liketrek/TREK v4.1.0

on GitHub

⚠️ UPDATE: PLEASE DO NOT UPDATE OR INSTALL VERSION 4.1.0. DUE TO A BUG WHEN SWITCHING THE BASEMAP FROM CARTO TO POSITRON, TREK IS TEMPORARILY UNUSABLE, AS NEITHER THE TRIP NOR THE MAP SETTINGS CAN BE OPENED. A 4.1.1 FIX IS IN THE WORKS.

Mostly a bug-fix release: twenty-four reported issues off the 4.0.0 tag. It is a minor rather than a patch because the MCP surface grew by 51 tools, plugins can now publish tools of their own, and there is a new versioned public API. No breaking changes, and nothing you use today behaves differently.

Read this first if you self-host

CARTO started stamping "API KEY REQUIRED" across keyless basemap tiles on 26.08.2026, which hit every instance using the default map at once (#2054, #2077). Two answers ship here:

• The Leaflet default basemap is now OpenFreeMap Positron: no key, no account, no request limit. Existing instances pick it up without doing anything.
• If you prefer CARTO, users and admins can enter an API key under map settings (#2060). See Map Settings for the tile sources and where each key goes.

Fixes

Dashboard

• Upcoming reservations dropped most bookings. Times are stored in two shapes and both were compared as text, so everything before 20:00 silently vanished (#1934). Stays are back in the list as check-in and check-out, and an unconfirmed booking now says so.
• The dashboard showed its finished empty state while still loading, with a stats row reading zero across every tile (#2115).

Planner and maps

• A flight with a layover drew a driving route across the ocean, and a stop between two legs routed from the arrival airport back to the departure one (#2071).
• The day route drew a straight line from the airport you flew out of to the hotel you were checking into, plus long rays from local stops to far-away airports (#2133).
• "Planned" only counted a place dragged onto a day, so hotels and venues linked through a booking sat under Unplanned while the day header printed their names (#2072).
• Place pins swam back and forth while dragging the MapLibre map and only settled when it stopped.

Exports and calendar

• The PDF printed 24h regardless of your setting, and the journey editors used a native time input that follows the browser locale instead (#2066, #2067).
• A booking that is a window, such as parking or a rental, filled every day of its range in the calendar feed. Both hand-overs now stand on their own (#2068). Rental cars were missing from the feed entirely.

Import

• Nearly every transport document was classified as lodging, because "check-in" appears on almost every ticket there is (#2076, #2078).
• A printed 12-hour clock lost its half of the day on the server path, so a three-hour hop was rendered as an overnight (#2094).
• An unreadable document type was written down as hotel, which opened the booking form with no transport type to pick.

Transit and bookings

• The stop you actually get off at had no row in the card, taking the train's arrival time with it (#2106).
• A booking could not start and end on the same day unless it carried times, which also left existing rows uneditable (#2107).

Atlas

• Saving a CARTO key crashed parts of the app, because the tile URL sat in the dependency list of the effect that builds the map (#2097).
• The country total counted address abbreviations: New York, NY produced NY, and 26 US state codes are real country codes, so CA resolved to Canada (#2111).

Accounts

• Repointing the instance at a different identity provider left the old avatar and issuer on every account (#2110).
• With password login off, the login page could bounce to the provider in a loop, and signing out landed you straight back in (#2123, #2126).
• Guest accounts stayed selectable in the Vacay invite and shared-calendar pickers (#2112).

Studio

• Running the automatic order over a whole book left it unsavable for the rest of the session, and autosave then re-queued the rejected document on every later change (#2085).

Other

• The trip-chat link preview fetcher could be pointed at loopback through an IPv6 form the guard did not know (#2058).
• Day details on a phone can be swiped to step through days, instead of only through the chip rail at the top (#2059).
• Storage migrations could start twice on a loaded runner, which is what had been failing CI on every push.
• The Vacay bottom navbar drew over the release notice dialog (#2052).
• SonarQube findings on the 4.0.0 branch cleared.

MCP

The reason this is a minor. 201 tools to 252, with 28 of them opening domains MCP could not reach at all: feeds, files, memories, trip invites, help, settings, addons, AirTrail, reservation import and trip warnings. The rest extend trips, vacay, categories, collections, journey and reservations.

Transport tools took four types where the planner offers ten, so a bus, ferry or taxi could be planned in the UI but not through an assistant. Create was also systematically richer than update across the surface, and nullability was dropped almost everywhere, which made "remove the check-in time" unreachable (#2099).

Wiki: MCP Tools and Resources for the full tool list, MCP Scopes for the scope groups, MCP Setup to connect a client.

Plugins

• A plugin can declare capabilities.mcpTools and its handlers appear on the MCP server as plugin_<id>_<name> (#2127). Two gates, neither implicit: the admin grants mcp:tools, and the session token carries the new opt-in plugins:use scope. No token issued before this release carries it.
• A plugin can attach a photo to a journal entry, on the permission that already covers journal writes (#1365).
• The SDK accepts a signing key change, so a publishing key can be rotated (#2087).

Wiki: Plugin Development for capabilities.mcpTools, Plugin Permissions for mcp:tools, Plugin Publishing for signing and rotation.

Public API v1

A versioned, read-only surface for integrations, separate from the internal endpoints that answer a session cookie (#214, #1367):

GET /api/v1/trips           trips the caller can reach
GET /api/v1/trips/:id       one trip, with ?include=
GET /api/v1/bucket-list     places with no trip attached
GET /api/v1/stats           aggregate counts

Keys are minted under Settings → Integrations and stored as a hash. An API key reads trips over HTTP, an MCP token drives the assistant tools, and neither opens the other's surface.

Wiki: Public API, new with this release, documents every endpoint, the include values and the rate limits.

Schema

Two migrations, both appended and additive with a default, so nothing visible changes:

• reservations.ingest_state defaults to live, the gate an automated ingest will write through. Nothing writes it yet.
• mcp_tokens.kind defaults to mcp, splitting an integration key from an MCP token. Existing keys keep working unchanged.

Full changelog: v4.0.0...v4.1.0