chore(release): v1.28.13 — sharing a document shares only the document

A link created from a document is now document-only: the create route forces an
empty report scope and the served view never aggregates a report, so the
recipient sees the attached document and no health data. Sharing from Settings
keeps the full record form. Earlier document links carry the full record and
should be revoked and re-created.

CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+## [1.28.13] — 2026-07-10 — Sharing a document shares only the document
+
+Fixes a scope bug: a link created from a document carried the full health record
+(vital signs, labs, medications) because an empty report scope was read as "all
+sections". A document share is now document-only — it serves the attached
+document and no health data — while sharing from Settings keeps the full record
+form. NOTE: revoke and re-create any document link made before this release; an
+earlier link cannot be narrowed retroactively.
+
 ## [1.28.12] — 2026-07-09 — Lab scans use your AI provider; tidier dashboard
 
 Scanning a lab report now uses the AI provider you already configured — including

docs/api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.28.12
+  version: 1.28.13
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.28.12",
+  "version": "1.28.13",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",

public/sw.js

@@ -36,7 +36,7 @@ try {
 // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild.
 const CACHE_VERSION =
   (typeof self !== "undefined" && self.__APP_VERSION__) ||
-  /* @sw-version-fallback */ "v1.28.12";
+  /* @sw-version-fallback */ "v1.28.13";
 const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`;
 const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`;
 // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`