From 6fe1a050a6f614c2f15fa8c07e09456f59bcb9db Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Sun, 11 Oct 2026 14:42:03 +0200 Subject: [PATCH] chore(release): v1.42.2 --- CHANGELOG.md | 77 +++++++++++++++++++++++++++++++++++++++++++ docs/api/openapi.yaml | 2 +- package.json | 2 +- public/sw.js | 2 +- 4 files changed, 80 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 388fe5bec..3899f4542 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,82 @@ # Changelog +## [1.42.2] — 2026-10-11 + +Actionable notifications, record search in the command palette, automatic +intake recording, and fixes for Oura, non-UTC databases, documents and +Google Health backfills. + +### Added + +- **Notification tap targets (#1203).** One map resolves a target path per + event type; ntfy carries it as `Click`, Telegram as an "Open in HealthLog" + button on public https (text link on plain http), web push as `url`, + webhook and Gotify as a URL field, email as a link line, APNs as `url`. + No target for guardian deliveries, discreet cycle mode or the silent sync + push. ntfy titles and action labels outside ASCII are sent RFC 2047 + encoded. +- **Notification content preference.** `notificationPrefs.content.detail` + (`generic` default, `detailed`) on `PATCH /api/auth/me/notification-prefs`; + with `detailed` the morning briefing title carries the score. +- **Mood quick answers on ntfy.** Three actions post to + `POST /api/notifications/action/[token]`: an HMAC token bound to user and + answer, valid six hours, single use per reminder, rate limited before + verification, recorded once in the idempotency table so a purged entry + cannot be answered again. Mood entries record source `NOTIFICATION`. A + reminder tapped while acting in another record opens the mood page + without the entry sheet. ntfy messages are published as JSON. +- **Record search (#1117).** `POST /api/search` (query in the body, so it + never appears in a URL or proxy log; read-level access, one search at a + time per account, 20 a minute) searches visits and + procedures, conditions, documents, vaccinations, lab results, medications, + symptoms, workouts and notes, decrypting encrypted text in bounded batches + with a shared time budget, and reports `truncated` when a bound stopped a + source. Matching is case-, accent- and umlaut-spelling-blind and shared + with the MCP `search` tool. The palette lists hits under "In your records"; + each hit deep-links to its entry. Migration 0397 adds a partial index on + live readings that carry a note. +- **Open in new tab (#1202)** for PDF and image originals in the document + vault. +- **Record doses automatically.** `Medication.autoMarkTaken` (with + `autoMarkTakenSince`, migration 0395): a job every 15 minutes records each + due dose as taken from the moment the option is switched on, through the + schedule engine, never over a dose taken, skipped or deleted by hand, with + the same stock and rollup follow-ups as a manual take. Intakes carry + `autoRecorded`; no reminders are sent for such a medication. List and + detail responses carry the resolved `remindersActive`. + +### Fixed + +- **Oura token exchange (#1204).** Codes are exchanged at + `moi.ouraring.com/oauth/v2/ext/oauth-token`; a code issued by that server is + never sent to the legacy endpoint. Refresh falls back to + `api.ouraring.com/oauth/token` once. The callback validates `iss` (RFC 9207). +- **Non-UTC database time zone (#1200).** Every connection (Prisma, pg-boss, + lock and maintenance clients) runs with `TimeZone=UTC`, with a `SET` + fallback when session options are disabled; raw SQL reads the clock as + `NOW() AT TIME ZONE 'UTC'`; boot warns when the session zone is not UTC. +- **Google Health backfill (#1194).** A slice that saved progress enqueues + the next slice and ends without `job.run.failed`; a slice without saved + progress still fails, and the chain stops after collections + 2 slices. +- **Admin AI spend card** sums today's spend on each account's local day. +- **Daily AI budget** is keyed on the account's local day. +- **Day view:** Escape inside the date picker no longer closes the day. + +### Changed + +- Docked strips run the full height, the header search is a magnifier icon, + `g p` toggles the day panel. +- The timeline opens on three months unless the URL names a zoom. +- The explanatory line under day-linked charts is gone. + +### API + +- New: `POST /api/search`, `POST /api/notifications/action/{token}`. +- Medication: `autoMarkTaken`, `autoMarkTakenSince`, `remindersActive`; + intakes and sync intake upserts: `autoRecorded`. +- `notificationPrefs.content.detail` on the notification preferences. +- APNs payloads carry `url` on every visible push. + ## [1.42.1] — 2026-10-10 Fixes for Google Health syncing and the measurement maintenance run. diff --git a/docs/api/openapi.yaml b/docs/api/openapi.yaml index 65f56a177..4c7f73d4d 100644 --- a/docs/api/openapi.yaml +++ b/docs/api/openapi.yaml @@ -1,7 +1,7 @@ openapi: 3.1.0 info: title: HealthLog API - version: 1.42.1 + version: 1.42.2 description: >- Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest. diff --git a/package.json b/package.json index d4f4fd06a..52e5227a7 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "healthlog", - "version": "1.42.1", + "version": "1.42.2", "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.", "license": "PolyForm-Noncommercial-1.0.0", "homepage": "https://healthlog.dev", diff --git a/public/sw.js b/public/sw.js index 71af802bd..02420a92e 100644 --- a/public/sw.js +++ b/public/sw.js @@ -36,7 +36,7 @@ try { // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild. const CACHE_VERSION = (typeof self !== "undefined" && self.__APP_VERSION__) || - /* @sw-version-fallback */ "v1.42.1"; + /* @sw-version-fallback */ "v1.42.2"; const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`; const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`; // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`