All pull requests

Pull requests

• bugfix(#1281) Keep renamed places and their visits together

  #1300·claudiusbirdwhistle opened Oct 2, 2026·

  ·

• bugfix(#714) Speed up processing of large imports

  #1299·claudiusbirdwhistle opened Oct 2, 2026·

  ·

• bugfix(#670) Keep visits and trips when processing a batch fails

  #1298·claudiusbirdwhistle opened Oct 2, 2026·

  ·

• security: throttle password guessing; trust X-Forwarded-* only from internal proxies

  #1297·claudiusbirdwhistle opened Oct 2, 2026·

  ·

• security: escape user-controlled names in map popups

  #1296·claudiusbirdwhistle opened Oct 2, 2026·

  ·

• security: validate OIDC avatar URLs and only store real images

  #1295·claudiusbirdwhistle opened Oct 2, 2026·

  ·

• security: geocoding services are admin-only, API keys are never rendered

  #1294·claudiusbirdwhistle opened Oct 2, 2026·

  ·

• security: federation avatars/subscriptions, OwnTracks Recorder and MQTT targets

  #1293·claudiusbirdwhistle opened Oct 2, 2026·

  ·

• security: harden the Immich photo proxy

  #1292·claudiusbirdwhistle opened Oct 2, 2026·

  ·

• security: outbound URL validation (SSRF) and locked-down map styles

  #1291·claudiusbirdwhistle opened Oct 2, 2026·

  ·

• security: memory ownership, magic-link scope, storage confinement and image-only uploads

  #1290·claudiusbirdwhistle opened Oct 2, 2026·

  ·

• security: owner checks for API tokens, magic-link deletion, sharing colours and the job queue

  #1289·claudiusbirdwhistle opened Oct 2, 2026·

  ·

• security: scope trip/visit metadata and transport modes to the owner; reject open redirects

  #1288·claudiusbirdwhistle opened Oct 2, 2026·

  ·

• security: access checks for the location, visit, trip and H3 cell APIs

  #1287·claudiusbirdwhistle opened Oct 2, 2026·

  ·
  2

• security: setup flow only for local admins without a password

  #1286·claudiusbirdwhistle opened Oct 2, 2026·

  ·

• security: prevent role self-escalation via user settings

  #1285·claudiusbirdwhistle opened Oct 2, 2026·

  ·

• security: per-install remember-me key, SameSite cookies, API tokens limited to /api, no OIDC re-linking

  #1284·claudiusbirdwhistle opened Oct 2, 2026·

  ·
  6

• security: deny-by-default routes for magic links; bind memory links to their memory

  #1283·claudiusbirdwhistle opened Oct 2, 2026·

  ·

• Translations update from Hosted Weblate

  #1266·weblate opened Sep 24, 2026Collaborator·

  ·