v1.1.0

Feature release. Highlights: in-app updates (Settings → Updates panel with Android APK auto-install + admin server-update banner), app-identity change (Android WebView now identifies as app.nutritrace.local instead of localhost so password managers show a real app name), and a redesigned Settings page with per-section drill-in navigation + in-Settings search.

⚠ Upgrade note. The Android app identifier change (app.nutritrace.local, see "Changed" below) invalidates the WebView's cached auth cookie. Server-connected Android users will need to re-enter their server URL and sign back in once after upgrading; standalone Android users lose their theme / accent / display prefs but keep all food, meal, and diary data (that lives in local SQLite, unaffected). PWA / browser users are not affected.

Added

• In-app updates. New Settings → Updates panel checks GitHub Releases for a newer version and, on Android, downloads the signed APK with a progress bar and hands off to the system installer via FileProvider. Admins on the PWA see a server-update banner comparing the running server version against the latest release, with a copy-paste docker-compose upgrade command. Opt-in stable or dev-build channels. Same shared signing key means Android upgrades in place with no reinstall.
• Editable log time on diary entries (#135, thanks @caioqv-dev). Tap any diary item to edit and the sheet shows a Logged Time picker next to Number of Servings (or above Save on Quick Calories entries). Fixes the common "ate lunch at 2pm but only logged it at 10pm" case where the entry's timestamp was stuck at whenever you added it. The picker only appears when Settings → Diary → Show Timestamps is on, keeping the edit sheet clean for users who don't care about per-item times. Uses the same in-app time picker as Fasting / Notifications / Backup schedules.
• Foods page: configurable default search source (#128, thanks @sunjam). New setting under Settings → Foods → Default Search Source picks which chip the Foods page opens with: All, My Foods, OFF, USDA, or Mealie. Existing users keep the current default (My Foods); power users who add new foods often can switch to All to fan out to OFF/USDA/Mealie on every visit.
• Optional email on the "Create Admin Account" form. Shows up only when SMTP is configured via environment variables (SMTP_HOST/SMTP_USER/etc. in docker-compose), so the server can actually reach that address at that point. Stored on the admin's user record for password-reset and invite emails later. Missing this field was called out in #122 by @sunjam.
• Accent-tinted browser chrome. The browser's tab bar / address strip now picks up your current accent color via <meta name="theme-color">. Running multiple instances side by side (personal + family, or NT + CT + LT together): pick a distinct accent per install and the tabs are visually different at a glance. Favicon and icons stay the branded NutriTrace mark.
• Pull-to-refresh sync + smarter connection banner (Android). In native server mode, swipe down from the top of any page to trigger a manual sync. When sync fails, the on-screen banner now analyzes what went wrong (no network vs cellular-only vs server unreachable vs HTTP error) with actionable copy and a Retry button, instead of a generic "sync error". Contributed by @librarian in #124.

Changed

• Redesigned Settings with per-section drill-in and search. The single scrolling Settings page has been replaced with a per-section drill-in layout: each section (Appearance, Diary, Foods, Goals, Notifications, Backup, etc.) opens on its own sub-page with a smooth back-arrow animation. New in-Settings search jumps directly to any specific field across all sections, with deep-link support so the target row scroll-highlights on arrival. Sidebar keeps the current section highlighted while you're inside its sub-pages. Same settings, much less scroll.
• Bitwarden / password managers now show a real app identifier instead of "localhost" (Android). The Android app used to serve its WebView from https://localhost/, so autofill entries saved through Bitwarden / 1Password / etc. showed up as "localhost" (indistinguishable from any other localhost app). NutriTrace now identifies itself as app.nutritrace.local, which reads clearly in autofill dialogs and in your saved-credentials list. See the Upgrade note at the top for the one-time cost.
• SMTP "Username" field relabeled to "Email or Username". Most SMTP providers (Gmail, Outlook, etc.) want the full email as the username. Label change removes the guesswork.
• Fitbit connect card hidden for new users. Fitbit's Web API is being wound down; Google Health is the recommended path forward. Users who already have Fitbit connected continue to see the card and their data keeps syncing until the September 2026 cutoff. Nothing changes for existing connections.

Fixed

• Micronutrient goal units read "mcg" instead of the confusing "MG" (#137, thanks @dominicbui). The Goals editor for Vitamin K / Vitamin A / Vitamin D / Folate (B9) / Vitamin B12 used the micro sign (µg) in the label, which the app's uppercase form-label style case-mapped to Greek Capital Mu (Μ), visually identical to Latin M in most fonts. So µg rendered as MG and looked like milligrams. Switched to the unambiguous mcg spelling everywhere.
• Open Food Facts country filtering now works for country-specific searches (#130, thanks @JacosVerksted for #131). OFF name search moved to the v2 API with the correct countries_tags=en:<country> filter shape. Previously-saved country prefs auto-backfill the en: prefix so existing users keep their setting. Country dropdown expanded from 15 to 30 entries and alphabetized: added Argentina, Austria, Belgium, Chile, Denmark, Finland, Ireland, Netherlands, New Zealand, Norway, Poland, Portugal, Singapore, South Africa, South Korea, Sweden, Switzerland.
• App icon no longer shows a white halo. The bundled icon PNGs had ~15px of solid white padding baked into their corners. On tinted browser chrome the halo was visible around the tab favicon; in-app the icon looked framed. Icon URLs also cache-busted with the app version so shipped icon fixes actually take effect without users needing to clear their browser cache.
• Create Admin form password field no longer crushed (#122). The password input on the Enable User Management form was rendering as a colored sliver because of a flex-layout bug. Password + Confirm now sit symmetrically side-by-side.
• Bundled assets load offline again. In native server mode, /icons/, /fonts/, /templates/, and /vendor/ paths were being rewritten to the configured server URL even though those assets are inside the Android APK. Now short-circuits to the WebView's local origin. Contributed by @librarian in #123.
• OpenAI-compatible endpoints accept vision requests again (#114). Image content blocks are normalised on the AI proxy before forwarding, so a request with an image attached goes through whether the block is a string URL or an object with image_url.url.
• GPT-5.6-era chat parameters supported. The AI proxy translates the newer max_completion_tokens and reasoning_effort fields when talking to models that require them.

Security

• fast-uri bumped to 3.1.5 (regexp DoS, moderate). Sub-dependency picked up via the standard transitive tree.
• brace-expansion bumped to 2.1.4 / 5.0.9 (regexp DoS, moderate). Standard npm audit fix update to the resolved sub-dependency versions.

---

Signed APK on the release page. Docker image is multi-arch (amd64 + arm64):

docker compose pull && docker compose up -d