The project licence changes from AGPL-3.0 to the PolyForm Noncommercial
License 1.0.0 for this and future versions: free to use, modify and
self-host for noncommercial purposes; commercial use needs a separate
arrangement. Releases up to and including v1.15.18 were published under
AGPL-3.0 and remain available under that licence. LICENSE carries the
verbatim PolyForm text, and the SPDX identifier is updated in
package.json, the version endpoint, the OpenAPI info block, the image
labels and the README.
- workouts/batch + safeJson: the body cap is a DoS ceiling, not a bound
the worst-case payload always fits under; an extreme GPS-heavy backlog
can exceed it and falls back to smaller batches client-side. Note that
request.text() still buffers the raw body, so the cap bounds the parse
cost, not the initial read.
- .dockerignore: keep LICENSE / LICENSE.md in the image — AGPL-3.0
conveys with the software.
- reminder-worker: the dense walk flag is an operator kill-switch now
that the fold is reworked, not a pending-rework gate.
BuildKit walks the working tree (not the git index), so files like a
local `.env`, `.planning/`, `coverage/`, the e2e Playwright
`storageState.json`, captured HARs, and `.git/` history were all shipped
into the build cache by default. The runner stage doesn't COPY any of
them into the final image, but they sit in the builder layer cache and
leak through any operation that reads cache layers (e.g. `docker save`).
The list mirrors `.gitignore` for the entries that matter, plus the
scratch directories that live in the working tree but aren't version
controlled. `.env.example` and `.env.production.example` stay explicitly
allowed so the documented self-host bootstrap keeps working.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Marc-André Bombeck