{"owner":"pcmarts","slug":"acl-recovery-tracker","releases":[{"version":"1.0.3","tag":"v1.0.3","commit_sha":"86ae8d95746761b9139a1bdd8404908178c273e2","artifact_sha256":"73afc3c52d0fae60616ca57755b823e2435ee9916155fff7bd357277f7de0700","published_at":"2026-09-01T19:34:02.533Z","changelog":"**Version bump only.** No application code, dependency or database schema\nchange since [v1.0.2](https://github.com/pcmarts/acl-recovery-tracker/releases/tag/v1.0.2) —\nthe two trees are identical apart from the version string. If you are running\nv1.0.2, there is nothing to upgrade for.\n\nThis tag exists to give the fixed scanner an unburned version number to verify\nagainst. A scan verdict is terminal, so v1.0.2 cannot be re-scanned and stays\nfailed.\n\n## Why v1.0.2 failed\n\nIts 8 HIGH findings (1 `react`, 7 `vite`) were artefacts of the scanner, not of\nthis repository.\n\nCaret ranges in `package.json` could not be resolved to an exact version, so\nevery dependency was queried twice — once **pinned** from `package-lock.json`,\nonce **versionless** from `package.json`. Those dedupe to different keys, so\nboth queries ran. A versionless OSV query is not a narrower question; it returns\nevery advisory ever filed against the package at any version. One of the eight\nwas filed against **Vite 2**, while this repo runs **7.3.6**.\n\nMeasured separately over the v1.0.2 tree:\n\n| Half | Packages | Vulnerabilities | HIGH/CRITICAL |\n|---|---|---|---|\n| Pinned | 545 | 0 | **0** |\n| Versionless | 20 | 26 | **8** |\n\nAll 8 blockers came from the phantom queries. No upgrade could clear them —\nwhich is why v1.0.2 failed on the same eight as v1.0.1, despite the commit in\nbetween genuinely fixing 15 real advisories.\n\nThe scanner-side fix (`dedupePackages` now drops a versionless entry when the\nsame `ecosystem|name` is pinned elsewhere) lives in the scanner's own codebase,\nnot in this repository.\n\n## Verified on this tree\n\n`npm audit` 0 vulnerabilities · `tsc -b` clean · `eslint` 0 errors ·\nproduction build succeeds.\n\n## Unchanged from v1.0.0\n\n- The app ships **without authentication**. RLS is enabled but grants the\n  `anon` role full access. See *Security* in the [README](README.md).\n- MIT permits buyers to redistribute and resell the source.\n- Not medical advice.","diff_summary":{"files_added":0,"files_changed":3,"files_removed":0,"additions":4,"deletions":4,"components_touched":["docs","config"]},"scan":"pass","scanner_version":"2026.08.1","analyzer_version":"0.1.0","price_micro":"1000000","update_price_micro":"200000"},{"version":"1.0.2","tag":"v1.0.2","commit_sha":"a6f535a117fdeee4b79a6ae1c2e46d70912792b3","artifact_sha256":"6cc0ac63556b76253c6bddbd4db4b802cbc6ea708d44671d47c11b4a3a12e65d","published_at":"2026-09-01T19:19:57.262Z","changelog":"Fixes the dependency advisories that failed the v1.0.1 release scan.\n**15 HIGH vulnerabilities, now 0.** No application code changed.\n\n## Vulnerabilities fixed\n\n| Package | Affected | Issue |\n|---|---|---|\n| `vite` | `<=7.3.3` | Path traversal in optimized deps `.map` handling; `server.fs.deny` bypass via queries and Windows alternate paths; arbitrary file read via dev server WebSocket |\n| `react-router-dom` | `<=7.14.1` | Vulnerable via `react-router` |\n| `ws` | `8.0.0`–`8.20.1` | Uninitialized memory disclosure; memory exhaustion DoS |\n| `serialize-javascript` | `<=7.0.4` | RCE via `RegExp.flags`; CPU exhaustion DoS. Transitive through `workbox-build` → `@rollup/plugin-terser` |\n\nThe `vite` and `react-router-dom` floors were raised in `package.json`, not\njust pinned in the lockfile — otherwise regenerating `package-lock.json` could\nland back on a vulnerable version.\n\n## Also checked\n\nThe scan could have failed on a secret or a size limit. Both were audited and\nwere clean:\n\n- **Secrets** — no `.env` has ever been committed, `.env.example` contains only\n  placeholders, and no credential-shaped strings exist in any tracked file.\n- **Size** — 660 KB tracked in total, the largest file being the 292 KB lockfile.\n\n## Added\n\n`.github/workflows/audit.yml` runs `npm audit --audit-level=high` on every push\nand weekly, so new advisories surface immediately rather than at the next\nrelease scan. It is deliberately separate from the deploy workflow: a new\nadvisory in a transitive dependency should report itself, not block a deploy of\ncode that was already fine.\n\n## Verified\n\n`npm ci` clean · `tsc -b` clean · `eslint` 0 errors · root and sub-path\nproduction builds both succeed.\n\n## Unchanged from v1.0.0\n\n- The app ships **without authentication**. RLS is enabled but grants the\n  `anon` role full access. See *Security* in the [README](README.md).\n- MIT permits buyers to redistribute and resell the source.\n- Not medical advice.","diff_summary":{"files_added":1,"files_changed":3,"files_removed":0,"additions":640,"deletions":652,"components_touched":["docs","ci","config"]},"scan":"fail","scanner_version":"2026.08.1","analyzer_version":"0.1.0","price_micro":"1000000","update_price_micro":"200000"},{"version":"1.0.1","tag":"v1.0.1","commit_sha":"c2e11c2c74c3676e7485beceb1fa068f88f8363f","artifact_sha256":"b5715f163ff1ed211adc5368b62a7402313043c05abfce6e0615fb180e0135a9","published_at":"2026-09-01T19:12:41.517Z","changelog":"A metadata release. No application code, dependencies or database schema\nchanged since [v1.0.0](https://github.com/pcmarts/acl-recovery-tracker/releases/tag/v1.0.0) —\nif you are already running it, there is nothing to upgrade for.\n\n## Changed\n\n- **LICENSE** now names a real copyright holder. v1.0.0 shipped the\n  placeholder `Copyright (c) 2026 ACL Recovery Tracker`, left over from\n  stripping the fork of personal details. It now reads\n  `Copyright (c) 2026 Paul Martin`.\n- **Version bumped to 1.0.1** in `package.json`, `package-lock.json` and the\n  README. The version is injected into the bundle at build time and shown on\n  the Settings page, so all four now agree.\n- **README** tells redistributors to substitute their own name in the licence,\n  rather than implying the field was left unset.\n\n## Still worth knowing\n\nUnchanged from v1.0.0, and both still apply:\n\n- The app ships **without authentication**. RLS is enabled but grants the\n  `anon` role full access, and the anon key is visible in the JavaScript\n  bundle — fine for one person at an unlisted URL, wrong if you publish the\n  link. See *Security* in the [README](README.md).\n- MIT permits buyers to redistribute and resell the source. If that is not\n  what you want from a paid product, swap the licence before distributing.\n- Not medical advice.","diff_summary":{"files_added":0,"files_changed":4,"files_removed":0,"additions":7,"deletions":7,"components_touched":["docs","config"]},"scan":"fail","scanner_version":"2026.08.1","analyzer_version":"0.1.0","price_micro":"9000000","update_price_micro":"5000000"},{"version":"1.0.0","tag":"v1.0.0","commit_sha":"aca09441492bbc586dc82c0ff27b03d8db83b147","artifact_sha256":"aa4811b4e5fd2620049c1eabe684cce63946097fb68ef7be45ca9d37fbdd003d","published_at":"2026-09-01T16:36:03.440Z","changelog":"The first distributable release of ACL Recovery Tracker: a progressive web app\nthat turns a surgery date into a week-by-week ACL rehabilitation plan.\n\n## What it does\n\n- **Phased plan** — five phases from *Protection & Early Healing* through\n  *Return to Activity*, advancing automatically from the user's surgery date,\n  with a manual override for when a physio moves them on early.\n- **Daily exercises** — grouped by strength, mobility, cardio, balance and\n  recovery, with per-session tracking and long-press to complete.\n- **Guided sessions** — step-by-step player with set/rep counters, rest timers\n  and audio cues.\n- **Timers** — ice, EMS and collagen presets, with a screen wake lock.\n- **Weekly check-ins** — pain, swelling, extension and flexion, kept as history.\n- **Progress** — streaks, range-of-motion trend, milestone timeline and a\n  browsable overview of the whole plan.\n- **EMS protocols** — per-phase electrode placement and stimulator settings.\n- **Installable PWA** — works offline, auto-updating service worker.\n\n## Setting it up\n\nRequires Node.js 20+ and a free Supabase project. Run\n[`supabase/schema.sql`](supabase/schema.sql), copy `.env.example` to `.env`,\nfill in the two `VITE_SUPABASE_*` values, then `npm install && npm run dev`.\nFull instructions, deployment guides and customisation notes are in the\n[README](README.md).\n\nOn first launch the app asks for a name, surgery date and procedure — nothing\nis hardcoded, and all three stay editable from Settings.\n\n## Please read before sharing a deployment\n\nThe app ships **without authentication**, on the assumption that one deployment\nbelongs to one person. Row level security is enabled, but the policies grant the\n`anon` role full access, and the anon key is visible in the JavaScript bundle.\nAnyone who obtains your project URL and key can read and write the data.\n\nThat is a reasonable trade-off for a personal deployment at an unlisted URL. It\nis the wrong one if you plan to publish the link. The *Security* section of the\nREADME sets out the four steps to make it genuinely multi-user.\n\n## Notes\n\n- Licensed [MIT](LICENSE). Update the copyright holder before distributing.\n- `lucide-react` is pinned to `^0.575.0`; version `0.577.0` ships no type\n  declarations and breaks `npm run build`.\n- Not medical advice. Recovery timelines vary by graft type, meniscus\n  involvement and surgeon preference.","diff_summary":null,"scan":"fail","scanner_version":"2026.08.1","analyzer_version":"0.1.0","price_micro":"9000000","update_price_micro":"5000000"}],"next_cursor":null}