v1.38.12 — the scanner findings are cleared

CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## [1.38.12] — 2026-09-09
+
+A dependency release: the image and the lockfile stop carrying twelve
+advisories the container scanner reported, and `next build` learns to
+type-check the application without the test tree.
+
+### Security
+
+- **Twelve scanner advisories cleared, none in this code.** next 16.2.11
+  carried two critical advisories (fixed in 16.3.3) and pulled a vulnerable
+  sharp; nodemailer 9.0.3 carried one high and three medium; js-yaml 4.3.1
+  one high; hono 4.13.3, under the MCP SDK's node server, three medium; the
+  vitest mocker and baseline-browser-mapping one medium each. Dependabot
+  listed none of them. next moves to 16.3.4, nodemailer to 9.1.1 and vitest
+  to 4.1.11 as direct pins; js-yaml, hono, baseline-browser-mapping and sharp
+  move through pnpm overrides bounded to the vulnerable ranges, so exactly
+  the copies the scanner named change and nothing else does.
+
+### Changed
+
+- **`next build` type-checks the application program, not the test tree.**
+  Next 16.3 checks the whole tsconfig program during the build, which reaches
+  the unit tests under `src/**/__tests__`, their fixtures under `tests/`, and
+  the test-runner configs; the image build context leaves `tests/` and `e2e/`
+  out on purpose, so the image build failed on both architectures with a
+  missing fixture module. The build now reads `tsconfig.build.json`, which
+  extends the main config without that tree. `pnpm typecheck` keeps using
+  `tsconfig.json` and still covers everything.
+
 ## [1.38.11] — 2026-09-08
 
 "Sign out everywhere" now means everywhere, a refresh cannot outrun a

docs/api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.38.11
+  version: 1.38.12
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 

next.config.ts

@@ -5,6 +5,12 @@ import { version as PKG_VERSION } from "./package.json";
 
 const nextConfig: NextConfig = {
   output: "standalone",
+  // `next build` type-checks the whole tsconfig program since 16.3, which
+  // reaches the unit tests under `src/**/__tests__` and their fixtures under
+  // `tests/`. The image build context leaves `tests/` and `e2e/` out on
+  // purpose, so the build reads a tsconfig without them; `pnpm typecheck`
+  // still covers the full program.
+  typescript: { tsconfigPath: "tsconfig.build.json" },
   poweredByHeader: false,
   // v1.4.38.4 — expose the package.json version to the client bundle
   // so the `<VersionPoller>` can compare the shell-baked version

package.json

@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.38.11",
+  "version": "1.38.12",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",
@@ -80,9 +80,9 @@
     "jspdf-autotable": "^5.0.8",
     "lucide-react": "^1.34.0",
     "mmdb-lib": "^3.0.2",
-    "next": "16.2.11",
+    "next": "16.3.4",
     "next-themes": "^0.4.6",
-    "nodemailer": "9.0.3",
+    "nodemailer": "9.1.1",
     "otpauth": "^9.5.1",
     "p-limit": "^7.3.1",
     "pg": "^8.23.0",
@@ -135,6 +135,6 @@
     "testcontainers": "^12.1.0",
     "tw-animate-css": "^1.4.0",
     "typescript": "^6",
-    "vitest": "^4.1.5"
+    "vitest": "^4.1.11"
   }
 }