Update mauriceboe/trek Docker tag to v4.2.1 #788

2026-09-04T03:05:08Z

renovate commented

2026-09-04 03:05:08 +00:00

This PR contains the following updates:

Package	Update	Change
mauriceboe/trek	minor	`4.1.1` → `4.2.1`

Release Notes

mauriceboe/TREK (mauriceboe/trek)

`v4.2.1`

Compare Source

Fifteen reported issues off the 4.2.0 tag, two privately reported security advisories, and one operator request. No breaking changes and no schema change. This release appends no migrations at all, so a rollback to 4.2.0 stays possible on the data side. Two changes need a word before you update.

Read this first

Installed PWAs reload themselves once, and offline map tiles have to be downloaded again. The offline fix in this release replaces the old "wipe everything on a version change" behaviour with a proper worker update, but the code that runs on your device right now is still the old one, so it does its clean-up one last time on the first start after this update. Open TREK with a connection and leave it open until it has reloaded itself (about 23 MB). Afterwards, go to Settings → Offline and press Download for offline use once. Your trips, files and anything waiting to sync are stored separately and are not affected. Do not uninstall and reinstall the app to speed this up: that would also delete the trips you have stored offline. From the next update onwards this no longer happens.
Balances change on trips that have an expense nobody paid for. Such an expense used to be charged to the people it was split between even though no one was owed anything, which pulled the balances away from zero. It no longer counts. On a trip where you already settled up against one of those phantom debts, the balances will now read the other way round and the settle-up box may suggest new transfers between people who never shared a bill. Nothing is corrected automatically. Undo those entries in the settle-up history, then settle again from the corrected figures. Trips without a payer-less expense are unaffected.

Security

Both reported privately by @skeletonsec, both fixed in #2263.

The ntfy token an operator configures no longer reaches a server the user chose (GHSA-7pqc-fj3c-9346). The token fell back to the operator's whenever a request carried none, so any signed-in user could point ntfy at a listener they control, leave the token field empty, and be handed the operator's push token. That applied to the connection test and to every ordinary notification, since the ntfy server is a per-user setting. The operator's token now travels only to the operator's own server, which keeps every legitimate setup working, including the common one where the operator provides the server and users only set a topic.
Outgoing notification requests are re-checked at every redirect (GHSA-8mw6-xphx-886m). Webhook and ntfy deliveries validated only the address they were given and then followed redirects blindly, so a redirect pointing at a loopback, internal or cloud-metadata address was dialled by the server. Every hop is now checked and pinned individually. The same weakness sat in the shared helper behind photo, AirTrail and image requests, where a redirect could have returned an internal service's response to the caller rather than merely reaching it; that is fixed too. Credentials are also dropped when a redirect crosses to another host, the way browsers do.

Fixes

Sharing and journeys

Public journey share pages load again. A share with the map enabled and at least one geotagged photo went straight to the error screen from 1024px up: the sidebar map places its photo thumbnails in screen space, and it drew before the map had been given a centre and a zoom, which Leaflet answers by throwing. The photos now wait for the opening view and appear as soon as it lands (#2254, reported and fixed by @xvilo).
Anonymous visitors no longer trigger a failed authenticated request on every share page. System notices, background tasks and save-to-collection were only held back on the login and password routes, so a visitor to a shared trip or journey mounted all three and logged a 401 nobody could act on (@xvilo).
The language picker on a public journey page reaches all 23 languages. It used to be cut off at the bottom edge of the page hero, leaving most of the list unpickable; it now floats above the page and scrolls when the screen is short. On both share pages, trip and journey, it also closes on Escape or a click outside, which it never did, and Traditional Chinese stops labelling itself 简体中文 (#2248).

Planner and maps

The Plan tab fits a tablet, a foldable and a narrow window again. Anything between the phone breakpoint and 1024px, which is an iPad held upright as much as an unfolded foldable or a browser window at half a laptop's width, now opens one side panel at a time: the day plan first, the places list one tap away, instead of two panels squeezing the map into a 200px strip. The map opens framed on the trip rather than on half a continent, the floating map controls no longer sit on top of the panel tabs and the Add Place button and swallow their taps, and those tabs finally carry a name a screen reader can announce (#2247).
The phone map has a way back to the whole trip. Picking a day on the map narrows it to that day, and until now nothing took that filter off again: the chip rail can only swap one day for another, and a second tap on the active chip opens the day sheet. A small control now sits beside the rail, in map view only: it clears the day and frames the whole trip, and pressing it again returns to the day it came from, route and all (#2257).
The start and end date no longer sit on top of each other in the trip dialog. Both fields are in a two-column grid, and neither column could shrink below the width of its contents, so a long date plus the keyboard button beside it pushed each cell past its half. On a phone the end date came to rest over the start date with its own button clipped off the card edge. The date now shortens with an ellipsis inside its column instead (#2267).
A note in a day plan no longer covers its own up and down buttons with a pencil and a bin. Tapping the note opens it for editing, the same gesture the phone already used, and delete moved into that dialog. That also makes reordering a note clickable for the first time, on a mouse as well as on a touchscreen (#2249).
Arabic, Hebrew, Persian and Urdu place names on the vector basemaps render joined and in the right order. The map engines need an optional plugin for bidirectional text and Arabic contextual shaping, and neither loads it on its own, so labels came out as isolated letters in reverse. Raster basemaps hid this because their labels are drawn server-side, which is why it surfaced when the default basemap became a vector style (#2235).
Notes on the phone show and keep their website. The field can be entered, edited and cleared, a saved link opens from the note, and members without edit rights see it too, on phone and desktop (#2222).

Bookings and import

Saving a hotel booking stops leaving a duplicate place behind. The stay is linked to the place created for it, so opening the same hotel again and saving reuses that place instead of minting another unlinked copy every time (#2243).
Editing a booking no longer wipes the price shown on its card, whatever the booking type. The price survives an ordinary edit, an AirTrail sync and any API or MCP update, whether it came from a linked expense or was written onto the booking by the import, so it holds on an instance with the Costs addon switched off too. It is removed when the expense behind it is deleted rather than lingering with nothing behind it, and setting or clearing the price explicitly still works as sent (#2233).
AI booking import works with OpenAI reasoning models. Every request pinned a temperature of 0, which the gpt-5 family rejects outright, so the extraction failed before it began and burned a second doomed retry on the way. The parameter is now dropped only once a provider says it will not take it, so deterministic extraction stays the default everywhere else, local NuExtract included (#2262).
Booking import says why it found nothing. The bundled KDE Itinerary extractor's version now appears in the startup log and in a new admin-only GET /api/admin/system-info, and LOG_LEVEL=debug passes the extractor's own error lines through instead of filtering them away. A provider script missing from an older extractor used to look exactly like a provider TREK does not support (#2261).
How long one AI parsing call may take is now a single setting, LLM_TIMEOUT_MS, instead of three constants that disagreed and none of which was the ceiling that actually applied. The underlying HTTP client is held to the same value, so raising the ceiling now works at all: it used to cap out at five minutes of its own accord, which meant a larger number changed nothing and the call failed with a header timeout instead. The default is 15 minutes so heavier documents fit without a code change, and it can be lowered to fail fast on a cloud provider (#2230).

Costs

An expense with "No one paid yet" no longer creates debt owed to the payer of a different expense. It counts toward the trip total and appears in the Outstanding amount card, the balances add up to zero again, and settle-up stops offering payments between people who never shared a bill (#2225). See Read this first above for what this means on a trip you have already settled.
"Your share" no longer counts expenses nobody has paid for. The balances below it stopped counting them, so the two halves of the costs panel disagreed with each other.

Offline

Offline mode works again. A version bump no longer wipes the app shell and every downloaded map tile, so an installed PWA still starts without a connection; a session that launched offline can sync once the signal returns instead of staying dead for its whole life; and switching a finished trip on in the offline settings actually stores it rather than leaving the cache at zero (#2228).
An offline map download no longer risks the cache it is filling. Where the browser refuses persistent storage, which is Safari and anyone who declined the prompt, a trip's tiles now stop at zoom 12 instead of 16. Street level detail is missing offline, but the origin stops claiming tens of gigabytes of padded quota for a single trip, which is what made the browser evict the whole bucket, precached app shell included, and leave the installed app unable to start at all (#2228).
The offline settings screen tells the truth: a download that never started, could not finish, or had nothing to store says so, instead of painting a full progress bar and a green "Ready for offline use" over a run of nothing, and a finished one says how many trips it stored. The list stops claiming that finished trips are already on the device, where every one of them showed its switch on and read "Stored offline" while the download passed over it. A storage error is reported rather than shown as "no trips cached", and Clear cache is no longer greyed out over a store that a half-finished download left behind (#2228).

Lists

Creating a list with a cover image uploaded from your own device keeps the image, and the new list opens once it is created. The id of the new list was read out of a field the response does not carry, so it never arrived: the upload was skipped without a word, and nothing was opened or selected afterwards. A cover picked from the photo search was never affected.

Integrations and admin

MCP OAuth: clients registering a private-use redirect scheme such as workbuddy:// can connect. http://[::1] is accepted alongside the other loopback addresses, and a native client that registered a placeholder port may authorize on the port the OS handed it, per RFC 8252. The settings form and dynamic client registration now apply the same rules, which also closes a hole where a scheme like javascript: was accepted as long as its host read localhost. Clients you have already registered are not re-validated, so nothing that works today stops working (#2227).
Plugins whose declared trek range does not admit the running version, whether it asks for an older one, a newer one, or a range no version can satisfy, and plugins that never said which TREK versions they support, can be installed, updated and activated when the operator sets TREK_PLUGINS_IGNORE_TREK_RANGE. Every gate warns instead of refusing, the admin is told at each step, and neither the plugin-API version gate nor the Discover compatibility verdict is loosened. While it is on, an entry Discover flags as incompatible no longer offers the newest release this TREK can run: the button becomes Install anyway and takes the newest published version, after the warning (#2226). Unset, nothing about plugin installation changes.
While TREK_PLUGINS_IGNORE_TREK_RANGE is set, the plugins panel says so on its own: a Version checks off badge sits in the header, on the desktop admin and on the phone, for as long as the variable is set. A second admin who did not set it can see that the version gate is loosened without installing anything.
A plugin that only got in because the version check was off stays marked for as long as it runs. Its row carries a chip reading "Outside its TREK range, version checks off", or "Declares no TREK range, version checks off" for one that declared none, so the warning outlives the install dialog and is still there weeks later.

Schema

No migrations. The schema is byte for byte the one 4.2.0 shipped, so this update writes nothing to the database structure and a rollback stays possible on the data side.

Full changelog: https://github.com/liketrek/TREK/compare/v4.2.0...v4.2.1

`v4.2.0`

Compare Source

Thirty-two reported issues and discussions off the 4.1.1 tag, plus a layout bug found on a Galaxy S26 Ultra and the Studio work asked for in discussion #2064. No breaking changes; the one visible behaviour change is called out right below.

Read this first

Five of the changes deserve a heads-up:

Offline maps: tiles for the OpenStreetMap DE and Stadia presets were never actually stored, and the prefetch skipped the overview zoom levels a multi-city trip opens at (#2180). After updating, open the trip and press Download for offline use once more so the missing tiles get backfilled.
Android app icon: the launcher icon now keeps a proper safe zone instead of filling the whole tile. An installed PWA picks it up after removing and re-adding the app, or with Chrome's next WebAPK refresh.
Journey maps: the GPX tracks of linked trips no longer draw by default (#2194). If you want them back, flip on Show all trip GPX tracks in the Journey Settings (owners only).
Studio books: the book designer only ever rendered three of its seven typefaces, so a book set in Inter, Lora, EB Garamond, Playfair or Bebas was laid out against the wrong metrics (#2183). They render properly now, which means an existing book reflows: line breaks move and a tight text frame can overrun. Open a book you mean to print and look over its text frames once before you order it.
Passkeys on a localhost-only install: an instance that never set APP_URL and is browsed at http://localhost no longer advertises passkeys, because the relying-party scope cannot be derived and the enrolment would be refused anyway (#2147). If you use a passkey on such an install, set APP_URL to the address you actually open (for example http://localhost:3000) before upgrading, and the button stays where it was.

Studio

Three things from discussion #2064, all in the book designer.

The photo browser knows which day a picture is from. A filter above the grid narrows it to one journal entry, to the pictures no entry holds, or to what you just uploaded, and it combines with the search box: the filter answers "which day", the search answers "which words". Each entry in the Entries tab carries a button to its own pictures, and the page on the sheet offers its own entry in one press. On a journey with four hundred photographs and a page per day, this is the difference between browsing and hunting.

Pictures can come in without leaving Studio. The panel takes an upload or a drop from the desktop, and a drop onto the sheet itself places the picture where you let go, filling the frame under the pointer when there is one. Where a picture is stored follows the filter: into the entry it names, otherwise into the journey's gallery, and the line above the grid says which before you press. Videos are left out of a drop rather than failing it. A photo element also gets Fill page and Fill spread, which stretch it exactly to the bleed and send it behind everything else, which is the commonest layout in a photo book and the fiddliest to hit by hand.

A stop can be left off the route. The home airport written up as the first day is a leg nobody travelled, and it moved the printed distance, the furthest point and the countries. The travel panel now lists every stop in a folding section that says how many still count, with a switch on each; the same switch sits in the entry editor on desktop and phone, and an entry that is off the route says so on its card. The entry stays in the journal either way, and the figures are recomputed on the server, so the map, the distance and the country list agree with each other.

Fixes

Planner and maps

Re-entering a trip with the route toggle on released every automated transit route onto the map at once, and only toggling off and on cleared it. Routes now draw for the selected day only (#2019).
On days without check-in and check-out times, the route started at a hotel you had not checked into yet, or led back to one you had already left, including a 2400 km ray home after the return flight. A flight, train or ferry on the day now settles which side the hotel anchors (#2157).
Transit journeys from the transit search could only be fully edited on mobile. The journey dialog now hands over to the full booking form on desktop too: travelers, costs, files, booking code and status (#2148).
Day assignment notes written through the API or an assistant were stored but invisible. They now show in the place inspector, the day sidebar, both edit forms and the PDF export, and moving the place to another day keeps the note (#2163).
The day weather could silently belong to a different city: it anchored to the first located place anywhere in the trip. It now sticks to the selected day, names the place it is for, refreshes its cache hourly in the PWA, and serves the last few days from the live forecast instead of a lagging archive (#2167).
Two bookings linked to the same stop showed as one, the place card resolved its bookings with a first-match lookup. A stop now lists every booking linked to it, on the desktop plan tab, the place inspector and the phone's timeline and place sheet (#2201).
Editing a booking on a phone silently erased the stop it was linked to, because the sheet saved an empty link over the one made on the desktop. The link survives an edit now, and the picker the desktop dialog has always had is in the phone sheet too, so a booking can be pinned to a stop, moved or unpinned from either (#2216).
Editing a transit booking dropped the stations it came with. No form edits those, so an edit leaves them alone instead of saving an empty set over them.
The booking sheet on a phone showed no files at all for a booking that had them, and a place never showed the files of the bookings on it, on either platform. Both list them now, and a confirmation stored on a booking is reachable from the place card (#2217).
Opening a place in Google or Apple Maps from the installed app left an empty window behind that had to be dismissed before TREK was usable again. The handover happens from the page you are on now (#2218).

Costs

Recorded settlement payments never appeared in the mobile Costs tab. They now show up day-grouped, same as on desktop (#2151).
Editing an amount of 4,90 showed 4,9 in the field. Edit fields seed with two decimals everywhere, currency aware, and a three-decimal currency like KWD stays typable in the split and receipt fields (#2175).
Negative amounts work end to end for partial reimbursements: input (with a sign toggle, because the iOS number pad has no minus key), split math down to the cent, balances and the assistant tools (#2176).

Calendar and exports

Accommodation check-in and check-out appeared as 0-minute events in the calendar feed. They carry the same one-hour window as the parking and rental hand-overs; with both times set the all-day bar is dropped entirely, and the markers then carry the booking's confirmation number, notes and location themselves (#2136).
GPX export returned a 500 for any trip or place name with non-ASCII characters. Downloads keep the original name now, and the same fix covers the ICS export, the calendar feed and wallet passes (#2165).

Mobile and offline

The dashboard filter row could push the top bar and the bottom dock off the right edge on narrow phones with Android's forced zoom active, while the cards fit perfectly. The row scrolls inside its own box now and the page can no longer widen sideways.
The collections map on a phone was a fixed-height card with dead space below. It fills the viewport like the trip and journal maps (#2104).
When locating fails, typically an installed iOS app whose own location permission was denied, the only feedback was a hover tooltip. A clear message appears instead, with a hint at the device settings (#2095).
The app boots in the account's language when offline (#2146).
Tapping the hotel chip in a day's header opened the day overview, the same as the day pill next to it. It opens the stay now: the accommodation editor when you can edit days, otherwise the hotel's place, and closing it brings you back to the timeline (#2210).

Accounts

Passkey registration failed with a bare 400 on instances without APP_URL. An origin outside the relying-party scope is refused with an actionable message right at the options step, and derived setups heal scheme and port mismatches behind TLS proxies on registration and login. An instance without any usable configuration no longer advertises passkeys the options step would refuse (#2147).

Self-hosting

Stopping the container always ran into Docker's grace period and ended in SIGKILL, exit 137: any open browser tab holds a WebSocket, a WebSocket never closes by itself, and the shutdown waited for it with a fallback timed to lose the race. Sockets are released deliberately now: tabs get a clean "going away", the database closes on every exit path, and shutdown finishes well inside the grace period, so docker stop and restarts are clean and fast (#2193).
"Send test email" failed with a generic toast over an empty log. It now logs every outcome and names the actual cause, wrong credentials, DNS, a refused or filtered port, the 465-versus-587 TLS mix-up, a certificate problem, with the relay's own answer included and secrets kept out; the test send now bounds every phase so the verdict actually arrives, while a real notification keeps the patience it needs for a relay that scans the message. Found on the way: replacing a stored SMTP password typed the new one behind the masking bullets and saved both, the field now clears like its neighbours (#2196).
The image ships fast-uri 3.1.7, which closes six advisories rated high in the URL parser that the MCP SDK's schema validator pulls in. Nothing in TREK's own request handling was reachable through them, but the scanner flags the old version.

Studio

Only three of the seven text fonts rendered; Playfair, Inter, EB Garamond and Bebas fell back to Poppins, and serif drew Georgia instead of Lora: a stale three-font map, plus five font families that were declared but never actually shipped. All picker fonts load and reach the canvas and the print renderer now (#2183).

Journey

Editing an entry returned its tags as a raw JSON string instead of a list (#2155).
The gallery was in upload order, so photos added later landed behind days they belong before. It runs in trip chronology now: capture time when the photo carries one, otherwise the date of the stop it belongs to, on desktop, on phones and in shared journeys. The hand-arranged photo order inside an entry stays yours (#2200). A share link you have already circulated will show its photos in the new order from the first restart.
Journey maps drew the GPX tracks of every linked trip, with nothing to switch off, and one long track zoomed the map out until the entries were specks. The tracks are a journey setting now, owner-only and off by default, and the download is skipped entirely while they are off; when they are on, they no longer decide the framing as long as there are entries to frame (#2194).

MCP

The Trip Summary, Budget Overview and Packing List prompts failed in every MCP client, MCP Inspector included, with "Invalid arguments for prompt: expected number, received string". Prompt arguments always arrive as strings; the trip id is parsed from one now, invalid ids are refused up front, and the server's prompt registry no longer accepts a number schema at all (#2207).

Other

Task-list checkboxes would not toggle on desktop: the press animation shrank the row mid-click and the click landed next to the checkbox. The same trap is defused on the planner rows, the dashboard cards, the collections rows, the journey gallery tiles and the shared vacay calendar cards (#2158).
Long notes on Atlas bucket-list markers overflowed the viewport as one endless line. Tooltips wrap, scroll and stay on screen (#2153).
Creating a packing item over the API silently dropped weight, bag and quantity; the create routes accept them now on REST, MCP and the plugin RPC, and a bag reference from another trip is rejected instead of being stored (#2154).
A shared bag's weight was summed over only the items you are allowed to see, so your buddies' personal items silently dropped out: two people saw two different totals, and an overweight bag warned nobody. The total is computed on the server over every item now and updates live for everyone on all write paths, revealing nothing but the number itself; offline, the app falls back to summing what it can see (#2191).
The plugin update and consent dialogs scroll (#2159).
Shared note markdown is sanitized on every surface it renders on.

Small additions

The todo list can be sorted by due date: a toggle next to the priority sort, on desktop and on the phone, with the nearest deadline first and undated tasks last. Drag-to-reorder pauses while a sort is active, as it already did for the priority sort (#2205).
Poll questions support safe Markdown and multiline text, and long options wrap fully on desktop and mobile (#2177).
The admin addons page is a tile grid with sub-shelves: bag tracking, the collab features and the photo providers hang off their parent addon, and photo providers now require the Journey addon instead of dangling without it. If your instance has Immich or Synology connected while Journey is switched off, the providers go quiet until you enable Journey, and switching Journey off clears their enabled flags rather than remembering them.
Connected photo providers sit as buttons next to Upload in the journey gallery header.
Admins can edit instance-wide plugin settings in the admin UI (#2170).
A plugin can put its own buttons into the admin's instance-settings dialog, so an operator runs a plugin's action, a re-sync or a cache purge, from the admin panel rather than the user settings tab (#2209).
A plugin's declared setting defaults apply now: the admin form, the desktop settings tab and the phone settings screen all start from them, the plugin reads them at runtime, and a required field that is left empty is refused instead of saved blank (#2199).

Schema

Five appended migrations, all additive and all with a default that keeps existing data as it was. One is presentational only: the Naver list import counts as an integration instead of a trip addon, which moves its tile between admin groups and changes nothing about the import itself. One adds the flag behind the stops switch to journal entries, defaulting to counting, so every existing journey keeps the route and the figures it had. One adds the journey setting for the linked trips' GPX tracks, off by default. The last two belong to the plugin system: a settings field can carry a default value, and a settings action can carry a scope, defaulting to the user tab it renders on today.

Full changelog: https://github.com/liketrek/TREK/compare/v4.1.1...v4.2.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [mauriceboe/trek](https://github.com/mauriceboe/TREK) | minor | `4.1.1` → `4.2.1` | --- ### Release Notes <details> <summary>mauriceboe/TREK (mauriceboe/trek)</summary> ### [`v4.2.1`](https://github.com/liketrek/TREK/releases/tag/v4.2.1) [Compare Source](https://github.com/mauriceboe/TREK/compare/v4.2.0...v4.2.1) <a href="https://github.com/liketrek/TREK/discussions/categories/feature-requests"><img alt="Upvote your favourite feature requests" src="https://raw.githubusercontent.com/liketrek/TREK/74c47a6158d2d1ffc66e0c3a2a65f6e9221230d2/wiki/assets/Banner-Feature-Requests.png" /></a> Fifteen reported issues off the 4.2.0 tag, two privately reported security advisories, and one operator request. **No breaking changes and no schema change.** This release appends no migrations at all, so a rollback to 4.2.0 stays possible on the data side. Two changes need a word before you update. #### Read this first - **Installed PWAs reload themselves once, and offline map tiles have to be downloaded again.** The offline fix in this release replaces the old "wipe everything on a version change" behaviour with a proper worker update, but the code that runs on your device right now is still the old one, so it does its clean-up one last time on the first start after this update. Open TREK **with a connection** and leave it open until it has reloaded itself (about 23 MB). Afterwards, go to **Settings → Offline** and press **Download for offline use** once. Your trips, files and anything waiting to sync are stored separately and are **not** affected. Do not uninstall and reinstall the app to speed this up: that would also delete the trips you have stored offline. From the next update onwards this no longer happens. - **Balances change on trips that have an expense nobody paid for.** Such an expense used to be charged to the people it was split between even though no one was owed anything, which pulled the balances away from zero. It no longer counts. On a trip where you already settled up against one of those phantom debts, the balances will now read the other way round and the settle-up box may suggest new transfers between people who never shared a bill. Nothing is corrected automatically. Undo those entries in the settle-up history, then settle again from the corrected figures. Trips without a payer-less expense are unaffected. #### Security Both reported privately by [@skeletonsec](https://github.com/skeletonsec), both fixed in [#2263](https://github.com/mauriceboe/TREK/issues/2263). - **The ntfy token an operator configures no longer reaches a server the user chose** (GHSA-7pqc-fj3c-9346). The token fell back to the operator's whenever a request carried none, so any signed-in user could point ntfy at a listener they control, leave the token field empty, and be handed the operator's push token. That applied to the connection test *and* to every ordinary notification, since the ntfy server is a per-user setting. The operator's token now travels only to the operator's own server, which keeps every legitimate setup working, including the common one where the operator provides the server and users only set a topic. - **Outgoing notification requests are re-checked at every redirect** (GHSA-8mw6-xphx-886m). Webhook and ntfy deliveries validated only the address they were given and then followed redirects blindly, so a redirect pointing at a loopback, internal or cloud-metadata address was dialled by the server. Every hop is now checked and pinned individually. The same weakness sat in the shared helper behind photo, AirTrail and image requests, where a redirect could have returned an internal service's response to the caller rather than merely reaching it; that is fixed too. Credentials are also dropped when a redirect crosses to another host, the way browsers do. #### Fixes **Sharing and journeys** - Public journey share pages load again. A share with the map enabled and at least one geotagged photo went straight to the error screen from 1024px up: the sidebar map places its photo thumbnails in screen space, and it drew before the map had been given a centre and a zoom, which Leaflet answers by throwing. The photos now wait for the opening view and appear as soon as it lands ([#2254](https://github.com/mauriceboe/TREK/issues/2254), reported and fixed by [@xvilo](https://github.com/xvilo)). - Anonymous visitors no longer trigger a failed authenticated request on every share page. System notices, background tasks and save-to-collection were only held back on the login and password routes, so a visitor to a shared trip or journey mounted all three and logged a 401 nobody could act on ([@xvilo](https://github.com/xvilo)). - The language picker on a public journey page reaches all 23 languages. It used to be cut off at the bottom edge of the page hero, leaving most of the list unpickable; it now floats above the page and scrolls when the screen is short. On both share pages, trip and journey, it also closes on Escape or a click outside, which it never did, and Traditional Chinese stops labelling itself 简体中文 ([#2248](https://github.com/mauriceboe/TREK/issues/2248)). **Planner and maps** - The Plan tab fits a tablet, a foldable and a narrow window again. Anything between the phone breakpoint and 1024px, which is an iPad held upright as much as an unfolded foldable or a browser window at half a laptop's width, now opens one side panel at a time: the day plan first, the places list one tap away, instead of two panels squeezing the map into a 200px strip. The map opens framed on the trip rather than on half a continent, the floating map controls no longer sit on top of the panel tabs and the Add Place button and swallow their taps, and those tabs finally carry a name a screen reader can announce ([#2247](https://github.com/mauriceboe/TREK/issues/2247)). - The phone map has a way back to the whole trip. Picking a day on the map narrows it to that day, and until now nothing took that filter off again: the chip rail can only swap one day for another, and a second tap on the active chip opens the day sheet. A small control now sits beside the rail, in map view only: it clears the day and frames the whole trip, and pressing it again returns to the day it came from, route and all ([#2257](https://github.com/mauriceboe/TREK/issues/2257)). - The start and end date no longer sit on top of each other in the trip dialog. Both fields are in a two-column grid, and neither column could shrink below the width of its contents, so a long date plus the keyboard button beside it pushed each cell past its half. On a phone the end date came to rest over the start date with its own button clipped off the card edge. The date now shortens with an ellipsis inside its column instead ([#2267](https://github.com/mauriceboe/TREK/issues/2267)). - A note in a day plan no longer covers its own up and down buttons with a pencil and a bin. Tapping the note opens it for editing, the same gesture the phone already used, and delete moved into that dialog. That also makes reordering a note clickable for the first time, on a mouse as well as on a touchscreen ([#2249](https://github.com/mauriceboe/TREK/issues/2249)). - Arabic, Hebrew, Persian and Urdu place names on the vector basemaps render joined and in the right order. The map engines need an optional plugin for bidirectional text and Arabic contextual shaping, and neither loads it on its own, so labels came out as isolated letters in reverse. Raster basemaps hid this because their labels are drawn server-side, which is why it surfaced when the default basemap became a vector style ([#2235](https://github.com/mauriceboe/TREK/issues/2235)). - Notes on the phone show and keep their website. The field can be entered, edited and cleared, a saved link opens from the note, and members without edit rights see it too, on phone and desktop ([#2222](https://github.com/mauriceboe/TREK/issues/2222)). **Bookings and import** - Saving a hotel booking stops leaving a duplicate place behind. The stay is linked to the place created for it, so opening the same hotel again and saving reuses that place instead of minting another unlinked copy every time ([#2243](https://github.com/mauriceboe/TREK/issues/2243)). - Editing a booking no longer wipes the price shown on its card, whatever the booking type. The price survives an ordinary edit, an AirTrail sync and any API or MCP update, whether it came from a linked expense or was written onto the booking by the import, so it holds on an instance with the Costs addon switched off too. It is removed when the expense behind it is deleted rather than lingering with nothing behind it, and setting or clearing the price explicitly still works as sent ([#2233](https://github.com/mauriceboe/TREK/issues/2233)). - AI booking import works with OpenAI reasoning models. Every request pinned a temperature of 0, which the gpt-5 family rejects outright, so the extraction failed before it began and burned a second doomed retry on the way. The parameter is now dropped only once a provider says it will not take it, so deterministic extraction stays the default everywhere else, local NuExtract included ([#2262](https://github.com/mauriceboe/TREK/issues/2262)). - Booking import says why it found nothing. The bundled KDE Itinerary extractor's version now appears in the startup log and in a new admin-only `GET /api/admin/system-info`, and `LOG_LEVEL=debug` passes the extractor's own error lines through instead of filtering them away. A provider script missing from an older extractor used to look exactly like a provider TREK does not support ([#2261](https://github.com/mauriceboe/TREK/issues/2261)). - How long one AI parsing call may take is now a single setting, `LLM_TIMEOUT_MS`, instead of three constants that disagreed and none of which was the ceiling that actually applied. The underlying HTTP client is held to the same value, so raising the ceiling now works at all: it used to cap out at five minutes of its own accord, which meant a larger number changed nothing and the call failed with a header timeout instead. The default is 15 minutes so heavier documents fit without a code change, and it can be lowered to fail fast on a cloud provider ([#2230](https://github.com/mauriceboe/TREK/issues/2230)). **Costs** - An expense with "No one paid yet" no longer creates debt owed to the payer of a different expense. It counts toward the trip total and appears in the Outstanding amount card, the balances add up to zero again, and settle-up stops offering payments between people who never shared a bill ([#2225](https://github.com/mauriceboe/TREK/issues/2225)). See **Read this first** above for what this means on a trip you have already settled. - "Your share" no longer counts expenses nobody has paid for. The balances below it stopped counting them, so the two halves of the costs panel disagreed with each other. **Offline** - Offline mode works again. A version bump no longer wipes the app shell and every downloaded map tile, so an installed PWA still starts without a connection; a session that launched offline can sync once the signal returns instead of staying dead for its whole life; and switching a finished trip on in the offline settings actually stores it rather than leaving the cache at zero ([#2228](https://github.com/mauriceboe/TREK/issues/2228)). - An offline map download no longer risks the cache it is filling. Where the browser refuses persistent storage, which is Safari and anyone who declined the prompt, a trip's tiles now stop at zoom 12 instead of 16. Street level detail is missing offline, but the origin stops claiming tens of gigabytes of padded quota for a single trip, which is what made the browser evict the whole bucket, precached app shell included, and leave the installed app unable to start at all ([#2228](https://github.com/mauriceboe/TREK/issues/2228)). - The offline settings screen tells the truth: a download that never started, could not finish, or had nothing to store says so, instead of painting a full progress bar and a green "Ready for offline use" over a run of nothing, and a finished one says how many trips it stored. The list stops claiming that finished trips are already on the device, where every one of them showed its switch on and read "Stored offline" while the download passed over it. A storage error is reported rather than shown as "no trips cached", and Clear cache is no longer greyed out over a store that a half-finished download left behind ([#2228](https://github.com/mauriceboe/TREK/issues/2228)). **Lists** - Creating a list with a cover image uploaded from your own device keeps the image, and the new list opens once it is created. The id of the new list was read out of a field the response does not carry, so it never arrived: the upload was skipped without a word, and nothing was opened or selected afterwards. A cover picked from the photo search was never affected. **Integrations and admin** - MCP OAuth: clients registering a private-use redirect scheme such as `workbuddy://` can connect. `http://[::1]` is accepted alongside the other loopback addresses, and a native client that registered a placeholder port may authorize on the port the OS handed it, per RFC 8252. The settings form and dynamic client registration now apply the same rules, which also closes a hole where a scheme like `javascript:` was accepted as long as its host read `localhost`. Clients you have already registered are not re-validated, so nothing that works today stops working ([#2227](https://github.com/mauriceboe/TREK/issues/2227)). - Plugins whose declared `trek` range does not admit the running version, whether it asks for an older one, a newer one, or a range no version can satisfy, and plugins that never said which TREK versions they support, can be installed, updated and activated when the operator sets `TREK_PLUGINS_IGNORE_TREK_RANGE`. Every gate warns instead of refusing, the admin is told at each step, and neither the plugin-API version gate nor the Discover compatibility verdict is loosened. While it is on, an entry Discover flags as incompatible no longer offers the newest release this TREK can run: the button becomes **Install anyway** and takes the newest published version, after the warning ([#2226](https://github.com/mauriceboe/TREK/issues/2226)). Unset, nothing about plugin installation changes. - While `TREK_PLUGINS_IGNORE_TREK_RANGE` is set, the plugins panel says so on its own: a **Version checks off** badge sits in the header, on the desktop admin and on the phone, for as long as the variable is set. A second admin who did not set it can see that the version gate is loosened without installing anything. - A plugin that only got in because the version check was off stays marked for as long as it runs. Its row carries a chip reading "Outside its TREK range, version checks off", or "Declares no TREK range, version checks off" for one that declared none, so the warning outlives the install dialog and is still there weeks later. #### Schema **No migrations.** The schema is byte for byte the one 4.2.0 shipped, so this update writes nothing to the database structure and a rollback stays possible on the data side. **Full changelog:** <https://github.com/liketrek/TREK/compare/v4.2.0...v4.2.1> ### [`v4.2.0`](https://github.com/liketrek/TREK/releases/tag/v4.2.0) [Compare Source](https://github.com/mauriceboe/TREK/compare/v4.1.1...v4.2.0) <a href="https://github.com/liketrek/TREK/discussions/categories/feature-requests"><img alt="Upvote your favourite feature requests" src="https://raw.githubusercontent.com/liketrek/TREK/74c47a6158d2d1ffc66e0c3a2a65f6e9221230d2/wiki/assets/Banner-Feature-Requests.png" /></a> Thirty-two reported issues and discussions off the 4.1.1 tag, plus a layout bug found on a Galaxy S26 Ultra and the Studio work asked for in discussion [#2064](https://github.com/mauriceboe/TREK/issues/2064). **No breaking changes**; the one visible behaviour change is called out right below. #### Read this first Five of the changes deserve a heads-up: - **Offline maps:** tiles for the OpenStreetMap DE and Stadia presets were never actually stored, and the prefetch skipped the overview zoom levels a multi-city trip opens at ([#2180](https://github.com/mauriceboe/TREK/issues/2180)). After updating, open the trip and press **Download for offline use** once more so the missing tiles get backfilled. - **Android app icon:** the launcher icon now keeps a proper safe zone instead of filling the whole tile. An installed PWA picks it up after removing and re-adding the app, or with Chrome's next WebAPK refresh. - **Journey maps:** the GPX tracks of linked trips no longer draw by default ([#2194](https://github.com/mauriceboe/TREK/issues/2194)). If you want them back, flip on **Show all trip GPX tracks** in the Journey Settings (owners only). - **Studio books:** the book designer only ever rendered three of its seven typefaces, so a book set in Inter, Lora, EB Garamond, Playfair or Bebas was laid out against the wrong metrics ([#2183](https://github.com/mauriceboe/TREK/issues/2183)). They render properly now, which means an existing book reflows: line breaks move and a tight text frame can overrun. Open a book you mean to print and look over its text frames once before you order it. - **Passkeys on a localhost-only install:** an instance that never set `APP_URL` and is browsed at `http://localhost` no longer advertises passkeys, because the relying-party scope cannot be derived and the enrolment would be refused anyway ([#2147](https://github.com/mauriceboe/TREK/issues/2147)). If you use a passkey on such an install, set `APP_URL` to the address you actually open (for example `http://localhost:3000`) before upgrading, and the button stays where it was. #### Studio Three things from discussion [#2064](https://github.com/mauriceboe/TREK/issues/2064), all in the book designer. **The photo browser knows which day a picture is from.** A filter above the grid narrows it to one journal entry, to the pictures no entry holds, or to what you just uploaded, and it combines with the search box: the filter answers "which day", the search answers "which words". Each entry in the Entries tab carries a button to its own pictures, and the page on the sheet offers its own entry in one press. On a journey with four hundred photographs and a page per day, this is the difference between browsing and hunting. **Pictures can come in without leaving Studio.** The panel takes an upload or a drop from the desktop, and a drop onto the sheet itself places the picture where you let go, filling the frame under the pointer when there is one. Where a picture is stored follows the filter: into the entry it names, otherwise into the journey's gallery, and the line above the grid says which before you press. Videos are left out of a drop rather than failing it. A photo element also gets **Fill page** and **Fill spread**, which stretch it exactly to the bleed and send it behind everything else, which is the commonest layout in a photo book and the fiddliest to hit by hand. **A stop can be left off the route.** The home airport written up as the first day is a leg nobody travelled, and it moved the printed distance, the furthest point and the countries. The travel panel now lists every stop in a folding section that says how many still count, with a switch on each; the same switch sits in the entry editor on desktop and phone, and an entry that is off the route says so on its card. The entry stays in the journal either way, and the figures are recomputed on the server, so the map, the distance and the country list agree with each other. #### Fixes **Planner and maps** - Re-entering a trip with the route toggle on released every automated transit route onto the map at once, and only toggling off and on cleared it. Routes now draw for the selected day only ([#2019](https://github.com/mauriceboe/TREK/issues/2019)). - On days without check-in and check-out times, the route started at a hotel you had not checked into yet, or led back to one you had already left, including a 2400 km ray home after the return flight. A flight, train or ferry on the day now settles which side the hotel anchors ([#2157](https://github.com/mauriceboe/TREK/issues/2157)). - Transit journeys from the transit search could only be fully edited on mobile. The journey dialog now hands over to the full booking form on desktop too: travelers, costs, files, booking code and status ([#2148](https://github.com/mauriceboe/TREK/issues/2148)). - Day assignment notes written through the API or an assistant were stored but invisible. They now show in the place inspector, the day sidebar, both edit forms and the PDF export, and moving the place to another day keeps the note ([#2163](https://github.com/mauriceboe/TREK/issues/2163)). - The day weather could silently belong to a different city: it anchored to the first located place anywhere in the trip. It now sticks to the selected day, names the place it is for, refreshes its cache hourly in the PWA, and serves the last few days from the live forecast instead of a lagging archive ([#2167](https://github.com/mauriceboe/TREK/issues/2167)). - Two bookings linked to the same stop showed as one, the place card resolved its bookings with a first-match lookup. A stop now lists every booking linked to it, on the desktop plan tab, the place inspector and the phone's timeline and place sheet ([#2201](https://github.com/mauriceboe/TREK/issues/2201)). - Editing a booking on a phone silently erased the stop it was linked to, because the sheet saved an empty link over the one made on the desktop. The link survives an edit now, and the picker the desktop dialog has always had is in the phone sheet too, so a booking can be pinned to a stop, moved or unpinned from either ([#2216](https://github.com/mauriceboe/TREK/issues/2216)). - Editing a transit booking dropped the stations it came with. No form edits those, so an edit leaves them alone instead of saving an empty set over them. - The booking sheet on a phone showed no files at all for a booking that had them, and a place never showed the files of the bookings on it, on either platform. Both list them now, and a confirmation stored on a booking is reachable from the place card ([#2217](https://github.com/mauriceboe/TREK/issues/2217)). - Opening a place in Google or Apple Maps from the installed app left an empty window behind that had to be dismissed before TREK was usable again. The handover happens from the page you are on now ([#2218](https://github.com/mauriceboe/TREK/issues/2218)). **Costs** - Recorded settlement payments never appeared in the mobile Costs tab. They now show up day-grouped, same as on desktop ([#2151](https://github.com/mauriceboe/TREK/issues/2151)). - Editing an amount of 4,90 showed 4,9 in the field. Edit fields seed with two decimals everywhere, currency aware, and a three-decimal currency like KWD stays typable in the split and receipt fields ([#2175](https://github.com/mauriceboe/TREK/issues/2175)). - Negative amounts work end to end for partial reimbursements: input (with a sign toggle, because the iOS number pad has no minus key), split math down to the cent, balances and the assistant tools ([#2176](https://github.com/mauriceboe/TREK/issues/2176)). **Calendar and exports** - Accommodation check-in and check-out appeared as 0-minute events in the calendar feed. They carry the same one-hour window as the parking and rental hand-overs; with both times set the all-day bar is dropped entirely, and the markers then carry the booking's confirmation number, notes and location themselves ([#2136](https://github.com/mauriceboe/TREK/issues/2136)). - GPX export returned a 500 for any trip or place name with non-ASCII characters. Downloads keep the original name now, and the same fix covers the ICS export, the calendar feed and wallet passes ([#2165](https://github.com/mauriceboe/TREK/issues/2165)). **Mobile and offline** - The dashboard filter row could push the top bar and the bottom dock off the right edge on narrow phones with Android's forced zoom active, while the cards fit perfectly. The row scrolls inside its own box now and the page can no longer widen sideways. - The collections map on a phone was a fixed-height card with dead space below. It fills the viewport like the trip and journal maps ([#2104](https://github.com/mauriceboe/TREK/issues/2104)). - When locating fails, typically an installed iOS app whose own location permission was denied, the only feedback was a hover tooltip. A clear message appears instead, with a hint at the device settings ([#2095](https://github.com/mauriceboe/TREK/issues/2095)). - The app boots in the account's language when offline ([#2146](https://github.com/mauriceboe/TREK/issues/2146)). - Tapping the hotel chip in a day's header opened the day overview, the same as the day pill next to it. It opens the stay now: the accommodation editor when you can edit days, otherwise the hotel's place, and closing it brings you back to the timeline ([#2210](https://github.com/mauriceboe/TREK/issues/2210)). **Accounts** - Passkey registration failed with a bare 400 on instances without APP\_URL. An origin outside the relying-party scope is refused with an actionable message right at the options step, and derived setups heal scheme and port mismatches behind TLS proxies on registration and login. An instance without any usable configuration no longer advertises passkeys the options step would refuse ([#2147](https://github.com/mauriceboe/TREK/issues/2147)). **Self-hosting** - Stopping the container always ran into Docker's grace period and ended in SIGKILL, exit 137: any open browser tab holds a WebSocket, a WebSocket never closes by itself, and the shutdown waited for it with a fallback timed to lose the race. Sockets are released deliberately now: tabs get a clean "going away", the database closes on every exit path, and shutdown finishes well inside the grace period, so `docker stop` and restarts are clean and fast ([#2193](https://github.com/mauriceboe/TREK/issues/2193)). - "Send test email" failed with a generic toast over an empty log. It now logs every outcome and names the actual cause, wrong credentials, DNS, a refused or filtered port, the 465-versus-587 TLS mix-up, a certificate problem, with the relay's own answer included and secrets kept out; the test send now bounds every phase so the verdict actually arrives, while a real notification keeps the patience it needs for a relay that scans the message. Found on the way: replacing a stored SMTP password typed the new one behind the masking bullets and saved both, the field now clears like its neighbours ([#2196](https://github.com/mauriceboe/TREK/issues/2196)). - The image ships `fast-uri` 3.1.7, which closes six advisories rated high in the URL parser that the MCP SDK's schema validator pulls in. Nothing in TREK's own request handling was reachable through them, but the scanner flags the old version. **Studio** - Only three of the seven text fonts rendered; Playfair, Inter, EB Garamond and Bebas fell back to Poppins, and serif drew Georgia instead of Lora: a stale three-font map, plus five font families that were declared but never actually shipped. All picker fonts load and reach the canvas and the print renderer now ([#2183](https://github.com/mauriceboe/TREK/issues/2183)). **Journey** - Editing an entry returned its tags as a raw JSON string instead of a list ([#2155](https://github.com/mauriceboe/TREK/issues/2155)). - The gallery was in upload order, so photos added later landed behind days they belong before. It runs in trip chronology now: capture time when the photo carries one, otherwise the date of the stop it belongs to, on desktop, on phones and in shared journeys. The hand-arranged photo order inside an entry stays yours ([#2200](https://github.com/mauriceboe/TREK/issues/2200)). A share link you have already circulated will show its photos in the new order from the first restart. - Journey maps drew the GPX tracks of every linked trip, with nothing to switch off, and one long track zoomed the map out until the entries were specks. The tracks are a journey setting now, owner-only and off by default, and the download is skipped entirely while they are off; when they are on, they no longer decide the framing as long as there are entries to frame ([#2194](https://github.com/mauriceboe/TREK/issues/2194)). **MCP** - The Trip Summary, Budget Overview and Packing List prompts failed in every MCP client, MCP Inspector included, with "Invalid arguments for prompt: expected number, received string". Prompt arguments always arrive as strings; the trip id is parsed from one now, invalid ids are refused up front, and the server's prompt registry no longer accepts a number schema at all ([#2207](https://github.com/mauriceboe/TREK/issues/2207)). **Other** - Task-list checkboxes would not toggle on desktop: the press animation shrank the row mid-click and the click landed next to the checkbox. The same trap is defused on the planner rows, the dashboard cards, the collections rows, the journey gallery tiles and the shared vacay calendar cards ([#2158](https://github.com/mauriceboe/TREK/issues/2158)). - Long notes on Atlas bucket-list markers overflowed the viewport as one endless line. Tooltips wrap, scroll and stay on screen ([#2153](https://github.com/mauriceboe/TREK/issues/2153)). - Creating a packing item over the API silently dropped weight, bag and quantity; the create routes accept them now on REST, MCP and the plugin RPC, and a bag reference from another trip is rejected instead of being stored ([#2154](https://github.com/mauriceboe/TREK/issues/2154)). - A shared bag's weight was summed over only the items you are allowed to see, so your buddies' personal items silently dropped out: two people saw two different totals, and an overweight bag warned nobody. The total is computed on the server over every item now and updates live for everyone on all write paths, revealing nothing but the number itself; offline, the app falls back to summing what it can see ([#2191](https://github.com/mauriceboe/TREK/issues/2191)). - The plugin update and consent dialogs scroll ([#2159](https://github.com/mauriceboe/TREK/issues/2159)). - Shared note markdown is sanitized on every surface it renders on. #### Small additions - The todo list can be sorted by due date: a toggle next to the priority sort, on desktop and on the phone, with the nearest deadline first and undated tasks last. Drag-to-reorder pauses while a sort is active, as it already did for the priority sort ([#2205](https://github.com/mauriceboe/TREK/issues/2205)). - Poll questions support safe Markdown and multiline text, and long options wrap fully on desktop and mobile ([#2177](https://github.com/mauriceboe/TREK/issues/2177)). - The admin addons page is a tile grid with sub-shelves: bag tracking, the collab features and the photo providers hang off their parent addon, and photo providers now require the Journey addon instead of dangling without it. If your instance has Immich or Synology connected while Journey is switched off, the providers go quiet until you enable Journey, and switching Journey off clears their enabled flags rather than remembering them. - Connected photo providers sit as buttons next to Upload in the journey gallery header. - Admins can edit instance-wide plugin settings in the admin UI ([#2170](https://github.com/mauriceboe/TREK/issues/2170)). - A plugin can put its own buttons into the admin's instance-settings dialog, so an operator runs a plugin's action, a re-sync or a cache purge, from the admin panel rather than the user settings tab ([#2209](https://github.com/mauriceboe/TREK/issues/2209)). - A plugin's declared setting defaults apply now: the admin form, the desktop settings tab and the phone settings screen all start from them, the plugin reads them at runtime, and a required field that is left empty is refused instead of saved blank ([#2199](https://github.com/mauriceboe/TREK/issues/2199)). #### Schema Five appended migrations, all additive and all with a default that keeps existing data as it was. One is presentational only: the Naver list import counts as an integration instead of a trip addon, which moves its tile between admin groups and changes nothing about the import itself. One adds the flag behind the stops switch to journal entries, defaulting to counting, so every existing journey keeps the route and the figures it had. One adds the journey setting for the linked trips' GPX tracks, off by default. The last two belong to the plugin system: a settings field can carry a default value, and a settings action can carry a scope, defaulting to the user tab it renders on today. **Full changelog:** <https://github.com/liketrek/TREK/compare/v4.1.1...v4.2.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate added 1 commit 2026-09-07 03:05:25 +00:00

Update mauriceboe/trek Docker tag to v4.2.1 846f2d8c49

renovate force-pushed renovate/mauriceboe-trek-4.x from 53f530d5e5 to 846f2d8c49

2026-09-07 03:05:25 +00:00

Compare

renovate changed title from ~~Update mauriceboe/trek Docker tag to v4.2.0~~ to Update mauriceboe/trek Docker tag to v4.2.1

2026-09-07 03:05:27 +00:00

AverageMarcus merged commit 1355d27bd9 into master

2026-09-14 05:20:34 +00:00

AverageMarcus deleted branch renovate/mauriceboe-trek-4.x

2026-09-14 05:20:36 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: AverageMarcus/cluster.fun#788