v0.9.7

Fixed

• Reprocessing an activity that already had a description stacked one more block on every attempt: Strava saved the new text with the whole old text still behind it, so each read-back failed and the text grew. The description field is now replaced the way a paste over a selection would be (select everything, insert through the browser's input path), with setting the value from script as the fallback. If the field does not hold exactly the new text afterwards, nothing is saved.

v0.9.6

Fixed

• Strava has been seen dropping the line break between one Glucava block's end marker and the next block's start marker. The second block then no longer started a line, was not recognised, and every reprocess stacked another block on top. A lost line break after a block's end marker is now put back before blocks are looked for, so glued blocks are replaced instead of stacked, and the read-back check no longer counts that line break as a difference.

v0.9.5

Changed

• When the description read back from Strava differs from what was written, the log now says how: lengths, line counts, marker counts, the code points around the first difference, and whether the page still shows the text from before the save. The text itself is never logged. This is for tracking down activities that fail the read-back check on every first attempt.

v0.9.4

Fixed

• A description template that renders three or more lines (for example the before/after preset) made every activity fail with "refused to write: merge would change text outside the glucava block", including the delayed chart upload. A Glucava block now ends at its end marker however many lines it spans.

Added

• Activities that failed with that error get an "Overwrite description" button on their page. After a confirmation it replaces the whole description with the Glucava block, as a way out when the markers in the existing text are damaged. The earlier text stays restorable through "Restore original".

v0.9.3

Security

• Built with Go 1.27.3, which fixes GO-2026-6809 (compromised intermediate certificates are distrusted in crypto/x509; reachable through the importer's zip check). golang.org/x/net is 0.60.0 (CVE-2026-78669).
• Image rebuilt on current Debian 13 security updates: Chromium 154.0.8037.92 -> 156.0.8078.47. A vulnerability scan (Trivy) reports 414 High/Critical findings against the 0.9.2 image, 338 of them in chromium, and 67 against this one. None of those 67 has a fix available yet: they are Debian base libraries (libxml2, util-linux, ...).

Changed

• Debian base image digest refreshed. Dependencies: PocketBase 0.40.5, golang.org/x/image 0.47.0, prometheus/client_golang 1.25.0, gomponents 1.4.0.
• CI: CodeQL init and analyze are bumped together (grouped in Dependabot), upload-artifact v7 and download-artifact v8, and a flaky retry test no longer depends on a fixed 20 ms probe.

v0.9.2

Fixed

• Remote sign-in browser: Google's sign-in also navigates to accounts.youtube.com at the top level to set the session, which the navigation lock refused. youtube.com is allowed as a sign-in host now.

v0.9.1

Fixed

• Remote sign-in browser: Google's sign-in redirects to the country domain (for example accounts.google.at), which the navigation lock refused with "blocked by Chromium". Google's country domains are allowed now, and the lock applies to top-level navigations only, so frames that sign-in pages embed (captcha, accounts.youtube.com) still load. Frames may only load from Strava, its sign-in providers and a short list of captcha hosts, and the remote browser can no longer reach loopback, private or link-local addresses.

v0.9.0

Added

• Remote sign-in browser: Strava page → Open sign-in browser shows a browser running on the Glucava server. Sign in to Strava in it the way you do anywhere else (email and password, Google, Apple, Facebook, verification codes); when you reach your dashboard Glucava keeps only the session cookies, encrypted, and closes it. Password and keystrokes are never stored or logged. Page loads are limited to Strava and its sign-in providers, one browser at a time, closed after 8 minutes. Passkeys are not available in it.

Security

• Built with Go 1.27.2 (container base image updated too), which fixes standard library vulnerabilities in net/http, crypto/tls, html/template and net/textproto.

Removed

• "Sign in automatically (experimental)", which filled Strava's login form with a password you typed into Glucava. The remote sign-in browser replaces it. Cookie import stays.

v0.8.0

Added

• Languages: Settings → Language (Automatic, English, Deutsch) translates the whole interface, notification and email texts, event messages on the Notifications page, chart labels and the PDF report; "Automatic" follows the browser. Dates, weekday and month names, durations and decimal separators follow the language (for example 5,8% and Do, 1. Okt). The Strava description template is never translated; only the preset names and descriptions are. Translations are plain JSON files in internal/i18n/locales/ that anyone can contribute without code changes: see docs/TRANSLATING.md, make i18n-check and go run ./tools/i18n new <tag> <name> <native name>.
• Installable web app and Web Push notifications: enable per device under Settings → Notifications → Push notifications (HTTPS required; iOS needs Add to Home Screen first). Pushes the same events as email: failure alerts and, optionally, activity, weekly and monthly summaries. The service worker caches only static files, so no glucose data is stored on the device. New settings push_alerts and push_summaries.

Changed

• Stored events carry a message key and arguments (migration 026), so the Notifications page and notifications show in the current language; older entries keep their English text.
• Notification and email texts are written in the installation language, since they are sent without a browser; the PDF report uses the language of the person who downloads it.
• "1 activities failed" now reads "1 activity failed".

v0.7.3

Changed

• Overview: the time-of-day and lows-and-highs cards use the full row, and the lows-and-highs summary merges longest and total time into one column, so their tables no longer scroll sideways on desktop.

Added

• A printable PDF report: the Overview's "Download report" button (and a link in Settings → Your data) produces an A4 report for the selected range, with the previous-period comparison, in mg/dL or mmol/L. It is typeset by Typst from glucava's own charts with an embedded font, so it looks the same on every host. It has key numbers, time in range against the consensus targets, the daily profile (AGP), a day-by-day chart, time of day, lows and highs, per-activity-type numbers, recent activities and glucose sources. The Docker image includes typst; other setups need it on the PATH or GLUCAVA_TYPST, otherwise the download answers 503.
• Suspected sensor artifacts: compression lows and sudden sensor dips are detected and flagged on the Overview (badge with reasons, and a note such as "time below range is 1.6% as recorded and 1.0% without the suspected artifacts"). Each low episode has "Not real" / "It was real" buttons that override the detector. Settings → Overview page → "Suspected sensor artifacts" can exclude them from the statistics and from the PDF report. The Activity page shows a notice when one overlaps the activity.