release: v1.47.2

CHANGELOG.md

@@ -2,6 +2,138 @@
 
 ## [Unreleased]
 
+## [1.47.2] — 2026-11-11
+
+### Added
+
+- **Search and filter the labs list.** Once the list ran past a
+  screenful, finding one marker meant scrolling. The labs page now has a
+  search field (press / to jump to it) that matches a marker's name or
+  panel, and filters for the newest reading's status (out of range, in
+  range, below or above), the category, and when a marker was last
+  measured. While a filter is active every category with a match is
+  open, and its header counts only the matches. The filters are part of
+  the page address, so a filtered view survives a reload and
+  back/forward and can be shared as a link. The list keeps the sort
+  order set under Settings > Arrangement > Labs. (#1370)
+- **Choose how the calendar subscription draws a forecast.** A logged
+  period of a few days next to a forecast spanning more than a week was
+  hard to read, because the forecast event covered every day the period
+  might fall on. The calendar subscription card now offers three styles
+  under "How forecasts look": just the expected days; the expected days
+  with the days the period may start earlier or run on later as separate
+  "possible" events (an open dot in discreet mode); or the single event
+  covering the whole range, as before. A subscription turned on from now
+  on starts with the expected days and their margin; one that is already
+  on keeps the single range until you change it, and rotating the link
+  keeps whichever style it has. `PATCH /api/cycle/feed-subscription`
+  accepts `forecastStyle` (`EXACT`, `MARGIN` or `BAND`) and the status
+  carries it. Migration `0495_cycle_feed_forecast_style`. (#1350)
+- **Crisis contacts for South Korea.** A questionnaire answer that shows
+  the crisis card now gives a Korean reader, or anyone whose locale names
+  South Korea, the emergency number 119 and the national suicide
+  prevention line 109, which answers around the clock. Before, Korean
+  fell through to the international set with 112, which reaches the
+  police there, not an ambulance.
+- **Set the order of the lab categories.** With the labs list grouped
+  by category you could reorder the markers but not the categories, and
+  nothing said how they were ordered. Settings > Arrangement > Labs now
+  has a "Category order" card while categories are on: move a category
+  with the handle or the arrows, and the card explains the default
+  (built-in categories in a fixed order, your own panels alphabetically,
+  Other last). A category that turns up later joins the end of your
+  order, and Other stays last if you left it there. The order is saved
+  with your account and applied by the server, so every device that
+  groups the list shows the same order. The labs list layout accepts
+  `categoryOrder`, and
+  `GET /api/labs/overview` answers `categories` in that order. (#1349)
+- **Blood ketones, and the glucose-ketone index worked out for you.**
+  Ketones (beta-hydroxybutyrate, mmol/L) are a measurement of their own
+  now, so a ketogenic diet no longer has to live in a custom metric with
+  the index typed in by hand beside it. Choose "Blood ketones" when you
+  add a measurement and, if the meter gave one, type the glucose from the
+  same fingerstick into the field below: both readings are saved together
+  with one time, or neither is. The glucose-ketone index is glucose in
+  mmol/L divided by ketones, for every ketone reading above zero, taken
+  from the glucose reading at the same time or, failing that, the nearest
+  one within 15 minutes. It is never stored, so it
+  follows any reading you edit or delete. It shows under the chart on the
+  new Ketones page, in the day view, and beside the ketones in the doctor
+  report and the clinician share; the FHIR export carries the ketone
+  readings under LOINC 104816-4. Values are shown as recorded, with no
+  band and no verdict. `GET /api/measurements/series` takes
+  `kind=ketones` and `kind=glucoseKetoneIndex`, and `GET /api/day/{date}`
+  carries `glucoseKetoneIndex`. Migration `0496_blood_ketones`. (#1367)
+
+### Fixed
+
+- **A missed "every N days" checkup now stays due until it is measured.**
+  A checkup on a cycle of a week or less, such as blood pressure every
+  two days, moved its next due date on by its cycle the moment its
+  reminder went out, measured or not. The card then read "in 2 days"
+  every evening and never "today" or "overdue", and the start page
+  dropped it. Such a checkup now counts from its last reading: once its
+  reminder is sent it stays due, then overdue, until a reading lands or
+  it is marked done, skipped or snoozed, and while it stays open it is
+  reminded again every N days, and never more than a week apart, at its
+  usual hour. A first due date in the past stays overdue past its first
+  reminder instead of jumping ahead. A checkup that already moved on
+  corrects itself at its next reminder.
+  Calendar schedules that repeat within a week, such as a twice-daily
+  measurement course, still move on to their next time. (#1369)
+- **A lab's "(calc)" note no longer becomes part of the unit.** Some
+  reports print "(calc)" beside a calculated value, and a document read
+  could copy it into the unit, so a marker was created in "g/dL (calc)"
+  or just "(calc)" and the next report's plain "g/dL" was refused as a
+  different unit. The read now drops that note (also "calculated",
+  "computed" and the German "berechnet"), a marker already saved in
+  "g/dL (calc)" accepts the plain "g/dL", and a unit that was only the
+  note counts as no unit and goes to review, so a person decides whether
+  the value really has none. A marker already saved in just "(calc)"
+  keeps that unit. Any other text in brackets still counts as part of
+  the unit. (#1313)
+- **The sync feed no longer loses a reading written during a long
+  import, and no longer starts over for a quiet account.** A Garmin or
+  Withings import writes a batch in one transaction and stamps its
+  readings before it commits them. When a reading logged by hand
+  committed in between and the app synced right then, the feed's position
+  moved past the import's readings, and they never reached the app or
+  Apple Health. Separately, a kind of data that had not changed for more
+  than 75 days (mood, say, for someone who stopped logging it) kept its
+  old position in the feed, and from then on every sync was answered as
+  expired and the app started over from scratch, each time. Now every
+  kind of data that `GET /api/sync/changes` has fully caught up takes a
+  position two minutes behind the present, like `start=now` (which moves
+  from one minute to two): what changed in those two minutes is read
+  once more, so anything that committed late still arrives, and a quiet
+  kind of data never ages out.
+- **Changing the calendar subscription while its link is being renewed.**
+  A subscription turned off at the same moment its link was renewed could
+  come back under the new link, and an option changed at that moment
+  could be lost to the new link. Turning it off now wins whichever comes
+  first, and the change lands on the link that stays live.
+- **A seven-day blood pressure course now ends after seven days.** A
+  course suggested by the Coach knew its last day only until its first
+  reminder went out. From then on every sent reminder, every reading and
+  every skip planned the next one without that end, so the morning and
+  evening reminders went on for good. The end now holds through every
+  reschedule, and once the last slot is past the course is cleared from
+  the list as intended. A course that already ran past its end sends the
+  one reminder it has planned and then stops.
+
+### Security
+
+- `node-forge` moves to 1.4.3, which fixes five advisories in certificate
+  chain checks, signatures and TLS handling. It arrives only under the APNs
+  library, and HealthLog signs push requests with a token key, so none of
+  that code runs; the update keeps the dependency audit clean.
+- The image carries Debian's zlib security update (DSA-6613-1, zlib1g
+  `1:1.3.dfsg+really1.3.1-1+deb13u1`), which fixes CVE-2026-85091,
+  CVE-2026-27171 and CVE-2026-76844. The 1.47.1 image was built before
+  that update and ships the earlier zlib. The refreshed `node:22-trixie-slim`
+  base does not include it yet either; the build-time `apt-get upgrade`
+  brings it in.
+
 ## [1.47.1] — 2026-11-07
 
 ### Added

bundle-budget.json

@@ -58,6 +58,7 @@
     "/insights/headphone-audio/page": 336,
     "/insights/health-score/page": 315,
     "/insights/hrv/page": 337,
+    "/insights/ketones/page": 339,
     "/insights/lean-body-mass/page": 336,
     "/insights/medications/page": 338,
     "/insights/mood/page": 337,