⚠ PRE-RELEASE — USE AT YOUR OWN RISK ⚠

This is a pre-release build of TREK. It may contain bugs, incomplete features, or breaking changes. It is not recommended for production use.

• Do not use this on a live instance without a full backup
• Database migrations may not be reversible
• APIs and configuration options are subject to change without notice

If you encounter issues, please report them at https://github.com/mauriceboe/TREK/issues.

Stable releases are available on the main release page.

⚠ Pre-release image — not recommended for production use.

docker pull mauriceboe/trek:3.1.0-pre.1

First pre-release on the way to 3.1.0.

Full Changelog: v3.0.22...v3.1.0-pre.1

How to update: https://github.com/mauriceboe/TREK/wiki/Updating

What's Changed

• v3.0.22 — Bug Fixes & Improvements by @jubnl and @mauriceboe in #1041

Details

• feat(oauth): add client_credentials grant for machine clients; fix PlaceAvatar stale-image retry
• fix(mcp): avoid race condition invalidating other sessions on token refresh (#1009)
• fix(mcp): expose price/budget fields on create tools so AI can link costs to items (#1031)
• fix(plan): show tour and other non-hotel bookings under their assigned day (#1008)
• fix(plan): keep the mobile plan panel open when opening day details (#1015)
• fix(plan): allow dropping a new place onto a day note (#967)
• fix(journey): resilient per-file photo upload with retry and progress (#1013)
• fix(journey): restore the entry-preview close button on tablet portrait (#1030)
• fix(journey): show the Immich/Synology picker add/cancel buttons above the bottom nav on mobile (#1045)
• fix(build): re-enable modulePreload polyfill for Safari < 17 (#1028)
• fix(transport): resolve "Invalid Date" on bookings in relative "Day N" trips
• fix(atlas): classify Hong Kong, Macau and other enclaves under their own country code (#963)
• fix(atlas): count cities when the address contains a postal code (#940)
• fix(places): render line breaks in place descriptions (#957)
• fix(map): render travel-time pills on the Mapbox GL map (#850)
• docs: update the demo link (#513)

Full Changelog: v3.0.21...v3.0.22

How to update: https://github.com/mauriceboe/TREK/wiki/Updating

What's Changed

• v3.0.21 Bug Fixes by @jubnl in #998

Details

• fix(journey): remove photo upload count limit and surface upload errors (#997)
• fix(planner): remove correct assignment when place assigned to same day multiple times
• fix(map): enable 3D terrain for Mapbox outdoors style in trip planner
• fix(maps): send Referer header on Google API calls when APP_URL is set

Full Changelog: v3.0.20...v3.0.21

How to update: https://github.com/mauriceboe/TREK/wiki/Updating

Hot fix

• fix CSP: HEIC conversion failed due to CSP config

Full Changelog: v3.0.19...v3.0.20

How to update: https://github.com/mauriceboe/TREK/wiki/Updating

What's Changed

• v3.0.19 Bug Fixes by @jubnl in #992

Detail

• fix(mcp): replace relative oauth constent redirect by absolute redirect derived from APP_URL
• feat(journey): convert HEIC/HEIF uploads to JPEG for cross-platform compatibility
• fix(journey): skip heic-to import for non-HEIC files to avoid test env failures
• fix(notifications): prevent double-escaping HTML in password reset emails

Full Changelog: v3.0.18...v3.0.19

⚠️ Security release — update recommended

This release patches a security vulnerability. If you are running any version prior to v3.0.18, updating is recommended.

A security advisory will be published shortly. In the meantime, see PR #984 for technical details.

How to update: https://github.com/mauriceboe/TREK/wiki/Updating

What's Changed

Security

• fix(security): equalise login response timing to prevent user enumeration via timing side-channel (CWE-203, CWE-208) — [#984](#984) by @jubnl

Bug fixes

• fix: align public share itinerary order with daily planner — [#983](#983) / [#985](#985)
• fix: shift owner vacancy entries when update_trip moves the trip window — [#983](#983)

Full Changelog: v3.0.17...v3.0.18

How to update: https://github.com/mauriceboe/TREK/wiki/Updating

What's Changed

• fix: prevent Invalid URL crash when APP_URL lacks a protocol by @jubnl in #972

Full Changelog: v3.0.16...v3.0.17

How to update: https://github.com/mauriceboe/TREK/wiki/Updating

What's Changed

• v3.0.16 — bug fixes by @jubnl in #964

Details

• fix(mcp): MCP RFC compliant for more strict clients
• fix(mcp): serve flat /.well-known/oauth-protected-resource for ChatGPT reconnect
• fix(mcp): fix OAuth popup blank page — SW denylist and COOP header
• fix(ntfy): encode non-Latin-1 header values with RFC 2047 to prevent ByteString crash
• docs(mcp): document Cloudflare bot detection blocking ChatGPT MCP requests
• fix(pwa): detect upstream proxy auth challenges and recover gracefully
• fix(files): add bottom-nav padding to files tab wrapper on mobile
• fix(budget): expose toolbar on mobile so users can add budget categories
• chore: remove committed build artifacts from server/public
• chore: add build-from-sources script

Full Changelog: v3.0.15...v3.0.16

How to update: https://github.com/mauriceboe/TREK/wiki/Updating

What's Changed

• Wiki: add budget documentation GIFs and minor fix by @tranko1 in #948
• fix: add APP_VERSION fallback and HOST bind address env var (#952 #953) by @jubnl in #955

New Contributors

• @tranko1 made their first contribution in #948

Full Changelog: v3.0.14...v3.0.15

How to update: https://github.com/mauriceboe/TREK/wiki/Updating

What's Changed

• Bug fixes - May 2nd 2026 by @jubnl in #941

Details

• fix: collab chat input hidden by mobile bottom nav bar (#939)
• chore: prepare database for nest + typeorm
• fix(ssrf): relax internal network resolution (#947)
• docs(ssrf): update Internal-Network-Access wiki to reflect relaxed guard
• fix(ssrf): let .local/.internal hostnames pass to IP-level checks
• fix(auth): trim username and email on all write paths
• feat(notices): add v3014-whitespace-collision admin notice

Full Changelog: v3.0.13...v3.0.14