I've been building Fathom, a desktop Jellyfin client, for quite some time now and just put out the first public release (0.9.0) for Linux and Windows.

The real draw is having everything in one place. Your Jellyfin movies, shows, music, and Live TV; most of Jellyfin's important server-side management (users, libraries, scheduled tasks, transcoding, Live TV and DVR, and more); and optional Seerr requests plus a full YouTube client, all without leaving the app. No bouncing between the web dashboard, a requests page, and a browser tab. One window does the lot.

What's in it:

• Server management, built in. Handle users, libraries, scheduled tasks, active sessions, transcoding, Live TV and DVR, and more, without opening the Jellyfin web dashboard.
• Optional Seerr requests right from the detail page, with Jellyfin, local, or API-key sign-in.
• Optional YouTube client. SponsorBlock, DeArrow, dislike counts, downloads, no ads and no account, off unless you turn it on.
• One shared player. Jellyfin and YouTube use the same controls, seek bar, and shortcuts. Picture-in-picture, or pop a video out to a floating, always-on-top window on your desktop.
• Plus: SyncPlay watch-together (works with other Jellyfin clients too), ratings (Rotten Tomatoes, IMDb, and more), in-app updates with a stable or beta channel, light/dark/AMOLED themes, and searchable settings. Everything plays through mpv, so you get direct play, hardware decoding, and proper subtitle and audio track control.

It's Linux-first (built and tested on Arch/KDE) with a self-contained AppImage, plus a portable Windows build. Android and more features are on the roadmap.

Download + source: https://github.com/Fathom-Media/fathom/releases/tag/v0.9.0 Repo (AGPL-3.0): https://github.com/Fathom-Media/fathom

This is the first public release, so expect a few rough edges. All feedback is genuinely wanted: bug reports, feature requests, and ideas. The goal is to grow Fathom into one of the best Jellyfin clients out there, so open an issue or start a discussion and it'll get read.

I've been building Fathom, a desktop Jellyfin client, for quite some time and just put out the first public release (0.9.0) for Linux and Windows.

The real draw is having everything in one place. Your Jellyfin movies, shows, music, and Live TV; most of Jellyfin's important server-side management (users, libraries, scheduled tasks, transcoding, Live TV and DVR, and more); and optional Seerr requests plus a full YouTube client, all without leaving the app. No bouncing between the web dashboard, a requests page, and a browser tab. One window does the lot.

What's in it:

• Server management, built in. Handle users, libraries, scheduled tasks, transcoding, active sessions, Live TV and DVR, and more, without opening the Jellyfin web dashboard.
• Optional Seerr requests right from the detail page, with Jellyfin, Seerr, or API-key sign-in.
• Optional YouTube client. SponsorBlock, DeArrow, dislike counts, downloads, no ads and no account, off unless you turn it on.
• One shared player. Jellyfin and YouTube use the same controls, seek bar, and shortcuts. Picture-in-picture, or pop a video out to a floating, always-on-top window on your desktop.
• Plus: SyncPlay watch-together (works with other Jellyfin clients too), ratings (Rotten Tomatoes, IMDb, and more), in-app updates with a stable or beta channel, light/dark/AMOLED themes, and searchable settings. Everything plays through mpv, so you get direct play, hardware decoding, and proper subtitle and audio track control.

It's Linux-first (built and tested on Arch/KDE) with a self-contained AppImage, plus a portable Windows build. Android and more features are on the roadmap.

Download + source: https://github.com/Fathom-Media/fathom/releases/tag/v0.9.0 Repo (AGPL-3.0): https://github.com/Fathom-Media/fathom

This is the first public release, so expect a few rough edges. All feedback is genuinely wanted: bug reports, feature requests, and ideas. The goal is to grow Fathom into one of the best Jellyfin clients out there, so open an issue or start a discussion and it'll get read.

AI Disclosure

Per Rule 7 / [AIP] disclosure requirements AI was used during development as a coding assistant. Level per category:

• Design (architecture, system design): Hint — I make the architectural calls; AI suggests trade-offs and edge cases I might have missed.
• Implementation (production code): Pair — roughly 50/50. AI drafts, I review, adjust, test on real hardware, and only commit what I've verified. Every commit is manually reviewed before it goes to my dev repo.
• Testing (writing tests, test plans, QA): Assisted — real-device testing is manual (I test on my own PC before every release). AI helps draft test plans and think through edge cases.
• Documentation (docs, comments, README, CHANGELOG): Pair — release notes and changelog entries are drafted with AI then edited for tone; comments and code docs are mostly Pair as well.
• Review (code review, PR feedback): Assisted — I'm the reviewer; AI helps with security sweeps, audit passes on complex changes, and consistency checks.
• Deployment (CI/CD config): Hint — GitHub Actions/release pipeline is largely conventional; AI-suggested improvements only.

CookTrace is a self-hosted recipe manager. Runs in a single Docker container, PWA + native Android app, no accounts on external services, no data leaving your network, AGPL-3.0.

• Repo: https://github.com/TraceApps/cooktrace
• Docker: ghcr.io/traceapps/cooktrace:latest

Retiring -rc.N and moving to strict semver. Docker images now publish under multiple tags so you can pin :1.0, :1, or :latest depending on how aggressively you want updates. Also delivers a real Send Test email flow with recipient dialog, fixes two Android bugs (recipes showing the wrong creation date, SMTP settings loading blank), patches a high-severity adm-zip CVE in the backup restore path, and adds public contributor docs.

Every future release uses strict semver: PATCH for bug fixes, MINOR for new features, MAJOR for breaking changes. Existing rc.N image tags and release assets stay live indefinitely; anyone pinned to a specific rc release is unaffected.

Added

• Multi-Tag Docker Publishing. :1.0.0, :1.0, :1, :latest. Pin :1.0 to auto-receive patches without opting into future 1.1.0 features.
• :dev Docker Tag. Rolling image built from the dev branch.
• Send Test Email Dialog. Asks where to send the test, pre-filled with your account email.

Changed

• Retired the -rc.N suffix.
• Send Test actually sends an email now (was just verifying SMTP auth).
• Email section moved under Admin.
• Password field uses a Change button when the server has a stored value.

Fixed

• Recipes on Android showed the first-connect date instead of the real creation date. Heals on next sync after upgrade.
• Email settings blank on the Android app.
• Trace AI chef hat clipped at the top of the FAB.

Security

• adm-zip 0.5.x → 0.6.0 (CVE-2026-39244, high). Crafted ZIP file could trigger a 4GB memory allocation during full-backup restore.

• Signed APK: https://github.com/TraceApps/cooktrace/releases/tag/v1.0.0
• Docker: docker compose pull && docker compose up -d
• Discussion: https://github.com/TraceApps/cooktrace/discussions/16

AI Disclosure

Per Rule 7 / [AIP] disclosure requirements AI was used during development as a coding assistant. Level per category:

• Design (architecture, system design): Hint, I make the architectural calls; AI suggests trade-offs and edge cases I might have missed.
• Implementation (production code): Pair, roughly 50/50. AI drafts, I review, adjust, test on real hardware, and only commit what I've verified. Every commit is manually reviewed before it goes to my dev repo.
• Testing (writing tests, test plans, QA): Assisted, real-device testing is manual (I test on my own PC and mobile devices before every release). AI helps draft test plans and think through edge cases.
• Documentation (docs, comments, README, CHANGELOG): Pair, release notes and changelog entries are drafted with AI then edited for tone; comments and code docs are mostly Pair as well.
• Review (code review, PR feedback): Assisted, I'm the reviewer; AI helps with security sweeps, audit passes on complex changes, and consistency checks.
• Deployment (CI/CD config): Hint, Docker / GitHub Actions / release pipeline is largely conventional; AI-suggested improvements only.

NutriTrace v1.0.0-rc.54 released: Health Connect sync fix, local LLM proxy support, backup fidelity pass

NutriTrace is a self-hosted nutrition tracker (Docker + Android, AGPL-3.0). Small point release focused on stability and fixes.

Fixes

• Health Connect users' Android sync unstuck (#89). Pending Health Connect rows on the phone were tripping a SQL bug on push, which stopped every subsequent pull. Symptom: items added on the browser weren't reaching the phone. Every user with Health Connect enabled on the Android app was silently affected. Two independent reporters (duplaja + traebertthomas-cpu) traced this to the same root cause within days of each other. Update the app on Android; the sync error banner clears on the next sync cycle.

• More accurate Time to Sound Sleep in Sleep Quality. Server-side ttss derivation now includes the initial 5-10 min settling-in awake segment, matching what the Fitbit app measures. Closes the consistent -5 to -7 min under-count on nights with a short initial wake segment. Applies to Health Connect and Google Health syncs.

What's new

• Server-side proxy for OpenAI-compatible AI providers (#90). Env-locked AI now supports AI_PROVIDER=oai-compat alongside claude / openai / gemini. Point AI_BASE_URL at a private-network Ollama, LM Studio, LocalAI, vLLM, or similar and the server calls it directly, so the browser never has to see the endpoint. Solves the mixed-content + Docker-internal-DNS gap for self-hosters running a local LLM sidecar. Same capability added to LiftTrace and CookTrace at the same time.

• Backup + restore fidelity pass. Eight silent data-loss scenarios closed across the full backup, JSON export/import, and Android local backup flows. Highlights: OFF unit metadata (nutrition_basis, alt_units, density_g_ml) from rc.50 now survives a restore, federation API tokens survive backups, JSON settings import correctly pushes to the server on PWA, and native restore no longer double-inserts on a second pass.

• "Copy to another date" defaults to today. Copying a meal or item from a past date now pre-fills today in the picker instead of the source date. One less tap for the "same lunch again today" case.

Install / upgrade

• Docker: pull the new image and restart your stack (see the README for compose snippets). Image is multi-arch (amd64 + arm64).
• Android: signed APK on the release page.
• Full CHANGELOG: main repo.

What is NutriTrace?

Self-hosted nutrition tracker. Diary + Foods catalog (with Open Food Facts / USDA / Mealie search + barcode scan), wellness integrations (Fitbit, Garmin, Withings, Google Health, Health Connect), workouts, goals, statistics, recipes, multi-user, OIDC SSO, federation with LiftTrace and CookTrace, AI assistant (Claude / OpenAI / Gemini / Ollama). Docker on the server, Capacitor app on Android. AGPL-3.0 licensed.

AI Disclosure

Per Rule 7 / [AIP] disclosure requirements AI was used during development as a coding assistant. Level per category:

• Design (architecture, system design): Hint — I make the architectural calls; AI suggests trade-offs and edge cases I might have missed.
• Implementation (production code): Pair — roughly 50/50. AI drafts, I review, adjust, test on real hardware, and only commit what I've verified. Every commit is manually reviewed before it goes to my dev repo.
• Testing (writing tests, test plans, QA): Assisted — real-device testing is manual (I test on my own PC and mobile devices before every release). AI helps draft test plans and think through edge cases.
• Documentation (docs, comments, README, CHANGELOG): Pair — release notes and changelog entries are drafted with AI then edited for tone; comments and code docs are mostly Pair as well.
• Review (code review, PR feedback): Assisted — I'm the reviewer; AI helps with security sweeps, audit passes on complex changes, and consistency checks.
• Deployment (CI/CD config): Hint — Docker/GitHub Actions/release pipeline is largely conventional; AI-suggested improvements only.

Solo maintainer; no team.

CookTrace is a self-hosted recipe manager (Docker + Android, AGPL-3.0). rc.3 is the next public roll-up, bundling everything since the rc.1 first public release plus the rc.2 patches in between.

What's new

• Pantry variants. A pantry row can now carry brand-specific rows underneath it. Recipes link to the generic parent (Whole Milk); each variant (Greenwise, Publix) has its own barcode, photo, stock, and expiration date. A generic can either use its own nutrition or pull from a chosen variant, so recipe math reflects the label of the product you actually cook with. Add Variant with inline suggestions from existing pantry rows; deleting a parent with variants asks whether to keep them as standalone items or remove them together.
• Pantry expiration dates + digest push. Every pantry row gains an Expires On field with amber/red pills and an "Expiring Soon" filter chip. A once-a-day roll-up delivers everything expiring within a chosen window (1 / 3 / 5 / 7 / 14 days) at a chosen time, through Apprise, Gotify, or ntfy plus the local device channel. Past-expiry items always included.
• AI Scan Label for pantry nutrition. Take a photo of a nutrition label from the pantry item editor and Trace extracts name, brand, serving size, and every nutrient it can read. Complementary to the existing barcode scanner: barcode → Open Food Facts lookup for name-brand products; label scan → store-brand jars, homemade batches, imports OFF doesn't cover. Requires an AI provider configured in Settings.
• Shopping list aisle grouping + drag reorder. New chip row toggles between By Aisle, By Recipe, and Flat. Every pantry category picks up an optional Default Aisle label; items added from a linked pantry row inherit that aisle automatically. Custom aisles work as free-text groups (write "Freezer" once and it becomes a group). Rows drag to reorder within a group; cross-group drops in By Aisle mode reassign the moved item's aisle, so shuffling the list is the same gesture as reclassifying an item.
• Simplified shopping quick-add + per-row edit. Primary add is now name plus optional qty plus a labeled Add pill, matching Google Keep, Bring!, AnyList, and OurGroceries. Unit moved to a per-row Edit modal so the sweep flow ("milk, eggs, bread") is name-tap-Add-repeat rather than three fields per item. The two bulk-add sources (Recipe, Planned Cooks) collapse behind a single + button in the header.
• Recipe Rest Time + Total Time. New Rest Time field for hands-off periods (rise, rest, marinate, chill, soak, ferment) rolls into the auto-calculated Total Time. Optional manual override on Total Time when the recipe's stated total is bigger than the components would imply. Times render as 1h 15m across list cards, recipe view, cookbook, public share, and the recipe-card image.
• Multi-select on Pantry and Recipes. Long-press to enter selection mode. Header title flips to "N Selected" and top-right icons become trash + cancel on Pantry, or trash + add-to-cookbook + cancel on Recipes. Matches the pattern used on NutriTrace's Diary + Foods. Replaces the older floating action pill.
• Mobile ingredient rows. The three per-row action buttons (link to pantry, section divider, delete) collapse behind a kebab menu on small screens so the ingredient name field has room to read. Adding a note is one tap in the kebab; the note appears on a second inline row.
• Four animated page banner styles. Retired the illustrated SVG headers in favor of Shimmer, Drift, Pulse, and Aurora gradient animations. All four honor Reduce Motion. Settings → Appearance → Banner Style.

Fixes

• Cook Mode now reliably keeps the screen awake on Android via the native KeepAwake plugin — the Web Wake Lock path silently stopped working on some Android WebView versions
• Cook photos taken during a diary log render immediately on the Diary Photos tab; older photos still render via a backstop URL conversion
• Bulk-add from a recipe or planned cook populates each row's aisle from the linked pantry item's category, so items land pre-grouped instead of piling into Uncategorized
• Long-pressing a shopping row no longer lets you drag it while the action menu is open — the finger-hold that opened the menu was feeding pointer moves into the reorder tracker
• Cancel out of Pantry multi-select no longer leaves an invisible layer blocking taps until reload
• The Shopping quick-add box no longer freezes on mobile when the pantry has hundreds of items — the suggestion list is now capped
• Last Cooked date no longer concatenates with a full timestamp
• Mealie ZIP importer extracts cook-event photos for full live-API parity

Security

• Dependency security bumps clear every actionable Dependabot alert: multer 1.4.5-lts.1 → 2.2.0 (three high-severity DoS CVEs on the LTS line), nodemailer 8.0.7 → 9.0.3 (five CVEs including TLS OAuth cert-validation bypass and CRLF header injection), vite 7.3.3 → 7.3.6 (dev-only server.fs.deny bypass), plus an esbuild override to clear a dev-server CORS advisory nested under svelte-i18n. Self-hosters on Docker just need to pull the new image.

Install / upgrade

• Docker: pull the new image and restart your stack (see the README for compose snippets)
• Android: signed APK on the release page
• Full CHANGELOG: main repo

What is CookTrace?

Self-hosted recipe manager. Full recipe library with live scaling, ingredient unit conversion, FDA-style Nutrition Facts, cook mode, and cook log. Pantry catalog with barcode scanning (ML Kit on Android, QuaggaJS on web), Open Food Facts + USDA lookup, variants, expiration dates, and an "8/10 in pantry" match pill on every recipe card. Cook diary + meal planner with list and month-calendar views. Shopping list that pulls missing ingredients from a recipe and skips anything you already have stocked. Trace AI assistant (Claude / OpenAI / Gemini / Ollama). Multi-user with OIDC SSO. Federation with NutriTrace (nutrition) and LiftTrace (lifting). Docker on the server, Capacitor app on Android. AGPL-3.0 licensed.

NutriTrace is a self-hosted nutrition tracker (Docker + Android, AGPL-3.0). rc.53 is a catch-up roll-up, bundling everything from rc.48 through rc.53 — the last update posted here was rc.47.

What's new

• Reorder + hide Statistics categories. Settings → Statistics → Categories now has a drag list of every metric the chart page renders (nutrients, body stats, water, wellness). Drag rows to pick your own order, toggle any of them off. New wellness sources you connect later automatically append to the end. (#85)

• Bulk delete on Foods, Meals, Recipes. Long-press an item in your catalog, pick "Select Multiple" from the action sheet, tap other items to add them to the selection, delete them all with one confirmation. Matches the multi-select UX the Diary already has. Diary entries that reference deleted items keep their nutrition snapshot but lose the link.

• Open Food Facts serving sizes + density. Foods scanned or searched from OFF now auto-import their serving units (1 slice, 1 cookie, 1 bottle, etc.), so you can log them in those units directly instead of converting to grams. Foods can also carry an optional density (g/ml) for accurate cross-system conversion on liquids like oil or honey. Unit metadata is opt-in via Settings → Diary → Show Unit Metadata for anyone who wants the leaner default. (#69, #70)

• Trace AI now logs real foods. Asking "add an apple to snacks" or "log Greek yogurt for breakfast" creates a real food entry with full nutrition (protein, carbs, fat, fiber, vitamins) instead of a Quick Calories row with just kcal. Searches your local catalog first, then Open Food Facts. Honors renamed / reordered meals so "snacks" routes to the right slot. (#79)

• French language. Full UI translation contributed by @antoinech2 (PR #72). Switchable in Settings → Language. A handful of less-common settings screens are still English and will be translated incrementally.

• Background Health Connect sync on Android. Wearable data syncs to the server about once an hour in the background even when NutriTrace is closed, so today's steps are already there when you open the browser build on a desktop. Settings → Wellness → Health Connect has a Background Sync row showing when the last sync ran plus battery-optimization guidance. (#68)

• Tap a date in the Statistics history list to jump into that day. Nutrient / water / body-stat rows open the Diary on that date, wellness rows open the Wellness page. Pairs with the rc.47 Nutrition Summary drill-down for an end-to-end "chart shows a spike, day page shows the cause" flow. (#64)

• Body-stat charts auto-fit their Y-axis to your actual data range (weight, HRV, RHR, body measurements, etc.) instead of pinning the floor to zero. If a goal is set, the range extends to keep the goal in view. Nutrient / counted charts still anchor to zero. (#67)

• Animated banner styles. The illustrated SVG page banners are retired in favor of four animated gradient styles: Shimmer, Drift, Pulse, Aurora. Pick in Settings → Appearance → Banner Style. All four honor the OS's Reduce Motion preference.

Fixes

• Editing a diary or body-stat entry from mobile and PWA in the same day could silently wipe an earlier entry when the two devices' sync windows overlapped. Every save path now refetches server state before writing so a stale cache can't overwrite fresh data from another device (#81)
• Browser password suggestions ("Suggest strong password" in Safari, 1Password, Bitwarden, etc.) now include a special character and pass validation on the first try (#82)
• Statistics charts were blank for users whose only wellness source was Health Connect or Google Health. Every wellness-source check across the app now routes through a single shared gate (#65)
• Adding a food with a phone-camera photo to the diary no longer fails with a silent 413 on busy days. Photos now save as proper uploaded files instead of inline base64 in the food record (#74)
• Removing a food or meal photo by tapping the X actually removes it now (kilkalabs follow-up on #74)
• Statistics chart tooltip no longer throws when hovering over days with missing data (#66)
• Wellness sync icons on Fitbit / Garmin / Withings / Google Health buttons rotate in the direction their arrows point (#86)
• Readiness on severe HRV crash days reads closer to Fitbit's own value (raised the interaction penalty cap to fully reflect the combined HRV+RHR crash signal)
• Inline barcode scan icons are accent-coloured and meet the 44x44 tap-target minimum (#71)
• OFF nutrients flagged as estimated no longer pull rough numbers into your totals

Security

• rc.53 clears every actionable Dependabot alert. multer 1.4.5-lts.1 → 2.2.0 (three high-severity DoS CVEs on the LTS line), nodemailer 8.0.7 → 9.0.3 (five CVEs including a TLS OAuth certificate-validation bypass and CRLF header injection), vite 6.4.1 → 6.4.3 (dev-only, server.fs.deny bypass on Windows). No user-facing changes; self-hosters just need to pull the new image.

Install / upgrade

• Docker: pull the new image and restart your stack (see the README for compose snippets). The image is multi-arch (amd64 + arm64), so Raspberry Pi 4 / Pi 5 works without a source build (#76). The README's compose snippet now includes env_file too, so INSECURE_COOKIES and other .env vars actually forward into the container.
• Android: signed APK on the release page
• Full CHANGELOG: main repo

What is NutriTrace?

Self-hosted nutrition tracker. Diary + Foods catalog (with Open Food Facts / USDA / Mealie search + barcode scan), wellness integrations (Fitbit, Garmin, Withings, Google Health, Health Connect), workouts, goals, statistics, recipes, multi-user, OIDC SSO, federation with LiftTrace and CookTrace, AI assistant (Claude / OpenAI / Gemini / Ollama). Docker on the server, Capacitor app on Android. AGPL-3.0 licensed.

LiftTrace is a self-hosted weightlifting tracker (Docker + Android, AGPL-3.0). rc.7 is the next public roll-up, bundling everything from rc.6 plus the rc.7 security-only follow-up.

What's new

• Per-exercise sharing. Every exercise now has a Share button in its detail header that produces a portable JSON file. Send it to another LiftTrace user through any channel (email, Drive, whatever), and they can import it. The Exercises page's "+" button offers Import From File and Import From URL, so anyone can pull an exercise from a public URL (raw.githubusercontent.com works out of the box; github.com/blob URLs are auto-rewritten). Sets the stage for a community exercise repo pattern.
• CSV workout export. The Workout Summary sheet has a download button that produces a long-format CSV (one row per set) with date, exercise, set number, reps, weight, RPE, warmup flag, completion state, and per-set / exercise / workout notes. Unilateral splits become two rows so left and right stay separate. PWA downloads directly; Android writes the file to Cache and opens the system Share sheet. Made for anyone feeding an external analysis pipeline.
• Custom equipment. Add your own equipment types (Slackboard, Sandbag, Weight Vest, whatever's in your home gym or hotel gym) via a new "+ Add" pill in the Exercise Editor's equipment picker. Custom entries sync across devices via your account. They also appear as dashed-border chips in the Exercises filter row when at least one exercise uses them.
• Multi-select equipment filter. The Exercises page equipment chip strip is multi-select now (was one-at-a-time), so you can pick everything you have access to today (Barbell + Dumbbell + Bodyweight when you're travelling and the hotel gym is bare) and filter the library to matching exercises. Selection persists across navigation.
• Animated banner redesigned. The illustrated SVG banners that used to fill each page's header on Animated mode were retired (cross-viewport rendering issues on narrow phones, the art crowded the title and hid action buttons on the Exercises page). Setting Banner Style to Animated now paints the same compact accent bar as Gradient plus a subtle motion effect, picked under Settings → Appearance → Banner Animation: Shimmer (soft white sweep, default), Drift (slow hue rotation), Pulse (brightness breathing), or Aurora (overlapping accent clouds). All four honour Reduce Motion. Reclaims about 40 pixels of vertical real estate on every page.

Fixes

• Editing the same workout from two devices near-simultaneously (phone + PWA) could clobber the other device's just-completed sets with a stale in-memory snapshot; the workout store now refetches and merges before writing.
• Browsers and password managers now correctly generate passwords that satisfy the policy (upper + lower + digit + special char, 8+ chars) when signing up, accepting an invite, resetting a password, or changing one from Profile. Previously the "suggest strong password" flow produced passwords without a special char, which the field then rejected.
• Trace FAB visualizer on Android now tracks music dynamics with the same amplitude as it does on the PWA; was previously over-damped by an extra smoothing layer.

Security

• Multer 1.4.5-lts.1 → 2.2.0 closes three high-severity CVEs on the LTS line (unhandled-exception DoS, crafted-request DoS, unclosed-stream memory leak).
• Nodemailer 8.0.7 → 9.0.3 closes five CVEs including raw-option bypass, TLS OAuth cert validation, and CRLF header injection.
• Vite bumped for the Windows server.fs.deny bypass patch.
• npm audit at both root and server now reports zero vulnerabilities. Self-hosters should pull the new Docker image or rebuild from source.

Install / upgrade

• Docker: pull the new image and restart your stack (see the README for compose snippets)
• Android: signed APK on the release page
• Full CHANGELOG: main repo

What is LiftTrace?

Self-hosted weightlifting tracker. Workouts and programs with progressive overload memory, statistics, exercise library with imports from Strong / Hevy / FitNotes / Jefit + custom exercises, radio + library music player (Subsonic / Jellyfin / Plex / Emby), body stats + weight trend, rest timer with countdown beeps, Smart Log (text or voice), superset / warm-up / RPE tracking, multi-user, OIDC SSO, federation with NutriTrace for calories-burned sync, AI assistant (Claude / OpenAI / Gemini / Ollama). Docker on the server, Capacitor app on Android. AGPL-3.0 licensed.

First public release of CookTrace, a self-hosted, fully-featured recipe manager for keeping every recipe you cook in one place, with the pantry, cook diary, shopping list, and Android app to match. Inspired by apps like Mealie, built as the third app in the Trace family alongside NutriTrace (nutrition) and LiftTrace (lifting). Single Docker container, AGPL-3.0, no telemetry, no cloud sync, no subscriptions.

Repo: https://github.com/TraceApps/cooktrace Release: https://github.com/TraceApps/cooktrace/releases/tag/v1.0.0-rc.1 Docker (amd64 + arm64): ghcr.io/traceapps/cooktrace:latest

Recipes

• Full recipe model: hero photo, ratings, ingredient groups, step-by-step instructions with per-step photos, kitchen gear, source / video URLs, rich-text notes
• Live scaling with snap-to-cooking-fractions math (1 ½ cup not 1.5 cup)
• Inline unit converter per ingredient with a built-in 250-entry density table, so volume → grams resolves correctly for flours, oils, dairy, sugars
• Cook Mode with screen wake-lock, bigger fonts, persistent checkboxes
• FDA-style Nutrition Facts box per recipe (31 nutriments, %DV column)
• Cook log — date + notes + photo per cook, full per-recipe history
• Sharing — per-user grants, public-link share tokens, Pinterest-style recipe-card image, Kitchens for fanning shares to a whole household

Bring your existing library

If you already keep recipes somewhere, you don't have to start over:

• Any recipe URL — three engines: schema.org JSON-LD (fast), recipe-scrapers Python library (300+ site-specific extractors), AI Smart mode for sites that block scrapers
• Photo import — snap a cookbook page, the AI assistant extracts the recipe
• Mealie / Tandoor / Paprika — paste-import single recipes from JSON, or bulk-import a full-backup zip. Picker shows thumbnails so you can choose exactly which 10 of 200 to bring over
• NutriTrace foods → Pantry — search your NT food library and bulk-import as pantry items with nutrition + image

Everything else

• Pantry with barcode scanning (ML Kit on Android, QuaggaJS on web), Open Food Facts + USDA lookup, and an "8 / 10 in pantry" match pill on every recipe card
• Cook Diary + Meal Planner — list and month-calendar views, drag-to-re-plan, one-tap mark as cooked
• Shopping list that pulls missing ingredients from a recipe and skips anything already stocked
• Trace AI assistant — bring your own Claude / OpenAI / Gemini key, or point at a local Ollama / LM Studio / LocalAI. Tool use reads + writes your real data; hold-to-record voice for hands-free logging
• NutriTrace federation — pull foods from your NT instance, log cooked recipes back to its diary
• Android app — runs standalone (fully offline) or connected to the server, with differential sync, biometric sign-in, native barcode scanning
• Multi-user — invites, password reset, OIDC SSO (Authentik, Keycloak, Authelia, Pocket-ID, Google)
• Backup — scheduled auto-backups, full ZIP restore, portable JSON, Android local-mode .zip for phone-to-phone transfer

First public release — bugs expected

Stable in solo testing for months, but real-world deployment surfaces things one person never will. Bug reports, feature requests, importer-failure URLs, and translation PRs are all genuinely wanted. Use the in-app Diagnostics view (Settings → Diagnostics → View Logs → Share) to attach logs to bug reports.

Issues: https://github.com/TraceApps/cooktrace/issues

LiftTrace is a self-hosted weightlifting tracker (Docker + Android, AGPL-3.0). rc.5 is the next public roll-up, bundling everything since the rc.4 release.

What's new

Scheduled automatic backups. Settings → Backup → Schedule lets you pick a time + frequency (daily / weekly). Server installs get an admin UI with optional ENV lock for managed deployments; the Android app does the same for offline-only users, writing scheduled backups to device storage or the share sheet.

Multi-architecture Docker image. The public image at ghcr.io/traceapps/lifttrace now ships both amd64 and arm64 builds, so Raspberry Pi 4 / 5 and other ARM self-hosters can docker compose up -d without building from source.

Default session length raised. From 30 days to 1 year so PWA users stop getting signed out every month. Admins can still set their own session length under Settings → User Management → Session Length.

Better biometric failure path on Android. When a stored auth token has expired, biometric sign-in now surfaces a clear "Session Expired" prompt instead of silently bouncing back to the Login screen with no explanation.

Fixes

• INSECURE_COOKIES is now called out inline in the example docker-compose.yml with a comment explaining the failure mode (every request 401s after a successful login because the browser drops the Secure cookie over plain HTTP); README troubleshooting entry expanded with the exact Firefox console message that confirms the diagnosis (#4)
• Sync pulls no longer clobber local pending edits. An incoming server pull respects in-flight local changes instead of overwriting them with older data.
• Sync now clears local auth state on a 401 response so the user gets prompted to sign in again, instead of the app looping silently on every subsequent request.

Install / upgrade

• Docker: pull the new image and restart your stack (see the README for compose snippets)
• Android: signed APK on the release page
• Full CHANGELOG: main repo

What is LiftTrace?

Self-hosted weightlifting tracker. Diary (sets, reps, weights, RPE, supersets, warm-ups, persistent rest timer, natural-language Smart Add), Programs (mesocycles, templates, week-by-week progression), Exercises (full library from wger / free-exercise-db / exercisedb plus your own custom entries with images, GIFs, or YouTube links), Statistics (volume, PRs, frequency, body stats trends, RPE overlays), Coaching (trainer prescribes workouts to athletes, per-set feedback, two-way reply threads), AI assistant (Claude / OpenAI / Gemini / Ollama, BYOK, opt-in), built-in music player (Subsonic / Jellyfin / Plex / Emby libraries plus Icecast / Shoutcast / HLS streaming stations with lockscreen controls), OIDC SSO (Authentik, Keycloak, Pocket ID, Authelia, Auth0, Google, anything OIDC 1.0), workout import from Strong / Hevy / FitNotes / Jefit CSVs, federation with NutriTrace (auto-log workout calories burned to your NT diary). Docker on the server, Capacitor app on Android. AGPL-3.0 licensed.

What's new

• Quick-view Foods sheet. Tap a food on the Foods tab and a slide-up sheet shows the full Nutrition Facts label, brand, and barcode, with Add to Diary + Edit buttons right there. The full Food Editor is still one tap away when you need it. Replaces the heavier "jump straight to the editor" behavior for what's usually a glance-at-info action.
• Scheduled automatic backups. Settings → Backup → Schedule lets you pick a time + frequency (daily / weekly / monthly). Server installs get an admin UI with optional ENV lock for managed deployments; the Android app does the same for offline-only users, writing scheduled backups to device storage.
• Copy diary items to another day. Unified copy sheet for a single item or a whole meal. Pick the target date + meal in one flow. Handy for meal-prep weeks where the same lunch repeats.
• Nutrient drill-down in the Diary Nutrition Summary. Tap any row (Sodium, Protein, Fiber, etc.) to expand it in place and see the top contributing foods sorted descending. Answers the "where did today's sodium come from?" question without leaving the Diary.
• Recipe / saved meal ingredient picker now searches every food source. Source filter chips (Local, OFF, USDA, Mealie, From Others) and a barcode scan button appear inside the picker, gated by what you have enabled in Settings. Picking from a non-local source auto-saves it to your local catalog first.

Fixes

• Sidebar was missing the Wellness link for Health Connect / Google Health users (#62)
• Imported foods showed the wrong photo after a sync round because the local image cache collided on OFF's structurally-identical filenames; cache keys are now derived from the full URL (#61)
• Sharing a log file or crash report from Diagnostics only saved the filename, not the contents — files now route through the cache directory so Android can grant read access (#60)
• Wellness goal progress bars stayed at 0 for Health Connect / Google Health users (#57)
• AI Assistant works with Gemini again — a schema field rejected only by Gemini's parser (#56)
• Manual Google Health sync no longer throws an unhandled rejection on Android (#55)
• AI proposal cards no longer stick around after a photo entry is committed
• Local Open Food Facts mirror nutrition data now loads correctly across every parquet shape encountered in the wild — rc.43 through rc.45 added parser support for Python-repr lists, Uint8Array buffers, and SQL NULL literals (#53)

Install / upgrade

• Docker: pull the new image and restart your stack (see the README for compose snippets)
• Android: signed APK on the release page
• Full CHANGELOG: main repo

What is NutriTrace?

Self-hosted nutrition tracker. Diary + Foods catalog (with Open Food Facts / USDA / Mealie search + barcode scan), wellness integrations (Fitbit, Garmin, Withings, Google Health, Health Connect), workouts, goals, statistics, recipes, multi-user, OIDC SSO, federation with LiftTrace and CookTrace (in development, not yet publicly available), AI assistant (Claude / OpenAI / Gemini / Ollama). Docker on the server, Capacitor app on Android. AGPL-3.0 licensed.

NutriTrace is a self-hosted nutrition / fitness tracker (Docker + Android, AGPL-3.0). rc.47 is the next public roll-up, bundling everything since the rc.42 broad release plus the small fix-only patches in between.

What's new

• Quick-view Foods sheet. Tap a food on the Foods tab and a slide-up sheet shows the full Nutrition Facts label, brand, and barcode, with Add to Diary + Edit buttons right there. The full Food Editor is still one tap away when you need it. Replaces the heavier "jump straight to the editor" behavior for what's usually a glance-at-info action.
• Scheduled automatic backups. Settings → Backup → Schedule lets you pick a time + frequency (daily / weekly / monthly). Server installs get an admin UI with optional ENV lock for managed deployments; the Android app does the same for offline-only users, writing scheduled backups to device storage.
• Copy diary items to another day. Unified copy sheet for a single item or a whole meal. Pick the target date + meal in one flow. Handy for meal-prep weeks where the same lunch repeats.
• Nutrient drill-down in the Diary Nutrition Summary. Tap any row (Sodium, Protein, Fiber, etc.) to expand it in place and see the top contributing foods sorted descending. Answers the "where did today's sodium come from?" question without leaving the Diary.
• Recipe / saved meal ingredient picker now searches every food source. Source filter chips (Local, OFF, USDA, Mealie, From Others) and a barcode scan button appear inside the picker, gated by what you have enabled in Settings. Picking from a non-local source auto-saves it to your local catalog first.

Fixes

• Sidebar was missing the Wellness link for Health Connect / Google Health users (#62)
• Imported foods showed the wrong photo after a sync round because the local image cache collided on OFF's structurally-identical filenames; cache keys are now derived from the full URL (#61)
• Sharing a log file or crash report from Diagnostics only saved the filename, not the contents — files now route through the cache directory so Android can grant read access (#60)
• Wellness goal progress bars stayed at 0 for Health Connect / Google Health users (#57)
• AI Assistant works with Gemini again — a schema field rejected only by Gemini's parser (#56)
• Manual Google Health sync no longer throws an unhandled rejection on Android (#55)
• AI proposal cards no longer stick around after a photo entry is committed
• Local Open Food Facts mirror nutrition data now loads correctly across every parquet shape encountered in the wild — rc.43 through rc.45 added parser support for Python-repr lists, Uint8Array buffers, and SQL NULL literals (#53)

Install / upgrade

• Docker: pull the new image and restart your stack (see the README for compose snippets)
• Android: signed APK on the release page
• Full CHANGELOG: main repo

What is NutriTrace?

Self-hosted nutrition tracker. Diary + Foods catalog (with Open Food Facts / USDA / Mealie search + barcode scan), wellness integrations (Fitbit, Garmin, Withings, Google Health, Health Connect), workouts, goals, statistics, recipes, multi-user, OIDC SSO, federation with LiftTrace and CookTrace (in development, not yet publicly available), AI assistant (Claude / OpenAI / Gemini / Ollama). Docker on the server, Capacitor app on Android. AGPL-3.0 licensed.

NutriTrace is a self-hosted nutrition + wellness tracker, alternative to MyFitnessPal / Cronometer / LoseIt. Runs entirely on your own server: no telemetry, no analytics, no account hosted by anyone but you. First public release was 26 April 2026; currently at v1.0.0-rc.42.

Repo (AGPL-3.0) · Release notes + APK · CHANGELOG

What's new in this release

• AI Meal Photos. Attach a meal photo and Trace returns an editable FDA-style Nutrition Facts card. Save as Quick Calories (one-off) or as a reusable Food entry in your library. Estimates cover the full ~30-nutrient profile, not just the headline macros.
• LiftTrace workout sync. The sister weightlifting app can now push completed workouts to NutriTrace via the federation API. Sessions appear in Workout History alongside Fitbit / Garmin / Health Connect, and feed the dynamic calorie goal.
• Smart Log Voice Input Language picker. Pick the mic language independently of device locale (useful if your device is set to English but you speak another language at meals).
• API Tokens panel is now open to single-user installs (was multi-user + env-gated before).
• Wizard celebration screen on onboarding completion.

Fixes worth calling out

• Local Open Food Facts mirror search returning empty results despite the backend finding real hits (DuckDB Node v1.x VARCHAR shape regression).
• Tapping a reminder notification on Android no longer just dismisses without opening the app.
• Env-locked AI deployments now actually run Trace's tools instead of silently dropping every tool call (this one was invisible: the model would reply in plain text instead of using your real data).

App overview (for anyone new)

• Diary: calories, ~30 macros / micros, water, body stats, meal photos, per-day notes
• Food sources: your own foods, Open Food Facts (with optional local DuckDB mirror for offline / air-gap), USDA, Mealie cookbook federation
• Saved meals + recipes, copy / move / clone across meal slots and dates
• Wellness sync: Fitbit, Garmin, Withings, Google Health (Health Connect on Android)
• Calorie goals: fixed, dynamic (target = base + daily burn), or adaptive TDEE
• Intermittent fasting tracker with schedules and reminders
• Optional Trace AI Assistant: multi-provider (Claude / OpenAI / Gemini / any OpenAI-compatible endpoint), BYO key, off by default, browser calls the provider directly so the server never sees your key
• Multi-user with invites, per-user admin, optional OIDC SSO (Authentik / Pocket-ID / Authelia tested)
• Android app (Capacitor 8): offline-first SQLite + sync, biometric sign-in, native Health Connect, native barcode scanner
• Backup: full server ZIP + per-user JSON export / import. Nothing leaves your server.

Deployment

services:
  nutritrace:
    image: ghcr.io/traceapps/nutritrace:latest
    ports: ["3000:3000"]
    volumes: ["./data:/data"]
    environment:
      - JWT_SECRET=<long-random-string>

Full docker-compose + env reference in DEPLOY.md. Signed Android APK attached to every GitHub release; in-place upgrades work.