Security and operations

• Debug files removed, sensitive paths blocked, HSTS and scoped CORS.
• Upload directories block PHP execution.

New features

• Calculator: ICR/ISF/target/pump step saved to profile for logged-in users.
• PWA for Dice and compare; dashboard activity cards.
• Nightscout: 3-step onboarding, /nightscout/status, free-tier email alert (CLI).

Technical

• Large PHP files split; filemtime cache busting; Test/smoke-test.php.
• Documentation uses /compare/ as canonical URL.

Classic compare retired

• Redirect: /compare/classic/ permanently redirects to /compare/.
• UI: Classic links removed from compare page, sidebar, docs, and calculator.

Smart Compare (Compare2)

• New page: /compare/ with priority-based device finder, model catalog (32+ devices), browse and side-by-side compare.
• Backup: Full tar backup of diabetes.newstargeted.com to /home/backup before changes.
• Legacy /compare/: Device data updated for June 2026 (Omnipod 5, MiniMed Flex, Dexcom Stelo, Libre 3 Plus). Fixed bad suffix and pen specs.
• Navigation: Sidebar, homepage, and /docs updated with Compare2 links.

Sidebar and homepage

• Sidebar: Collapsible categories (Overview, Tools, My account, Nightscout) with saved state; active section opens automatically on page load.
• Homepage: New sections for public tools, Nightscout, member tools, and help/info.
• Footer: Simplified layout; documentation remains in the legal row.
• Fixed: Sidebar on travel expenses, invoice, meeting minutes, and profile (CSS cache); changelog expands only the latest version by default.

Unified documentation at /docs

• New page: Public documentation for all tools (Dice, compare, calculator, Nightscout, member tools, account) at /docs with Norwegian and English content.
• Nightscout: /nightscout/docs redirects to /docs#nightscout-hosting.
• Navigation: Documentation link in footer legal row and sidebar; Nightscout Hosting button points to new anchor.

Email: authenticated SMTP for password reset links

• API mail relay: [email protected] now uses authenticated SMTP (port 587) via api.newstargeted.com instead of the sendmail fallback.
• Forgot password: Reset links are delivered reliably to the registered email (tested to [email protected]).
• Operations: Mail relay password rotated and stored in api config.php (chmod 600). PHP mail() fallback kept as a safety net.

Admin, Nightscout settings, and profile

• Admin users: Emails masked and blurred with click to show/hide, copy button, and pagination (default 5 per page, choices 5–50).
• Nightscout settings: New admin page /nightscout/settings with Site Settings and Free Accounts tabs (lifetime or limited time).
• Free accounts: New users can receive free subscriptions automatically when enabled; registration and create-instance respect the settings.
• Profile sessions: Pagination with go-to-page on /profile?tab=sessions (default 5 per page).

Forgot password: readable link and username

• Link contrast: Back to login and related links on forgot-password and reset-password now use visible teal on the dark card background.
• Language switcher: English | Norsk links on forgot-password and reset-password (same as login and register).
• Email or username: Forgot password accepts one field (same as login); reset link is sent to the registered email without revealing whether the account exists.

Referat: protocol from the same meeting data

• Protocol export: A short protocol (case and decision only) is derived from the meeting minutes and can be exported as CSV, Word, DOCX and PDF, including via public share links.
• New fields: Absent attendees and next meeting (date, time, location) in the form and protocol footer.
• Routes: /referat/print-protokoll/ID and /referat/print-public-protokoll with doc=protokoll on export URLs.

Calculator: HbA1c range reference table

• Visible reference: The HbA1c tab now shows a table of DCCT % ranges and their meanings (the same seven bands as the calculator), plus a short footnote on exact thresholds and the hypo warning when mean glucose is low.

HbA1c estimator: clinical classification and hypoglycemia warning

• Seven clinical bands: classifyA1c() now uses hypo (below 4.0%), non-diabetic (4.0-5.7%), prediabetes (5.7-6.5%), diabetes target reached (6.5-7.0%), above target (7.0-8.0%), high (8.0-9.0%) and very high (above 9.0%). HbA1c around 3.7% is no longer mislabelled «Target reached».
• New red hypo card: .calc-band-hypo uses a distinct red/pink palette separate from the «very high» card to highlight the danger signal.
• Glucose hypo warning: When mean glucose is below 70 mg/dL (3.9 mmol/L), a visible warning row is appended to the result card (independent of the A1c band).
• Next lab test: suggestNextLabWeeks() returns 4 weeks for the hypo band (prompt follow-up recommended).
• Labels: renderResult() now looks up band labels by keys (result_band_hypo, _normal, _prediabetes, _target, _above_target, _high, _very_high) in Norwegian and English.

New page: Diabetes Calculator (/calculator)

• HbA1c estimator: Estimate HbA1c (DCCT %), IFCC (mmol/mol), eAG and GMI from average glucose. Manual entry, Nightscout pull (logged in) or CSV/JSON upload (Dexcom Clarity, FreeStyle Libre, Nightscout entries.json).
• Bolus calculator: Calculate meal bolus (carbs / ICR), correction ((current - target) / ISF), subtract IOB and round to pump/pen step (0.05 / 0.1 / 0.5 / 1 U).
• Device picker: Reuses the device list from /compare/ (BGM, CGM, FGM, insulin pumps and pens).
• Unit: Toggle between mmol/L and mg/dL; default mmol/L (Norway). Saved locally in the browser.
• Nightscout API: New endpoint /calculator/api/nightscout-pull (auth required) fetches aggregated stats (mean, TIR 70-180 mg/dL) from the user's own instance. api_secret is never exposed.
• Sidebar: New «Calculator» / «Kalkulator» link under Compare Devices.
• Disclaimer: Tool provides estimates only. Always confirm with your provider before adjusting treatment.

Login and registration

• Logout: Logout now redirects to /login; old admin login page removed (redirect only).
• Language on login and 2FA: English | Norsk switcher on login and 2FA step; 2FA error message localized.
• Registration: Canonical URL /register (same level as /login); nightscout/register redirects to /register. Language switcher on register page.
• Form on error: Username and email preserved on validation error; only password is cleared.
• Show password: Checkbox to show/hide password on login, register and reset-password forms.
• Log in with security key: Button on login page for passkey-first login (no password required).
• 2FA after registration: After Nightscout registration users are redirected to Profile → 2FA with welcome message and optional setup.

Profile and 2FA

• Profile page: Language preference persisted in DB, cookie and session; Profile link above username in sidebar on all pages. Nightscout profile merged into /profile (Account, 2FA, Subscription).
• Profile container and buttons: Visible profile card; button labels fixed with $profileL (sidebar no longer overwrites $L).
• 2FA tab: URL uses tab=2fa (not mfa); redirect from tab=mfa. QR code for TOTP setup.
• Account linking: Email and Discord can be linked; sign in with either; 2FA applies to both. Set password for Discord-only users; change password shown for all with password.
• Login history: New «Login history» tab with devices, IP, revoke per session and «Sign out all other sessions».
• Password tab: Dedicated Password tab; change password and set password moved there. Policy: min 7 chars, 1 capital, 1 special, no ÆØÅ (profile, reset, registration).
• 2FA backup: «Download backup codes» button to download backup codes as text file.
• Disable 2FA: «Are you sure?» popup instead of typing DISABLE.

Security keys (WebAuthn / Windows Hello)

• Attestation formats: android-key, android-safetynet, apple, tpm and fido-u2f allowed (Android/iPad/Windows Hello).
• ByteBuffer: getBase64Url() replaced with base64url helper (lbuchs/webauthn v2).
• API and path: DIABETES_ROOT set in profile.php and auth/webauthn.php; vendor autoload loaded correctly. POST with JSON body: action read from body (fixes invalid_action).
• TPM attestation: Raw ECDSA signature converted to DER; Microsoft TPM root certificates added (fixes «invalid certificate signature»).
• User messages: webauthn_unavailable and technical codes replaced with friendly «Security key not set up or not available»; cancelled prompt shows «Cancelled…». Dynamic message shows actual PHP version and missing package.

Compare devices

• Backup: Script and full tar backup of diabetes.newstargeted.com to /home/backup (timestamped).
• Diabetes type: Filter and comparison mode: Type 1, Type 2, Type 1 vs Type 1, Type 2 vs Type 2, Type 1 vs Type 2. Devices tagged with diabetesType (T1/T2/Both).
• One-to-one comparison: «Select for comparison» per device; side-by-side specification table for selected device A and B.
• New devices: FreeStyle Lite (BGM), Medtronic Simplera (CGM), Beta Bionics iLet, Sequel twiist (pumps), Tandem Mobi, Omnipod 5, MiniMed 780G; updated descriptions for Dexcom G7, Libre 3, NovoPen 6, etc.
• Full-page layout: Comparison section uses full width (no large empty space to the right).

Miscellaneous

• Sidebar: «Login» button to /login (not just Discord). Dice and Dice Statistics translated to Lodd and Lodd-statistikk in Norwegian.
• Favicon: favicon.ico added at root; profile pages include favicon link.

Travel expenses

• List, create, edit, view: Full travel expense flow with own reports per user.
• Sharing: Public share link (share token) for each report.
• Export: Excel (CSV) and PDF; report loaded by report ID when exporting.
• Receipts: Receipt image uploads stored under images/receipts/{user_id}/{report_id}/.
• Logo: Custom logo upload and display in PDF export.
• Rows: Add and remove expense rows in the form.
• Routing: Clean URL structure under /travel-expenses/ (router, create, edit, view, export, share).

Meeting minutes (Referat)

• List, create, edit, view: Meeting minutes with cases, decisions and contact.
• Sharing: Public share link per meeting.
• Export: CSV (Excel), Word and PDF.
• Layout: Referat-style layout and styling (referat.css), form JS (referat-form.js).
• Routing: Clean URL structure under /referat/ (router, create, edit, view, export, share, print).

Website and security

• Maintenance mode: Check on all pages (maintenance-check) before output.
• Authentication: Discord-based login; protected pages for travel expenses and referat.
• Sidebar: Unified sidebar with Travel expenses and Referat in addition to Dashboard, Dice2 and Admin.
• Language: Norwegian and English (language-detection) across pages.

Lodd / Dice2 – Initial changelog

• Changelog: New changelog page available from the sidebar.
• Dice2: Unified sidebar with Dashboard, Dice2, Dice (classic), Compare devices and Admin.
• Dashboard: Stats (last 24h), draws and CSV export log.
• Export: CSV export with timestamp, number, lottery, color and range.
• QR / Vipps: QR display in sidebar with zoom and size controls.
• Understanding Version Numbers: SemVer section with Major (red), Minor (orange) and Patch (green), including icon badges (fa-exclamation-triangle, fa-plus-circle, fa-bug).
• Version badge: Version 1.0.0 displays «Major» instead of «New», aligned with SemVer.
• Copy link: Copy-link button per version to copy direct link with hash to clipboard.
• Filters: Filters container (filters-container) with search, version type (Major/Minor/Patch), year, per page and Clear, plus «Showing X of Y versions».
• Filter logic: Search in title and body, filter by data-type and data-year, limit by per page, update results count.