From e5cdd0d483f7dc8024dccd9514cd82583f30fe00 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Thu, 23 Jul 2026 17:24:53 +0200
Subject: [PATCH] =?UTF-8?q?chore(release):=20v1.32.6=20=E2=80=94=20fold=20?=
 =?UTF-8?q?in=20the=20outstanding=20hardening=20and=20data-integrity=20fix?=
 =?UTF-8?q?es?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 CHANGELOG.md          | 29 +++++++++++++++++++++++++++++
 docs/api/openapi.yaml |  2 +-
 package.json          |  2 +-
 public/sw.js          |  2 +-
 4 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 94ef287cc..cde53d9cd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,35 @@
 
 ## [Unreleased]
 
+## [1.32.6] — 2026-07-23
+
+Hardening and data-integrity fixes that were reviewed earlier and are now folded
+into the trunk.
+
+- **Outbound Web Push dials through the guarded network path.** A push endpoint
+  now goes through the same safeFetch wrapper the rest of the app uses, so an
+  operator-configured endpoint cannot be pointed at an internal address.
+- **A bulk mood edit saves all at once.** The mood rows and their tag links are
+  written in one transaction, so a failure part way through no longer leaves a
+  partial save.
+- **Nutrient entries are bounded on write and included in the backup.** Values
+  are range-checked when saved, and the per-day nutrient records now travel with
+  the full backup and restore.
+- **Every response path carries the baseline security headers**, including the
+  early returns that used to skip them.
+- **Provider re-sync tolerates an empty token-refresh body.** Oura, Polar, and
+  Fitbit treat an empty body as transient rather than a hard failure, so a
+  reconnect is not lost to a blank response.
+- **The Coach reply stream aborts cleanly when you navigate away**, and the
+  daily metric series carries its own min and max.
+- Also folded in: the WebAuthn relying-party origin gating (localhost only in
+  development), the medication-compliance point-window bound, a request-time
+  future-date bound on the medication-intake import, and pinned regression tests
+  for the snapshot-cache tenant key, the GlitchTip path-secret redaction, and the
+  Withings credentials delete.
+
+No migrations. No breaking changes.
+
 ## [1.32.5] — 2026-07-23
 
 - **Browser SSO sign-in no longer fails on a duplicated callback.** With the
diff --git a/docs/api/openapi.yaml b/docs/api/openapi.yaml
index 9b737b437..d7381d5b8 100644
--- a/docs/api/openapi.yaml
+++ b/docs/api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.32.5
+  version: 1.32.6
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 
diff --git a/package.json b/package.json
index c47434ba7..b5c8003a3 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.32.5",
+  "version": "1.32.6",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",
diff --git a/public/sw.js b/public/sw.js
index a67fb5689..e0c6020b1 100644
--- a/public/sw.js
+++ b/public/sw.js
@@ -36,7 +36,7 @@ try {
 // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild.
 const CACHE_VERSION =
   (typeof self !== "undefined" && self.__APP_VERSION__) ||
-  /* @sw-version-fallback */ "v1.32.5";
+  /* @sw-version-fallback */ "v1.32.6";
 const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`;
 const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`;
 // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`