From 074e3bbdf133f540b645adb12b91e85edfad4e32 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Thu, 4 Jun 2026 13:31:25 +0200 Subject: [PATCH] =?UTF-8?q?chore(release):=20v1.11.2=20=E2=80=94=20Coach-m?= =?UTF-8?q?emory=20controls,=20SSRF=20hardening,=20more=20pinnable=20metri?= =?UTF-8?q?cs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Coach-memory management UI (review/forget durable facts), connect-time DNS-rebinding pins on user/operator-overridable outbound hosts, eight additional pinnable dashboard metrics, plus a rollup write-race fix and fast-path source-priority amortisation. Co-Authored-By: Claude Opus 4.8 (1M context) --- CHANGELOG.md | 16 ++++++++++++++++ docs/api/openapi.yaml | 2 +- package.json | 2 +- 3 files changed, 18 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 95d6fb2b9..7174405eb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,21 @@ # Changelog +## [1.11.2] — 2026-06-04 — Coach-memory controls, privacy hardening, more pinnable metrics + +### Added + +- **Review and clear what the Coach remembers.** A new "What the Coach remembers" settings section lists the durable facts the assistant has learned about you, grouped by category, and lets you forget a single one or clear all of them. Encrypted at rest; available wherever the Coach is enabled. +- **More dashboard metrics you can pin.** Cardio recovery, six-minute walk distance, stair ascent/descent speed, breathing disturbances, wrist temperature, fall count, and walking steadiness can now be pinned to your Home layout. + +### Security + +- **Outbound request hardening.** The AI provider clients (when pointed at a custom base URL) and the optional IP-geo lookup now reject any address that resolves to a private or internal host, closing a server-side request-forgery / DNS-rebinding gap. + +### Fixed + +- A rare write race when two updates recompute the same day's rollup at once is now handled cleanly instead of surfacing a transient error. +- Analytics fast paths resolve your source-priority preference once per request instead of repeatedly. + ## [1.11.1] — 2026-06-04 — source-aware vitals + Coach long-term memory Closes the three follow-ups left open by v1.11.0: cross-source vital de-duplication, the Coach's conversation memory, and durable personal facts. diff --git a/docs/api/openapi.yaml b/docs/api/openapi.yaml index 39ef54640..19c3d242a 100644 --- a/docs/api/openapi.yaml +++ b/docs/api/openapi.yaml @@ -1,7 +1,7 @@ openapi: 3.1.0 info: title: HealthLog API - version: 1.11.1 + version: 1.11.2 description: >- Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest. diff --git a/package.json b/package.json index 955eee106..3dff3e73c 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "healthlog", - "version": "1.11.1", + "version": "1.11.2", "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.", "license": "AGPL-3.0-only", "homepage": "https://healthlog.dev",