release: prepare v1.34.1

CHANGELOG.md

@@ -2,6 +2,49 @@
 
 ## [Unreleased]
 
+## [1.34.1] — 2026-07-29
+
+Security and reliability point release. This release preserves the existing
+authentication, consent and health-data boundaries while hardening the MCP
+scope contract, refresh replay, passkey step-up, SSRF/private-origin checks,
+password-reset revocation and PWA cache isolation.
+
+### Highlights
+
+- Google Health now shows bounded per-resource progress and terminal outcomes;
+  workouts resolve to canonical WHOOP-enriched records without synthetic pulse
+  curves or duplicate full syncs.
+- Medication reminders retain unresolved rolling occurrences as overdue until
+  their exact actionable band ends; exact occurrence identity prevents repeats
+  and duplicate intakes.
+- Intake imports now distinguish source-file capability, completed writes and
+  already-recorded replays. Bounded row details never expose medication facts,
+  credentials, keys or raw health rows.
+- Coach follow-ups and Hero numbers use the current authoritative evidence;
+  future/invalid arrival timestamps cannot win freshness selection.
+- Shared documents, native JSON downloads, public pages under nonce CSP and
+  authenticated PWA cache policy are covered by desktop/mobile regression and
+  accessibility gates.
+
+### Boundaries and residuals
+
+- Nightscout private-network access now requires the exact operator-approved
+  origin and pinned final socket. This is a breaking policy for arbitrary
+  user-selected private origins.
+- Apple ECG remains encrypted, bounded and source-labelled; WHOOP ECG is not
+  inferred. WHOOP pulse aggregates do not create a sample curve.
+- Antonios's provider-specific Google full-sync error remains an open reporter
+  confirmation; this release does not claim that exact external incident is
+  resolved.
+- The five accepted Low paths remain documented in the audit ledger:
+  Coach plaintext titles/provenance, GlitchTip capability URLs, Nightscout
+  token-warning logs and Codex response-body/PHI logs. The Nightscout warning
+  sink is incidentally mitigated by bounded cohort logging in this tree, but
+  still needs a dedicated regression before it is considered closed.
+- Dependency advisories are intentionally deferred to v1.34.2. The dated audit
+  records 19 transitive advisories (9 High, 9 Moderate, 1 Low) without changing
+  the dependency tree in this release.
+
 ## [1.34.0] — 2026-07-28
 
 Two things this release keeps saying to itself. A job, a sync, or a write

docs/api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.34.0
+  version: 1.34.1
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.34.0",
+  "version": "1.34.1",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",
@@ -108,6 +108,7 @@
   "devDependencies": {
     "@axe-core/playwright": "^4.12.1",
     "@next/bundle-analyzer": "^16.2.12",
+    "@openai/codex-security": "^0.1.1",
     "@playwright/test": "^1.60.0",
     "@tailwindcss/postcss": "^4",
     "@testcontainers/postgresql": "^12.0.3",

pnpm-workspace.yaml

@@ -25,3 +25,4 @@ allowBuilds:
 minimumReleaseAgeExclude:
   - "@next/bundle-analyzer@16.2.12"
   - lucide-react@1.27.0
+  - "@openai/codex-security@0.1.1"