mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 12:32:43 +00:00
Marc-André Bombeck
f5962497d6
Consolidated hotfix landing the findings from a six-axis audit
covering mobile security, UX + accessibility, code quality + docs,
README + discoverability, web performance, and mobile-deep responsive
behaviour. None of the changes break the public API or the existing
data shape; every fix is additive and SAFE under the v1.4.34.x web
freeze. Full audit reports live in `.planning/round-audit-*.md`.
Security
- Password rotation now wipes API tokens + refresh tokens in the
same `$transaction` as session revocation. A stolen iOS Bearer no
longer survives a user-initiated password change or an admin reset.
- `/.well-known/` proxy bypass tightened to an explicit-allowlist
`Set`. Stale `/api/auth/codex/callback` PUBLIC_PATHS entry dropped.
- HSTS gains `preload`. Withings host removed from the global CSP
and gated to the integration's own routes.
- `getClientIp` warns once per process on `TRUST_PROXY_HOPS`/XFF
mismatch + exposes a tagged helper for tighter universal buckets.
- Service worker rejects off-origin notification-click URLs. Offline
fallback body switched to a locale-neutral icon. Manifest gains
`scope`, `id`, `display_override`.
UX + accessibility
- i18n leaks closed on Dialog/Sheet close-X, ChartSkeleton's loading
announcement, and the notifications-section breadcrumb.
- Focus rings on bottom-nav, the More overflow button, and the
mobile top-bar user menu.
- Tap-target floor: Input / NativeSelect / Select / DateTimeInput
switch to `h-11 sm:h-10`.
- Admin chip-strip auto-scroll-into-view (matches v1.4.33 settings).
- List-page subtitles visible on mobile.
- Insights empty-state CTA vocabulary normalised so the link opens
the right measurement form (was silently failing for
BODY_TEMPERATURE / BLOOD_GLUCOSE / PULSE).
Mobile-deep
- `viewport.themeColor` reacts to light/dark mode.
- TopBar + Coach FAB reserve safe-area-inset-top / -bottom for
notched iPhones.
- Sonner toaster switches to `theme="system"`.
Code quality
- `SESSION_SECRET` dropped — the env var was documented as required
but never read by code. Three secrets, not four. Self-hosters
upgrading can delete the existing line.
- `toJson<T>()` helper consolidates seven Prisma JSON-cast sites.
- `db-compat.ts` gains a header docstring naming it the
schema-bootstrap path.
- Passkey response types adopted from `@simplewebauthn/server`;
`any` + eslint-disable pragmas drop out.
- Zero-TODO CI gate added at `.github/workflows/no-todo-markers.yml`.
Documentation + discoverability
- README rework: How-it-compares matrix, Apple Health + AI Coach
promoted to standalone Key-Features bullets, status block, latest
release + GHCR badges, OpenAPI pointer, three-secret Quick Start.
- openGraph + twitter cards now carry `images` and a
`summary_large_image` Twitter card.
- GitHub repo metadata: description tightened from 290 to 156
chars + keyword-front, `homepageUrl` flipped from a personal
tenant to the demo site, six generic / PII-adjacent topics
swapped for six high-intent ones.
- Five new user-facing docs: `docs/self-hosting/getting-started.md`,
`docs/self-hosting/reverse-proxy.md`,
`docs/integrations/apple-health.md`,
`docs/integrations/withings.md`,
`docs/integrations/ai-providers.md`.
- `docs/README.md` clarifies the docs tree as internal playbooks
vs the user-facing `docs.healthlog.dev` site.
118 lines
3.3 KiB
JSON
118 lines
3.3 KiB
JSON
{
|
|
"name": "healthlog",
|
|
"version": "1.4.34.4",
|
|
"description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
|
|
"license": "AGPL-3.0-only",
|
|
"homepage": "https://healthlog.dev",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "git+https://github.com/MBombeck/HealthLog.git"
|
|
},
|
|
"bugs": {
|
|
"url": "https://github.com/MBombeck/HealthLog/issues"
|
|
},
|
|
"keywords": [
|
|
"health-tracking",
|
|
"self-hosted",
|
|
"pwa",
|
|
"blood-pressure",
|
|
"withings",
|
|
"next.js",
|
|
"prisma",
|
|
"passkey"
|
|
],
|
|
"private": true,
|
|
"packageManager": "pnpm@10.31.0",
|
|
"scripts": {
|
|
"dev": "next dev",
|
|
"build": "next build",
|
|
"analyze": "ANALYZE=1 next build",
|
|
"bundle-report": "node scripts/print-bundle-report.mjs",
|
|
"start": "next start",
|
|
"lint": "eslint",
|
|
"db:generate": "prisma generate",
|
|
"db:push": "prisma db push",
|
|
"db:migrate": "prisma migrate dev",
|
|
"db:migrate:deploy": "prisma migrate deploy",
|
|
"db:studio": "prisma studio",
|
|
"format": "prettier --write .",
|
|
"format:check": "prettier --check .",
|
|
"typecheck": "tsc --noEmit",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"test:integration": "vitest run --config vitest.integration.config.mts",
|
|
"e2e": "playwright test",
|
|
"e2e:ui": "playwright test --ui",
|
|
"openapi:generate": "npx tsx scripts/generate-openapi.ts",
|
|
"openapi:check": "npx tsx scripts/check-openapi.ts"
|
|
},
|
|
"dependencies": {
|
|
"@aws-sdk/client-s3": "^3.1045.0",
|
|
"@hookform/resolvers": "^5.2.2",
|
|
"@node-rs/argon2": "^2.0.2",
|
|
"@parse/node-apn": "^8.1.0",
|
|
"@prisma/adapter-pg": "^7.8.0",
|
|
"@prisma/client": "^7.8.0",
|
|
"@simplewebauthn/browser": "^13.3.0",
|
|
"@simplewebauthn/server": "^13.3.0",
|
|
"@tanstack/react-query": "^5.100.9",
|
|
"@types/sax": "^1.2.7",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"dotenv": "^17.4.2",
|
|
"jspdf": "^4.2.1",
|
|
"jspdf-autotable": "^5.0.7",
|
|
"lucide-react": "^1.14.0",
|
|
"mmdb-lib": "^3.0.2",
|
|
"next": "16.2.6",
|
|
"next-themes": "^0.4.6",
|
|
"pg-boss": "^12.18.2",
|
|
"prisma": "^7.8.0",
|
|
"radix-ui": "^1.4.3",
|
|
"react": "19.2.5",
|
|
"react-dom": "19.2.5",
|
|
"react-hook-form": "^7.75.0",
|
|
"recharts": "^3.8.1",
|
|
"sax": "^1.6.0",
|
|
"sonner": "^2.0.7",
|
|
"tailwind-merge": "^3.6.0",
|
|
"web-push": "^3.6.7",
|
|
"yaml": "^2.8.4",
|
|
"zod": "^4.4.3",
|
|
"zod-openapi": "^5.4.6",
|
|
"zxcvbn-typescript": "^5.0.1"
|
|
},
|
|
"devDependencies": {
|
|
"@axe-core/playwright": "^4.11.3",
|
|
"@next/bundle-analyzer": "^16.2.6",
|
|
"@playwright/test": "^1.59.1",
|
|
"@tailwindcss/postcss": "^4",
|
|
"@testcontainers/postgresql": "^11.14.0",
|
|
"@types/node": "^25",
|
|
"@types/pg": "^8.20.0",
|
|
"@types/react": "^19",
|
|
"@types/react-dom": "^19",
|
|
"@types/web-push": "^3.6.4",
|
|
"@vitejs/plugin-react": "^5.1.4",
|
|
"@vitest/coverage-v8": "^4.1.5",
|
|
"eslint": "^9",
|
|
"eslint-config-next": "16.2.6",
|
|
"pdf-parse": "^2.4.5",
|
|
"pg": "^8.20.0",
|
|
"prettier": "^3.8.3",
|
|
"prettier-plugin-tailwindcss": "^0.8.0",
|
|
"shadcn": "^4.7.0",
|
|
"tailwindcss": "^4",
|
|
"testcontainers": "^11.14.0",
|
|
"tw-animate-css": "^1.4.0",
|
|
"typescript": "^6",
|
|
"vitest": "^4.1.5"
|
|
},
|
|
"pnpm": {
|
|
"onlyBuiltDependencies": [
|
|
"prisma",
|
|
"@prisma/engines"
|
|
]
|
|
}
|
|
}
|