chore(release): v1.4.1 — hardening + per-section admin + CI safety nets#149
Merged
chore(release): v1.4.1 — hardening + per-section admin + CI safety nets#149
Conversation
CHANGELOG entry covers the three buckets of change between 1.4.0 and 1.4.1: security hardening from the audit pass (moodLog SSRF closed + centralised error redaction), citation-accuracy fixes (ESH 2023 label, Saint-Maurice attribution, steps source), and the CI safety nets (executable Postgres testcontainers + Playwright/axe-core foundation), plus the structural per-section admin extraction and the in-tree docs sync. The deferred items from the audit pass land in docs/ops/v141-followup-issues.md so they're discoverable for the v1.4.2 cycle without re-running the audit. package.json bumped 1.4.0 → 1.4.1. No DB migration. No env-var change required. No API contract change. Co-Authored-By: Marc-André Bombeck <mbombeck@gmail.com>
MBombeck
added a commit
that referenced
this pull request
May 8, 2026
Production at healthlog.bombeck.io has been 503-ing since the v1.4.1 deploys started landing on apps-01 (Coolify). The container boots — Next.js prints "Ready" and the pg-boss workers run — but never accepts HTTP on :3000, so the Docker healthcheck fails and Traefik takes the upstream out of rotation. A manual restart, a Coolify force-rebuild, and a docker-compose pin to the GHCR :1.4.0 multi-arch image all failed to bring the site back up — Coolify rebuilds the image from main HEAD on every deploy regardless of the compose directives. This commit resets the working tree to commit 21bd46d (v1.4.0 release). Same content that's been running for self-hosters since yesterday's tag-and-release. The next Coolify deploy will build from this tree and produce a healthy container. The v1.4.1 work is NOT lost: - PRs #144, #145, #137, #146, #147, #148, #149, #150 remain in git history. - Their commits are still tagged (`v1.4.1`), still on the GHCR multi-arch image (`ghcr.io/mbombeck/healthlog:1.4.1`), still in the GitHub Release notes. - Self-hosters who have already pulled the v1.4.1 image keep it. - Local development continues from main HEAD with the v1.4.1 code — the regression only surfaced under the Coolify build flow. Re-applying v1.4.1 to production will need a separate cycle to reproduce the runtime failure under the Coolify build path. That work is tracked in docs/ops/v141-followup-issues.md (added back when the tree is reapplied) and the deploy gating in .github/workflows/e2e.yml will catch this class of bug going forward. No DB migration. No env-var change. No API contract change. Co-Authored-By: Marc-André Bombeck <mbombeck@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release v1.4.1 — the followup-marathon's hardening release, packaging the audit-driven security + truthfulness fixes alongside the structural and CI work that landed since 1.4.0.
What's in 1.4.1
Security
redirect: "manual").Bearer …, Telegrambot<token>, query-string secrets) applied to both Wide Events (Loki) and Glitchtip incident path.Citation accuracy
CI safety nets
Internal cleanup
Docs
Deferred to v1.4.2
docs/ops/v141-followup-issues.mdlists the items the audit found that warrant deeper architectural work — idempotency-race serialisation, encryption-key NODE_ENV gate, refresh-token rotation transactional rewrite, moodLog HMAC lookup column, recharts dynamic split for/insights,MoodEntry @@indexmigration, glucose-history bound. Six security MEDIUM, three performance P0, plus i18n hardcoded-strings cleanup. Each entry has audit reference, fix shape, and "why deferred" reasoning.Quality gates
pnpm typecheckcleanpnpm test— 669 / 669 passpnpm test:integration— 10 / 10 pass (3.9s)pnpm lint— 0 errorspnpm exec prettier --check— clean on touched filesOperator notes
docker compose pull && docker compose up -d.🤖 Generated with Claude Code