * fix(db): keep the OAuth2 provider username on signup (#1159) * fix(db): keep the OAuth2 provider username on signup PocketBase only maps the provider username when the raw value already satisfies users.username (^[\w][\w.\-]*$, min 3), so OSM display names with spaces or umlauts get a generated usersNNNNNN name instead. Transliterate accented characters, replace what is left over, and resolve collisions before assigning. Assigning the raw value fails record validation and breaks signup entirely. * fix(db): let PocketBase assign the cleaned OAuth2 username --------- Co-authored-by: slothful-vassal <[email protected]> * fix(web): parse HTML and GPX structurally (#1247) * fix(web): parse HTML and GPX structurally * fix(gpx): preserve import compatibility with a single XML parse * fix(web): bind and normalize trail list pagination (#1250) Make pagination bindable and centralize item-count rounding for card and list displays. Persist normalized page sizes consistently and isolate component specs in a dedicated Playwright project. Co-authored-by: Flomp <[email protected]> * chore(deps): bump devalue from 5.8.1 to 5.9.2 in /web (#1252) Bumps [devalue](https://github.com/sveltejs/devalue) from 5.8.1 to 5.9.2. - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.8.1...v5.9.2) --- updated-dependencies: - dependency-name: devalue dependency-version: 5.9.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump devalue from 5.8.1 to 5.9.2 in /docs (#1251) Bumps [devalue](https://github.com/sveltejs/devalue) from 5.8.1 to 5.9.2. - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.8.1...v5.9.2) --- updated-dependencies: - dependency-name: devalue dependency-version: 5.9.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Add a privacy policy at /privacy (#1203) * add privacy policy * fix(db): let accounts with comments be deleted, and retract cascaded content * fix(db): route incoming activities by IRI path, not by keyword search * feat(db): announce account deletion, and act on it when it arrives * docs: harden the privacy policy against PR #1203 review * fix(db): announce account deletion only after the transaction commits * fix(db): notify everyone holding a deleted account's content, not only followers * fix(db): tell a summit log's followers about its deletion even when its trail is already gone * fix(db): send a comment's deletion to everyone its text was sent to * fix: pull mention recipients from activity log * update policy * fix: delete activities on account deletion * fix: trail delete processing * fix(federation): send trail and summit log deletions to mentioned actors * fix(federation): retract deleted trails and lists from everyone holding a copy * fix(federation): attribute a trail fetched for a reply to its author * fix(federation): accept the Delete of a comment from other software * fix(routes): drop the copy of a remote trail or list its origin reports gone * docs(privacy): describe unpublishing and the deletion audience as they now work --------- Co-authored-by: Christian Beutel <> Co-authored-by: slothful-vassal <[email protected]> * fix: keep trail and list shares in sync with search (#1257) * fix: use elevation loss limit in map filters (#1258) * fix(search): validate radius filters and preserve zero coordinates (#1259) Co-authored-by: Flomp <[email protected]> * fix: pass retrieved trail fields through search options (#1261) * docs: mobile app beta documentation (#1256) * update docs with app data (cherry picked from commit 2b58c8e) * add app landing page (cherry picked from commit 1af7ed5) * add apps page to docs nav (cherry picked from commit 7954359) * add new screenshots (cherry picked from commit babf229) * docs(app): fix navigation, recording, trail detail and offline accuracy (cherry picked from commit d71c620) * docs(app): add app vs web comparison page and app bug report template (cherry picked from commit 0b36fec) * docs(app): install instructions for the beta on /app and getting started (cherry picked from commit a51ab7c) * docs(app): settings, find trails, planner, lists and profile accuracy fixes (cherry picked from commit 784f025) * docs(app): add trail editor and troubleshooting pages (cherry picked from commit 1750f89) * docs: app-development and region-catalogue fixes for the app beta (cherry picked from commit 26b2ed3) * docs(site): announce the app beta on the homepage and docs pages (cherry picked from commit 4640273) * docs(site): drop the app beta banner from docs pages (cherry picked from commit 960e8c0) * docs: replace region sizing table with density/relief guidance (cherry picked from commit 119fefe) * docs: remove em-dashes from the app beta documentation (cherry picked from commit 0f9c333) * docs(site): remove em-dashes from the homepage (cherry picked from commit cbccdcd) * docs(app): reduce the what-works-where tables to plain checks and crosses (cherry picked from commit 88b770e) * docs(app): show the full beta disclaimer on every app page (cherry picked from commit 23af400) * docs(run): add mobile app support page for instance admins (cherry picked from commit aaf7bc0) * small docs improvements (cherry picked from commit 415e824) * docs: add origin caution box to app development page --------- Co-authored-by: Christian Beutel <> * fix: refresh trail search tags after tag renames (#1262) * fix: detect upload duplicates with a targeted search (#1263) * fix: use UTC calendar days for trail date filters (#1260) * feat(plugins): import the provider's difficulty rating (#1266) * perf(images): use pocketbase thumbnails for cards, galleries, and avatars (#1268) * perf(images): use pocketbase thumbnails for cards, galleries, and avatars - Use 600x0 thumbnails for trail banners, gallery previews, map popups, and edit grids - Use 100x100 / 300x300 thumbnails for user and list avatars - Keep original full-resolution files for PhotoSwipe lightbox zoom and ZIP exports - Prevent appending ?thumb= to video URLs in getFileURL - Add unit tests for getFileURL * fix(db): register the thumbnail sizes the web UI requests * fix(web): detect video files by extension instead of substring --------- Co-authored-by: fparadise <[email protected]> Co-authored-by: Flomp <[email protected]> Co-authored-by: Christian Beutel <> * perf(elevation): optimize `smoothElevations` moving average without array allocations (#1267) * perf(elevation): optimize smoothElevations moving average without array allocations Avoid creating millions of intermediate array slices and mapped objects when computing elevation smoothing for dense GPX tracks. The moving average algorithm remains mathematically identical with zero loss of precision. * test(elevation): pin smoothElevations to the implementation it replaced --------- Co-authored-by: fparadise <[email protected]> Co-authored-by: Flomp <[email protected]> Co-authored-by: Christian Beutel <> * fix(web): keep a single xmlns when writing GPX 1.0 files (#1271) * App beta release workflow and Play open-test link (#1265) * ci: add manual app beta release workflow * ci: hard-code the TestFlight group * docs: add Google Play open-testing link to app install page * docs: point the APK button at app releases --------- Co-authored-by: Christian Beutel <> * ci: keep Play release notes within 500 characters (#1274) Co-authored-by: Christian Beutel <> * fix: prevent missing authors from crashing search initialization (#1273) * ci: attach the APK to a draft before publishing the app release (#1275) Co-authored-by: Christian Beutel <> * ci: cut release branches from dev instead of rebasing onto main (#1278) Co-authored-by: Christian Beutel <> * chore: release v0.21.0 * add changelog --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Matteo Fortini <[email protected]> Co-authored-by: Flomp <[email protected]> Co-authored-by: Henri <[email protected]> Co-authored-by: snowyukitty <[email protected]> Co-authored-by: snowyukitty <[email protected]> Co-authored-by: slothful-vassal <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> Co-authored-by: pttydou <[email protected]> Co-authored-by: Robin Monks <[email protected]> Co-authored-by: fparadise <[email protected]> Co-authored-by: Marcel Fuhrmann <[email protected]> Co-authored-by: fparadise <[email protected]> Co-authored-by: mrhard9090 <[email protected]> Co-authored-by: Matt Van Horn <[email protected]> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Christian Beutel <> * chore: release v0.21.1 * docs: add changelog * docs: add MojeStezky.cz to the server list --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Matteo Fortini <[email protected]> Co-authored-by: Flomp <[email protected]> Co-authored-by: Henri <[email protected]> Co-authored-by: snowyukitty <[email protected]> Co-authored-by: snowyukitty <[email protected]> Co-authored-by: slothful-vassal <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> Co-authored-by: pttydou <[email protected]> Co-authored-by: Robin Monks <[email protected]> Co-authored-by: fparadise <[email protected]> Co-authored-by: Marcel Fuhrmann <[email protected]> Co-authored-by: fparadise <[email protected]> Co-authored-by: mrhard9090 <[email protected]> Co-authored-by: Matt Van Horn <[email protected]> Co-authored-by: Christian Beutel <>

* fix self-federation (#1044) * fix polyline db field size (#1047) * fix waypoint actor in ingetrations (#1049) * Improve trail planning: option to re-order route anchors (#1007) * trail anchor list added * add search location card to extend route endpoint in drawing mode * add POI popup endpoint action in route drawing mode * fix anchor stats, improve anchor list entries and refine route marker behavior * fix map marker spinner * docs updated * fix spinner when delete an anchor * further improvements * fix adding first anchor from POI * optimize drag handle area --------- Co-authored-by: Flomp <[email protected]> * Update remote_trail.go (#1002) Public Trails from users with private accounts currently show a 404. This fixes that Co-authored-by: slothful-vassal <[email protected]> * Add IRI to local resources (#1046) * initial commit * add remote trail/list * fix errors * update to use new IRIs * use origin in migration instead * use UnsafeWithoutHooks * fix trail/list order of operations * fix remote trail/list fetch * fixes list document update * fix errors --------- Co-authored-by: Christian Beutel <> * feat: implement server-side map clustering (#991) * feat: meilisearch bounding box intersection and map filtering * feat: tiered clustering and polyline filtering based on bounding box diagonal Addressing review comments with optimized performance and data accuracy: - Implemented a two-tiered search strategy (Summary vs. Detailed) to provide 100% accurate cluster counts while minimizing metadata traffic. - Added a client-side ID-based cache to eliminate redundant network requests for trails already in memory. - Introduced tiered 'detail shedding' that dynamically hides small trail lines when zooming out to maintain smooth panning performance. - Fixed Svelte 5 reactivity issues to ensure clusters reappear instantly when trail detail is shed. - Consolidated zoom thresholds into centralized constants for system-wide consistency. - Updated Meilisearch configuration to support efficient ID-based filtering. * feat: implement server-side map clustering using Meilisearch and Supercluster - Implemented SvelteKit server-side clustering route at `/api/v1/search/trails/cluster` using the `supercluster` library. - Integrated backend search results with the new clustering endpoint to improve performance for large trail datasets. - Fixed Svelte 5 reactivity in `MapWithElevationMaplibre.svelte` by making `mapLoaded` reactive and fixing destructuring of `` map data. - Removed obsolete client-side zoom constraints (`minzoom`/`maxzoom`) from `TrailLayer`, `PreviewLayer`, and `ClusterLayer` to allow dynamic visibility controlled by backend attributes. - Fixed a bug where unauthenticated users generated invalid Meilisearch filters. - Optimized map page performance by caching bounding box and filter values in the route loader. - Updated `ClusterLayer` font to `Noto Sans Regular` to match available tileserver resources. * feat: implement dynamic polyline visibility based on result density - Replaced static zoom-based diagonal thresholds with a dynamic "Top N" approach for polyline visibility. - Updated `/api/v1/search/trails/cluster` to mark only the top `MAP_MAX_POLYLINES` (default 100) trails by bounding box diagonal as "large". - Modified `trails_search_bounding_box` store function to always fetch polylines for trails marked as large, regardless of zoom level. - Removed obsolete `MAP_*_ZOOM_DIAGONAL_LIMIT` constants and simplified map layer constructors by removing tier-based filtering. - Updated environment configurations and documentation to use the new `PUBLIC_MAP_MAX_POLYLINES` variable. * refactor: remove obsolete zoom-based map clustering thresholds Following the transition to dynamic server-side clustering based on result density (Top N polylines), this commit removes all remaining zoom-based thresholds and logic. - Removed PUBLIC_MAP_LOW_ZOOM_THRESHOLD, PUBLIC_MAP_MEDIUM_ZOOM_THRESHOLD, and PUBLIC_MAP_HIGH_ZOOM_THRESHOLD environment variables. - Removed the 'mapClusterMinZoom' user setting from the schema, models, and settings UI. - Simplified the map component and MapLibre layer managers by removing unused 'clusterMinZoom', 'minZoom', and 'maxZoom' parameters. - Cleaned up obsolete 'map-cluster-zoom-level' translation keys across all locales. - Updated documentation to reflect the removal of these variables. * chore: remove map clustering debug logs * docs: update changelog and fix global zoom feature disappearance * fix: address PR reviews and refine map cluster/preview visuals * feat: implement configurable map cluster zoom and trail start marker settings * feat: render single unclustered shedded trails as start markers instead of cluster circles * minor fixes * minor ui changes * fix missing entries in map list * remove redundant map clustering zoom clamp * fix merge issues * fix merge issues * fixes * hide popup for trails without details * several improvements * prevent import of client trail_store in server cluster code * update changelog --------- Co-authored-by: slothful-vassal <[email protected]> * Bump softprops/action-gh-release from 2 to 3 (#952) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2 to 3. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/v2...v3) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: slothful-vassal <[email protected]> * Bump the docker-backward-compatible group across 1 directory with 8 updates (#1053) Bumps the docker-backward-compatible group with 7 updates in the /docs directory: | Package | From | To | | --- | --- | --- | | [@astrojs/check](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/astro-check) | `0.9.8` | `0.9.9` | | [@astrojs/node](https://github.com/withastro/astro/tree/HEAD/packages/integrations/node) | `10.1.1` | `10.1.2` | | [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.38.4` | `0.39.2` | | [@astrojs/svelte](https://github.com/withastro/astro/tree/HEAD/packages/integrations/svelte) | `8.1.1` | `8.1.2` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.2.4` | `4.3.0` | | [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `6.3.2` | `6.4.2` | | [starlight-openapi](https://github.com/HiDeoo/starlight-openapi/tree/HEAD/packages/starlight-openapi) | `0.25.0` | `0.25.3` | Updates `@astrojs/check` from 0.9.8 to 0.9.9 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/astro-check/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/language-tools/astro-check) Updates `@astrojs/node` from 10.1.1 to 10.1.2 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/node/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/integrations/node) Updates `@astrojs/starlight` from 0.38.4 to 0.39.2 - [Release notes](https://github.com/withastro/starlight/releases) - [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md) - [Commits](https://github.com/withastro/starlight/commits/@astrojs/[email protected]/packages/starlight) Updates `@astrojs/svelte` from 8.1.1 to 8.1.2 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/svelte/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/integrations/svelte) Updates `@tailwindcss/vite` from 4.2.4 to 4.3.0 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.0/packages/@tailwindcss-vite) Updates `astro` from 6.3.2 to 6.4.2 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/[email protected]/packages/astro) Updates `starlight-openapi` from 0.25.0 to 0.25.3 - [Release notes](https://github.com/HiDeoo/starlight-openapi/releases) - [Changelog](https://github.com/HiDeoo/starlight-openapi/blob/main/packages/starlight-openapi/CHANGELOG.md) - [Commits](https://github.com/HiDeoo/starlight-openapi/commits/[email protected]/packages/starlight-openapi) Updates `tailwindcss` from 4.2.4 to 4.3.0 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.0/packages/tailwindcss) --- updated-dependencies: - dependency-name: "@astrojs/check" dependency-version: 0.9.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: "@astrojs/node" dependency-version: 10.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: "@astrojs/starlight" dependency-version: 0.39.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: "@astrojs/svelte" dependency-version: 8.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: astro dependency-version: 6.4.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: starlight-openapi dependency-version: 0.25.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: tailwindcss dependency-version: 4.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump golang.org/x/net (#1036) Bumps the gomod-backward-compatible group with 1 update in the /db directory: [golang.org/x/net](https://github.com/golang/net). Updates `golang.org/x/net` from 0.53.0 to 0.55.0 - [Commits](https://github.com/golang/net/compare/v0.53.0...v0.55.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.55.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-backward-compatible ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Remove search docker (#1054) * Bump golang.org/x/net Bumps the gomod-backward-compatible group with 1 update in the /db directory: [golang.org/x/net](https://github.com/golang/net). Updates `golang.org/x/net` from 0.53.0 to 0.55.0 - [Commits](https://github.com/golang/net/compare/v0.53.0...v0.55.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.55.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-backward-compatible ... Signed-off-by: dependabot[bot] <[email protected]> * remove search docker --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Feat add actors to meilisearch (#1048) * initial commit * update api docs * adds search token versioning * make id filterable * isLocal -> is_local * add iri to actor index * update gitignore * Merge remote-tracking branch 'origin/main' into feat-add-actors-to-meilisearch * fix sharing for newly discovered actors * fix ActorSearchResult type --------- Co-authored-by: Christian Beutel <> * waypoint editing while drawing a route (#1060) * waypoint editing while drawing a route * fix waypoint click while drawing --------- Co-authored-by: Christian Beutel <> * fix: harden ActivityPub federation and fix N+1 follower fanout (#1056) * initial commit * improve activitypub recipient query * small fixes --------- Co-authored-by: Christian Beutel <> Co-authored-by: slothful-vassal <[email protected]> * Bump astro from 6.4.2 to 6.4.8 in /docs (#1068) Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) from 6.4.2 to 6.4.8. - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/[email protected]/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/[email protected]/packages/astro) --- updated-dependencies: - dependency-name: astro dependency-version: 6.4.8 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump vite and sveltekit-openapi-generator in /web (#1061) Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [sveltekit-openapi-generator](https://github.com/Michael-Obele/sveltekit-api-gen). These dependencies needed to be updated together. Updates `vite` from 8.0.9 to 8.0.16 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) Updates `sveltekit-openapi-generator` from 0.1.5 to 0.1.6 - [Release notes](https://github.com/Michael-Obele/sveltekit-api-gen/releases) - [Changelog](https://github.com/Michael-Obele/sveltekit-api-gen/blob/main/CHANGELOG.md) - [Commits](https://github.com/Michael-Obele/sveltekit-api-gen/compare/v0.1.5...v0.1.6) --- updated-dependencies: - dependency-name: vite dependency-version: 8.0.16 dependency-type: direct:development - dependency-name: sveltekit-openapi-generator dependency-version: 0.1.6 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: add plugin system (#1034) * feat: add plugin system * fix db docker build * fix hammerhead readme, add strava subscription news to docs * fixes and sdk improvements * fix: reduce Meilisearch load, debounce federation sync (#1012) * optimize meili trail index * several fixes --------- Co-authored-by: Flomp <[email protected]> * Bump svelte from 5.55.5 to 5.56.0 in /docs (#1032) Bumps [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) from 5.55.5 to 5.56.0. - [Release notes](https://github.com/sveltejs/svelte/releases) - [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md) - [Commits](https://github.com/sveltejs/svelte/commits/[email protected]/packages/svelte) --- updated-dependencies: - dependency-name: svelte dependency-version: 5.56.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * Release v0.19.2 (#1035) * chore: release v0.19.2 * add changelog --------- Co-authored-by: Flomp <[email protected]> Co-authored-by: Christian Beutel <> * speed up plugin sync and several small fixes * concepts for security improvements and process stability * improve concept * security concept implemented * remove insecure TLS * worker concept implemented * fixes and cleanup * fixes * docu * mermaid, namings * WASM plugin host improvements, plugin logging * fix db migration * Improve plugin config and category mapping UI * fixes * further fixes * remove manual test sync * fix db migration and strava mapping * type added, UI improvements * fix plugin card toggle clickable area * optimize synch status card layout * plugin type 'trails' instead of 'integration' * session auth validation in UI * fix komoot date and waypoints * improve category mapping * fix send to hammerhead: trail name * plugin setup error handling improved * fix review findings * re-mapping added * rename remote_category --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Flomp <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * fix missing tmp directory in docker image (#1069) * migrate tiptap to v3 (#1075) * feat: Refine trail category model (#1059) * feat: advanced trail categories * rename remote_category * fix merge issues * subcategories for plugins mapping * fix refresh * remove vertical trail filter category scrolling * cleanup * add confirm modal for disabling a category * Fix federation issues * fix review findings * redesign category settings page * remove prio badge * fix subcategory badge layout * optimize subcategory settings layout * further settings page layout optimization * fix subcategory icon position * fix * update docs --------- Co-authored-by: Christian Beutel <> * increase request size limits (#1083) * Bump the gomod-backward-compatible group in /db with 3 updates (#1085) Bumps the gomod-backward-compatible group in /db with 3 updates: [github.com/doyensec/safeurl](https://github.com/doyensec/safeurl), [golang.org/x/net](https://github.com/golang/net) and [golang.org/x/sync](https://github.com/golang/sync). Updates `github.com/doyensec/safeurl` from 0.2.3 to 0.2.5 - [Release notes](https://github.com/doyensec/safeurl/releases) - [Commits](https://github.com/doyensec/safeurl/compare/v0.2.3...v0.2.5) Updates `golang.org/x/net` from 0.55.0 to 0.56.0 - [Commits](https://github.com/golang/net/compare/v0.55.0...v0.56.0) Updates `golang.org/x/sync` from 0.20.0 to 0.21.0 - [Commits](https://github.com/golang/sync/compare/v0.20.0...v0.21.0) --- updated-dependencies: - dependency-name: github.com/doyensec/safeurl dependency-version: 0.2.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod-backward-compatible - dependency-name: golang.org/x/net dependency-version: 0.56.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-backward-compatible - dependency-name: golang.org/x/sync dependency-version: 0.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-backward-compatible ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/checkout from 6 to 7 (#1086) Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * Bump the docker-backward-compatible group in /docs with 5 updates (#1087) * Bump the docker-backward-compatible group in /docs with 5 updates Bumps the docker-backward-compatible group in /docs with 5 updates: | Package | From | To | | --- | --- | --- | | [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.39.2` | `0.41.0` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.0` | `4.3.1` | | [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.2` | | [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.56.0` | `5.56.4` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.0` | `4.3.1` | Updates `@astrojs/starlight` from 0.39.2 to 0.41.0 - [Release notes](https://github.com/withastro/starlight/releases) - [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md) - [Commits](https://github.com/withastro/starlight/commits/@astrojs/[email protected]/packages/starlight) Updates `@tailwindcss/vite` from 4.3.0 to 4.3.1 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/@tailwindcss-vite) Updates `sharp` from 0.34.5 to 0.35.2 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](https://github.com/lovell/sharp/compare/v0.34.5...v0.35.2) Updates `svelte` from 5.56.0 to 5.56.4 - [Release notes](https://github.com/sveltejs/svelte/releases) - [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md) - [Commits](https://github.com/sveltejs/svelte/commits/[email protected]/packages/svelte) Updates `tailwindcss` from 4.3.0 to 4.3.1 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/tailwindcss) --- updated-dependencies: - dependency-name: "@astrojs/starlight" dependency-version: 0.41.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: sharp dependency-version: 0.35.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-backward-compatible - dependency-name: svelte dependency-version: 5.56.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible - dependency-name: tailwindcss dependency-version: 4.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-backward-compatible ... Signed-off-by: dependabot[bot] <[email protected]> * update docs dependencies --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christian Beutel <> Co-authored-by: Flomp <[email protected]> * Bump js-yaml from 4.1.1 to 4.3.0 in /docs (#1091) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.3.0. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.1.1...4.3.0) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump js-yaml from 4.1.1 to 4.3.0 in /web (#1092) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.3.0. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.1.1...4.3.0) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump the npm-backward-compatible group across 1 directory with 20 updates (#1090) * Bump the npm-backward-compatible group across 1 directory with 20 updates Bumps the npm-backward-compatible group with 19 updates in the /web directory: | Package | From | To | | --- | --- | --- | | [@sveltejs/adapter-node](https://github.com/sveltejs/kit/tree/HEAD/packages/adapter-node) | `5.5.4` | `5.5.6` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.2.4` | `4.3.1` | | [@threlte/core](https://github.com/threlte/threlte/tree/HEAD/packages/core) | `8.5.9` | `8.5.16` | | [@threlte/extras](https://github.com/threlte/threlte/tree/HEAD/packages/extras) | `9.14.8` | `9.21.0` | | [@xmldom/xmldom](https://github.com/xmldom/xmldom) | `0.8.13` | `0.9.10` | | [autoprefixer](https://github.com/postcss/autoprefixer) | `10.5.0` | `10.5.1` | | [meilisearch](https://github.com/meilisearch/meilisearch-js) | `0.57.0` | `0.58.0` | | [pdfkit](https://github.com/foliojs/pdfkit) | `0.17.2` | `0.19.1` | | [pocketbase](https://github.com/pocketbase/js-sdk) | `0.26.8` | `0.27.0` | | [three](https://github.com/mrdoob/three.js) | `0.183.2` | `0.184.0` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.4` | `4.1.9` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.59.1` | `1.61.1` | | [@sveltejs/enhanced-img](https://github.com/sveltejs/kit/tree/HEAD/packages/enhanced-img) | `0.10.4` | `0.11.0` | | [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit) | `2.60.1` | `2.67.0` | | [@sveltejs/vite-plugin-svelte](https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte) | `7.0.0` | `7.1.2` | | [@tailwindcss/typography](https://github.com/tailwindlabs/tailwindcss-typography) | `0.5.19` | `0.5.20` | | [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.55.7` | `5.56.4` | | [svelte-check](https://github.com/sveltejs/language-tools) | `4.4.6` | `4.7.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.16` | `8.1.0` | Updates `@sveltejs/adapter-node` from 5.5.4 to 5.5.6 - [Release notes](https://github.com/sveltejs/kit/releases) - [Changelog](https://github.com/sveltejs/kit/blob/main/packages/adapter-node/CHANGELOG.md) - [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/[email protected]/packages/adapter-node) Updates `@tailwindcss/vite` from 4.2.4 to 4.3.1 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/@tailwindcss-vite) Updates `@threlte/core` from 8.5.9 to 8.5.16 - [Release notes](https://github.com/threlte/threlte/releases) - [Changelog](https://github.com/threlte/threlte/blob/main/packages/core/CHANGELOG.md) - [Commits](https://github.com/threlte/threlte/commits/@threlte/[email protected]/packages/core) Updates `@threlte/extras` from 9.14.8 to 9.21.0 - [Release notes](https://github.com/threlte/threlte/releases) - [Changelog](https://github.com/threlte/threlte/blob/main/packages/extras/CHANGELOG.md) - [Commits](https://github.com/threlte/threlte/commits/@threlte/[email protected]/packages/extras) Updates `@xmldom/xmldom` from 0.8.13 to 0.9.10 - [Release notes](https://github.com/xmldom/xmldom/releases) - [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md) - [Commits](https://github.com/xmldom/xmldom/compare/0.8.13...0.9.10) Updates `autoprefixer` from 10.5.0 to 10.5.1 - [Release notes](https://github.com/postcss/autoprefixer/releases) - [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md) - [Commits](https://github.com/postcss/autoprefixer/compare/10.5.0...10.5.1) Updates `meilisearch` from 0.57.0 to 0.58.0 - [Release notes](https://github.com/meilisearch/meilisearch-js/releases) - [Commits](https://github.com/meilisearch/meilisearch-js/compare/v0.57.0...v0.58.0) Updates `pdfkit` from 0.17.2 to 0.19.1 - [Release notes](https://github.com/foliojs/pdfkit/releases) - [Changelog](https://github.com/foliojs/pdfkit/blob/master/CHANGELOG.md) - [Commits](https://github.com/foliojs/pdfkit/compare/v0.17.2...v0.19.1) Updates `pocketbase` from 0.26.8 to 0.27.0 - [Release notes](https://github.com/pocketbase/js-sdk/releases) - [Changelog](https://github.com/pocketbase/js-sdk/blob/master/CHANGELOG.md) - [Commits](https://github.com/pocketbase/js-sdk/compare/v0.26.8...v0.27.0) Updates `tailwindcss` from 4.2.4 to 4.3.1 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/tailwindcss) Updates `three` from 0.183.2 to 0.184.0 - [Release notes](https://github.com/mrdoob/three.js/releases) - [Commits](https://github.com/mrdoob/three.js/commits) Updates `vitest` from 4.1.4 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/vitest) Updates `@playwright/test` from 1.59.1 to 1.61.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](https://github.com/microsoft/playwright/compare/v1.59.1...v1.61.1) Updates `@sveltejs/enhanced-img` from 0.10.4 to 0.11.0 - [Release notes](https://github.com/sveltejs/kit/releases) - [Changelog](https://github.com/sveltejs/kit/blob/main/packages/enhanced-img/CHANGELOG.md) - [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/[email protected]/packages/enhanced-img) Updates `@sveltejs/kit` from 2.60.1 to 2.67.0 - [Release notes](https://github.com/sveltejs/kit/releases) - [Changelog](https://github.com/sveltejs/kit/blob/main/packages/kit/CHANGELOG.md) - [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/[email protected]/packages/kit) Updates `@sveltejs/vite-plugin-svelte` from 7.0.0 to 7.1.2 - [Release notes](https://github.com/sveltejs/vite-plugin-svelte/releases) - [Changelog](https://github.com/sveltejs/vite-plugin-svelte/blob/main/packages/vite-plugin-svelte/CHANGELOG.md) - [Commits](https://github.com/sveltejs/vite-plugin-svelte/commits/@sveltejs/[email protected]/packages/vite-plugin-svelte) Updates `@tailwindcss/typography` from 0.5.19 to 0.5.20 - [Release notes](https://github.com/tailwindlabs/tailwindcss-typography/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss-typography/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss-typography/compare/v0.5.19...v0.5.20) Updates `svelte` from 5.55.7 to 5.56.4 - [Release notes](https://github.com/sveltejs/svelte/releases) - [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md) - [Commits](https://github.com/sveltejs/svelte/commits/[email protected]/packages/svelte) Updates `svelte-check` from 4.4.6 to 4.7.0 - [Release notes](https://github.com/sveltejs/language-tools/releases) - [Commits](https://github.com/sveltejs/language-tools/compare/[email protected]@4.7.0) Updates `vite` from 8.0.16 to 8.1.0 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/[email protected]/packages/vite) --- updated-dependencies: - dependency-name: "@sveltejs/adapter-node" dependency-version: 5.5.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-backward-compatible - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-backward-compatible - dependency-name: "@threlte/core" dependency-version: 8.5.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-backward-compatible - dependency-name: "@threlte/extras" dependency-version: 9.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-backward-compatible - dependency-name: "@xmldom/xmldom" dependency-version: 0.9.10 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-backward-compatible - dependency-name: autoprefixer dependency-version: 10.5.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-backward-compatible - dependency-name: meilisearch dependency-version: 0.58.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-backward-compatible - dependency-name: pdfkit dependency-version: 0.19.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-backward-compatible - dependency-name: pocketbase dependency-version: 0.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-backward-compatible - dependency-name: tailwindcss dependency-version: 4.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-backward-compatible - dependency-name: three dependency-version: 0.184.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-backward-compatible - dependency-name: vitest dependency-version: 4.1.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-backward-compatible - dependency-name: "@playwright/test" dependency-version: 1.61.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-backward-compatible - dependency-name: "@sveltejs/enhanced-img" dependency-version: 0.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-backward-compatible - dependency-name: "@sveltejs/kit" dependency-version: 2.67.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-backward-compatible - dependency-name: "@sveltejs/vite-plugin-svelte" dependency-version: 7.1.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-backward-compatible - dependency-name: "@tailwindcss/typography" dependency-version: 0.5.20 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-backward-compatible - dependency-name: svelte dependency-version: 5.56.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-backward-compatible - dependency-name: svelte-check dependency-version: 4.7.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-backward-compatible - dependency-name: vite dependency-version: 8.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-backward-compatible ... Signed-off-by: dependabot[bot] <[email protected]> * update deps * fix maplibre preserveDrawingBuffer --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> Co-authored-by: Christian Beutel <> * feat: Add PWA Favicon Support (#1008) * feat: add pwa favicon support * Delete package-lock.json --------- Co-authored-by: Flomp <[email protected]> * docs: overhaul homepage and add servers page (#1084) * overhaul frontpage * add servers * fix cursor pointer and index.mdx --------- Co-authored-by: Christian Beutel <> * release/v0.19.3 (#1093) * fix(security): patch IDOR and stored XSS vulnerabilities - Add CanAccessRecord() check to ActivitypubTrail and ActivitypubComment to prevent unauthenticated access to private records (GHSA-9qg7-jr2x-prvh) - Apply icon allowlist in createMarkerFromWaypoint before insertAdjacentHTML to prevent stored XSS via waypoint.icon (GHSA-hx3v-rv4v-w875) - Replace innerHTML template literal in elevation profile with safe DOM construction to prevent XSS via waypoint.name and icon (GHSA-m7v2-6gj3-3g2p) * update .gitignore * update changelog * add security.md * update version --------- Co-authored-by: Christian Beutel <> * add plugin system to contributing guidelines (#1095) * change trail edit in draw mode (#1081) * change trail edit in draw mode * further fixes * fix dev release build (#1101) * fix: close SSRF in /api/v1/trail/download (GHSA-7vqq-mjjr-h9j5) (#1104) * fix: close SSRF in /api/v1/trail/download (GHSA-7vqq-mjjr-h9j5) The endpoint fetched a user-supplied URL with no validation, letting unauthenticated requests reach internal services (PocketBase, Meilisearch) and cloud metadata endpoints. Add auth gating, protocol/hostname allowlisting, and DNS-resolved IP validation against private/reserved ranges (IPv4 and IPv6, including tunneled addresses like 6to4/Teredo/NAT64). The connection is pinned to the validated IP and redirects are rejected outright, closing the DNS-rebinding and redirect-based bypasses of a naive resolve-then-fetch check. Co-Authored-By: Claude Sonnet 5 <[email protected]> * fix url import modal loading * allow max 5 redirects --------- Co-authored-by: Christian Beutel <> Co-authored-by: Claude Sonnet 5 <[email protected]> * fix: prevent duplicate feed entries on repeated trail/list activities (#1052) InsertIntoFeed inserted a new feed row on every call. Inbound Update activities for an already-known item (and, before the IsLocalIRI guard, the self-delivery loop) therefore filled the feed table with duplicates — on one affected instance 2.89M duplicate rows, which made the feed endpoint time out and slowed the start page noticeably. Skip the insert when the (actor, item) pair already has a feed entry and return the existing record instead. Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]> Co-authored-by: Flomp <[email protected]> * fix/enhance trail duplicates (#1080) * fix/enhance trail duplicates * fixes * fixes and duplicate modal added --------- Co-authored-by: Flomp <[email protected]> * Bump dompurify from 3.4.0 to 3.4.11 in /web (#1065) Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.0 to 3.4.11. - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](https://github.com/cure53/DOMPurify/compare/3.4.0...3.4.11) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.11 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * Bump golang.org/x/image from 0.39.0 to 0.41.0 in /db (#1102) Bumps [golang.org/x/image](https://github.com/golang/image) from 0.39.0 to 0.41.0. - [Commits](https://github.com/golang/image/compare/v0.39.0...v0.41.0) --- updated-dependencies: - dependency-name: golang.org/x/image dependency-version: 0.41.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * New Crowdin updates (#831) * New translations en.json (French) * New translations en.json (Spanish) * New translations en.json (Czech) * New translations en.json (German) * New translations en.json (Basque) * New translations en.json (Hungarian) * New translations en.json (Italian) * New translations en.json (Dutch) * New translations en.json (Polish) * New translations en.json (Portuguese) * New translations en.json (Russian) * New translations en.json (Chinese Simplified) * New translations en.json (Polish) * New translations en.json (French) * New translations en.json (Spanish) * New translations en.json (Czech) * New translations en.json (German) * New translations en.json (Basque) * New translations en.json (Hungarian) * New translations en.json (Italian) * New translations en.json (Dutch) * New translations en.json (Polish) * New translations en.json (Portuguese) * New translations en.json (Russian) * New translations en.json (Chinese Simplified) * New translations en.json (French) * New translations en.json (Spanish) * New translations en.json (Czech) * New translations en.json (German) * New translations en.json (Basque) * New translations en.json (Hungarian) * New translations en.json (Italian) * New translations en.json (Dutch) * New translations en.json (Polish) * New translations en.json (Portuguese) * New translations en.json (Russian) * New translations en.json (Chinese Simplified) * New translations en.json (French) * New translations en.json (Spanish) * New translations en.json (Czech) * New translations en.json (German) * New translations en.json (Basque) * New translations en.json (Hungarian) * New translations en.json (Italian) * New translations en.json (Dutch) * New translations en.json (Polish) * New translations en.json (Portuguese) * New translations en.json (Russian) * New translations en.json (Chinese Simplified) * New translations en.json (Czech) * New translations en.json (Czech) * New translations en.json (Czech) * New translations en.json (French) * New translations en.json (Spanish) * New translations en.json (Czech) * New translations en.json (German) * New translations en.json (Basque) * New translations en.json (Hungarian) * New translations en.json (Italian) * New translations en.json (Dutch) * New translations en.json (Polish) * New translations en.json (Portuguese) * New translations en.json (Russian) * New translations en.json (Chinese Simplified) * New translations en.json (French) * New translations en.json (Spanish) * New translations en.json (Czech) * New translations en.json (German) * New translations en.json (Basque) * New translations en.json (Hungarian) * New translations en.json (Italian) * New translations en.json (Dutch) * New translations en.json (Polish) * New translations en.json (Portuguese) * New translations en.json (Russian) * New translations en.json (Chinese Simplified) * New translations en.json (Dutch) * New translations en.json (Dutch) * New translations en.json (French) * New translations en.json (Spanish) * New translations en.json (Czech) * New translations en.json (German) * New translations en.json (Basque) * New translations en.json (Hungarian) * New translations en.json (Italian) * New translations en.json (Dutch) * New translations en.json (Polish) * New translations en.json (Portuguese) * New translations en.json (Russian) * New translations en.json (Chinese Simplified) * New translations en.json (Chinese Simplified) * New translations en.json (Chinese Simplified) * New translations en.json (Czech) * New translations en.json (Czech) * New translations en.json (Czech) * New translations en.json (Czech) * New translations en.json (Dutch) * New translations en.json (Dutch) * New translations en.json (French) * New translations en.json (Spanish) * New translations en.json (Czech) * New translations en.json (German) * New translations en.json (Basque) * New translations en.json (Hungarian) * New translations en.json (Italian) * New translations en.json (Dutch) * New translations en.json (Polish) * New translations en.json (Portuguese) * New translations en.json (Russian) * New translations en.json (Chinese Simplified) * New translations en.json (French) * New translations en.json (Spanish) * New translations en.json (Czech) * New translations en.json (German) * New translations en.json (Basque) * New translations en.json (Hungarian) * New translations en.json (Italian) * New translations en.json (Dutch) * New translations en.json (Polish) * New translations en.json (Portuguese) * New translations en.json (Russian) * New translations en.json (Chinese Simplified) * New translations en.json (Czech) * New translations en.json (Norwegian) * New translations en.json (Russian) * New translations en.json (Dutch) * New translations en.json (Norwegian) * New translations en.json (Norwegian) * New translations en.json (Dutch) * New translations en.json (French) * New translations en.json (Spanish) * New translations en.json (Czech) * New translations en.json (German) * New translations en.json (Basque) * New translations en.json (Hungarian) * New translations en.json (Italian) * New translations en.json (Norwegian) * New translations en.json (Polish) * New translations en.json (Portuguese) * New translations en.json (Russian) * New translations en.json (Chinese Simplified) * New translations en.json (Czech) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (French) [ci skip] * New translations en.json (Spanish) [ci skip] * New translations en.json (Czech) [ci skip] * New translations en.json (German) [ci skip] * New translations en.json (Basque) [ci skip] * New translations en.json (Hungarian) [ci skip] * New translations en.json (Italian) [ci skip] * New translations en.json (Norwegian) [ci skip] * New translations en.json (Polish) [ci skip] * New translations en.json (Portuguese) [ci skip] * New translations en.json (Russian) [ci skip] * New translations en.json (Chinese Simplified) [ci skip] * New translations en.json (French) [ci skip] * New translations en.json (Spanish) [ci skip] * New translations en.json (Czech) [ci skip] * New translations en.json (German) [ci skip] * New translations en.json (Basque) [ci skip] * New translations en.json (Hungarian) [ci skip] * New translations en.json (Italian) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (Norwegian) [ci skip] * New translations en.json (Polish) [ci skip] * New translations en.json (Portuguese) [ci skip] * New translations en.json (Russian) [ci skip] * New translations en.json (Chinese Simplified) [ci skip] * New translations en.json (French) [ci skip] * New translations en.json (Spanish) [ci skip] * New translations en.json (Czech) [ci skip] * New translations en.json (German) [ci skip] * New translations en.json (Basque) [ci skip] * New translations en.json (Hungarian) [ci skip] * New translations en.json (Italian) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (Norwegian) [ci skip] * New translations en.json (Polish) [ci skip] * New translations en.json (Portuguese) [ci skip] * New translations en.json (Russian) [ci skip] * New translations en.json (Chinese Simplified) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (Spanish) [ci skip] --------- Co-authored-by: Christian Beutel <> * Prepare changelog for release v0.20.0 (#1096) * prepare changelog for release v0.20.0 * update changelogs * update trailer --------- Co-authored-by: Flomp <[email protected]> Co-authored-by: Christian Beutel <> * Release v0.20.0 (#1106) * chore: release v0.20.0 * update changelog --------- Co-authored-by: Flomp <[email protected]> Co-authored-by: Christian Beutel <> * Set up dev/main branch model and release pipeline sync (#1113) * initial commit * update workflow permissions * fix script injection * further script injection fix --------- Co-authored-by: Christian Beutel <> Co-authored-by: slothful-vassal <[email protected]> * Update Italian translations in it.json (#1135) Co-authored-by: Flomp <[email protected]> * Rebase and clean up (#1099) * Fix duplicated shared-list rendering (#1134) * fix: prevent duplicated shared-list rendering * refactor: consolidate rich text previews into formatHTMLAsText The shared list fix duplicated logic that formatHTMLAsText already owned, and only covered one of the four places that truncate rich text. Fixes #1128. * fix test * fix(test): select-all across platforms and scope the rich text assertions Control+a does not select on macOS, and getByText resolved to the inline element itself rather than its container. --------- Co-authored-by: snowyukitty <[email protected]> Co-authored-by: Flomp <[email protected]> Co-authored-by: Christian Beutel <> * optimize mime type and error handling, fix limit hanlding (#1115) * Bump nanoid from 3.3.15 to 3.3.18 in /web (#1161) Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.15 to 3.3.18. - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](https://github.com/ai/nanoid/compare/3.3.15...3.3.18) --- updated-dependencies: - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump nanoid from 3.3.15 to 3.3.18 in /docs (#1160) Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.15 to 3.3.18. - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](https://github.com/ai/nanoid/compare/3.3.15...3.3.18) --- updated-dependencies: - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * New Crowdin updates (#1155) * New translations en.json (French) [ci skip] * New translations en.json (Spanish) [ci skip] * New translations en.json (Czech) [ci skip] * New translations en.json (German) [ci skip] * New translations en.json (Basque) [ci skip] * New translations en.json (Hungarian) [ci skip] * New translations en.json (Italian) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (Norwegian) [ci skip] * New translations en.json (Polish) [ci skip] * New translations en.json (Portuguese) [ci skip] * New translations en.json (Russian) [ci skip] * New translations en.json (Chinese Simplified) [ci skip] * New translations en.json (Italian) [ci skip] * fix: 500 on list pages owned by a private profile (#1156) Opening /lists/@handle/{id} for a user whose account privacy is set to "private" returned a 500 ("Failed to resolve trail.") for every visitor but the owner, including for lists that are public. findLocalListByRemoteInfo treated federation.ErrProfilePrivate as a resolution failure. GetActorByHandle returns that error alongside a perfectly valid actor record - it means "this profile is private", not "this actor could not be resolved". The list's own ViewRule is what decides visibility, and it already does. findLocalTrailByRemoteInfo has tolerated this since #986 ("Fix trails being unavailable when profile is private"), which is why trail URLs kept working while the equivalent list URLs 500'd. Mirror that handling here, and map a genuinely unresolvable private profile to a 404 rather than a 500. Also corrects the copy-pasted "Failed to resolve trail" message in the list handler. Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> Co-authored-by: slothful-vassal <[email protected]> * fix(web): preserve share token in fullscreen map (#1172) * Re-add Further Heights to the server list (#1171) Re-adding furtherheights.com (originally shared in discussion #361, image already in server/imgs/). The instance is on wanderer 0.20.0. Co-authored-by: slothful-vassal <[email protected]> * plugin info modal added (#1166) * plugin info modal added * add homepage link, small fixes * fix issues (see comment) --------- Co-authored-by: Christian Beutel <> * fix: actor endpoint fails on bios with subdivision flag emoji (#1186) The users_anonymous view selected bio unqualified. SQLite resolves that to settings.bio, but PocketBase's view field inference only looks at the main table (users), finds no bio field and falls back to a json field. Reading plain text through a json field runs it through strconv.Quote, which escapes non-printable runes above U+FFFF as \U0001abcd. That is not valid JSON, so marshalling the record fails after the 200 header has been written and the client receives an empty body. The JS SDK turns the unparseable body into an empty record, and the ActivityPub actor endpoint then fails with "Invalid time value" on the missing created field. Qualifying bio as settings.bio lets it resolve to the underlying text field. PocketBase regenerates a view's fields from its query on save. Fixes #1164 Co-authored-by: Christian Beutel <> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> Co-authored-by: slothful-vassal <[email protected]> * Bump supercluster from 8.0.1 to 9.0.0 in /web (#1183) Bumps [supercluster](https://github.com/mapbox/supercluster) from 8.0.1 to 9.0.0. - [Release notes](https://github.com/mapbox/supercluster/releases) - [Commits](https://github.com/mapbox/supercluster/compare/v8.0.1...v9.0.0) --- updated-dependencies: - dependency-name: supercluster dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump fast-uri from 3.1.3 to 3.1.7 in /docs (#1187) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.3 to 3.1.7. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](https://github.com/fastify/fast-uri/compare/v3.1.3...v3.1.7) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump fast-uri from 3.1.3 to 3.1.7 in /web (#1188) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.3 to 3.1.7. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](https://github.com/fastify/fast-uri/compare/v3.1.3...v3.1.7) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump browserslist from 4.28.4 to 4.28.8 in /web (#1189) Bumps [browserslist](https://github.com/browserslist/browserslist) from 4.28.4 to 4.28.8. - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](https://github.com/browserslist/browserslist/compare/4.28.4...4.28.8) --- updated-dependencies: - dependency-name: browserslist dependency-version: 4.28.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump @tiptap from 3.27.1 to 3.30.4 in /web (#1191) * chore(deps): bump @xmldom/xmldom from 0.9.10 to 0.9.12 in /web (#1190) Bumps [@xmldom/xmldom](https://github.com/xmldom/xmldom) from 0.9.10 to 0.9.12. - [Release notes](https://github.com/xmldom/xmldom/releases) - [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md) - [Commits](https://github.com/xmldom/xmldom/compare/0.9.10...0.9.12) --- updated-dependencies: - dependency-name: "@xmldom/xmldom" dependency-version: 0.9.12 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * New Crowdin updates (#1178) * New translations en.json (Spanish) [ci skip] * New translations en.json (Spanish) [ci skip] * New translations en.json (French) [ci skip] * New translations en.json (Czech) [ci skip] * New translations en.json (German) [ci skip] * New translations en.json (Basque) [ci skip] * New translations en.json (Hungarian) [ci skip] * New translations en.json (Italian) [ci skip] * New translations en.json (Dutch) [ci skip] * New translations en.json (Norwegian) [ci skip] * New translations en.json (Polish) [ci skip] * New translations en.json (Portuguese) [ci skip] * New translations en.json (Russian) [ci skip] * New translations en.json (Chinese Simplified) [ci skip] * New translations en.json (Czech) [ci skip] --------- Co-authored-by: slothful-vassal <[email protected]> * upgrade go to 1.26 (#1195) * Security fixes: ActivityPub delete authorization, inbox proxy trust, collection create rules, IPv6 SSRF bypass (#1205) * fix GHSA-xcwc-jhv2-w4h6 * fix GHSA-mr29-2qg5-m4fw * fix GHSA-vj82-xj83-jp85 * fix GHSA-332v-mq7g-5hqf * fix GHSA-8j93-xvwx-jjg3 * allow dots and hyphens in the inbox path username segment The pattern only admitted [a-z0-9_]+, but local usernames may also contain dots and hyphens (users collection: ^[\w][\w.\-]*$, 3-150 chars), so valid inboxes were rejected. Mirror that alphabet and its length bounds; a leading dot or hyphen stays disallowed, keeping . and .. unmatchable. * fixes ruleset --------- Co-authored-by: Christian Beutel <> * improve statistics page (#1162) * improve statistics page * improve layout * several fixes, improvements and re-designs * fix issues (see comment) * several fixes and optimizations * filter test added * fix test --------- Co-authored-by: Christian Beutel <> * Bump @sveltejs/kit from 2.68.0 to 2.70.2 in /web (#1157) Bumps [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit) from 2.68.0 to 2.70.2. - [Release notes](https://github.com/sveltejs/kit/releases) - [Changelog](https://github.com/sveltejs/kit/blob/version-3/packages/kit/CHANGELOG.md) - [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/[email protected]/packages/kit) --- updated-dependencies: - dependency-name: "@sveltejs/kit" dependency-version: 2.70.2 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump svgo from 4.0.1 to 4.1.0 in /docs (#1210) Bumps [svgo](https://github.com/svg/svgo) from 4.0.1 to 4.1.0. - [Release notes](https://github.com/svg/svgo/releases) - [Commits](https://github.com/svg/svgo/compare/v4.0.1...v4.1.0) --- updated-dependencies: - dependency-name: svgo dependency-version: 4.1.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump @vitest/mocker and vitest in /web (#1214) Bumps [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) to 4.1.11 and updates ancestor dependency [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). These dependencies need to be updated together. Updates `@vitest/mocker` from 4.1.9 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/mocker) Updates `vitest` from 4.1.9 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: "@vitest/mocker" dependency-version: 4.1.11 dependency-type: indirect - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump astro from 7.0.4 to 7.3.2 in /docs (#1213) Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) from 7.0.4 to 7.3.2. - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/[email protected]/packages/astro) --- updated-dependencies: - dependency-name: astro dependency-version: 7.3.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump smol-toml from 1.7.0 to 1.8.0 in /docs (#1215) Bumps [smol-toml](https://github.com/squirrelchat/smol-toml) from 1.7.0 to 1.8.0. - [Release notes](https://github.com/squirrelchat/smol-toml/releases) - [Commits](https://github.com/squirrelchat/smol-toml/compare/v1.7.0...v1.8.0) --- updated-dependencies: - dependency-name: smol-toml dependency-version: 1.8.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.2 in /web (#1217) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 4.3.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.3.0...4.3.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump js-yaml from 4.3.0 to 4.3.2 in /docs (#1218) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 4.3.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.3.0...4.3.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flomp <[email protected]> * chore(deps): bump the docker-backward-compatible group across 1 directory with 10 updates (#1220) Bumps the docker-backward-compatible group with 9 updates in the /docs directory: | Package | From | To | | --- | --- | --- | | [@astrojs/check](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/astro-check) | `0.9.9` | `0.9.10` | | [@astrojs/node](https://github.com/withastro/astro/tree/HEAD/packages/integrations/node) | `11.0.0` | `11.1.5` | | [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.41.1` | `0.42.0` | | [@astrojs/svelte](https://github.com/withastro/astro/tree/HEAD/packages/integrations/svelte) | `9.0.0` | `9.0.1` | | [@fontsource/ibm-plex-mono](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/ibm-plex-mono) | `5.2.7` | `5.3.0` | | [@fontsource/ibm-plex-sans](https://github.com/fontsource/font-fil…

fix: prevent duplicated shared-list rendering

751cd50

Flomp changed the base branch from main to dev August 7, 2026 17:11

Flomp and others added 2 commits August 7, 2026 19:18

Merge branch 'dev' into fix/shared-list-rich-text-rendering

a3fabfb

refactor: consolidate rich text previews into formatHTMLAsText

6e0811c

The shared list fix duplicated logic that formatHTMLAsText already owned, and only covered one of the four places that truncate rich text. Fixes #1128.

Flomp previously approved these changes Aug 7, 2026

View reviewed changes

fix test

a423eb5

Flomp dismissed their stale review via a423eb5 August 7, 2026 18:17

Flomp and others added 2 commits August 7, 2026 20:17

Merge branch 'dev' into fix/shared-list-rich-text-rendering

f341e8f

fix(test): select-all across platforms and scope the rich text assert…

7d20d2e

…ions Control+a does not select on macOS, and getByText resolved to the inline element itself rather than its container.

Flomp approved these changes Aug 7, 2026

View reviewed changes

Flomp merged commit e61767f into open-wanderer:dev Aug 7, 2026
1 check passed

Navigation Menu

Repository navigation

Fix duplicated shared-list rendering - #1134

Fix duplicated shared-list rendering#1134
Flomp merged 6 commits into
open-wanderer:devfrom
snowyukitty:fix/shared-list-rich-text-rendering

snowyukitty commented Jul 29, 2026

Uh oh!

Flomp commented Aug 7, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

snowyukitty commented Jul 29, 2026

What changed

Why

How it was tested

Known limitations

Uh oh!

Flomp commented Aug 7, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants