chore(release): v1.32.3 — native step-up elevations for iOS 2FA management

CHANGELOG.md

@@ -2,6 +2,27 @@
 
 ## [Unreleased]
 
+## [1.32.3] — 2026-07-23
+
+Security release. It ships on its own so the change to how a second factor is
+proven can be watched in isolation.
+
+- **A native client can manage its own second factor.** The iOS app can now
+  turn two-factor authentication on or off, add or remove a security key, and
+  regenerate recovery codes over its API session — actions that were reachable
+  only from a browser before. It does so through a short-lived, single-use
+  elevation the app earns by re-proving a factor, never by presenting its
+  token alone.
+- **The re-proved factor decides what the elevation reaches.** Re-proving with
+  a password reaches exactly what a plain browser session reaches; the actions
+  a browser gates behind a completed second factor now require the same over
+  the API — a re-proved TOTP code or security key, never the password alone.
+  Administrative endpoints remain reachable only from a browser session,
+  unchanged.
+
+One migration (0267), additive. Addresses the native 2FA-management gap
+(healthlog-iOS #57).
+
 ## [1.32.2] — 2026-07-23
 
 Security release. Ships on its own and ahead of everything queued, because it

docs/api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.32.2
+  version: 1.32.3
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.32.2",
+  "version": "1.32.3",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",

public/sw.js

@@ -36,7 +36,7 @@ try {
 // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild.
 const CACHE_VERSION =
   (typeof self !== "undefined" && self.__APP_VERSION__) ||
-  /* @sw-version-fallback */ "v1.32.2";
+  /* @sw-version-fallback */ "v1.32.3";
 const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`;
 const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`;
 // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`