v1.2.0

Upgrading

This release fixes security issues. Self-hosted instances should upgrade. It contains the fixes for the advisories published on 12 October 2026: GHSA-hg5g-w9jc-pmm8 (high), GHSA-h563-xx5x-fqr4, GHSA-3w93-h5xm-f3gv, GHSA-r8q4-f3qp-g5mv, GHSA-7vm8-q3qm-hp39, GHSA-xcm4-g2cq-p3r3, GHSA-cjjw-vwqj-5c36 and GHSA-2x65-qmg4-pfgx. Thanks to @antonalvarezbc and @wueestry for reporting them.

With OPENATHLETE_VERSION=1, pull and restart (docker compose pull && docker compose up -d), or run the install script again.

• Migrations run automatically when the API starts (20 since 1.1.0, all additive). Two change existing data:
  • training zone values saved with the complete sport list of an earlier release now apply to every sport, as they were meant to;
  • tokens of coach invitations already accepted or refused are cleared.
• No required environment variable. New optional ones:
  • SMTP_HOST, SMTP_PORT, SMTP_SECURE, SMTP_USER, SMTP_PASSWORD, EMAIL_FROM: send emails through any SMTP server instead of Brevo;
  • SIGNUP_MODE (open by default, invite or closed) and SIGNUP_NOTIFICATION_EMAIL;
  • API_PUBLIC_URL: only if your API has its own address (where AI agents reach the MCP server);
  • APPLE_IAP_APP_ID: App Store purchases, for the hosted instance.
• Behaviour you may notice:
  • invitation links work once, and a password sign-up must use the invited address;
  • conversations outside a session can only include one's coaches and athletes;
  • GET /auth/email-exists is removed;
  • API responses never carry password hashes, push tokens, or (in messages) email addresses.

Highlights

• Calendar: week and season views, comments on sessions, drag and drop of activity files, session series, copy and move by day or week, keyboard navigation, undo, periods without training, A/B/C races, and sessions coloured by how they went.
• Training load: planned load estimated without AI, projected form, done against planned in each week, and a coach dashboard with each athlete's form, alerts and unread messages.
• AI agents: an MCP server with OAuth 2.1 and personal tokens, so assistants can read and plan your training.
• Self-hosting: SMTP email, sign-up control, password resets without email and admin commands, and the app only offers the sign-in methods and device connectors the instance has set up.
• Mobile apps: published to TestFlight and Google Play testing from release tags, Sign in with Apple, and a choice of server in the apps.
• Also: records rebuilt around one chart per record, TCX import, the Mobility sport, emails in each recipient's language, evening reminders of the next day's sessions, and the website in Spanish.

What's Changed

• feat(web): suggest same-day activities when linking a session by @antonalvarezbc in #63
• feat(web): search messages within a chat or across conversations by @antonalvarezbc in #62
• feat: import TCX activity files by @antonalvarezbc in #65
• feat(web): add a focused weekly calendar view by @antonalvarezbc in #60
• feat(web): select and delete multiple planned workouts by @antonalvarezbc in #59
• chore(deps): bump the docs group in /apps/docs with 4 updates by @dependabot[bot] in #66
• chore(deps): bump the minor-and-patch group with 10 updates by @dependabot[bot] in #67
• feat(messages): configurable coach notices for athlete activity updates by @antonalvarezbc in #64
• chore(deps-dev): bump @types/node from 22.13.10 to 22.20.5 in the minor-and-patch group by @dependabot[bot] in #68
• fix(api): weight recent weeks most in the ACWR and wait for history by @antonalvarezbc in #70
• Publish the mobile apps to TestFlight and Google Play from release tags by @tristanblt in #77
• Remove the store feedback and Claude workflows by @tristanblt in #78
• Fix the App Review rejection: Sign in with Apple and App Store purchases by @tristanblt in #81
• fix(web): format linking suggestions with the app's date locales by @antonalvarezbc in #72
• fix(web): give dialogs and the mobile menu a generic close label by @antonalvarezbc in #73
• feat(web): show an offline screen instead of signing out by @antonalvarezbc in #74
• refactor(api): tell from the import whether an activity is new by @antonalvarezbc in #76
• feat(workout): Critical Power (Running) as power target metric by @Noah-zipit in #79
• feat(sport): add Mobility sport by @Noah-zipit in #80
• test(e2e): link a coach and an athlete, and cover bulk deletion by @antonalvarezbc in #75
• test(e2e): run the phone tests on an Android phone too by @antonalvarezbc in #82
• fix(web): keep the chat open after a tap on the messages bubble by @antonalvarezbc in #84
• fix(web): readable native dropdowns in dark mode by @antonalvarezbc in #85
• fix(web): forget the previous account's data on logout by @antonalvarezbc in #87
• fix(web): summarise the sports of a training zone by @antonalvarezbc in #88
• fix: send emails in the recipient's language by @antonalvarezbc in #83
• fix(website): show every marathon plan, with clean titles and sitemap entries by @antonalvarezbc in #86
• feat(website): add a Spanish version of the website by @antonalvarezbc in #89
• Harden the release pipeline before the store submissions by @tristanblt in #90
• fix(database): give every sport to zones saved with a former complete list by @antonalvarezbc in #91
• build(deps): bump the docs group in /apps/docs with 6 updates by @dependabot[bot] in #93
• build(deps): bump the minor-and-patch group with 40 updates by @dependabot[bot] in #94
• fix(api): preserve measurement precision in MCP metric history by @ScottieNoy in #97
• fix(api): allow valid zero and signed MCP metric values by @ScottieNoy in #98
• fix(training-load): format goal RPE on 10-point scale by @VicoF in #99
• feat(mobile): allow selecting and changing server by @macschlingel in #92

New Contributors

• @tristanblt made their first contribution in #77
• @Noah-zipit made their first contribution in #79
• @ScottieNoy made their first contribution in #97
• @VicoF made their first contribution in #99
• @macschlingel made their first contribution in #92

Full Changelog: v1.1.0...v1.2.0