From 6f4e39acf696c2273bdd186ff3cb0eed61fbe284 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Tue, 15 Sep 2026 23:01:17 +0200
Subject: [PATCH] =?UTF-8?q?chore(release):=20v1.38.23=20=E2=80=94=20MCP=20?=
 =?UTF-8?q?connects=20from=20Chrome=20again,=20and=20lab=20scans=20can=20g?=
 =?UTF-8?q?o=20past=20six=20an=20hour?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 CHANGELOG.md          | 40 ++++++++++++++++++++++++++++++++++++++++
 docs/api/openapi.yaml |  2 +-
 package.json          |  2 +-
 public/sw.js          |  2 +-
 4 files changed, 43 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 748a3bde4..4e4de399e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,45 @@
 # Changelog
 
+## [1.38.23] — 2026-09-15
+
+Connecting an AI assistant through MCP works in Chrome and Edge again, and
+lab-report scans can be raised past six an hour.
+
+### Fixed
+
+- **Connecting an AI assistant through MCP works in Chrome and Edge again.**
+  After you pressed Allow on the consent screen, the grant went through but
+  the browser stayed on the page and never returned to the assistant, so
+  claude.ai and other clients waited forever. The consent page carried a
+  security policy that only allowed its own address as a form target, and
+  Chromium-based browsers apply that to the redirect back to the client as
+  well. The consent page now allows exactly the return address it has
+  checked against the connecting client, and nothing else. If you added a
+  reverse-proxy rule to work around this, you can remove it. Thanks to
+  @Mark-Milkis for tracking it down in #983.
+- **A lab scan that never reached the AI no longer uses up one of your
+  scans.** A file that was too large, not an image or PDF, a PDF that could
+  not be rendered, or a scan the daily AI budget turned away still counted
+  against the hourly limit. Only scans that are actually sent to the provider
+  count now.
+
+### Added
+
+- **If you host this yourself, you can raise the lab-scan limit.** Scanning a
+  stack of reports after a doctor's visit ran into a fixed six scans an hour.
+  Set `LABS_OCR_LIMIT_PER_HOUR` to allow more (default 6, between 1 and 1000),
+  the same way `DOCUMENT_AI_LIMIT_PER_HOUR` works for documents. The daily AI
+  budget still bounds the cost. Thanks to @rkerian for #985.
+
+### Changed
+
+- **If you write against the API**, the redirect after the MCP consent
+  decision is now `303 See Other` instead of `302`. The 429 from
+  `POST /api/labs/ocr/extract` now also carries `meta.retryAt`.
+- Prisma moves to 7.10 for the app, its client and the migration tool in the
+  image, together with updates to Playwright, lucide-react, pdfjs and the CI
+  actions. Nothing changes in how the app behaves.
+
 ## [1.38.22] — 2026-09-13
 
 A channel test no longer runs on settings you have not saved.
diff --git a/docs/api/openapi.yaml b/docs/api/openapi.yaml
index 2a78a0b1f..c0de7bf46 100644
--- a/docs/api/openapi.yaml
+++ b/docs/api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.38.22
+  version: 1.38.23
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 
diff --git a/package.json b/package.json
index 701d88780..21ac7b8df 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.38.22",
+  "version": "1.38.23",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",
diff --git a/public/sw.js b/public/sw.js
index c0cc236fa..c5bf23928 100644
--- a/public/sw.js
+++ b/public/sw.js
@@ -36,7 +36,7 @@ try {
 // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild.
 const CACHE_VERSION =
   (typeof self !== "undefined" && self.__APP_VERSION__) ||
-  /* @sw-version-fallback */ "v1.38.22";
+  /* @sw-version-fallback */ "v1.38.23";
 const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`;
 const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`;
 // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`