Commit Graph
6592 Commits
Author SHA1 Message Date
Marc-André Bombeck cb12882aff fix(labs): keep the biomarker picked after "Save and add another" (#1029)
The reset after "Save and add another" cleared the biomarker and passed
the picker `undefined`, which switched it to its own internal state. It
went on showing the marker it last held while the form value was empty,
so the next save refused with "Pick a biomarker first" under a visibly
picked marker, and a later pick could land on the first catalogue entry.

The picker is always controlled now (an empty pick shows the
placeholder), and "Save and add another" keeps the marker, the draw date
and the visit, clearing only the reading, its note and its printed
range. Focus moves to the value field for the next entry.
2026-09-24 08:02:11 +02:00
Marc-André Bombeck e9e060083c fix(cycle): list symptoms one per line with the intensity beside them (#1001)
Selecting a symptom grew its chip inline with the 1-4 intensity
selector, which reflowed the wrapping row and moved the chips after it,
often out from under the finger reaching for the intensity. Each symptom
is now its own row: the toggle on the left, the intensity on the right.
The intensity's space is laid out whether or not it is shown, so a
selection changes colours and reveals it in place and nothing moves.
The intensity stays optional and out of the tab order until the symptom
is picked. Long names wrap instead of truncating.
2026-09-24 08:02:10 +02:00
Marc-André Bombeck 7d25bb7352 fix(cycle): log past dates as themselves, in any order (#1004)
The log sheet took its "Day N" header and its "period ended" button
from the verdict, which is the answer about today. A January date opened
in September read "Day 2", and a back-dated period could only be closed
on dates where today happened to be a bleeding day, so the button came
and went as unrelated months were filled in.

The calendar read now carries, per date, the cycle day of the logged
cycle that date belongs to (null before the first start, after today, or
past the verdict's ceiling for an open cycle) and whether a one-tap
period end can land there. The sheet reads both off the grid day for the
date it opened on.

Saving a new entry with nothing picked used to write an empty row: the
request succeeded, the sheet closed and the calendar had nothing to
draw, which read as a save that did nothing. Save now needs something to
store and says what, and an emptied existing entry still saves. The
sheet also stops writing until the opened date's own entry has loaded,
because until then it held the previous date's row id and a quick Save
patched the wrong day.

On the server, a start recorded a few days after an earlier one is the
same period entered in the other order: opening the earlier start now
folds the later one into it instead of leaving a one-day cycle in front
of it, and a bleed too far before the next start to be its first day and
too close to be a cycle of its own no longer infers a start. Opening or
removing a start re-attributes the day-logs whose cycle changed.
2026-09-24 08:02:00 +02:00
Marc-André Bombeck aa58495cbe Merge pull request #1007 from muhdusama/medfix/apple-health-scheduled-mirror
fix: allow scheduled Apple Health medication mirrors
2026-09-20 23:47:32 +02:00
muhdusama 24ff031f7a fix: preserve legacy compliance response contract 2026-09-21 07:17:13 +10:00
Marc-André Bombeck 50717c567a docs: keep README screenshots on one line (#1022) 2026-09-20 20:15:57 +02:00
dependabot[bot] edb613bf2b chore(deps): bump docker/setup-buildx-action from 4.3.0 to 4.4.1 (#1020)
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 4.3.0 to 4.4.1.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/37fe631027851001ddb9b187196cc803df7f5f0e...f87e5991a6d7451dcb8d9637bfbc97413f497069)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-20 19:00:55 +02:00
dependabot[bot] 9402e48936 chore(deps): bump docker/build-push-action from 7.3.0 to 7.4.0 (#1019)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 7.3.0 to 7.4.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/53b7df96c91f9c12dcc8a07bcb9ccacbed38856a...c3c9e263c25d99ce0380d002d59b67737d91b0dc)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 7.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-20 19:00:44 +02:00
dependabot[bot] 2c640683a7 chore(deps): bump undici from 8.10.0 to 8.10.2 (#1018)
Bumps [undici](https://github.com/nodejs/undici) from 8.10.0 to 8.10.2.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v8.10.0...v8.10.2)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 8.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-20 19:00:31 +02:00
dependabot[bot] fd8431ae47 chore(deps-dev): bump eslint-config-next from 16.2.12 to 16.3.5 (#1015)
Bumps [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) from 16.2.12 to 16.3.5.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.5/packages/eslint-config-next)

---
updated-dependencies:
- dependency-name: eslint-config-next
  dependency-version: 16.3.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-20 18:24:50 +02:00
Marc-André Bombeck 271cebeead Merge pull request #1014 from MBombeck/MBombeck-patch-1
Enhance README with additional images
2026-09-20 17:50:30 +02:00
Marc-André Bombeck 6b1b061b0b Enhance README with additional images
Added images for insights, resting pulse, medications, and coach chat to the README.
2026-09-20 17:22:36 +02:00
Marc-André Bombeck 749f3682c0 Add assets 2026-09-20 17:18:05 +02:00
muhdusama 41d47c3184 fix: mark mirror adherence not applicable 2026-09-20 21:48:20 +10:00
muhdusama c223b6d77d fix: scope Apple Health schedule exemption 2026-09-20 20:46:47 +10:00
Marc-André Bombeck ac59e68a54 Merge pull request #1012 from MBombeck/docs/app-store-links
docs(readme): point at the App Store listing
2026-09-20 11:52:47 +02:00
Marc-André Bombeck 325e94a8f9 docs(readme): point at the App Store listing
The iOS client left public beta. The badge row, the navigation lines and
the iOS section named TestFlight only, which now reads as the single way
in. Both routes stay, with the price and the free-code offer stated
rather than left for someone to discover on the store page.
2026-09-20 11:36:27 +02:00
Marc-André Bombeck 0195c59667 Merge pull request #1010 from MBombeck/release/v1.38.25
Release v1.38.25
v1.38.25
2026-09-20 11:10:30 +02:00
Marc-André Bombeck 4f31b4b025 chore(release): v1.38.25 — readings that never arrived, and an import that said no 2026-09-20 10:53:24 +02:00
Marc-André Bombeck 6291c95b5a Merge pull request #1009 from MBombeck/fix/import-export-xml-name
fix(import): find the export XML whatever iOS named it
2026-09-20 00:33:54 +02:00
Marc-André Bombeck c405f15ef0 fix(import): find the export XML whatever iOS named it
The archive member was matched against the English lowercase spelling
alone. iOS writes that file name in the phone's language and some
versions capitalise it, so an ordinary export could arrive as
Export.xml or a translated name and was refused with a message telling
the reader their export was invalid.

The basename now matches in any capitalisation, and a single XML member
at the top of the archive is taken as the translated spelling. Apple's
clinical-document file never qualifies: it sits beside the real export
and would parse to nothing. When no member qualifies the error lists the
XML members the archive does hold, so the next report arrives with the
answer in it.

Refs #1008
2026-09-20 00:14:26 +02:00
muhdusama 30e454fb83 fix: allow scheduled Apple Health mirrors 2026-09-20 00:26:05 +10:00
Marc-André Bombeck c183d1862e Merge pull request #1003 from MBombeck/fix/cycle-symptom-severity-null
fix(cycle): accept a symptom logged without an intensity
2026-09-18 19:33:22 +02:00
Marc-André Bombeck 6113855b19 chore(openapi): regenerate after the symptom severity change 2026-09-18 19:10:39 +02:00
Marc-André Bombeck bff083f532 fix(cycle): accept a symptom logged without an intensity
Picking a symptom without tapping an intensity is how most of them are
logged. The sheet sends severity null for those, the schema took a number
or nothing at all, and the day log came back 422 with two issues for two
symptoms. All the sheet could say was "Could not save. Try again.", and
the cycle saved fine as soon as the symptoms were removed, which sent
people looking in the wrong place.

Nothing else disagreed: the link row has always stored an unrated symptom
as a plain presence, and the writer already maps a non-number to NULL.
Only the gate at the door refused it, on both the create and the patch
path, and no test touched either schema.

Refs #1001
2026-09-18 18:51:38 +02:00
Marc-André Bombeck 1fe90f3fab Merge pull request #1000 from MBombeck/fix/hk-percent-tolerance
fix(apple-health): take a percent from a fraction or an already-scaled client
2026-09-18 16:58:59 +02:00
Marc-André Bombeck 9d9e8570f7 fix(apple-health): take a percent from a fraction or an already-scaled client
Shipped iOS builds multiply oxygen saturation and body fat by 100 before
upload. The importer scaled them again, so 0.97 was stored as 9700, the
plausibility guard rejected the row as out of range inside an HTTP 200,
and the client treats that skip as final and moves its HealthKit anchor
past the sample. Every reading of those two types was lost, silently, on
every install that syncs them.

The contract says values travel raw and the server scales, and that is
what the OpenAPI description publishes. One comment in the schema said
the opposite, that the client must multiply by 100 first, and that is
the line the app was built against. It is corrected here.

The five percent-shaped HealthKit identifiers now take either spelling:
a value above the fraction ceiling is already a percent and passes
through, anything at or below it is scaled. The domains do not overlap,
and the per-type range guard still rejects what is impossible either
way. Current app builds stop losing readings without an app release.

The tests pin both spellings, the range after conversion, and that the
tolerant converter covers the percent class and nothing else: waist
circumference uses the same factor to turn metres into centimetres, and
a blanket change made a 1.02 m waist into 1.02 cm.

Refs MBombeck/healthlog-iOS#7
2026-09-18 16:40:11 +02:00
Marc-André Bombeck 244d0e4b69 Merge pull request #999 from MBombeck/release/v1.38.24
Release v1.38.24
v1.38.24
2026-09-16 18:48:07 +02:00
Marc-André Bombeck 5188b28ea6 chore(release): v1.38.24 — Insights loads without the assistant, and the database stays current 2026-09-16 18:27:51 +02:00
Marc-André Bombeck bf728ff552 Merge pull request #998 from MBombeck/dependabot/npm_and_yarn/types/node-26.5.1
chore(deps-dev): bump @types/node from 26.1.1 to 26.5.1
2026-09-16 15:47:54 +02:00
Marc-André Bombeck c2ec2b76cf Merge pull request #994 from MBombeck/dependabot/npm_and_yarn/sonner-2.0.8
chore(deps): bump sonner from 2.0.7 to 2.0.8
2026-09-16 15:47:26 +02:00
dependabot[bot] 34182cbb4f chore(deps-dev): bump @types/node from 26.1.1 to 26.5.1
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 26.1.1 to 26.5.1.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.5.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-09-16 13:23:10 +00:00
dependabot[bot] 4ac11c71cb chore(deps): bump sonner from 2.0.7 to 2.0.8
Bumps [sonner](https://github.com/emilkowalski/sonner) from 2.0.7 to 2.0.8.
- [Release notes](https://github.com/emilkowalski/sonner/releases)
- [Commits](https://github.com/emilkowalski/sonner/compare/v2.0.7...v2.0.8)

---
updated-dependencies:
- dependency-name: sonner
  dependency-version: 2.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-09-16 13:10:36 +00:00
Marc-André Bombeck 629731120a Merge pull request #997 from MBombeck/dependabot/npm_and_yarn/jose-6.2.12
chore(deps): bump jose from 6.2.10 to 6.2.12
2026-09-16 15:09:43 +02:00
Marc-André Bombeck c33a88b282 Merge pull request #993 from MBombeck/dependabot/npm_and_yarn/napi-rs/canvas-1.0.9
chore(deps): bump @napi-rs/canvas from 1.0.7 to 1.0.9
2026-09-16 15:09:20 +02:00
Marc-André Bombeck 19ba97e3fc Merge pull request #990 from MBombeck/dependabot/npm_and_yarn/sax-1.6.1
chore(deps): bump sax from 1.6.0 to 1.6.1
2026-09-16 15:08:31 +02:00
dependabot[bot] 9db3770ea3 chore(deps): bump @napi-rs/canvas from 1.0.7 to 1.0.9
Bumps [@napi-rs/canvas](https://github.com/Brooooooklyn/canvas) from 1.0.7 to 1.0.9.
- [Release notes](https://github.com/Brooooooklyn/canvas/releases)
- [Changelog](https://github.com/Brooooooklyn/canvas/blob/main/CHANGELOG.md)
- [Commits](https://github.com/Brooooooklyn/canvas/compare/v1.0.7...v1.0.9)

---
updated-dependencies:
- dependency-name: "@napi-rs/canvas"
  dependency-version: 1.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-09-16 12:06:47 +00:00
dependabot[bot] fade5d467e chore(deps): bump sax from 1.6.0 to 1.6.1
Bumps [sax](https://github.com/isaacs/sax-js) from 1.6.0 to 1.6.1.
- [Commits](https://github.com/isaacs/sax-js/compare/v1.6.0...v1.6.1)

---
updated-dependencies:
- dependency-name: sax
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-09-16 12:06:47 +00:00
dependabot[bot] 453c1141a7 chore(deps): bump jose from 6.2.10 to 6.2.12
Bumps [jose](https://github.com/panva/jose) from 6.2.10 to 6.2.12.
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](https://github.com/panva/jose/compare/v6.2.10...v6.2.12)

---
updated-dependencies:
- dependency-name: jose
  dependency-version: 6.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-09-16 11:54:00 +00:00
Marc-André Bombeck 6f562c05ca Merge pull request #992 from MBombeck/dependabot/npm_and_yarn/nodemailer-10.0.9
chore(deps): bump nodemailer from 9.1.1 to 10.0.9
2026-09-16 13:53:51 +02:00
Marc-André Bombeck 78996e6ba5 Merge pull request #996 from MBombeck/ci/pin-trivy-installer
ci(security): pin and verify the Trivy installer
2026-09-16 13:46:41 +02:00
Marc-André Bombeck 01cc7197fb Merge pull request #995 from MBombeck/chore/postgres-major-ignore
chore(deps): keep PostgreSQL majors out of the update stream
2026-09-16 13:46:37 +02:00
Marc-André Bombeck c79cd3a0ed Merge pull request #982 from MBombeck/fix/insights-without-assistant
fix(insights): keep the overview reads open with the assistant switched off
2026-09-16 13:39:54 +02:00
dependabot[bot] 4b32bad6e9 chore(deps): bump @tanstack/react-virtual from 3.14.5 to 3.14.12 (#991)
Bumps [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) from 3.14.5 to 3.14.12.
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.12/packages/react-virtual)

---
updated-dependencies:
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-16 11:16:53 +00:00
Marc-André Bombeck 3da671c7c3 chore(deps): drop the separate nodemailer types
nodemailer 10 is a TypeScript rewrite and ships its own declarations, so
the hand-added @types/nodemailer package now shadows them with the types
of a release two majors old. The email sender keeps its default import
and its Transporter type from the package itself.

The new floor is Node 20; the image and the engines field are on 22.
2026-09-16 13:08:48 +02:00
Marc-André Bombeck a6b150c36e ci(security): pin and verify the Trivy installer
The Trivy install step piped a script fetched from a tag straight into a
shell. A tag can be moved to other content, so the job ran whatever the
ref pointed at, with the runner's privileges, and the Scorecard check
flagged it as an unpinned download-then-run.

The script now comes from the commit the tag points at, is checked
against its SHA-256 before it runs, and the binary version stays what it
was.
2026-09-16 13:05:21 +02:00
Marc-André Bombeck 6058590872 chore(deps): keep PostgreSQL majors out of the update stream
The compose ecosystem added last change did its job on the first run and
immediately proposed 16.15 to 18.6. A PostgreSQL major changes the
on-disk format, so merging that would hand self-hosters a container that
cannot read their data directory without pg_upgrade or a dump and
restore. Minor releases keep arriving as reviewable PRs; a major is a
project decision with a migration path behind it, not a weekly bump.

The guard grows a case for the ignore rule, so dropping it fails rather
than quietly re-opening the door.
2026-09-16 13:05:14 +02:00
Marc-André Bombeck 2b512501db fix(insights): leave mood out of the trends row when its module is off
The tab strip already hides the Mood pill when the mood module is off, but
the trends row still charted mood, both from a briefing finding and in its
blood pressure / weight / mood fallback. selectTrendCharts now takes the
metrics to leave out, and the overview passes mood when the module is off.

Refs #975
2026-09-16 12:56:09 +02:00
Marc-André Bombeck c7f7a2925f fix(insights): keep the overview reads open with the assistant switched off
With the assistant switched off on the server, the Insights overview did
not load. Its main read, /api/insights/comprehensive, was gated on the
Coach surface, and the derived tiles, the ECG list, strip and live ingest,
and the rhythm events were gated on the status-card surface. The master
flag forces every surface off, so all of them answered 403 and the page
replaced the whole overview with an error.

None of these handlers calls a provider or returns assistant prose. They
now gate on the insights module only, like health-status, labs-changes and
patterns already do. comprehensive had no module gate of its own, only the
Coach gate, so it gains the insights module gate the other five already
call. Routes that serve generated text keep their gate.

The route-gate inventory moves the six files onto the not-Coach-owned
list, four OpenAPI descriptions drop the gate they no longer have, and a
comprehensive test pins a 200 with the master flag off.

Refs #975
2026-09-16 12:55:43 +02:00
dependabot[bot] c46874060d chore(deps): bump nodemailer from 9.1.1 to 10.0.9
Bumps [nodemailer](https://github.com/nodemailer/nodemailer) from 9.1.1 to 10.0.9.
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodemailer/nodemailer/compare/v9.1.1...v10.0.9)

---
updated-dependencies:
- dependency-name: nodemailer
  dependency-version: 10.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-09-16 10:40:05 +00:00