tom/HealthLog
1
0 Fork 0
mirror of https://github.com/MBombeck/HealthLog.git synced 2026-11-08 12:32:43 +00:00
Code Issues Packages Projects Releases Wiki Activity
5,858 Commits 11 Branches 539 Tags
7a4e09bb4c59bcf032e256839a508be68fa46aaa
Commit Graph
615 Commits
Author SHA1 Message Date
Marc-André Bombeck 7a4e09bb4c chore(release): v1.37.28 — the parts of a shared record nobody could see 2026-08-24 02:58:23 +02:00
Marc-André Bombeck 5803d16e7d chore(release): v1.37.27 — the checks that were green because they were not checking 2026-08-23 19:44:01 +02:00
Marc-André Bombeck b9fe29c066 Bump knip from 6.16.1 to 6.32.2 
The newer resolver tracks each re-export as its own reference site, so a
barrel line that nothing imports is now reported instead of being counted
as used whenever the underlying symbol was used anywhere. The gate goes
from zero findings to 206 on unchanged code.
 2026-08-23 19:11:12 +02:00
dependabot[bot] 8ecf7e5595 Bump @napi-rs/canvas from 1.0.2 to 1.0.7 (#836) 
Bumps [@napi-rs/canvas](https://github.com/Brooooooklyn/canvas) from 1.0.2 to 1.0.7.
- [Release notes](https://github.com/Brooooooklyn/canvas/releases)
- [Changelog](https://github.com/Brooooooklyn/canvas/blob/main/CHANGELOG.md)
- [Commits](https://github.com/Brooooooklyn/canvas/compare/v1.0.2...v1.0.7)

---
updated-dependencies:
- dependency-name: "@napi-rs/canvas"
  dependency-version: 1.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-23 18:55:24 +02:00
dependabot[bot] b217bb2618 Bump @next/bundle-analyzer from 16.2.12 to 16.3.1 (#834) 
Bumps [@next/bundle-analyzer](https://github.com/vercel/next.js/tree/HEAD/packages/next-bundle-analyzer) from 16.2.12 to 16.3.1.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.1/packages/next-bundle-analyzer)

---
updated-dependencies:
- dependency-name: "@next/bundle-analyzer"
  dependency-version: 16.3.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-23 18:36:00 +02:00
dependabot[bot] ece7253a42 Bump @modelcontextprotocol/sdk from 1.29.0 to 1.30.0 (#831) 
Bumps [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) from 1.29.0 to 1.30.0.
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.29.0...1.30.0)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-23 18:29:10 +02:00
Marc-André Bombeck fed37829e2 chore(release): v1.37.26 — the app reads what you wrote, in every language it offers 2026-08-23 15:35:33 +02:00
Marc-André Bombeck 590911ca72 chore(release): v1.37.25 — the Coach stops answering with numbers it cannot check 2026-08-22 16:49:04 +02:00
Marc-André Bombeck 08fd7c208f Merge pull request #762 from MBombeck/dependabot/npm_and_yarn/playwright/test-1.62.1 
Bump @playwright/test from 1.60.0 to 1.62.1
 2026-08-16 20:11:17 +02:00
Marc-André Bombeck 2435c9cefe Merge pull request #760 from MBombeck/dependabot/npm_and_yarn/pg-boss-12.27.0 
Bump pg-boss from 12.26.0 to 12.27.0
 2026-08-16 20:10:37 +02:00
dependabot[bot] 552f11c21f Bump @playwright/test from 1.60.0 to 1.62.1 
Bumps [@playwright/test](https://github.com/microsoft/playwright) from 1.60.0 to 1.62.1.
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](https://github.com/microsoft/playwright/compare/v1.60.0...v1.62.1)

---
updated-dependencies:
- dependency-name: "@playwright/test"
  dependency-version: 1.62.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-16 17:27:52 +00:00
dependabot[bot] c9a3132893 Bump testcontainers from 12.0.3 to 12.1.0 
Bumps [testcontainers](https://github.com/testcontainers/testcontainers-node) from 12.0.3 to 12.1.0.
- [Release notes](https://github.com/testcontainers/testcontainers-node/releases)
- [Commits](https://github.com/testcontainers/testcontainers-node/compare/v12.0.3...v12.1.0)

---
updated-dependencies:
- dependency-name: testcontainers
  dependency-version: 12.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-16 17:27:38 +00:00
Marc-André Bombeck 50e4138ed5 Merge pull request #761 from MBombeck/dependabot/npm_and_yarn/testcontainers/postgresql-12.1.0 
Bump @testcontainers/postgresql from 12.0.3 to 12.1.0
 2026-08-16 19:25:17 +02:00
dependabot[bot] 73c3eff294 Bump @testcontainers/postgresql from 12.0.3 to 12.1.0 
Bumps [@testcontainers/postgresql](https://github.com/testcontainers/testcontainers-node) from 12.0.3 to 12.1.0.
- [Release notes](https://github.com/testcontainers/testcontainers-node/releases)
- [Commits](https://github.com/testcontainers/testcontainers-node/compare/v12.0.3...v12.1.0)

---
updated-dependencies:
- dependency-name: "@testcontainers/postgresql"
  dependency-version: 12.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-16 16:41:09 +00:00
dependabot[bot] 238d63f3b9 Bump pg-boss from 12.26.0 to 12.27.0 
Bumps [pg-boss](https://github.com/timgit/pg-boss) from 12.26.0 to 12.27.0.
- [Release notes](https://github.com/timgit/pg-boss/releases)
- [Commits](https://github.com/timgit/pg-boss/compare/12.26.0...12.27.0)

---
updated-dependencies:
- dependency-name: pg-boss
  dependency-version: 12.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-16 16:41:07 +00:00
dependabot[bot] cc670633ff Bump prettier from 3.9.1 to 3.9.6 
Bumps [prettier](https://github.com/prettier/prettier) from 3.9.1 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.9.1...3.9.6)

---
updated-dependencies:
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-16 16:41:05 +00:00
Marc-André Bombeck 23278318ef chore(release): v1.37.24 — the card stops waiting for sleep that never comes 2026-08-16 09:33:42 +02:00
Marc-André Bombeck 370a7b3df8 chore(release): v1.37.23 — postpone reads as an action, not a menu row 2026-08-15 19:29:40 +02:00
Marc-André Bombeck 1a4cff11d2 chore(release): v1.37.22 — two deferred audit findings, closed 2026-08-15 00:36:30 +02:00
Marc-André Bombeck 548e94cc75 chore(release): v1.37.21 — every intake path resolves a dose the same way 2026-08-14 18:42:50 +02:00
Marc-André Bombeck 54afd3e42c chore(release): v1.37.20 — checkups you can postpone, skip, and look back on 2026-08-14 14:28:41 +02:00
Marc-André Bombeck 83fa7856c8 chore(release): v1.37.19 — the supply math agrees with itself 2026-08-14 07:19:43 +02:00
Marc-André Bombeck dd885043c4 chore(release): v1.37.18 — the app stops promising what it does not do 2026-08-14 04:01:21 +02:00
Marc-André Bombeck 82a535c9b5 chore(release): v1.37.17 — the discovery reads days, not readings 2026-08-13 22:58:38 +02:00
Marc-André Bombeck 5d508575c9 chore(release): v1.37.16 — every write reaches every reader 2026-08-13 20:37:28 +02:00
Marc-André Bombeck 297496b517 chore(release): v1.37.15 — async work reports what actually happened 2026-08-13 13:38:44 +02:00
Marc-André Bombeck 499ca2c4b4 chore(release): v1.37.14 — the rail tells today's truth, immediately 2026-08-13 10:05:23 +02:00
Marc-André Bombeck 47b0d340b7 chore(release): v1.37.13 — the record reads honestly under load 2026-08-13 06:19:13 +02:00
Marc-André Bombeck 5191f213f4 chore(release): v1.37.12 — the public privacy policy matches the app 2026-08-11 18:20:18 +02:00
Marc-André Bombeck 1e89b8de9c chore(release): v1.37.11 — one save for the lifestyle context 2026-08-10 10:23:59 +02:00
Marc-André Bombeck 196b37fa78 chore(release): v1.37.10 — one drug, a different dose at each time 2026-08-10 07:59:29 +02:00
Marc-André Bombeck 0de59a7360 chore(release): v1.37.9 — the record you want a paramedic to have 2026-08-10 05:33:51 +02:00
Marc-André Bombeck 4d37ebfc8a chore(release): v1.37.8 — the assistant can answer for your visits 2026-08-10 02:19:59 +02:00
Marc-André Bombeck 0d496aaf86 chore(release): v1.37.7 — runtime GeoLite2 fetch for self-hosters 
A self-hoster on the published image can set MAXMIND_LICENSE_KEY at
runtime and the app fetches the GeoLite2 databases itself, no rebuild or
manual mount. Refs #659.
 2026-08-09 22:31:51 +02:00
Marc-André Bombeck 976c14b223 chore(release): v1.37.6 — the server-side safety pass 
Two hardening changes collected on the trunk: a screening reminder can no
longer be marked done through a crafted request, and editing a custom mood
tag, tag group or cycle symptom now leaves an audit entry the way deleting
one already did.
 2026-08-09 18:01:26 +02:00
Marc-André Bombeck d711392bea chore(release): v1.37.5 — the app-wide UI and copy polish 2026-08-09 13:15:08 +02:00
Marc-André Bombeck 3a03732578 chore(release): v1.37.4 — honest settings copy and doctor-visit polish 2026-08-09 09:27:27 +02:00
Marc-André Bombeck 8d5948ceb3 chore(release): v1.37.3 — the immunization record 2026-08-09 01:55:42 +02:00
Marc-André Bombeck 102845c64a chore(release): v1.37.2 — the mood forecast, doctor visits, and a settings polish 2026-08-08 16:21:39 +02:00
Marc-André Bombeck 035ec054da chore(release): v1.37.1 — five mood values and the range the lab report printed 2026-08-08 05:38:56 +02:00
Marc-André Bombeck 315ca5e67c fix(deps): move the PDF renderer past a script-execution flaw 
pdfjs-dist 6.1.200 and a transitive 5.6.205 both sit in the affected range
of a flaw that lets a crafted PDF run JavaScript inside the renderer. The
document vault feeds it every uploaded PDF, so pin the direct dependency to
6.2.108 and add a bounded override so the transitive copy lands there too.
The override stops short of pdf-parse's 5.4.296, which predates the flaw and
drives the local text-extraction path.

The runtime image ships every pdfjs-dist copy in the store, not just the one
that gets loaded, so an unused transitive copy still counted.

Hoisting in the image picked whichever copy the filesystem listed first, and
more than one copy reaches it, so the version named in package.json was not
reliably the one the renderer resolved. Carry the resolved version forward
from the build stage, select it by name, and fail the build when it is
missing rather than leaving another copy in its place.
 2026-08-07 14:35:23 +02:00
Marc-André Bombeck c3c058074b chore(release): v1.37.0 — share part of a record, or keep one for somebody with no login 2026-08-07 08:25:17 +02:00
Marc-André Bombeck d77a3fe8d7 chore(release): v1.36.1 — a second person can contribute, and the front door works 2026-08-04 11:44:13 +02:00
Marc-André Bombeck f41605efba Close two high advisories on the outbound path 
`undici` moves to 8.10.0 and the `fast-uri` override rises to 3.1.5. Both were
published as high after the last run on the trunk, so this is new information
rather than neglect, and both matter here: undici is what backs `safeFetch`,
which is the one documented egress boundary and the place the connect-time
DNS-rebinding pin lives.

The undici advisory is a cross-user information disclosure and a parse-time
crash through degenerate private cache directives. `fast-uri` arrives four ways
through transitive dependencies and the existing override was pinned one patch
short of the fix.

The safe-fetch dispatcher suite passes against the new client, which is the
part that had to be checked rather than assumed: the pin reaches into undici's
connect hook and a client bump is exactly where that could quietly stop being
enforced.
 2026-08-03 22:10:15 +02:00
dependabot[bot] 9e61e73dec build(deps-dev): bump shadcn from 4.13.0 to 4.16.1 
Bumps [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) from 4.13.0 to 4.16.1.
- [Release notes](https://github.com/shadcn-ui/ui/releases)
- [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md)
- [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.16.1/packages/shadcn)

---
updated-dependencies:
- dependency-name: shadcn
  dependency-version: 4.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-03 16:15:56 +00:00
Marc-André Bombeck a0fc404fb8 Merge pull request #697 from MBombeck/dependabot/npm_and_yarn/tanstack/react-query-5.101.4 
build(deps): bump @tanstack/react-query from 5.101.2 to 5.101.4
 2026-08-03 18:13:01 +02:00
Marc-André Bombeck e621da670c Merge pull request #696 from MBombeck/dependabot/npm_and_yarn/react-hook-form-7.83.0 
build(deps): bump react-hook-form from 7.81.0 to 7.83.0
 2026-08-03 18:12:53 +02:00
Marc-André Bombeck 5da64628ec Merge pull request #695 from MBombeck/dependabot/npm_and_yarn/eslint-config-next-16.2.12 
build(deps-dev): bump eslint-config-next from 16.2.6 to 16.2.12
 2026-08-03 18:12:46 +02:00
dependabot[bot] 15bd7e660a build(deps): bump react-hook-form from 7.81.0 to 7.83.0 
Bumps [react-hook-form](https://github.com/react-hook-form/react-hook-form) from 7.81.0 to 7.83.0.
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](https://github.com/react-hook-form/react-hook-form/compare/v7.81.0...v7.83.0)

---
updated-dependencies:
- dependency-name: react-hook-form
  dependency-version: 7.83.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-03 11:03:27 +00:00
dependabot[bot] ad18303f7e build(deps-dev): bump eslint-config-next from 16.2.6 to 16.2.12 
Bumps [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) from 16.2.6 to 16.2.12.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.2.12/packages/eslint-config-next)

---
updated-dependencies:
- dependency-name: eslint-config-next
  dependency-version: 16.2.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-03 11:03:23 +00:00