From 2706a978381b4ac8637445457cc99f61c17a3a33 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Fri, 10 Jul 2026 00:28:12 +0200 Subject: [PATCH] =?UTF-8?q?chore(release):=20v1.28.13=20=E2=80=94=20sharin?= =?UTF-8?q?g=20a=20document=20shares=20only=20the=20document?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A link created from a document is now document-only: the create route forces an empty report scope and the served view never aggregates a report, so the recipient sees the attached document and no health data. Sharing from Settings keeps the full record form. Earlier document links carry the full record and should be revoked and re-created. --- CHANGELOG.md | 9 +++++++++ docs/api/openapi.yaml | 2 +- package.json | 2 +- public/sw.js | 2 +- 4 files changed, 12 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 40d8c00c9..c4f45e725 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,15 @@ ## [Unreleased] +## [1.28.13] — 2026-07-10 — Sharing a document shares only the document + +Fixes a scope bug: a link created from a document carried the full health record +(vital signs, labs, medications) because an empty report scope was read as "all +sections". A document share is now document-only — it serves the attached +document and no health data — while sharing from Settings keeps the full record +form. NOTE: revoke and re-create any document link made before this release; an +earlier link cannot be narrowed retroactively. + ## [1.28.12] — 2026-07-09 — Lab scans use your AI provider; tidier dashboard Scanning a lab report now uses the AI provider you already configured — including diff --git a/docs/api/openapi.yaml b/docs/api/openapi.yaml index 9c922c3e0..07a59a596 100644 --- a/docs/api/openapi.yaml +++ b/docs/api/openapi.yaml @@ -1,7 +1,7 @@ openapi: 3.1.0 info: title: HealthLog API - version: 1.28.12 + version: 1.28.13 description: >- Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest. diff --git a/package.json b/package.json index f943bfeef..2d3cde4f6 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "healthlog", - "version": "1.28.12", + "version": "1.28.13", "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.", "license": "PolyForm-Noncommercial-1.0.0", "homepage": "https://healthlog.dev", diff --git a/public/sw.js b/public/sw.js index 37dda533d..1ada9a62c 100644 --- a/public/sw.js +++ b/public/sw.js @@ -36,7 +36,7 @@ try { // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild. const CACHE_VERSION = (typeof self !== "undefined" && self.__APP_VERSION__) || - /* @sw-version-fallback */ "v1.28.12"; + /* @sw-version-fallback */ "v1.28.13"; const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`; const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`; // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`