LoginSign Up
← Back to all sparks
G

GraphHopper

DEVOPS
Velocity2.5

Fast open source routing engine and navigation API

www.graphhopper.com ↗

GraphHopper 11.1 is a security release, and 12.0 prerelease tags have started.

routingopenstreetmapnavigationsecurity-fixesrelease-cadence
◆Current state
GraphHopper published 11.1 in October as a security release fixing what it calls critical vulnerabilities, without describing them; the attached change list largely repeats 11.0's OSM tag work, plus items such as trip-based public transit routing, scriptable turn penalties and POST /navigate. Alongside it, 12.0-pre1 and 12.0-pre3 tags and an odd 11.0-alpha1 tag appeared with only commit messages. The roughly yearly major cadence (10.0 in late 2024, 11.0 in October 2025) points at 12.0 as the next major.
◆Where it's heading
The engine's recent work is routing quality, reading OSM tags more faithfully per mode, and that continues in the 11.x list. The 12.0 prereleases suggest the next major is in preparation, but their notes give no content. Security disclosure is thin: 11.1 is labelled critical without naming the issue.
◆Prediction
A 12.0 release is the next likely major entry given the prerelease tags; its contents can't be read from these entries.

◆Recent moves

  1. 19d ago

    11.1 security release for undisclosed critical vulnerabilities

    A security release for vulnerabilities it calls critical but doesn't describe, with a change list that mostly repeats 11.0's OSM handling and adds transit and turn-penalty items. Operators should upgrade, but the feed doesn't say what was exposed.

    View source ↗
  2. 1mo ago

    12.0-pre3 prerelease tag (no notes)

    A 12.0 prerelease tag whose only note is a README version update. A sign the next major is being prepared, nothing more.

    View source ↗
  3. 1mo ago

    Release tag adapting to Sonatype publishing

    A tag adapting the release process to Sonatype's newer publishing mechanism. Release plumbing.

    View source ↗
  4. 1mo ago

    12.0-pre1 prerelease tag (no notes)

    The first 12.0 prerelease tag, noting only an increased maximum for max_length. No release notes.

    View source ↗
  5. 1y ago

    11.0 refines mode-specific OSM tag handling and adds POST /navigate

    A release almost entirely made of routing quality work: maxspeed=none parsing, separate foot_road_access and bike_road_access, cycleway oneway tag combinations, country handling moved into the toll parser, and MTB speeds on compacted surfaces. The new POST /navigate endpoint accepting a GraphHopper request is the only API addition.

    View source ↗
  6. 1y ago

    10.2 fixes an import failure on recent OSM turn restriction data

    A bugfix release for 9.x and 10.0 throwing errors during import when turn restrictions are enabled against recent OSM data. Version 10.1 was skipped, making this the effective successor to 10.0.

    View source ↗