From 397baac818910297bff1d5093361e445fc9edd74 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Wed, 2 Sep 2026 12:29:09 +0200 Subject: [PATCH] =?UTF-8?q?chore(release):=20v1.38.3=20=E2=80=94=20delete?= =?UTF-8?q?=20from=20the=20phone,=20name=20every=20source?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The account-deletion fix landed after v1.38.2 was tagged, so its entry moves out of that section and into this one where it belongs. Also in this release: every measurement source carries a display name in all seven languages, with a test that reads the enums out of the schema. --- CHANGELOG.md | 37 ++++++++++++++++++++----------------- docs/api/openapi.yaml | 2 +- package.json | 2 +- public/sw.js | 2 +- 4 files changed, 23 insertions(+), 20 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8903e3142..4a2693f1f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,9 +1,28 @@ # Changelog -## [Unreleased] +## [1.38.3] — 2026-09-02 + +An account with two-factor can be deleted from the phone, and every data +source is called by its name. ### Fixed +- **An account with two-factor can be deleted from the app.** Deleting + the account, and erasing the record while keeping the account, both demand a + fresh second-factor proof once a factor is enrolled. That proof lived on the + session row, which a native client does not have, so anyone who had turned on + TOTP or registered a security key was refused on both endpoints from the app + no matter what they sent — the only way through was a browser. The app can + now re-prove a factor the same way it already does for second-factor + management: mint a single-use elevation at `POST /api/auth/step-up` with a + TOTP code, security key, or passkey, and send it back in the `X-Step-Up` + header alongside the deletion. The web path is untouched, a token on its own + still gets nowhere, a password-proved elevation is refused for erasure just as + a password login never satisfied the gate on the web, and the proof is spent + only when the erasure is about to run, so a mistyped confirmation does not + burn it. One thing to know when erasing the record over a token: API tokens + are part of what that request deletes, so the app signs itself out and has to + sign in again. - Settings, Sources: four of the sources in the priority ladder were listed by their internal name. `GOOGLE_HEALTH`, `OURA`, `POLAR` and `STRAVA` appeared exactly like that instead of Google Health, Oura, Polar and @@ -24,22 +43,6 @@ stays in the language you read the app in. ### Fixed -- **An account with two-factor can be deleted from the app.** Deleting - the account, and erasing the record while keeping the account, both demand a - fresh second-factor proof once a factor is enrolled. That proof lived on the - session row, which a native client does not have, so anyone who had turned on - TOTP or registered a security key was refused on both endpoints from the app - no matter what they sent — the only way through was a browser. The app can - now re-prove a factor the same way it already does for second-factor - management: mint a single-use elevation at `POST /api/auth/step-up` with a - TOTP code, security key, or passkey, and send it back in the `X-Step-Up` - header alongside the deletion. The web path is untouched, a token on its own - still gets nowhere, a password-proved elevation is refused for erasure just as - a password login never satisfied the gate on the web, and the proof is spent - only when the erasure is about to run, so a mistyped confirmation does not - burn it. One thing to know when erasing the record over a token: API tokens - are part of what that request deletes, so the app signs itself out and has to - sign in again. - **Anthropic keys work again on current Claude models.** Every JSON surface on the Anthropic provider (the daily briefing, the status cards, lab and document extraction, anything that asks the model for a JSON object) had diff --git a/docs/api/openapi.yaml b/docs/api/openapi.yaml index 0c3981f36..7fe801805 100644 --- a/docs/api/openapi.yaml +++ b/docs/api/openapi.yaml @@ -1,7 +1,7 @@ openapi: 3.1.0 info: title: HealthLog API - version: 1.38.2 + version: 1.38.3 description: >- Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest. diff --git a/package.json b/package.json index 460d63cab..2ee73b20e 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "healthlog", - "version": "1.38.2", + "version": "1.38.3", "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.", "license": "PolyForm-Noncommercial-1.0.0", "homepage": "https://healthlog.dev", diff --git a/public/sw.js b/public/sw.js index b04b819b7..ea103ef72 100644 --- a/public/sw.js +++ b/public/sw.js @@ -36,7 +36,7 @@ try { // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild. const CACHE_VERSION = (typeof self !== "undefined" && self.__APP_VERSION__) || - /* @sw-version-fallback */ "v1.38.2"; + /* @sw-version-fallback */ "v1.38.3"; const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`; const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`; // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`