## CodeWithCJ/SparkyFitness — v1.6.5…v1.7.0

_281+ commits._

### Features
- **feat(frontend): migrate TanStack Table v8 to v9** (d39df85)
- **feat(frontend): show previous values for custom check-in categories** (fd62a4b)
- **feat(mobile): previous measurement hints and body fat calculator** (dc89cc3)
- **feat(measurements): add bulk latest manual custom entry lookup** (0f5ff67)

### Fixes
- **fix(mobile): match watch target names with EAS credentials** (a1ed61d)
- **fix(build): enable injectWorkspacePackages for deploy and resolve type mismatches** (5e54c50)
- **Merge pull request #2463 from CodeWithCJ/fix/server-access-control-hardening** (9016786)
- **fix(server): make food-provider admin check email-aware** (41d8252)
- **fix(server): close food-provider SSRF via DNS resolution and guarded fetch** (93564ec)
- **fix(server): harden access-control error handling and food-provider SSRF** (efb15c0)
- **chatbot fix rollback to node compatable undici": "^7.24.4"** (0716030)
- **fix(deps): pin vite's and tsx's esbuild off the broken 0.28.2 to unblock CI** (6fde767)
- **fix(mobile): initialize Health Connect before the bulk/historical-steps seed permission requests** (5e0d516)
- **fix(mobile): stop double-rendering the item count in collapsible sections** (cfcfb9b)
- **fix: reject a null exercise id instead of 500ing the progress endpoint** (d815cb7)
- **fix(mobile): always request the full permission union on any HealthKit/Health Connect action** (21a5e91)
- **fix(library-delete): make history deletion atomic and address review feedback** (49b2945)
- **fix(exercises): fix library delete cascading, snapshot preservation, and cache invalidation** (433afda)
- **fix(auth): address review feedback on SSO origins and email change** (a81d357)
- **fix(auth): address review feedback on rate-limit docs and nginx** (a1dabad)
- **fix(auth): prevent false-positive IP bans and close demo SSO SSRF** (91bc3b2)
- **fix(demo): let the sandbox use providers and read its own API keys** (9bde640)
- **fix(auth): do not let a late session probe log out the next account** (9aed8de)
- **fix(exercises): let the API contract carry an entry whose exercise is gone** (a7028dc)
- **fix(demo,admin): address review findings on delete rules and demo restrictions** (3c13b78)
- **fix(demo,admin): stop the demo request flood and preserve data on user deletes** (691c105)
- **Merge pull request #2441 from Dragonk/fix/workout-presets-pagination** (f53f49f)
- **Merge pull request #2440 from CodeWithCJ/fix/reports-custom-nutrients-syntax** (df2d075)
- **fix(exercises): never serve a cached preset page across accounts** (4e647a4)
- **fix(reports): parameterize custom nutrient JSON keys and fix swagger schema** (fc2decc)
- **fix(exercises): isolate preset cache per user and name presets in toasts** (618d6b6)
- **fix(health): pass target and actor user IDs to getClient in getDailyHealthMetrics** (902a150)
- **fix(reports): escape quotes in custom nutrient names in report queries** (3e29476)
- **fix(exercises): paginate workout presets from the server total** (2a532d6)
- **fix(health): carry forward episodic metrics across sparse wearable syncs** (4ce8f2d)
- **fix(frontend): update Withings developer portal URL in settings** (4e6b117)
- **Merge pull request #2378 from zeusal/fix/mobile-clear-caches-on-identity-change** (89feef5)
- **Merge pull request #2432 from L4XB/fix/polar-hypnogram-recording-zone** (c47ef9c)
- **fix(mobile): preserve locale parameter in time format helpers** (38a069f)
- **fix(polar): clamp the first hypnogram stage to the recorded bedtime** (3850b8e)
- **fix(mobile): respect 24-hour time format in time pickers and displays** (1faf184)
- **fix(polar): anchor hypnogram stages in the recording zone and stop them at wake time** (1a72194)
- **fix(frontend): add the missing previous-custom-values translation key** (7d7bdaf)
- **Merge pull request #2427 from SisyphusMD/fix/pr-review-validation** (8f68635)
- **Merge pull request #2406 from gustavvelasquez/fix/sleep-primary-cluster-duration** (6e728c2)
- **fix(watch): enable instant real-time message transfer and include linked food containers** (5a6483d)
- **fix(mobile): restore previous-value hints on a full legacy page** (ffcee80)
- **fix(watch): resolve conflict with main, fix water progress guard, and add watch run script** (5f9111c)
- **fix(mobile): refuse a truncated legacy page outright instead of partially** (4e38bbc)
- **fix(mobile): derive the legacy-page completeness guard from the reduction** (b23d35d)
- **fix(mobile): reduce the legacy hint page instead of rejecting it wholesale** (8c73158)
- **fix(mobile): never offer a truncated history as the latest previous value** (b8b12d9)
- **fix: address review feedback on previous-value hints** (777083b)
- **fix(mobile): fall back to the custom entries list for previous values** (1a148aa)
- **fix(mobile): log a failed previous-value lookup instead of swallowing it** (612a94e)
- **fix(actions): validate fork reviews with read-only tokens** (192ca25)
- **Merge pull request #2426 from SisyphusMD/fix/shared-active-calories** (15b5e32)
- **fix(diary): prevent goal range wrapping onto two lines in daily energy widget** (db422a7)
- **fix(goals): abort goal save if preference normalization fails in daily goal editors** (c8d2744)
- **fix: prevent duplicate active calories with family sharing** (f0b46cb)
- **Merge pull request #2424 from Professorvennie/fix/adaptive-tdee-weight-trend-units** (855148d)
- **Merge pull request #2415 from SisyphusMD/fix/db-context-client-release** (1321bb6)
- **Merge pull request #2422 from SisyphusMD/fix/historical-step-measurements** (df784eb)
- **fix(goals): support nutrient target range in diary, reports, and chatbot, and fix onboarding goal mode override** (f12ebc9)
- **fix(calories): use dated measurements for historical steps** (3700842)
- **fix(db): release clients when context initialization fails** (b751e83)
- **fix(workouts): resolve missing userId in workout plan template retrieval** (124f5cc)
- **Merge pull request #2413 from SisyphusMD/fix/db-idle-connection-errors** (8a20e83)
- **fix(db): keep the server running after idle connection errors** (d724eda)
- **Fix Adaptive TDEE weight trend to honor configured mass unit** (e3cddd4)
- **Merge pull request #2410 from SisyphusMD/fix/strava-preserve-missing-calories** (0481a89)
- **fix(strava): preserve calories when activity details are missing** (a7a87af)
- **Merge pull request #2407 from SisyphusMD/fix/strava-activity-detail-duplicates** (af877fb)

### Backend
- **Merge pull request #2468 from CodeWithCJ/nix/update-pnpm-hashes** (6b36295)
- **Merge pull request #2467 from CodeWithCJ/dev5** (face3b8)
- **Merge pull request #2466 from CodeWithCJ/dev5** (0275fd5)
- **ignore minimum days for two packages** (192e513)
- **Merge pull request #2464 from CodeWithCJ/dev4** (ca3e30b)
- **Merge pull request #2460 from CodeWithCJ/i18n/sync-weblate-translations** (598ee22)
- **Merge pull request #2459 from CodeWithCJ/nix/update-pnpm-hashes** (094c31d)
- **Merge pull request #2457 from CodeWithCJ/dev3** (eb1b1f4)
- **Replace image with higher resolution version** (2f6ca38)
- **Update README with more alternatives to MyFitnessPal** (07013f3)
- **Merge remote-tracking branch 'origin/main' into dev3** (e6f2bd8)
- **Merge pull request #2452 from CodeWithCJ/dev2** (3cc3aed)
- **Merge pull request #2449 from CodeWithCJ/ci/schema-backup-sync** (42b3c19)
- **Merge pull request #2450 from CodeWithCJ/nix/update-pnpm-hashes** (aebc481)
- **Merge pull request #2448 from CodeWithCJ/dev** (201aa4e)
- **Merge pull request #2446 from CodeWithCJ/dev** (40dfa5d)
- **skill update** (130d22b)
- **Merge pull request #2445 from CodeWithCJ/dev** (398a28a)
- **Merge pull request #2444 from CodeWithCJ/ci/schema-backup-sync** (02f8d20)
- **Merge pull request #2443 from CodeWithCJ/dev** (9ab76a0)
- **Merge pull request #2439 from CodeWithCJ/dev** (0fd26a4)
- **Merge pull request #2438 from CodeWithCJ/dev** (db67bc9)
- **Merge pull request #2437 from CodeWithCJ/dev** (9d2977a)
- **Merge pull request #2434 from CodeWithCJ/dev** (a7b4a58)
- **mobile: report an identity change with no handler registered** (92496d8)
- **Merge pull request #2429 from Dragonk/feat/mobile-measurement-history-bf-calculator** (e1ff65f)
- **Merge pull request #2433 from CodeWithCJ/dev** (7d952b3)
- **Merge pull request #2371 from TheGothian/feat/watch** (d1573bc)
- **pnpm fixes** (148a267)
- **Merge remote-tracking branch 'upstream/main' into feat/watch** (b3f12e2)
- **mobile: report a cookie jar that could not be cleared** (24e51e5)
- **mobile: clear the cookie jar when the identity changes** (57da639)
- **server: let the Bearer token outrank a stale session cookie** (784861e)
- **lint style adjustments and fixed pnpm validate issues** (dbe7284)
- **Merge pull request #2425 from CodeWithCJ/dev** (976bdfc)
- **Use bracket access for indexed t() mock vars** (86e061a)
- **Keep kcalPerKg on the kg density for unsynced locales** (35a799f)
- **Merge pull request #2414 from CodeWithCJ/dev** (412167c)
- **Fill Adaptive TDEE unit placeholders via object-form t()** (8e5a6d5)
- **Merge pull request #2412 from CodeWithCJ/ci/schema-backup-sync** (739adc9)
- **Merge pull request #2379 from CodeWithCJ/feature/hydration-nutrition-link** (8abfd3e)
- **Merge pull request #2409 from CodeWithCJ/dev3** (845834e)
- **Merge pull request #2408 from CodeWithCJ/ci/schema-backup-sync** (6b2744a)

### Tests
- **test(ai): make validation error matcher resilient in goal tools test** (8ef114d)
- **test(reports): assert full parameter array in reportSupplementScaling test** (5c35137)
- **test(reports): update reportSupplementScaling test for parameterized custom nutrient query** (52aed10)
- **test(mobile): cover previous-value hints and body fat calculation** (0ff184e)
- **test(strava): assert snapshot arguments for each import** (2670cd4)

### Docs
- **docs: add maintainer image-tooling reference page** (84356ea)
- **docs(exercises): document the preset query key and name resolver** (f88cee7)
- **docs(calories): document range measurement selection** (80a61cd)
- **docs(db): document client release responsibility** (e6ea0e3)

### Chore
- **chore(nix): update pnpm deps hashes** (a6703cf)
- **chore(release): bump version to 1.7.0** (deb7d68)
- **chore(docker): wire ALLOW_PRIVATE_NETWORK_FOOD_PROVIDERS into compose** (7dc31d3)
- **chore(i18n): sync non-English translations from Weblate** (fe341fb)
- **chore(nix): update pnpm deps hashes** (db7aaa7)
- **chore(mobile): upgrade @kingstinct/react-native-healthkit to 15.1.0** (115bb66)
- **chore(mobile): upgrade react-native-health-connect to v4, drop expo-health-connect** (95ae8ef)
- **chore(deps): unify the workspace on TypeScript 6 and upgrade ts-to-zod** (471e4a6)
- **chore(deps): take remaining packages to latest within their constraints** (b2df50a)
- **chore(mobile): upgrade to Expo SDK 57 and React Native 0.86** (e97ab93)
- **chore(deps): upgrade Vercel AI SDK to v7 and assistant-ui to 0.15** (db1d998)
- **chore(deps): upgrade lucide-react, react-day-picker, i18next and recharts** (66a3907)
- **chore(deps): upgrade low-risk dependencies and restore pnpm settings** (08db308)
- **chore(nix): update pnpm deps hashes** (6909ef8)
- **chore: sync db_schema_backup.sql with migrations** (4b1edfb)
- **chore(auth): upgrade Better Auth to 1.7.4** (7e3b928)
- **chore: sync db_schema_backup.sql with migrations** (16830c5)
- **refactor(integrations): bind the OAuth state claim to the authenticated actor** (ff9256a)
- **refactor(integrations): issue single-use OAuth state nonces for Withings and Polar** (c8818c6)
- **refactor(uploads): guard stored paths before unlink, ignore watch target artifacts** (66adb26)
- **refactor(uploads): serve sensitive photo subtrees through authenticated routes** (2d67d78)
- **refactor(shared): move body fat formulas into @workspace/shared** (ed125c0)
- **refactor(workouts): restrict workout plan template dates to string | null** (1c3437d)
- **refactor(workouts): replace any types with explicit TypeScript interfaces in workoutPlanTemplateService** (9393528)
- **chore: sync db_schema_backup.sql with migrations** (ecd8b26)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/CodeWithCJ/SparkyFitness?utm_source=github-action)._