Wakapi vs Basecamp

Wakapi's recent releases cluster around identity and deployment rather than time tracking itself: OpenID Connect login, then an OIDC-only mode, multiple API keys per user, and a switch from Alpine to a distroless nonroot container image. The 2.17.x line has also carried a responsibly disclosed security fix and dropped its relay endpoint. Release notes are mostly bare issue numbers, so several entries state that something changed without saying what.

The direction is a self-hosted tool making itself deployable somewhere other than one developer's server. External identity providers, an option to disable local login entirely, per-key credentials and a container that runs as a nonroot user with no shell are the requirements that come from someone else's security review, not from a hobbyist's wishlist. The corresponding cost is visible too: dropped MSSQL support and a Docker base change that forces SQLite users to fix directory permissions by hand.

The identity and packaging thread is the only sustained one in this feed, so further hardening in that area is the most likely continuation; the sparse release notes make anything more specific guesswork.