Dawarich 1.22.0 went up on 7 November. If your instance archives raw location data, the upgrade note is the part to read before you pull it.
The key comes first
“With ARCHIVE_RAW_DATA=true, set ARCHIVE_ENCRYPTION_KEY before upgrading: without it, production stops archiving raw data and only logs an error.”
The note says which key to use. “On an instance that already has archives, use the current SECRET_KEY_BASE value; otherwise generate a key with bin/rails secret.”
Then the part that cannot be undone. “Keep the key safe, because cleared raw data cannot be recovered without it.” An instance that clears raw data from the database and then loses the key has lost the archive itself.
The security bump
The release moves onto Rails 8.1.4.1 “to close the security advisories fixed in that release”. It names one of them: GHSA-f3w6-w445-fwh9, described in the note as “arbitrary file read and write in Active Storage image analysis”.
That parenthetical is all there is. The advisory page returned 404 when it was fetched for this piece, so there is no severity, no score and no exploit status to report here. For anyone self-hosting, the note’s own line is the action: “Self-hosters get the fixes by upgrading.”
Two changes you will notice
Tracks can now split at midnight in your time zone, “so a night at home with your phone still reporting no longer joins several days into one Track”. The option is off by default, and existing Tracks only change if you “press Recalculate tracks & stats”.
The Timeline also shows the local time of a visit “when the place is in a different time zone than your account”. The note’s example is “19:30 local” beside a Kansas visit on a Berlin account. Days still split by the account’s time zone. The API and the MCP get_timeline tool return the place’s zone as local_timezone, and the boundaries come from timezone-boundary-builder, loaded during the database migration.
One changed behaviour matters more than the restyle it arrived with. A stop long enough to count as a visit, “5 minutes by default, never less”, now ends a Track. The Timeline draws two journeys where it used to draw one across the visit.
Fixes worth naming
Raw data archival “no longer clears points whose archive file has gone missing”, and account exports now include raw data that was already archived and cleared from the database. Public timeline links and filtered exports stay “limited to their selected import”, queued exports and restored backups included.
The selected timezone survives saving settings. A failed import shows its error on the import page again on self-hosted instances. GPS filtering drops a single imprecise network point that jumps to a distant cell tower and back. That is the fix for the phone at home reporting one fix across a bay.
What this does not cover
Only the release note was read. Dawarich’s documentation was not, so there are no install or configuration steps beyond the key instruction quoted above. Nothing was tested on a running instance, and nothing is claimed about the Rails advisories past the words the note uses.
Set the key, then upgrade. If you keep location history in Reitti instead, none of this applies to that instance.
Sources: Dawarich’s 1.22.0 release record, published 7 November 2026. The advisory page for GHSA-f3w6-w445-fwh9 returned 404 and is not cited.
Written from the release note alone. Nothing was installed, and no instance was running while this was written.