audit(v1.3.3): SpO2 + body-composition + 14 CRITICAL/HIGH security/correctness fixes#121

Merged

MBombeck merged 13 commits intomainfrom

audit/v1.3.3-fixes

May 7, 2026

Commits on May 7, 2026

fix(measurements): close issue #109 + sync body composition across UI/PDF/thresholds

MBombeck
and
claude
committed
docs: align OpenAPI spec + migration comment with body-composition reality

MBombeck
and
claude
committed
fix(security): close 3 audit CRITICALs (Withings header / idempotency Bearer / GlitchTip URL strip)

MBombeck
and
claude
committed
feat(measurements): add OXYGEN_SATURATION (SpO2) as first-class measurement type — v1.3.3

MBombeck
and
claude
committed
fix(analytics): truthfulness pass on medical citations + clamp override orangeMax

MBombeck
and
claude
committed
fix(security): Bearer-scope wildcard handling + GDPR Art.17 account-delete erasure

MBombeck
and
claude
committed
test(pdf): real text-content assertions for body composition + SpO2 rows

MBombeck
and
claude
committed
fix(measurements): close enum drift cousins — derive 5 type-arrays from canonical enum + extend 2 contract enums

MBombeck
and
claude
committed
fix(security): close 6 V3-audit HIGH findings (CSP, web-push SSRF, IP geo, AI provider leak, import rate-limit)

MBombeck
and
claude
committed
fix(security,gdpr): trusted-proxy IP, audit-log retention, idempotency cachable filter, Bearer mock tightening

MBombeck
and
claude
committed
fix(security): encrypt moodLog webhook secret at rest with AES-256-GCM (V3 audit STILL-V2-C-2)

MBombeck
and
claude
committed
docs: sync README + AGENTS + CLAUDE + CHANGELOG + OpenAPI for v1.3.3 (V3 audit doc-drift)

MBombeck
and
claude
committed
fix(audit-review): close 4 HIGH + 2 MEDIUM findings from multi-agent review pass

MBombeck
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

audit(v1.3.3): SpO2 + body-composition + 14 CRITICAL/HIGH security/correctness fixes#121

audit(v1.3.3): SpO2 + body-composition + 14 CRITICAL/HIGH security/correctness fixes#121
MBombeck merged 13 commits intomainfrom
audit/v1.3.3-fixes

Commits on May 7, 2026

fix(measurements): close issue #109 + sync body composition across UI/PDF/thresholds

docs: align OpenAPI spec + migration comment with body-composition reality

fix(security): close 3 audit CRITICALs (Withings header / idempotency Bearer / GlitchTip URL strip)

feat(measurements): add OXYGEN_SATURATION (SpO2) as first-class measurement type — v1.3.3

fix(analytics): truthfulness pass on medical citations + clamp override orangeMax

fix(security): Bearer-scope wildcard handling + GDPR Art.17 account-delete erasure

test(pdf): real text-content assertions for body composition + SpO2 rows

fix(measurements): close enum drift cousins — derive 5 type-arrays from canonical enum + extend 2 contract enums

fix(security): close 6 V3-audit HIGH findings (CSP, web-push SSRF, IP geo, AI provider leak, import rate-limit)

fix(security,gdpr): trusted-proxy IP, audit-log retention, idempotency cachable filter, Bearer mock tightening

fix(security): encrypt moodLog webhook secret at rest with AES-256-GCM (V3 audit STILL-V2-C-2)

docs: sync README + AGENTS + CLAUDE + CHANGELOG + OpenAPI for v1.3.3 (V3 audit doc-drift)

fix(audit-review): close 4 HIGH + 2 MEDIUM findings from multi-agent review pass