LiftTrace is a self-hosted weightlifting tracker (Docker + Android, AGPL-3.0). rc.7 is the next public roll-up, bundling everything from rc.6 plus the rc.7 security-only follow-up.

What’s new

• Per-exercise sharing. Every exercise now has a Share button in its detail header that produces a portable JSON file. Send it to another LiftTrace user through any channel (email, Drive, whatever), and they can import it. The Exercises page’s “+” button offers Import From File and Import From URL, so anyone can pull an exercise from a public URL (raw.githubusercontent.com works out of the box; github.com/blob URLs are auto-rewritten). Sets the stage for a community exercise repo pattern.
• CSV workout export. The Workout Summary sheet has a download button that produces a long-format CSV (one row per set) with date, exercise, set number, reps, weight, RPE, warmup flag, completion state, and per-set / exercise / workout notes. Unilateral splits become two rows so left and right stay separate. PWA downloads directly; Android writes the file to Cache and opens the system Share sheet. Made for anyone feeding an external analysis pipeline.
• Custom equipment. Add your own equipment types (Slackboard, Sandbag, Weight Vest, whatever’s in your home gym or hotel gym) via a new “+ Add” pill in the Exercise Editor’s equipment picker. Custom entries sync across devices via your account. They also appear as dashed-border chips in the Exercises filter row when at least one exercise uses them.
• Multi-select equipment filter. The Exercises page equipment chip strip is multi-select now (was one-at-a-time), so you can pick everything you have access to today (Barbell + Dumbbell + Bodyweight when you’re travelling and the hotel gym is bare) and filter the library to matching exercises. Selection persists across navigation.
• Animated banner redesigned. The illustrated SVG banners that used to fill each page’s header on Animated mode were retired (cross-viewport rendering issues on narrow phones, the art crowded the title and hid action buttons on the Exercises page). Setting Banner Style to Animated now paints the same compact accent bar as Gradient plus a subtle motion effect, picked under Settings → Appearance → Banner Animation: Shimmer (soft white sweep, default), Drift (slow hue rotation), Pulse (brightness breathing), or Aurora (overlapping accent clouds). All four honour Reduce Motion. Reclaims about 40 pixels of vertical real estate on every page.

Fixes

• Editing the same workout from two devices near-simultaneously (phone + PWA) could clobber the other device’s just-completed sets with a stale in-memory snapshot; the workout store now refetches and merges before writing.
• Browsers and password managers now correctly generate passwords that satisfy the policy (upper + lower + digit + special char, 8+ chars) when signing up, accepting an invite, resetting a password, or changing one from Profile. Previously the “suggest strong password” flow produced passwords without a special char, which the field then rejected.
• Trace FAB visualizer on Android now tracks music dynamics with the same amplitude as it does on the PWA; was previously over-damped by an extra smoothing layer.

Security

• Multer 1.4.5-lts.1 → 2.2.0 closes three high-severity CVEs on the LTS line (unhandled-exception DoS, crafted-request DoS, unclosed-stream memory leak).
• Nodemailer 8.0.7 → 9.0.3 closes five CVEs including raw-option bypass, TLS OAuth cert validation, and CRLF header injection.
• Vite bumped for the Windows server.fs.deny bypass patch.
• npm audit at both root and server now reports zero vulnerabilities. Self-hosters should pull the new Docker image or rebuild from source.

Install / upgrade

• Docker: pull the new image and restart your stack (see the README for compose snippets)
• Android: signed APK on the release page
• Full CHANGELOG: main repo

What is LiftTrace?

Self-hosted weightlifting tracker. Workouts and programs with progressive overload memory, statistics, exercise library with imports from Strong / Hevy / FitNotes / Jefit + custom exercises, radio + library music player (Subsonic / Jellyfin / Plex / Emby), body stats + weight trend, rest timer with countdown beeps, Smart Log (text or voice), superset / warm-up / RPE tracking, multi-user, OIDC SSO, federation with NutriTrace for calories-burned sync, AI assistant (Claude / OpenAI / Gemini / Ollama). Docker on the server, Capacitor app on Android. AGPL-3.0 licensed.