The project licence changes from AGPL-3.0 to the PolyForm Noncommercial
License 1.0.0 for this and future versions: free to use, modify and
self-host for noncommercial purposes; commercial use needs a separate
arrangement. Releases up to and including v1.15.18 were published under
AGPL-3.0 and remain available under that licence. LICENSE carries the
verbatim PolyForm text, and the SPDX identifier is updated in
package.json, the version endpoint, the OpenAPI info block, the image
labels and the README.
openssl rand -base64 24 can emit URI-reserved characters (/, +, =). Since POSTGRES_PASSWORD is interpolated unescaped into DATABASE_URL, such a password breaks the connection URL and blocks boot. Switch every documented example to openssl rand -hex 32 (URL-safe, 256-bit).
Rewrite the CONTRIBUTING branch-model section from the retired develop->main
model to the current trunk-based model: main is the single long-lived branch,
short-lived release/vX.Y.Z branches merge to main, the tag triggers the GHCR
build. Correct the schema model count in CLAUDE.md from 47 to 61 (the real
count of model declarations in prisma/schema.prisma) and refresh the stale
current-line marker.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a table of contents to the README, extend the comparison matrix with
WHOOP and Google Health/Fitbit columns plus rows for multi-source dedup,
provider aggregation, and encryption at rest, and add a CI status badge.
Reconcile two stale claims against the current code: the Prisma model
count (now 60) and the AI architecture note (add Codex). Strengthen the
Security and Privacy section with the bring-your-own-key / local-endpoint
AI posture.
Add .github/FUNDING.yml so the GitHub Sponsor button renders, and fix the
contributor prerequisite to Node.js 22 to match the Dockerfile base image.
(cherry picked from commit 7cfe326709814dd0ce16d1554d5afd5933de448c)
Consolidated hotfix landing the findings from a six-axis audit
covering mobile security, UX + accessibility, code quality + docs,
README + discoverability, web performance, and mobile-deep responsive
behaviour. None of the changes break the public API or the existing
data shape; every fix is additive and SAFE under the v1.4.34.x web
freeze. Full audit reports live in `.planning/round-audit-*.md`.
Security
- Password rotation now wipes API tokens + refresh tokens in the
same `$transaction` as session revocation. A stolen iOS Bearer no
longer survives a user-initiated password change or an admin reset.
- `/.well-known/` proxy bypass tightened to an explicit-allowlist
`Set`. Stale `/api/auth/codex/callback` PUBLIC_PATHS entry dropped.
- HSTS gains `preload`. Withings host removed from the global CSP
and gated to the integration's own routes.
- `getClientIp` warns once per process on `TRUST_PROXY_HOPS`/XFF
mismatch + exposes a tagged helper for tighter universal buckets.
- Service worker rejects off-origin notification-click URLs. Offline
fallback body switched to a locale-neutral icon. Manifest gains
`scope`, `id`, `display_override`.
UX + accessibility
- i18n leaks closed on Dialog/Sheet close-X, ChartSkeleton's loading
announcement, and the notifications-section breadcrumb.
- Focus rings on bottom-nav, the More overflow button, and the
mobile top-bar user menu.
- Tap-target floor: Input / NativeSelect / Select / DateTimeInput
switch to `h-11 sm:h-10`.
- Admin chip-strip auto-scroll-into-view (matches v1.4.33 settings).
- List-page subtitles visible on mobile.
- Insights empty-state CTA vocabulary normalised so the link opens
the right measurement form (was silently failing for
BODY_TEMPERATURE / BLOOD_GLUCOSE / PULSE).
Mobile-deep
- `viewport.themeColor` reacts to light/dark mode.
- TopBar + Coach FAB reserve safe-area-inset-top / -bottom for
notched iPhones.
- Sonner toaster switches to `theme="system"`.
Code quality
- `SESSION_SECRET` dropped — the env var was documented as required
but never read by code. Three secrets, not four. Self-hosters
upgrading can delete the existing line.
- `toJson<T>()` helper consolidates seven Prisma JSON-cast sites.
- `db-compat.ts` gains a header docstring naming it the
schema-bootstrap path.
- Passkey response types adopted from `@simplewebauthn/server`;
`any` + eslint-disable pragmas drop out.
- Zero-TODO CI gate added at `.github/workflows/no-todo-markers.yml`.
Documentation + discoverability
- README rework: How-it-compares matrix, Apple Health + AI Coach
promoted to standalone Key-Features bullets, status block, latest
release + GHCR badges, OpenAPI pointer, three-secret Quick Start.
- openGraph + twitter cards now carry `images` and a
`summary_large_image` Twitter card.
- GitHub repo metadata: description tightened from 290 to 156
chars + keyword-front, `homepageUrl` flipped from a personal
tenant to the demo site, six generic / PII-adjacent topics
swapped for six high-intent ones.
- Five new user-facing docs: `docs/self-hosting/getting-started.md`,
`docs/self-hosting/reverse-proxy.md`,
`docs/integrations/apple-health.md`,
`docs/integrations/withings.md`,
`docs/integrations/ai-providers.md`.
- `docs/README.md` clarifies the docs tree as internal playbooks
vs the user-facing `docs.healthlog.dev` site.
Largest feature delta in the v1.4.x line. Insights expands into seven dedicated metric sub-pages; GLP-1 medication tracking lands end-to-end (drug-level chart with Research Mode acknowledgment, EMA titration ladder, cadence + compliance, side-effect taxonomy, pen/vial inventory); cross-source priority becomes a two-axis resolver; per-user timezone threads through ten analytics surfaces; Withings activity + sleep v2 sync; onboarding rebuilt as a nested-route wizard; Personal Records ship end-to-end; Health Score provenance accordion; Coach runs native first-party prompts across six locales with a 1800-assertion refusal-probe matrix; OpenAPI drift gate hard-fails; multi-arch GHCR image. Migrations 0043 through 0060 are additive and forward-only. PROMPT_VERSION 4.24.0 → 4.25.0 with GROUND RULE 9 (refuses dose recommendations) and GROUND RULE 15 (refuses drug-level estimates with MDR + MDCG 2021-24 cites).
See CHANGELOG.md for the full per-section delta.
Maintainer-voice sweep across `src/`. ~190 references to the
maintainer by first name in code comments and JSDoc neutralised to
"the maintainer", "the live tenant", "users", or "the user" depending
on context. Three sed passes covering ~50 distinct patterns
(`Marc reported`, `Marc wants`, `Marc kept`, `Marc rolled back`, etc.).
Test fixtures (`displayName: "Marc B."`, `username: "marc"`,
`<HeroStrip userName="Marc">`) kept as opaque test data per the brief.
CHANGELOG normalisation. The v1.4.14 + v1.4.15 entries paired a
German bullet with its English translation by historical design — the
in-app copy is English-default and the user docs are English, so the
mixed-language style was a holdover from the early-marathon notes.
A one-off node script extracted the `_..._` English paragraph from
each bilingual bullet and rewrote the entry as that text. ~44 bullets
reduced; one Docs bullet that lost a leading word in the regex
fixed by hand.
CLAUDE.md → CONTRIBUTING-AI.md rename so the filename is no longer
AI-vendor-specific. `CONTRIBUTING.md` reference updated. `AGENTS.md`
stays in place for multi-agent compatibility (the conventions doc is
shared with Codex / Cursor / etc.).
Wave-4 state wrap. STATE.md now records C1–C5 + D + D2 as complete;
v1421-backlog.md grew a "Closed in v1.4.22" header listing the 20
items the marathon landed; `.planning/phase-W4-report.md` documents
the per-commit decisions, test deltas, and the 23 items deferred to
v1.4.23 with reasoning.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adopts the canonical Contributor Covenant 2.1 (verbatim, with
conduct@bombeck.io as the enforcement contact). CONTRIBUTING.md links
to it.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
CONTRIBUTING.md gains a "Branch Model" section with an ASCII flow
diagram and the two-rule summary (develop = daily target, main =
release-only). Hotfix flow + end-user-vs-contributor guidance
included. Mirror page on docs.healthlog.dev landed in healthlog-docs
5d96861.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Full audit of every overlapping claim across the five top-level docs
against the v1.3.2 codebase. Fixes structural drift accumulated since
v1.2:
- README: API envelope was documented as `{ data, error, meta }` but the
actual helpers return `{ data, error }`. Architecture tree was missing
6 src/app/, 4 components/, 8 lib/ subdirectories that landed in
1.2/1.3 (auth, mood, charts, targets, notifications, bugreport,
gamification, settings, ai, feedback, insights, logging, moodlog,
monitoring, …). API Reference grew 4 new sections (Personalization,
Feedback + Tokens, Notifications, Admin) covering ~25 previously
undocumented endpoints. Route count `~60` → `100+`. Achievement count
`30+` → `38+`. i18n keys `1000+` → `1500+` with note about the new
integrity test.
- AGENTS.md: Status `v1.2.0` → `v1.3.2` with the body-composition / SSRF
/ GHCR / pg-boss-drain / blocking-CI / locale-integrity highlights.
Prisma `7.4` → `7.8`. Migrations `0001–0018` → `0001–0022`. Settings
page `13 sections / ~2100 lines` → `8 top-level sections / ~3150
lines` with the actual section IDs. Insights page line estimate
trimmed to `~1750`, section ID `medications` → `meds`.
NotificationChannel / EventType correctly described as `String`
fields (not Prisma enums) sourced from
`src/lib/notifications/types.ts`.
- CONTRIBUTING.md: UI-language statement was inverted ("UI text in
German" → English-default with German user-selectable, plus the
i18n integrity test). Dark-mode-only claim corrected — light/system
toggle exists in the topbar. Node `22+` → `20+` to match the README.
openssl recipe split: POSTGRES_PASSWORD uses base64 24, the three
hex secrets use hex 32. CI check list expanded to the 5-step
pipeline (typecheck, lint, test, format:check, build).
- CLAUDE.md: vitest config path `vitest.config.ts` → `vitest.config.mts`.
Bearer-token hashing labelled `HMAC-SHA256` (keyed by
`API_TOKEN_HMAC_KEY`) instead of plain SHA-256. Removed the
reference to a non-existent `docs/STATUS.md` and the overstated
`docs/{architecture,security,ops,API,ADRs}` directory list — the
long-form end-user docs live at docs.healthlog.dev, only audit notes
are local.
- SECURITY.md: pin example bumped from `:1.2.0` to `:1.3.2`.
Verified against code: 23 Prisma models, all listed endpoints exist,
all package.json versions match, every CHANGELOG v1.3.x claim
(SSRF guard, Withings 77/88 mapping, pg-boss SIGTERM drain, WCAG
44×44 touch targets, rate-limited threshold writes, N+1 fix in
/api/insights/comprehensive) traced to the actual implementation.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
HealthLog — personal health-tracking PWA with weight, blood pressure,
pulse, mood tracking, medication compliance, Withings integration,
doctor report PDF export, and Dracula-themed UI.
Marc-André Bombeck