8,000 stars — thank you 🌟
TREK just passed 8,000 GitHub stars. For a self-hosted travel planner that started as a side project, that's genuinely humbling — and it's all of you: the bug reports, the translations, the pull requests, and everyone quietly running TREK on a NAS or a Pi in a closet somewhere.
A patch release is normally fixes only. As a small thank-you, 3.1.3 ships a few new features too — alongside the usual pile of fixes. Keep the issues and PRs coming. 💛
✨ New features
- Distance unit — metric or imperial. A per-user setting so distances render in kilometres or miles, mirroring the temperature unit. Default stays metric. (#1300 — thanks @mvanhorn)
- MapLibre + OpenFreeMap map provider. A third, fully self-hostable and API-key-free map provider alongside Leaflet/OSM and Mapbox. The GL engine is code-split, so Leaflet-only setups never download it. (#1317 — thanks @hykilpikonna)
- Places sidebar follows the map. Click a marker and the places list scrolls straight to it. (#1315 — thanks @hykilpikonna)
- Precise Google Maps links. The "Google Maps" button now resolves to the actual place via its feature ID instead of dropping a raw-coordinate pin. (#554 — thanks @hykilpikonna)
🔒 Security
This release also closes one privately-reported vulnerability. Updating is recommended.
| Advisory | Severity | Issue |
|---|---|---|
| GHSA-r4cp-666p-8f69 | Medium (CVSS 4.3) | Cross-trip reservation title disclosure — a member of one trip could reference another private trip's reservation id (on file upload, update or link) and read its title back through the file's reservation join. Cross-trip references are now rejected on every file write path. (CWE-639) |
Changelog
- feat: distance unit (metric/imperial) display setting (#1300)
- feat(maps): MapLibre + OpenFreeMap as a self-hostable map provider (#1317)
- feat(planner): seek the places sidebar to the selected map marker (#1315)
- feat(maps): precise Google Maps place links via feature IDs (#554)
- fix(map): drop the phantom hotel leg to/from a transport endpoint on arrival days (#1321)
- fix(map): draw the hotel-to-hotel leg on a transfer day with no activities (#1297)
- fix(map): pin the GL basemap label language to the UI language (#1299)
- fix(planner): show the route tools for a single place when optimizing from accommodation (#1330)
- fix(maps): make Overpass endpoints configurable and harden the POI search (#1309)
- fix(atlas): assign border places by polygon, not just bounding box (#1331)
- fix(reservations): keep dated bookings on their date when the trip range shifts (#1288)
- fix(costs): freeze the FX rate so settled expenses don't reopen when rates drift (#1335)
- fix(airtrail): import the airline name, not the ICAO code (#1334)
- fix(dashboard): persist the currency & timezone widgets so an upgrade keeps them (#1311)
- fix(places): guide single-place links to the right importer (#1304)
- fix(share): translate the day label on the public share page (#1296)
- fix(pwa): use the self-contained app icon for the favicon so it shows on dark tabs (#1328)
- fix(files): reject cross-trip reservation/place/assignment links — GHSA-r4cp-666p-8f69
- i18n: new Swedish translation + refreshed Dutch translations
- chore: replace the 3.0 upgrade notices with a thank-you / support modal
- docs(wiki): document all environment variables and fix the kitinerary install steps
What's Changed
Released by @mauriceboe in #1324, with community contributions from @hykilpikonna, @mvanhorn, @olsson82, @eindpunt, @Hardik-369, @jubnl and @CooperSheroy. Thank you all. 🙌
Full Changelog: v3.1.2...v3.1.3