chore(release): v1.33.1 — what the app knew and did not say

Eight workstreams, two migrations, and a pass by an independent reader that
found four things this release was claiming about itself that were not true.

Two of the fixes change what people receive. Medication reminders went out
every fifteen minutes because the dedup key could not tell one dose slot from
another, and "handled by the app" was silencing every channel rather than the
one it names. Both are called out in the notes, because a user who set that
flag as a general mute will notice.

Two came from reports: an OpenAI-compatible gateway that the provider list
had no room for, after an earlier answer from us said otherwise, and four
places where a timestamp followed the browser instead of the profile.

The backup half is the one worth reading. Three record types were carried and
could not be restored, or could not be carried at all, and each failed in a
different direction: one dropped silently, one stopped the restore outright,
one was discarded while the restore reported success. What a backup holds is
now declared in one file with a written reason for everything left out, and
the roughly thirty types that are still carried by neither end are named there
instead of waiting to be discovered by someone who needed them.

CHANGELOG.md

@@ -2,6 +2,89 @@
 
 ## [Unreleased]
 
+## [1.33.1] — 2026-07-27
+
+A patch release about the same thing as the one before it: places where the
+app knew something and said something else.
+
+### Two that change what you receive
+
+**Medication reminders arrived every fifteen minutes.** The rule that decides
+whether a reminder has already been sent was keyed on a ledger that could not
+tell one dose slot from another, so an overdue dose kept re-announcing itself
+for as long as it stayed overdue. One account was getting roughly fifty mails
+a day. A reminder now goes out once per dose, per escalation step, per local
+day, and two doses due at the same time no longer replace each other on the
+lock screen.
+
+**"Handled by the app" now silences only the app.** The setting that lets the
+iOS client take over medication reminders was suppressing every channel, so
+switching it on quietly turned off Telegram, ntfy, webhooks, email and web
+push as well. That was never what it said it did. If you have been using it as
+a general mute, those channels will start delivering again, and the setting
+does what its name says.
+
+### Two that were reported
+
+Someone self-hosting could not use an OpenAI-compatible gateway. LiteLLM,
+OpenRouter and vLLM all speak the OpenAI wire, but the provider list had no
+entry that honoured a base URL of your own, and an earlier answer from us said
+otherwise. There is now a provider for exactly this, with its own key, model
+and endpoint. The plain OpenAI entry stays pinned to OpenAI, which a test
+enforces, so a key meant for one never travels to the other.
+
+Timestamps followed the browser rather than the profile in four places. The
+worst of them: a shared report downloaded as a PDF could carry a different
+date than the page it was downloaded from, for the same reading. Charts also
+drew their week and month boundaries in one fixed timezone, so an evening
+reading landed in the wrong bar for anyone living elsewhere.
+
+### The backup
+
+Three things it carried and could not restore, or could not carry at all.
+
+A cycle symptom you created yourself was never included, so on restore its
+key resolved to nothing and the link was dropped without a word. Three lines
+away in the same function, an unknown cycle reference threw an error. Same
+kind of missing reference, two different answers.
+
+A mood factor you created yourself had the opposite ending: the restore
+looked only for the built-in ones, found your own missing, and stopped. The
+file was complete and unusable.
+
+Nutrient day totals have been written into every backup since v1.29 and were
+discarded on restore, silently, while the restore reported success.
+
+What a backup contains is now declared in one place, with a written reason
+for every record type left out. Around thirty types are still carried by
+neither the file nor the restore, and they are named there rather than left
+to be discovered. The export card no longer promises "every record you own",
+because it does not.
+
+### For operators
+
+Two migrations. `0280` adds the gateway provider's columns, `0281` turns the
+integration ledger's single failing-part slot into a set. Neither deletes or
+rewrites a measurement.
+
+A provider that syncs several things separately can now remember every part
+that is failing at once. Until now the last one to report overwrote the rest,
+which is the limit named in the v1.33.0 notes and not fixed then.
+
+Self-hosters can point `GEOLITE2_DIR` at their own GeoLite2 databases. The
+variable was read by the code and missing from the compose whitelist, so it
+never reached the container. The message in the admin area used to tell
+self-hosters to set a secret in this repository, which is not something they
+can do.
+
+### Credit
+
+Reported by @k-nacion (the OpenAI-compatible gateway and the timezone
+rendering), @mathewcsims (the unreachable GeoLite2 setting, found by reading
+the strings inside a running container), @Nazza01 (the dose-history import),
+@doenke (the table under the chart, and for narrowing his own request until it
+fit one release) and @lutzkind (the dashboard layout).
+
 ## [1.33.0] — 2026-07-26
 
 Eight defects, and every one of them had the same shape: something failed

docs/api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.33.0
+  version: 1.33.1
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.33.0",
+  "version": "1.33.1",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",

public/sw.js

@@ -36,7 +36,7 @@ try {
 // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild.
 const CACHE_VERSION =
   (typeof self !== "undefined" && self.__APP_VERSION__) ||
-  /* @sw-version-fallback */ "v1.33.0";
+  /* @sw-version-fallback */ "v1.33.1";
 const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`;
 const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`;
 // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`