MyGarage

Added

• — A Brakes tab beside Tires tracks pads, shoes, rotors and drums per corner, brake jobs, and a wear estimate for each corner (#202)
• — Each axle gets a brake pads low reminder when a corner is due soon or worn out, closed by a brake job or a healthy measurement
• — After a tire rotation or set fit, the Tires tab offers to log brake measurements while the wheels are off
• — SSO settings have a Callback URL field, so oidc_redirect_uri can be pinned from Settings
• — Tires on a vehicle that tracks engine hours use the hour meter: mounts, dismounts, rotations, set fits and readings take hours, and hours on the tire and the wear estimate are worked out in hours (#217)
• — A vehicle that tracks both distance and hours records both on each tire event, the second one optional, and its tire figures stay on distance

• — Tire readings can be edited from the tire's history: fix a wrong date, tread, pressure or note, or add an odometer or hour meter reading later
• — A tread gauge reading in inches (0.346) typed into a 32nds field is read as 32nds (11/32)
• — Common Torque Pro extended PIDs, such as OBD adapter voltage and turbo boost, have readable names

Changed

• — CI splits the test suites across parallel runners (shared-workflows v1.7.0)
• — /api/auth/users/count returns has_users only
• — The SSO setup guide is no longer Authentik-specific, and lists Rauthy as a supported provider
• — An API update to a service visit that leaves out a line item's supplies_used keeps its supply usages; send [] to remove them
• — An API update to a service visit also keeps the other line-item fields it leaves out; send null to clear one
• — The API refuses (400) a line-item link to an item outside its visit when updating a visit or adding a line item, and ignores one when creating a visit

• — The API refuses a line item that links to itself
• — Manufacturer-specific codes (P1xxx, B1xxx and so on) no longer show one maker's meaning; the DTC card says the code is manufacturer-specific
• — The tire API refuses (422) an odometer on a vehicle that doesn't track distance, and engine hours on one that doesn't track hours
• — Low-tread reminders show the tread and the minimum in your units, in the reminder list and in the notification, instead of a note in millimetres
• — The settings API refuses (422) a key that isn't a known setting, including the ones the app keeps itself and the livelink_* keys, which have their own routes. It also checks the values a reader would crash on, such as the telemetry retention (30 to 365 days)

Removed

• — Sign-in for accounts still on a pre-Argon2 (bcrypt) password hash. bcrypt hasn't shipped since at least v2.14.0, so such accounts couldn't sign in anyway. An admin resets the password, and the log names the account

Fixed

• — A LiveLink telemetry retention of 0 or less, saved through the settings API or a settings restore, made the nightly prune delete every stored reading. Both refuse it now, and below 30 days the prune deletes nothing and logs a warning
• — A settings restore stores a hand-edited number or true/false instead of failing on PostgreSQL, and skips a value the settings API would refuse, with a warning
• — Alert lines on percent readings that can pass 100, such as volumetric efficiency and fuel trims, are no longer refused; the 0 to 100 limit stays on propane, battery and other fill-like readings
• — Completing a reminder whose stored maintenance type isn't a known one (a hand edit or an old restore) no longer errors; the type comes from the title
• — A LiveLink reading name longer than 100 characters no longer fails ingest on PostgreSQL
• — Photos and scanned PDFs can be read: the image now ships the Tesseract OCR engine (English), which it never had, so a scanned insurance declarations page, a window sticker photo and a fuel receipt photo no longer come back blank. Before this only PDFs with a text layer could be read

• — The OCR status endpoints report Tesseract as available only when the engine itself is installed, not just its Python wrapper
• — Torque Pro's one-digit PIDs (kc, kd, k5 and the rest) are stored as Engine RPM, Speed, Coolant and so on instead of KC, KD, K5, and what's already stored moves over, with older trips' speed, RPM and coolant filled in (#223)
• — Toasts no longer cover a drawer's buttons on tablets and desktops (bottom-left, top-left while a drawer is open), and sit above the tab bar on phones
• — Small supply amounts (a few mL in L, qt or gal) no longer show as 0.00, and supply amounts follow the selected language
• — With sign-in off, creating a user and resetting a password no longer error after saving, the family pages no longer error, and Share is hidden on the vehicle page
• — Test Connection in the SSO settings works with sign-in off
• — Uploading a window sticker again fills only empty fields, so your edits stay; turn off "Keep the values already saved" to replace them
• — A failed window sticker upload no longer deletes the sticker already saved, and a sticker whose text can't be read says so
• — Fuelio, Drivvo, Tesla and Auto-detect imports ask which odometer unit and decimal style the file uses, instead of assuming kilometres and dot decimals
• — Importing a vehicle's JSON export brings back its engine-hours readings, and the import summary lists DEF, engine hours and insurance too
• — A reminder on a vehicle that has barely moved no longer breaks the reminder list, the due counts, the calendar or the daily reminder notifications
• — A tire with almost no tread wear between two readings no longer breaks the tire list, tire analytics or saving a tire; it shows the distance left without a wear date
• — A LiveLink HTTPS upload with a timestamp offset is stored in UTC instead of being dropped (PostgreSQL) or shifted (SQLite)
• — Diagnostic trouble code descriptions were wrong from about P0126 on (P0300 read "Cylinder 12 Contribution"); the built-in list is now 9,341 correct generic codes, fresh installs get it, and existing installs are corrected on upgrade
• — Codes recorded before the list was installed get their description, and codes recorded with the old wrong text are corrected
• — The DTC tab's Cleared and All filters show cleared codes, and the category shows as a readable label instead of the raw value
• — A repair added together with the inspection that found it stays linked to it when the visit is saved
• — Editing a visit to add a failed inspection and point an existing repair at it no longer fails to save, and a repair moved off an inspection you remove keeps its new link
• — Drivvo imports read a Mileage column in the unit you pick, and find columns whatever their capitalisation
• — A Fuelio, Drivvo or Tesla import with a row that has more cells than headers no longer fails the whole file
• — A JSON backup row with a missing or bad date says so instead of "could not be imported"
• — A window sticker delete that fails keeps the sticker file
• — Clicking an authentication mode no longer switches to it. Each mode has a Switch button that asks first, and Switch to SSO waits until an issuer URL and client ID are saved
• — The SSO settings save with a Save button instead of on every keystroke, and a bad Callback URL shows its error under the field
• — Turning sign-in off drops the signed-in session in that browser at once. Other open tabs catch up when you return to them, checked at most once a minute
• — Signing in to an account whose stored password hash is damaged answers 'Incorrect username or password' instead of an error, and costs the same time as any other miss
• — Changing the password of an account that only signs in through SSO answers with a clear message instead of an error
• — A signed-out page load no longer logs an ERROR line
• — SSO sign-in through Rauthy no longer logs a SecurityWarning about the EdDSA algorithm name, and providers that use the newer Ed25519 name work too
• — The Callback URL refuses invisible characters, an address with no host, and a port that isn't a number
• — Tires on an hours-only vehicle no longer ask for an odometer, and the hour meter typed there no longer ends up in hidden odometer readings
• — Hour meter readings typed into a tire's odometer before this release stay in the vehicle's odometer history; turn on distance tracking for the vehicle to see and delete them. They stay on the tire's mount periods and readings too, where Edit on the period or deleting the reading clears them while distance tracking is on
• — An hours-only vehicle no longer gets odometer milestone notifications
• — Clearing the date in a tire dialog asks for a date instead of failing with an error
• — A past mount period can no longer run past the day its tire was retired, and a tire can't be retired before the end of its mount history
• — The hours list shows a reading a tire recorded as Tire instead of Manual
• — A tire reading logged after a higher one the same day no longer lowers the vehicle's odometer or hours for that day, and deleting a tire reading leaves the day at the highest reading still on file
• — A reminder you make counts its progress bar from the readings on file when you made it, so a reading added or corrected later that day no longer holds the bar at zero or hides it (thanks @Drisicato, PR #216)
• — Importing an old (pre-v3) vehicle backup counts a repeating reminder's mileage from the vehicle's odometer instead of saving the interval as the due odometer, keeps a one-time reminder's due date and mileage, and brings completed reminders back as done; a mileage-only reminder with no odometer reading to count from is reported instead
• — A tread or pressure reading dated before a newer reading of the other kind now updates the tire's tread or pressure
• — Torque Pro readings show their units, and intake manifold pressure no longer shows as a temperature

Security

• — POI provider settings are admin-only
• — SSO link and sign-in tokens moved out of the URL query, and the link token out of the app's logs
• — Signing in with an unknown username, an SSO-only account or an account still on a bcrypt hash now takes as long as a wrong password
• — SSO logs a warning, once per start, while oidc_redirect_uri is blank (see SECURITY.md)