Selfhosted

CookTrace is a self-hosted recipe manager. Runs in a single Docker container, PWA + native Android app, no accounts on external services, no data leaving your network, AGPL-3.0.

• Repo: https://github.com/TraceApps/cooktrace
• Docker: ghcr.io/traceapps/cooktrace:latest

Retiring -rc.N and moving to strict semver. Docker images now publish under multiple tags so you can pin :1.0, :1, or :latest depending on how aggressively you want updates. Also delivers a real Send Test email flow with recipient dialog, fixes two Android bugs (recipes showing the wrong creation date, SMTP settings loading blank), patches a high-severity adm-zip CVE in the backup restore path, and adds public contributor docs.

Every future release uses strict semver: PATCH for bug fixes, MINOR for new features, MAJOR for breaking changes. Existing rc.N image tags and release assets stay live indefinitely; anyone pinned to a specific rc release is unaffected.

Added

• Multi-Tag Docker Publishing. :1.0.0, :1.0, :1, :latest. Pin :1.0 to auto-receive patches without opting into future 1.1.0 features.
• :dev Docker Tag. Rolling image built from the dev branch.
• Send Test Email Dialog. Asks where to send the test, pre-filled with your account email.

Changed

• Retired the -rc.N suffix.
• Send Test actually sends an email now (was just verifying SMTP auth).
• Email section moved under Admin.
• Password field uses a Change button when the server has a stored value.

Fixed

• Recipes on Android showed the first-connect date instead of the real creation date. Heals on next sync after upgrade.
• Email settings blank on the Android app.
• Trace AI chef hat clipped at the top of the FAB.

Security

• adm-zip 0.5.x → 0.6.0 (CVE-2026-39244, high). Crafted ZIP file could trigger a 4GB memory allocation during full-backup restore.

• Signed APK: https://github.com/TraceApps/cooktrace/releases/tag/v1.0.0
• Docker: docker compose pull && docker compose up -d
• Discussion: https://github.com/TraceApps/cooktrace/discussions/16

AI Disclosure

Per Rule 7 / [AIP] disclosure requirements AI was used during development as a coding assistant. Level per category:

• Design (architecture, system design): Hint, I make the architectural calls; AI suggests trade-offs and edge cases I might have missed.
• Implementation (production code): Pair, roughly 50/50. AI drafts, I review, adjust, test on real hardware, and only commit what I've verified. Every commit is manually reviewed before it goes to my dev repo.
• Testing (writing tests, test plans, QA): Assisted, real-device testing is manual (I test on my own PC and mobile devices before every release). AI helps draft test plans and think through edge cases.
• Documentation (docs, comments, README, CHANGELOG): Pair, release notes and changelog entries are drafted with AI then edited for tone; comments and code docs are mostly Pair as well.
• Review (code review, PR feedback): Assisted, I'm the reviewer; AI helps with security sweeps, audit passes on complex changes, and consistency checks.
• Deployment (CI/CD config): Hint, Docker / GitHub Actions / release pipeline is largely conventional; AI-suggested improvements only.