LoginSign Up
← Back to all sparks
W

Wakapi

PM
Velocity5.0

Self-hosted coding statistics and time tracking service

wakapi.dev ↗

Wakapi tightens API key scope and fixes double-counted AI agent time.

time-trackingself-hostedapi-securityai-codingdatabase-performance
◆Current state
Wakapi's 2.18 line opened with security and data fixes: API keys now authorize only /api endpoints (a breaking change), permission checks on the filtered stats endpoint were fixed, and AI agent thinking time was being counted twice, which needs summary regeneration to correct. 2.18.1 fixed slow SQLite charts and an unresponsive server during aggregation, and 2.18.2 adds a heartbeats index that can take hours to build on large tables.
◆Where it's heading
Identity and access remain the theme: OIDC login, OIDC-only mode, multiple API keys, the critical auth bypass fix in 2.17.6, and now narrower key scope. Performance work for large heartbeat tables is emerging alongside it. Release notes are still often bare issue numbers.
◆Prediction
Expect 2.18.x patches addressing database migrations, given the MariaDB failure noted in 2.18.1; the notes don't show what a 2.19 would contain.

◆Recent moves

  1. 20d ago

    Heartbeats index that can take hours to build

    Bug fixes and improvements listed only by issue number, plus a new heartbeats index whose creation can delay first boot by hours. Operators with large databases should build the index ahead of upgrading.

    View source ↗
  2. 1mo ago

    SQLite chart and aggregation fixes; MariaDB migration warning

    Fixes slow SQLite activity charts, a server stall during summary aggregation, wrong Neovim detection and timezone drift in summaries. MariaDB migrations are flagged as likely to fail.

    View source ↗
  3. 1mo ago

    API keys limited to /api; AI agent time no longer double-counted

    API keys are now limited to /api endpoints, a breaking change, and a permission gap in filtered stats is closed, both reported by the same researcher. It also fixes double-counted AI agent thinking time, which matters as more coding happens through agents.

    View source ↗
  4. 2mo ago

    Critical auth bypass from a shared cache key namespace

    A single-line security release fixing a critical authentication bypass caused by a shared cache key namespace. It lands directly on the identity work this project has been building out, and the note gives operators no detail beyond the severity label and the cause.

    View source ↗
  5. 3mo ago

    Release 2.17.5

    Four contributor improvements listed as issue numbers with no descriptions, so the release's actual content is not readable from the notes. Consistent with how this project has been publishing recently.

    View source ↗
  6. 5mo ago

    Release 2.17.4

    One improvement and one bug fix, both identified only by issue number. Nothing in the entry indicates whether either affects users.

    View source ↗