NutriTrace v1.1.0: In-App Updates, Password Manager App Identity, Redesigned Settings

[thebigjoe1]

Just released. Signed APK + Docker image are up on the release page: https://github.com/TraceApps/nutritrace/releases/tag/v1.1.0

Feature release. Biggest changes: in-app updates now check GitHub Releases and install the new APK on Android for you, the Android app shows a proper name in Bitwarden / 1Password autofill (goodbye "localhost"), and Settings has been redesigned into a per-section drill-in layout with in-app search.

⚠ Upgrade note for Android users. The app identity change means the Android WebView loses its cached login. On first launch after upgrading you'll need to re-enter your server URL and sign back in once (server-connected users) or accept that theme / accent / display prefs reset to defaults (standalone users). Your food, meal, and diary data is unaffected. PWA users on browsers are not affected.

Added

• In-app updates. New Settings → Updates panel checks GitHub Releases for a newer version. On Android, downloads the signed APK with a progress bar and hands off to the system installer via FileProvider. Admins on the PWA see a server-update banner comparing the running server version against the latest release, with a copy-paste docker-compose upgrade command. Opt-in stable or dev-build channels. Same shared signing key means Android upgrades in place with no reinstall.
• Editable log time on diary entries. Tap any diary item to edit and the sheet shows a Logged Time picker (gated on Settings → Diary → Show Timestamps). Fixes the common "ate lunch at 2pm but logged it at 10pm" case. Thanks to @caioqv-dev for the suggestion in #135.
• Foods page: configurable default search source. New setting picks which chip the Foods page opens with (All, My Foods, OFF, USDA, Mealie). Thanks to @sunjam for the suggestion in #128.
• Optional email on the Create Admin Account form. Shows up only when SMTP is configured via environment variables. Stored on the admin's user record for password-reset and invite emails later. Thanks to @sunjam for raising in #122.
• Accent-tinted browser chrome. The tab bar / address strip picks up your current accent color. Running multiple instances side by side reads as visually distinct at a glance.
• Pull-to-refresh sync + smarter connection banner (Android). Swipe down from the top of any page to trigger a manual sync in native server mode. Sync-failure banner now analyzes what actually went wrong instead of a generic error. Thanks to @librarian for contributing in #124.

Changed

• Redesigned Settings with per-section drill-in and search. Each Settings section opens on its own sub-page with a smooth back-arrow animation. In-Settings search jumps to any specific field across all sections. Sidebar keeps the current section highlighted while you're inside sub-pages.
• Password managers now show a real app identifier instead of "localhost" (Android). The Android app identifies itself as app.nutritrace.local, so autofill entries in Bitwarden / 1Password read clearly. See the upgrade note above for the one-time cost. Food, meal, and diary data is unaffected (SQLite, separate from the WebView).
• Fitbit connect card hidden for new users. Fitbit's Web API is being wound down. Users who already have Fitbit connected keep syncing until the September 2026 cutoff. Nothing changes for existing connections.
• SMTP "Username" field relabeled to "Email or Username". Most providers want the full email as the username, so the label removes the guesswork.

Fixed

• Micronutrient goal units read "mcg" instead of the confusing "MG". The Goals editor for Vitamin K / A / D / Folate B9 / B12 was case-mapping the µ symbol to Greek Capital Mu (visually identical to Latin M) in the uppercase form-label style. Switched to mcg spelling everywhere. Thanks to @dominicbui for reporting in #137.
• Open Food Facts country filtering works again. OFF name search moved to the v2 API with the correct countries_tags=en:<country> filter shape. Previously-saved country prefs auto-backfill. Country dropdown also expanded from 15 to 30 entries and alphabetized (added Argentina, Austria, Belgium, Chile, Denmark, Finland, Ireland, Netherlands, New Zealand, Norway, Poland, Portugal, Singapore, South Africa, South Korea, Sweden, Switzerland). Thanks to @JacosVerksted for contributing in #131.
• Create Admin form password field no longer crushed. The password input was rendering as a colored sliver because of a flex-layout bug. Password + Confirm now sit symmetrically side-by-side. Thanks to @sunjam for reporting in #122.
• App icon no longer shows a white halo. The bundled icon PNGs had ~15px of solid white padding baked into their corners.
• Bundled assets load offline again. /icons/, /fonts/, /templates/, /vendor/ paths no longer get rewritten to the server URL when they should be served from inside the APK. Thanks to @librarian for contributing in #123.
• OpenAI-compatible endpoints accept vision requests again. Image content blocks normalized on the AI proxy before forwarding, so requests with images go through whether the block is a string URL or an object with image_url.url.
• GPT-5.6-era chat parameters supported. AI proxy translates the newer max_completion_tokens and reasoning_effort fields when talking to models that require them.

Security

• fast-uri bumped to 3.1.5 (regexp DoS, moderate). Sub-dependency picked up via the standard transitive tree.
• brace-expansion bumped to 2.1.4 / 5.0.9 (regexp DoS, moderate). Standard npm audit fix update to the resolved sub-dependency versions.

---

Signed APK on the release page. Docker image is multi-arch (amd64 + arm64):

docker compose pull && docker compose up -d