tom/HealthLog
1
0 Fork 0
mirror of https://github.com/MBombeck/HealthLog.git synced 2026-11-08 12:32:43 +00:00
Code Issues Packages Projects Releases Wiki Activity
5,756 Commits 11 Branches 539 Tags
e39e2b60c273cb102721cb2c6031a135573c7bf6
Commit Graph
607 Commits
Author SHA1 Message Date
Marc-André Bombeck 08fd7c208f Merge pull request #762 from MBombeck/dependabot/npm_and_yarn/playwright/test-1.62.1 
Bump @playwright/test from 1.60.0 to 1.62.1
 2026-08-16 20:11:17 +02:00
Marc-André Bombeck 2435c9cefe Merge pull request #760 from MBombeck/dependabot/npm_and_yarn/pg-boss-12.27.0 
Bump pg-boss from 12.26.0 to 12.27.0
 2026-08-16 20:10:37 +02:00
dependabot[bot] 552f11c21f Bump @playwright/test from 1.60.0 to 1.62.1 
Bumps [@playwright/test](https://github.com/microsoft/playwright) from 1.60.0 to 1.62.1.
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](https://github.com/microsoft/playwright/compare/v1.60.0...v1.62.1)

---
updated-dependencies:
- dependency-name: "@playwright/test"
  dependency-version: 1.62.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-16 17:27:52 +00:00
dependabot[bot] c9a3132893 Bump testcontainers from 12.0.3 to 12.1.0 
Bumps [testcontainers](https://github.com/testcontainers/testcontainers-node) from 12.0.3 to 12.1.0.
- [Release notes](https://github.com/testcontainers/testcontainers-node/releases)
- [Commits](https://github.com/testcontainers/testcontainers-node/compare/v12.0.3...v12.1.0)

---
updated-dependencies:
- dependency-name: testcontainers
  dependency-version: 12.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-16 17:27:38 +00:00
Marc-André Bombeck 50e4138ed5 Merge pull request #761 from MBombeck/dependabot/npm_and_yarn/testcontainers/postgresql-12.1.0 
Bump @testcontainers/postgresql from 12.0.3 to 12.1.0
 2026-08-16 19:25:17 +02:00
dependabot[bot] 73c3eff294 Bump @testcontainers/postgresql from 12.0.3 to 12.1.0 
Bumps [@testcontainers/postgresql](https://github.com/testcontainers/testcontainers-node) from 12.0.3 to 12.1.0.
- [Release notes](https://github.com/testcontainers/testcontainers-node/releases)
- [Commits](https://github.com/testcontainers/testcontainers-node/compare/v12.0.3...v12.1.0)

---
updated-dependencies:
- dependency-name: "@testcontainers/postgresql"
  dependency-version: 12.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-16 16:41:09 +00:00
dependabot[bot] 238d63f3b9 Bump pg-boss from 12.26.0 to 12.27.0 
Bumps [pg-boss](https://github.com/timgit/pg-boss) from 12.26.0 to 12.27.0.
- [Release notes](https://github.com/timgit/pg-boss/releases)
- [Commits](https://github.com/timgit/pg-boss/compare/12.26.0...12.27.0)

---
updated-dependencies:
- dependency-name: pg-boss
  dependency-version: 12.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-16 16:41:07 +00:00
dependabot[bot] cc670633ff Bump prettier from 3.9.1 to 3.9.6 
Bumps [prettier](https://github.com/prettier/prettier) from 3.9.1 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.9.1...3.9.6)

---
updated-dependencies:
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-16 16:41:05 +00:00
Marc-André Bombeck 23278318ef chore(release): v1.37.24 — the card stops waiting for sleep that never comes 2026-08-16 09:33:42 +02:00
Marc-André Bombeck 370a7b3df8 chore(release): v1.37.23 — postpone reads as an action, not a menu row 2026-08-15 19:29:40 +02:00
Marc-André Bombeck 1a4cff11d2 chore(release): v1.37.22 — two deferred audit findings, closed 2026-08-15 00:36:30 +02:00
Marc-André Bombeck 548e94cc75 chore(release): v1.37.21 — every intake path resolves a dose the same way 2026-08-14 18:42:50 +02:00
Marc-André Bombeck 54afd3e42c chore(release): v1.37.20 — checkups you can postpone, skip, and look back on 2026-08-14 14:28:41 +02:00
Marc-André Bombeck 83fa7856c8 chore(release): v1.37.19 — the supply math agrees with itself 2026-08-14 07:19:43 +02:00
Marc-André Bombeck dd885043c4 chore(release): v1.37.18 — the app stops promising what it does not do 2026-08-14 04:01:21 +02:00
Marc-André Bombeck 82a535c9b5 chore(release): v1.37.17 — the discovery reads days, not readings 2026-08-13 22:58:38 +02:00
Marc-André Bombeck 5d508575c9 chore(release): v1.37.16 — every write reaches every reader 2026-08-13 20:37:28 +02:00
Marc-André Bombeck 297496b517 chore(release): v1.37.15 — async work reports what actually happened 2026-08-13 13:38:44 +02:00
Marc-André Bombeck 499ca2c4b4 chore(release): v1.37.14 — the rail tells today's truth, immediately 2026-08-13 10:05:23 +02:00
Marc-André Bombeck 47b0d340b7 chore(release): v1.37.13 — the record reads honestly under load 2026-08-13 06:19:13 +02:00
Marc-André Bombeck 5191f213f4 chore(release): v1.37.12 — the public privacy policy matches the app 2026-08-11 18:20:18 +02:00
Marc-André Bombeck 1e89b8de9c chore(release): v1.37.11 — one save for the lifestyle context 2026-08-10 10:23:59 +02:00
Marc-André Bombeck 196b37fa78 chore(release): v1.37.10 — one drug, a different dose at each time 2026-08-10 07:59:29 +02:00
Marc-André Bombeck 0de59a7360 chore(release): v1.37.9 — the record you want a paramedic to have 2026-08-10 05:33:51 +02:00
Marc-André Bombeck 4d37ebfc8a chore(release): v1.37.8 — the assistant can answer for your visits 2026-08-10 02:19:59 +02:00
Marc-André Bombeck 0d496aaf86 chore(release): v1.37.7 — runtime GeoLite2 fetch for self-hosters 
A self-hoster on the published image can set MAXMIND_LICENSE_KEY at
runtime and the app fetches the GeoLite2 databases itself, no rebuild or
manual mount. Refs #659.
 2026-08-09 22:31:51 +02:00
Marc-André Bombeck 976c14b223 chore(release): v1.37.6 — the server-side safety pass 
Two hardening changes collected on the trunk: a screening reminder can no
longer be marked done through a crafted request, and editing a custom mood
tag, tag group or cycle symptom now leaves an audit entry the way deleting
one already did.
 2026-08-09 18:01:26 +02:00
Marc-André Bombeck d711392bea chore(release): v1.37.5 — the app-wide UI and copy polish 2026-08-09 13:15:08 +02:00
Marc-André Bombeck 3a03732578 chore(release): v1.37.4 — honest settings copy and doctor-visit polish 2026-08-09 09:27:27 +02:00
Marc-André Bombeck 8d5948ceb3 chore(release): v1.37.3 — the immunization record 2026-08-09 01:55:42 +02:00
Marc-André Bombeck 102845c64a chore(release): v1.37.2 — the mood forecast, doctor visits, and a settings polish 2026-08-08 16:21:39 +02:00
Marc-André Bombeck 035ec054da chore(release): v1.37.1 — five mood values and the range the lab report printed 2026-08-08 05:38:56 +02:00
Marc-André Bombeck 315ca5e67c fix(deps): move the PDF renderer past a script-execution flaw 
pdfjs-dist 6.1.200 and a transitive 5.6.205 both sit in the affected range
of a flaw that lets a crafted PDF run JavaScript inside the renderer. The
document vault feeds it every uploaded PDF, so pin the direct dependency to
6.2.108 and add a bounded override so the transitive copy lands there too.
The override stops short of pdf-parse's 5.4.296, which predates the flaw and
drives the local text-extraction path.

The runtime image ships every pdfjs-dist copy in the store, not just the one
that gets loaded, so an unused transitive copy still counted.

Hoisting in the image picked whichever copy the filesystem listed first, and
more than one copy reaches it, so the version named in package.json was not
reliably the one the renderer resolved. Carry the resolved version forward
from the build stage, select it by name, and fail the build when it is
missing rather than leaving another copy in its place.
 2026-08-07 14:35:23 +02:00
Marc-André Bombeck c3c058074b chore(release): v1.37.0 — share part of a record, or keep one for somebody with no login 2026-08-07 08:25:17 +02:00
Marc-André Bombeck d77a3fe8d7 chore(release): v1.36.1 — a second person can contribute, and the front door works 2026-08-04 11:44:13 +02:00
Marc-André Bombeck f41605efba Close two high advisories on the outbound path 
`undici` moves to 8.10.0 and the `fast-uri` override rises to 3.1.5. Both were
published as high after the last run on the trunk, so this is new information
rather than neglect, and both matter here: undici is what backs `safeFetch`,
which is the one documented egress boundary and the place the connect-time
DNS-rebinding pin lives.

The undici advisory is a cross-user information disclosure and a parse-time
crash through degenerate private cache directives. `fast-uri` arrives four ways
through transitive dependencies and the existing override was pinned one patch
short of the fix.

The safe-fetch dispatcher suite passes against the new client, which is the
part that had to be checked rather than assumed: the pin reaches into undici's
connect hook and a client bump is exactly where that could quietly stop being
enforced.
 2026-08-03 22:10:15 +02:00
dependabot[bot] 9e61e73dec build(deps-dev): bump shadcn from 4.13.0 to 4.16.1 
Bumps [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) from 4.13.0 to 4.16.1.
- [Release notes](https://github.com/shadcn-ui/ui/releases)
- [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md)
- [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.16.1/packages/shadcn)

---
updated-dependencies:
- dependency-name: shadcn
  dependency-version: 4.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-03 16:15:56 +00:00
Marc-André Bombeck a0fc404fb8 Merge pull request #697 from MBombeck/dependabot/npm_and_yarn/tanstack/react-query-5.101.4 
build(deps): bump @tanstack/react-query from 5.101.2 to 5.101.4
 2026-08-03 18:13:01 +02:00
Marc-André Bombeck e621da670c Merge pull request #696 from MBombeck/dependabot/npm_and_yarn/react-hook-form-7.83.0 
build(deps): bump react-hook-form from 7.81.0 to 7.83.0
 2026-08-03 18:12:53 +02:00
Marc-André Bombeck 5da64628ec Merge pull request #695 from MBombeck/dependabot/npm_and_yarn/eslint-config-next-16.2.12 
build(deps-dev): bump eslint-config-next from 16.2.6 to 16.2.12
 2026-08-03 18:12:46 +02:00
dependabot[bot] 15bd7e660a build(deps): bump react-hook-form from 7.81.0 to 7.83.0 
Bumps [react-hook-form](https://github.com/react-hook-form/react-hook-form) from 7.81.0 to 7.83.0.
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](https://github.com/react-hook-form/react-hook-form/compare/v7.81.0...v7.83.0)

---
updated-dependencies:
- dependency-name: react-hook-form
  dependency-version: 7.83.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-03 11:03:27 +00:00
dependabot[bot] ad18303f7e build(deps-dev): bump eslint-config-next from 16.2.6 to 16.2.12 
Bumps [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) from 16.2.6 to 16.2.12.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.2.12/packages/eslint-config-next)

---
updated-dependencies:
- dependency-name: eslint-config-next
  dependency-version: 16.2.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-03 11:03:23 +00:00
dependabot[bot] 02ff6dff2b build(deps): bump @tanstack/react-query from 5.101.2 to 5.101.4 
Bumps [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) from 5.101.2 to 5.101.4.
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.101.4/packages/react-query)

---
updated-dependencies:
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.101.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-03 11:03:20 +00:00
dependabot[bot] 8779fb9cc9 build(deps): bump @prisma/adapter-pg from 7.8.0 to 7.9.1 
Bumps [@prisma/adapter-pg](https://github.com/prisma/prisma/tree/HEAD/packages/adapter-pg) from 7.8.0 to 7.9.1.
- [Release notes](https://github.com/prisma/prisma/releases)
- [Commits](https://github.com/prisma/prisma/commits/7.9.1/packages/adapter-pg)

---
updated-dependencies:
- dependency-name: "@prisma/adapter-pg"
  dependency-version: 7.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-03 11:03:01 +00:00
Marc-André Bombeck 314bf26638 chore(release): v1.36.0 — one record, two people, and a line that says which 2026-08-02 20:28:53 +02:00
Marc-André Bombeck 3cf2cb417f chore(release): v1.35.6 — one line where there were two 2026-08-02 07:29:42 +02:00
Marc-André Bombeck c9ee84e5e4 chore(release): v1.35.5 — a read stops deciding what gets written 2026-08-02 01:30:12 +02:00
Marc-André Bombeck 2618a7ae71 chore(release): v1.35.4 — the checks tell the truth about the calendar and about themselves 2026-08-02 00:38:01 +02:00
Marc-André Bombeck ffe5545032 chore(release): v1.35.3 — an ECG arrives on its own, and only once 
Apple Watch ECG recordings reach the record straight from the app instead of
only through an export archive. One recording per request, gated by the same
switches that already govern reading them.

A recording is now identified by what it is rather than by what a source calls
it, so the same strip arriving through both doors converges on one row. The
migration that adds the constraint resolves the duplicates already stored: it
keeps the row holding the waveform over one holding only a verdict, and moves a
removed row's event link onto the row that is kept. The losing rows are deleted.
 2026-08-01 19:54:08 +02:00
Marc-André Bombeck 99ceb236de chore(release): v1.35.2 — one answer, published 
The cycle ring stops working out its own verdict and reads the server's. The
constant that made that possible is deleted rather than deprecated, because a
constant left in client code is a constant that gets copied again, which is how
the other client's ring froze in the first place.

The score settings page takes the shape the other settings cards have, loses a
pillar that could never score, and turns green where the app's other two scores
already did. A saved selection now comes back as it was sent.

Five gaps in the published specification are closed, including a route that
shipped this morning and was never described at all.
 2026-08-01 12:16:27 +02:00