From 6aba9b356f0539ec815e3fe22eaf6e764e802b95 Mon Sep 17 00:00:00 2001
From: SkateSpots <skatespots>
Date: Fri, 30 Oct 2026 00:13:39 +0700
Subject: [PATCH] release: 1.7.39

---
 package-lock.json | 4 ++--
 package.json      | 2 +-
 release-notes.txt | 9 +++++++++
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 19f832c..0a46a99 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "skate-spots",
-  "version": "1.7.38",
+  "version": "1.7.39",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "skate-spots",
-      "version": "1.7.38",
+      "version": "1.7.39",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@bitcoinerlab/secp256k1": "^1.2.0",
diff --git a/package.json b/package.json
index a09d6cd..77d0f6d 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "skate-spots",
   "private": true,
-  "version": "1.7.38",
+  "version": "1.7.39",
   "license": "AGPL-3.0-only",
   "type": "module",
   "homepage": "https://skate-spots.org",
diff --git a/release-notes.txt b/release-notes.txt
index a9c7486..354f624 100644
--- a/release-notes.txt
+++ b/release-notes.txt
@@ -1,3 +1,12 @@
+🧪 Zero known production vulnerabilities + profile services
+- Replaced the write-only SheetJS xlsx package with a small local OOXML writer.
+  `npm audit --omit=dev` is now **0 vulnerabilities**.
+- Personal profiles now show a **Lab services** strip linking to their
+  Transport, coaching, design, building and other Lab profiles.
+- Added tests for the Transport parser and XLSX writer (156 tests total).
+
+---
+
 🔍 Audit pass: counts, forms, dependencies
 - Followers now query up to 500 follow lists instead of 100, so profile and
   sponsor counts are less likely to undercount.