chore(release): v1.38.12 — the scanner findings are cleared

Version anchors, the OpenAPI document and the changelog entry for the dependency release.

CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## [1.38.12] — 2026-09-09
+
+A dependency release: the image and the lockfile stop carrying twelve
+advisories the container scanner reported, and `next build` learns to
+type-check the application without the test tree.
+
+### Security
+
+- **Twelve scanner advisories cleared, none in this code.** next 16.2.11
+  carried two critical advisories (fixed in 16.3.3) and pulled a vulnerable
+  sharp; nodemailer 9.0.3 carried one high and three medium; js-yaml 4.3.1
+  one high; hono 4.13.3, under the MCP SDK's node server, three medium; the
+  vitest mocker and baseline-browser-mapping one medium each. Dependabot
+  listed none of them. next moves to 16.3.4, nodemailer to 9.1.1 and vitest
+  to 4.1.11 as direct pins; js-yaml, hono, baseline-browser-mapping and sharp
+  move through pnpm overrides bounded to the vulnerable ranges, so exactly
+  the copies the scanner named change and nothing else does.
+
+### Changed
+
+- **`next build` type-checks the application program, not the test tree.**
+  Next 16.3 checks the whole tsconfig program during the build, which reaches
+  the unit tests under `src/**/__tests__`, their fixtures under `tests/`, and
+  the test-runner configs; the image build context leaves `tests/` and `e2e/`
+  out on purpose, so the image build failed on both architectures with a
+  missing fixture module. The build now reads `tsconfig.build.json`, which
+  extends the main config without that tree. `pnpm typecheck` keeps using
+  `tsconfig.json` and still covers everything.
+
 ## [1.38.11] — 2026-09-08
 
 "Sign out everywhere" now means everywhere, a refresh cannot outrun a

docs/api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.38.11
+  version: 1.38.12
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.38.11",
+  "version": "1.38.12",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",

public/sw.js

@@ -36,7 +36,7 @@ try {
 // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild.
 const CACHE_VERSION =
   (typeof self !== "undefined" && self.__APP_VERSION__) ||
-  /* @sw-version-fallback */ "v1.38.11";
+  /* @sw-version-fallback */ "v1.38.12";
 const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`;
 const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`;
 // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`