From b8a3890ef4382f729d0933401687ce419eaf757f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Wed, 9 Sep 2026 19:19:50 +0200
Subject: [PATCH] =?UTF-8?q?chore(release):=20v1.38.12=20=E2=80=94=20the=20?=
 =?UTF-8?q?scanner=20findings=20are=20cleared?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Version anchors, the OpenAPI document and the changelog entry for the dependency release.
---
 CHANGELOG.md          | 29 +++++++++++++++++++++++++++++
 docs/api/openapi.yaml |  2 +-
 package.json          |  2 +-
 public/sw.js          |  2 +-
 4 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7e3b5817a..08914f206 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,34 @@
 # Changelog
 
+## [1.38.12] — 2026-09-09
+
+A dependency release: the image and the lockfile stop carrying twelve
+advisories the container scanner reported, and `next build` learns to
+type-check the application without the test tree.
+
+### Security
+
+- **Twelve scanner advisories cleared, none in this code.** next 16.2.11
+  carried two critical advisories (fixed in 16.3.3) and pulled a vulnerable
+  sharp; nodemailer 9.0.3 carried one high and three medium; js-yaml 4.3.1
+  one high; hono 4.13.3, under the MCP SDK's node server, three medium; the
+  vitest mocker and baseline-browser-mapping one medium each. Dependabot
+  listed none of them. next moves to 16.3.4, nodemailer to 9.1.1 and vitest
+  to 4.1.11 as direct pins; js-yaml, hono, baseline-browser-mapping and sharp
+  move through pnpm overrides bounded to the vulnerable ranges, so exactly
+  the copies the scanner named change and nothing else does.
+
+### Changed
+
+- **`next build` type-checks the application program, not the test tree.**
+  Next 16.3 checks the whole tsconfig program during the build, which reaches
+  the unit tests under `src/**/__tests__`, their fixtures under `tests/`, and
+  the test-runner configs; the image build context leaves `tests/` and `e2e/`
+  out on purpose, so the image build failed on both architectures with a
+  missing fixture module. The build now reads `tsconfig.build.json`, which
+  extends the main config without that tree. `pnpm typecheck` keeps using
+  `tsconfig.json` and still covers everything.
+
 ## [1.38.11] — 2026-09-08
 
 "Sign out everywhere" now means everywhere, a refresh cannot outrun a
diff --git a/docs/api/openapi.yaml b/docs/api/openapi.yaml
index 218517c87..ae5eff259 100644
--- a/docs/api/openapi.yaml
+++ b/docs/api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.38.11
+  version: 1.38.12
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 
diff --git a/package.json b/package.json
index 55be0e676..ceb8f13f9 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.38.11",
+  "version": "1.38.12",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",
diff --git a/public/sw.js b/public/sw.js
index 2630a9bf1..cf6393427 100644
--- a/public/sw.js
+++ b/public/sw.js
@@ -36,7 +36,7 @@ try {
 // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild.
 const CACHE_VERSION =
   (typeof self !== "undefined" && self.__APP_VERSION__) ||
-  /* @sw-version-fallback */ "v1.38.11";
+  /* @sw-version-fallback */ "v1.38.12";
 const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`;
 const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`;
 // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`