mirror of
https://github.com/actualbudget/actual.git
synced 2026-10-12 02:10:19 +00:00
master
272
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Julian Dominguez-Schatz
|
42e9d79d4a |
Merge commit from fork
* [AI] Reject invalid password inputs before hashing - Require non-empty strings at password validation, hashing and verification boundaries so JSON objects, arrays and other scalar types cannot reach Argon2's buffer conversion. - Add regressions for malformed passwords on fresh and configured servers, including assertions that rejected input never reaches Argon2. Advisory: https://github.com/actualbudget/actual/security/advisories/GHSA-3jjw-2hq7-mmm2 * [AI] Require admin permission for EnableBanking configuration - Require administrator permission to configure EnableBanking, even when credentials have not been configured yet. - Check permission before validating credentials with the provider or persisting secrets, and disable configuration controls for non-admins. - Test unauthenticated, BASIC and ADMIN requests against empty and existing configuration, preserving secrets and avoiding provider calls on denial. Advisories: https://github.com/actualbudget/actual/security/advisories/GHSA-hfxx-qc34-gqcw * [AI] Neutralize BOM-prefixed CSV formulas - Detect spreadsheet formula triggers after leading BOM characters and prepend an apostrophe before the original text. - Protect textual CSV headers and scalar values as well as ordinary strings. - Preserve numeric output, including negative amounts, and cover repeated BOMs, formula triggers, quoting and Unicode text in regression tests. Advisories: https://github.com/actualbudget/actual/security/advisories/GHSA-7jvc-qfpw-85g2 * [AI] Remove ambiguous Commerzbank payee matching - Split Commerzbank payees into non-empty whitespace/slash-delimited tokens and escape their literal text before constructing the cleanup expression. - Use consuming separators that cannot overlap the literal tokens, avoiding ambiguous matching on long runs of spaces or slashes. - Require separators between payee tokens: concatenated words in notes are no longer stripped. Allow 20 seconds for the hostile-case subprocess, including Node and Vite startup on slower CI runners. - Skip matching for empty payees while preserving normal note cleanup. - Exercise hostile payees, including the report's spaced-word reproducer, in a subprocess with a hard timeout; retain the existing bank fixtures. Advisories: https://github.com/actualbudget/actual/security/advisories/GHSA-p34v-m2gp-w3jm * [AI] Reject unsafe IPv6 address classes in SSRF checks - Allow public unicast addresses by default. The private-network option additionally permits private, loopback, unique-local and carrier-grade NAT addresses. - Permit the well-known NAT64 prefix only for embedded public IPv4 destinations; private and metadata addresses remain blocked in both modes. - Reject other IPv6 transition, multicast, reserved and link-local classes in both modes, and classify IPv4-mapped addresses by the embedded IPv4 address. - Cover literal URLs, DNS answers, redirects and both SimpleFIN fetch paths, including NAT64, 6to4 and Teredo addresses, with synthetic upstreams. Advisories: https://github.com/actualbudget/actual/security/advisories/GHSA-97j5-6g5r-42v5 * [AI] Exclude callback secrets from ordinary server logs - Log request method, pathname and response status without query strings, and restrict serialized metadata to the same safe fields. - Keep full OpenID and banking provider messages, response bodies, session identifiers and error stacks behind existing actual-sensitive namespaces. - Apply the same opt-in handling to shared banking errors, proxy target URLs and unhandled rejections; do not forward raw streaming errors to Express's ordinary error logger. - Stop logging stored secret values, including with debugging enabled. - Document targeted sensitive debugging and private support exchanges. - Test ordinary and opt-in output, query and serialized metadata leaks, provider failures, session URLs, streaming errors and secret storage. - Preserve provider format sequences by passing SimpleFIN response text as a debug format argument, rather than part of the format string. Advisories: https://github.com/actualbudget/actual/security/advisories/GHSA-ppcp-hx2h-fm35 * [AI] Revoke password sessions when credentials change - Update the password hash and revoke all password-authenticated sessions in one transaction, including password changes through the local CLI. - Issue a fresh token for each successful password login instead of reusing an existing session token. - Recheck the verified password hash before creating a session so an in-flight login cannot restore access after a credential change. - Correct the UI's claim that other sessions remain signed in, and test multiple sessions, CLI resets, transaction rollback and login/reset races. This addresses session revocation and token reuse. Requiring the current password for remote changes is covered by the following commit. Advisories: https://github.com/actualbudget/actual/security/advisories/GHSA-7363-3qq5-2frj https://github.com/actualbudget/actual/security/advisories/GHSA-4wgp-48c6-v9w3 * [AI] Require the current password for remote password changes - Require currentPassword alongside the replacement password for remote changes, preserving the administrator and password-authentication checks. - Verify the current credential, rate-limit attempts and reject a change if the verified password hash changes before the update. - Collect the current password in the client and handle failure to sign in after a successful change. Keep the local reset command available without the old password. - Test that a session token alone cannot change credentials and that failed requests preserve the existing password and sessions. - Clear the redundant success notice when signing in with the new password fails. Advisories: https://github.com/actualbudget/actual/security/advisories/GHSA-4wgp-48c6-v9w3 * [AI] Restrict Electron protocol launches and network file reveals - Allow only parsed HTTP/HTTPS URLs through external-opening IPC, new-window handling and navigation, addressing GHSA-7pf2-w24j-p6h2. - Also reject network/UNC paths in the separate file-reveal handler. A note such as [View receipt](//host/share/invoice.pdf) reaches showItemInFolder without passing through openExternal. On Windows, resolving that share can disclose NTLM authentication responses to an attacker-controlled server where network and authentication policies permit it. This additional flow was not demonstrated in the advisory. - Accept native absolute local paths without adding file-URL conversion. - Test protocol filtering and network-path rejection without invoking OS handlers. The note-to-file-reveal flow is code-confirmed; an actual Windows authentication exchange has not been reproduced. The following commit addresses the advisory's separate internal-origin classification finding. Advisory: https://github.com/actualbudget/actual/security/advisories/GHSA-7pf2-w24j-p6h2 Additional finding references: https://github.com/electron/electron/blob/v43.4.0/shell/common/platform_util_win.cc#L270-L340 https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-ntlm-blocking - Exercise Windows path semantics on all test platforms and exclude generated Electron tests and Vitest configuration from the packaged application. * [AI] Classify Electron app URLs exactly and block redirects - Replace substring checks with exact app://actual scheme/host matching and the existing development origin, http://localhost:3001. - Use the classification for browser handoffs and focus/log script execution so remote URLs containing app:// or localhost: are not mistaken for app pages. - Preserve the existing global renderer-navigation block and add redirect blocking there, without duplicating it in the main-window handlers. - Keep ordinary IPC registration unchanged; broad sender validation is outside this URL-classification fix. - Test misleading hosts, ports and URL substrings. Exercise ordinary clicks, new-window links and explicit browser IPC in Electron, asserting the exact HTTP/HTTPS URLs handed to the browser without opening real OS handlers. Exercise a local HTTP redirect to check the app stays put. Advisory: https://github.com/actualbudget/actual/security/advisories/GHSA-7pf2-w24j-p6h2 - Retain startup logs until an internal page finishes loading, then forward them to DevTools; cover startup delivery in the Electron navigation suite. * [AI] Choose import destinations from trusted local context - Allocate fresh local IDs for cloud downloads and local archive imports, ignoring destination IDs supplied in archived metadata. - Pass an explicit local destination for replacement downloads and verify its cloud-file association. Do not require matching sync group IDs, so downloading the reset version of the same cloud file remains possible. - Reject server metadata describing a different cloud file and close the budget before an authorized replacement. - Retain existing import metadata compatibility, collision error handling, nested archive layouts and backups; do not require a budget name. - Test targeted collisions, local recovery imports with obsolete IDs or missing optional metadata, mismatched cloud associations and replacement after a sync ID reset using real local files and databases. Advisory: https://github.com/actualbudget/actual/security/advisories/GHSA-7fr5-fjj8-hwjq - Reuse the matching local budget for API downloads after a sync reset, report cloud-file mismatches in API/CLI errors, and document local IDs. * [AI] Revoke sessions on sign-out and API shutdown Revoke only the supplied session on explicit sign-out. Clear local credentials if the server cannot be reached, and revoke password-created API sessions during shutdown without revoking caller-supplied tokens. Cover isolated and repeated revocation, invalid tokens, offline sign-out, borrowed API tokens and shutdown after a close failure. Session expiry policy is unchanged. Follow-up to: https://github.com/actualbudget/actual/security/advisories/GHSA-7363-3qq5-2frj |
||
|
Harshil Patel
|
1eeffe3278 |
[AI] Show clear error and configure action when GoCardless credentials are missing (#8963)
* [AI] Show clear error and configure action when GoCardless credentials are missing * [AI] Restore GoCardless transaction handler after test * [AI] Persist not-configured sync status and hide configure action for non-admins |
||
|
Matt Fiddaman
|
18e995513b |
add retry when GoCardless access token exires (#9088)
* add requisitions retry * note |
||
|
|
821caa2643 |
[AI] fix(enablebanking): fix HypoVereinsbank auth and data access (#8355)
* fix(enablebanking): pass PSU IP address header for HypoVereinsbank auth HypoVereinsbank falls back to corporate auth portal when psu-ip-address header is missing, because the first auth_method is "business". Passing the PSU headers from the incoming request selects the personal banking method instead. * fix(enablebanking): remove PSU headers from data access calls HypoVereinsbank requires Psu-Ip-Address during authorization to select the personal auth method, but rejects it on balance/transaction API calls with ASPSP_ERROR. Restrict PSU headers to startAuth only. Also add balances/transactions consent scopes to the auth request as required by the Enable Banking API. * [AI] chore: add release notes for #8355 * [autofix.ci] apply automated fixes * Scope PSU header removal to HypoVereinsbank only for data access calls Instead of stripping PSU headers globally from balance/transaction fetches, introduce `ASPSPS_WITHOUT_DATA_ACCESS_PSU_HEADERS` and `dataAccessPsuHeaders()` so only ASPSPs known to reject these headers are affected. Other ASPSPs continue to receive PSU headers on data access calls. Also restore PSU headers being passed through `buildSessionResult()` at both the auth_callback and poll-auth call sites, and propagate `aspspName` from the client via the `/transactions` endpoint so the scoping helper has the context it needs to decide. Co-Authored-By: Claude Sonnet 4.6 <[email protected]> * [autofix.ci] apply automated fixes * Fix dataAccessPsuHeaders to pass through headers when aspspName is unknown The previous condition `!aspspName || set.has(aspspName)` stripped PSU headers whenever aspspName was undefined, breaking all ASPSPs that don't send it. The correct default is to pass headers through for unknown ASPSPs and only strip them when the ASPSP is explicitly listed in the exclusion set. Co-Authored-By: Claude Sonnet 4.6 <[email protected]> --------- Co-authored-by: Carsten <[email protected]> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <[email protected]> |
||
|
Guo-Yixin
|
2dc69b3de5 | [AI] fix(sync-server): prevent duplicate Enable Banking transactions (#9046) | ||
|
|
3a77479e14 |
🔖 (26.10.0) (#9011)
* 🔖 (26.10.0) * Generate release notes for v26.10.0 * add frontmatter * [autofix.ci] apply automated fixes * Generate release notes for v26.10.0 * Generate release notes for v26.10.0 * link to experimental sidebar docs * [autofix.ci] apply automated fixes * cleanup from cherrypicks * Generate release notes for v26.10.0 * cleanup cp notes * update release date * [autofix.ci] apply automated fixes --------- Co-authored-by: github-merge-queue <[email protected]> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Matt Fiddaman <[email protected]> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
||
|
Mohammed Yasin Zuhayr
|
967684afa4 |
chore: migrate sync-server app-sync validation and errors to TypeScript (#9030)
* chore: migrate sync-server app-sync validation and errors to TypeScript * fix: reject an empty x-actual-group-id header on upload |
||
|
|
954f970241 |
[AI] Migrate create-folders migration to TypeScript (#8851)
* [AI] Migrate create-folders migration to TypeScript * [AI] Add release note for create-folders migration * [AI] Preserve migration titles after TypeScript conversion * [AI] Reject duplicate normalized migration titles --------- Co-authored-by: Baris Arı <[email protected]> Co-authored-by: Baris Ari <[email protected]> |
||
|
Matt Fiddaman
|
8f2318d1dc |
⬆️ better-sqlite3 v13 (#8736)
* better-sqlite3 v13 * note * fix build * engine update * fix yarn warning and arm32 docker builds |
||
|
|
d5d0b663c9 |
Bump @vitest/mocker from 4.1.10 to 5.0.0 in the npm_and_yarn group across 0 directory (#8923)
* Bump @vitest/mocker in the npm_and_yarn group across 0 directory Updates `@vitest/mocker` from 4.1.10 to 5.0.0 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.0/packages/mocker) --- updated-dependencies: - dependency-name: "@vitest/mocker" dependency-version: 5.0.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]> * [AI] Fix typecheck failures under vitest 5 Vitest 5 changed two things that broke the typecheck/build jobs: - `vi.fn()`'s inferred type now references `Procedure` from an internal vitest chunk that cannot be named from outside, so the hoisted mocks in `cloud-storage.test.ts` tripped TS2883. Annotate them as `Mock`. - The `expect` package was inlined and the global `jest.Matchers` declaration dropped, so `@testing-library/jest-dom`'s default entry no longer augments vitest's `Assertion`. Use the `/vitest` entry point instead. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01Bvwt76cXUoLwfHiy1jhToc * [AI] Bump @actual-app/crdt to 3.1.3 The dependency bump touches packages/crdt/package.json, so the CRDT version bump check requires a new version. Matches how the previous dependabot group bump (#8921) was handled. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01Bvwt76cXUoLwfHiy1jhToc * [AI] Add release note for the vitest bump Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01Bvwt76cXUoLwfHiy1jhToc --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: MatissJanis <[email protected]> Co-authored-by: Claude Opus 5 <[email protected]> |
||
|
dependabot[bot]andMatiss Janis Aboltins
|
5c76dfbd92 |
Bump the npm_and_yarn group across 1 directory with 5 updates (#8921)
* Bump the npm_and_yarn group across 1 directory with 5 updates Bumps the npm_and_yarn group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [csv-parse](https://github.com/adaltas/node-csv/tree/HEAD/packages/csv-parse) | `7.0.1` | `7.0.2` | | [colord](https://github.com/omgovich/colord) | `2.9.3` | `2.10.0` | | [joi](https://github.com/hapijs/joi) | `17.13.4` | `17.13.7` | | [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.6.1` | `1.8.0` | | [svgo](https://github.com/svg/svgo) | `3.3.4` | `3.3.5` | Updates `csv-parse` from 7.0.1 to 7.0.2 - [Changelog](https://github.com/adaltas/node-csv/blob/master/packages/csv-parse/CHANGELOG.md) - [Commits](https://github.com/adaltas/node-csv/commits/[email protected]/packages/csv-parse) Updates `colord` from 2.9.3 to 2.10.0 - [Release notes](https://github.com/omgovich/colord/releases) - [Changelog](https://github.com/omgovich/colord/blob/master/CHANGELOG.md) - [Commits](https://github.com/omgovich/colord/commits/v2.10) Updates `joi` from 17.13.4 to 17.13.7 - [Commits](https://github.com/hapijs/joi/compare/v17.13.4...v17.13.7) Updates `smol-toml` from 1.6.1 to 1.8.0 - [Release notes](https://github.com/squirrelchat/smol-toml/releases) - [Commits](https://github.com/squirrelchat/smol-toml/compare/v1.6.1...v1.8.0) Updates `svgo` from 3.3.4 to 3.3.5 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](https://github.com/svg/svgo/compare/v3.3.4...v3.3.5) --- updated-dependencies: - dependency-name: csv-parse dependency-version: 7.0.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: colord dependency-version: 2.10.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: joi dependency-version: 17.13.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: smol-toml dependency-version: 1.8.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: svgo dependency-version: 3.3.5 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]> * Bump version from 3.1.1 to 3.1.2 --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Matiss Janis Aboltins <[email protected]> |
||
|
|
1dcf7aaa71 |
[AI] Support reading secrets from a file with a _FILE environment variable (#8868)
* [AI] Support reading any setting from a file with a _FILE environment variable Adds the `_FILE` environment-variable suffix convention used by Docker secrets and Kubernetes file-mounted secrets. Setting `<VAR>_FILE` to a path makes Actual read that setting's value from the file, so secrets can be mounted rather than passed through the environment. This covers both config systems: every env-backed setting in the sync server's convict schema, and every env-backed setting in the CLI. On the sync-server side the override is applied after `loadFile()` and before `validate()`, using `set()`. convict re-imports the environment at the end of both `load()` and `loadFile()`, so an override applied any earlier would be clobbered by the plain environment variable. A `_FILE` variable pointing at an unreadable file is a hard error rather than a silent fallback, so a secret that failed to mount stops startup instead of leaving the server running with an empty value. Refs #5233, #7686. Supersedes the approach in #5235, which applied the override before `loadFile()` and so had the precedence backwards. Co-Authored-By: Claude Opus 5 <[email protected]> * [AI] Address review feedback on _FILE support - Treat a `_FILE` variable that is set but empty as an unreadable path rather than as unset. Previously it fell back to the plain environment variable, which contradicted the documented behaviour and hid a failed mount. This applied to both the CLI and the sync server; regression tests added for both. - Read `_FILE` variables by their literal name in the CLI's resolution chain, so the `_FILE` variables are greppable in the config module and the precedence order is visible in the chain itself. This also keeps `utils.ts` free of filesystem access. - List the remaining supported variables in the CLI environment variable table. - Rename a test to describe what it asserts. - Narrow the release note, which overstated the scope: `_FILE` applies to settings that already have an environment variable binding. Co-Authored-By: Claude Opus 5 <[email protected]> * [AI] Limit _FILE support to secrets Following the convention set by Docker's official images, where only secrets get a _FILE variant, this narrows the scope to: - sync server: ACTUAL_OPENID_CLIENT_SECRET, ACTUAL_GITHUB_TOKEN - CLI: ACTUAL_PASSWORD, ACTUAL_SESSION_TOKEN, ACTUAL_ENCRYPTION_PASSWORD ACTUAL_HTTPS_KEY and ACTUAL_HTTPS_CERT already accept a path, so they get no _FILE variant. Both sides now name the `_FILE` variables literally at the point of use, so they are greppable and the precedence order is visible in the call itself. On the sync server this replaces the generic schema walk, which had to mirror convict's internal rule for telling a setting from a group; the schema no longer has to be hoisted to a named const, so load-config.js is reduced to an import and the override loop. Also documents ACTUAL_ENCRYPTION_PASSWORD, which the CLI supports but neither environment variable table listed. Co-Authored-By: Claude Opus 5 <[email protected]> * [AI] Use a descriptive name for the temp directory in the config file env tests Addresses the remaining review nitpick: `dir` did not say what the directory held. Renamed in both test files for consistency. Co-Authored-By: Claude Opus 5 <[email protected]> * [AI] Trim comments and documentation per review - Shorten the readFileEnv doc comments in both packages, and drop the note in load-config.js about which variables are deliberately excluded, keeping the two lines explaining why the override runs between loadFile and validate. - Reduce the server documentation to a short note and move it to the top of the page. - Point at the runtime's own secret support (e.g. Docker secrets) in the CLI security notes rather than suggesting a hand-made file. - Drop the per-variable OpenID section, which repeated the note above it. Co-Authored-By: Claude Opus 5 <[email protected]> * [AI] Simplify the wording of the _FILE precedence note Replaces the sentence in the server docs, the CLI docs and the CLI README with a shorter statement of precedence, and drops the note about stopping on an unreadable file, which can be inferred. Co-Authored-By: Claude Opus 5 <[email protected]> --------- Co-authored-by: Claude Opus 5 <[email protected]> Co-authored-by: Matt Fiddaman <[email protected]> |
||
|
|
d05aa0f11a |
🔖 (26.9.0) (#8789)
* 🔖 (26.9.0) * Generate release notes for v26.9.0 * add release notes for 26.9.0 * tweak wording * Generate release notes for v26.9.0 * Generate release notes for v26.9.0 * wording tweaks * [AI] Add Tim Smart to blog authors * update authors * Use relative doc links in 26.9.0 release notes * Update packages/docs/blog/2026-09-01-release-26-9-0.md Co-authored-by: Julian Dominguez-Schatz <[email protected]> * tweak schedule button * fix links * Apply suggestion from @jfdoming Co-authored-by: Julian Dominguez-Schatz <[email protected]> --------- Co-authored-by: github-merge-queue <[email protected]> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Tim Smart <[email protected]> Co-authored-by: Julian Dominguez-Schatz <[email protected]> |
||
|
Shahid
|
baba5f502c |
Change title util to TypeScript (#8553)
* Migrate title util to TypeScript * Add release notes * Type the options parameter to preserve custom specials * Move title options type inline |
||
|
Anju
|
3ac0d7309b |
[AI] Migrate health-check script to TypeScript (#8599)
* [AI] Migrate health-check script to TypeScript * [AI] Include TypeScript scripts in knip entries * [AI] Validate health status response type |
||
|
Marcin RadoszewskiandClaude Opus 5
|
faadbb37bb |
GoCardless: derive Alior payee from the card transaction description (#8738)
* GoCardless: derive Alior payee from the card transaction description Alior Bank stopped returning creditorName on outgoing transactions in early July 2026. Without it, formatPayeeName falls through to debtorName, which on an outgoing transaction is the account holder, so every card payment is booked against the user instead of the merchant. The merchant is still available behind a fixed prefix in remittanceInformationUnstructured, so take it from there when creditorName is missing. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * rename release note to the PR number Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> --------- Co-authored-by: Claude Opus 5 (1M context) <[email protected]> |
||
|
Gautam Singh
|
19ae5da8b5 |
Return an error when changing password with no password method (#8603)
* Return an error when changing password with no password method changePassword ran an UPDATE against method = 'password' and returned success even when it matched zero rows. On an instance configured with only openid auth, the reset-password script therefore reported success without saving a password. * Add release note |
||
|
|
ecf069d35b |
🔖 (26.8.1) (#8671)
* 🔖 (26.8.1) * generate release notes * add header * add account context note * change date --------- Co-authored-by: matt-fidd <[email protected]> Co-authored-by: Matt Fiddaman <[email protected]> |
||
|
|
011b49e550 |
🔖 (26.8.0) (#8563)
* 🔖 (26.8.0) * Generate release notes for v26.8.0 * Add release notes for version 26.8.0, highlighting new stable features, mobile banking improvements, and day-level date range selection in reports. * Update authorship in release notes for version 26.8.0 to reflect MatissJanis as the author. * [AI] Apply review feedback to 26.8.0 release notes: clarify onboarding/mobile bank sync wording and note per-file credentials are Pluggy.ai only * [AI] Copy review-feedback wording fixes into releases.md for 26.8.0 Co-Authored-By: Claude Fable 5 <[email protected]> --------- Co-authored-by: github-merge-queue <[email protected]> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <[email protected]> Co-authored-by: Claude Fable 5 <[email protected]> |
||
|
Julian Dominguez-Schatz
|
fd4dea21ae | Update to Node 24 (#8604) | ||
|
Matt Fiddaman
|
cefd52e9c3 |
better simplefin errors (#8568)
* better simplefin errors * note * coderabbit |
||
|
|
ff1b6045a1 |
⬆️ mid month dependency update (#8533)
* @types/node (^22.19.21 → ^22.20.1) * eslint (^10.5.0 → ^10.7.0) * eslint-plugin-perfectionist (^5.9.0 → ^5.10.0) * knip (^6.17.1 → ^6.27.0) * lage (^2.15.13 → ^2.15.17) * vitest (^4.1.8 → ^4.1.10) * better-sqlite3 (^12.10.0 → ^12.11.1) * vite (^8.0.16 → ^8.1.5) * react-aria-components (^1.18.0 → ^1.19.0) * @storybook/addon-a11y (^10.4.4 → ^10.5.2) * @storybook/addon-docs (^10.4.4 → ^10.5.2) * @storybook/react-vite (^10.4.4 → ^10.5.2) * @vitejs/plugin-react (^6.0.2 → ^6.0.3) * eslint-plugin-storybook (^10.4.4 → ^10.5.2) * storybook (^10.4.4 → ^10.5.2) * @bufbuild/protobuf (^2.12.0 → ^2.12.1) * @bufbuild/protoc-gen-es (^2.12.0 → ^2.12.1) * @codemirror/language (^6.12.3 → ^6.12.4) * @uiw/react-codemirror (^4.25.10 → ^4.25.11) * csv-stringify (^6.7.0 → ^6.8.1) * es-toolkit (^1.47.1 → ^1.49.0) * i18next (^26.3.1 → ^26.3.6) * lru-cache (^11.5.1 → ^11.5.2) * react-aria (^3.49.0 → ^3.50.0) * react-hotkeys-hook (^5.3.2 → ^5.3.3) * react-i18next (^17.0.8 → ^17.0.10) * rolldown (^1.1.1 → ^1.2.0) * @docusaurus/core (^3.10.1 → ^3.10.2) * @docusaurus/plugin-content-docs (^3.10.1 → ^3.10.2) * @docusaurus/plugin-ideal-image (^3.10.1 → ^3.10.2) * @docusaurus/preset-classic (^3.10.1 → ^3.10.2) * @docusaurus/theme-common (^3.10.1 → ^3.10.2) * @docusaurus/theme-mermaid (^3.10.1 → ^3.10.2) * unist-util-visit-parents (^6.0.0 → ^6.0.2) * @docusaurus/module-type-aliases (^3.10.1 → ^3.10.2) * @docusaurus/types (^3.10.1 → ^3.10.2) * @oxlint/plugins (^1.69.0 → ^1.74.0) * @types/estree (^1.0.8 → ^1.0.9) * fast-check (^4.8.0 → ^4.9.0) * @capacitor/android (^8.0.0 → ^8.4.2) * @capacitor/core (^8.0.0 → ^8.4.2) * @capacitor/ios (^8.0.0 → ^8.4.2) * @capacitor/splash-screen (^8.0.1 → ^8.0.2) * @capgo/capacitor-updater (^8.50.1 → ^8.51.2) * @capacitor/cli (^8.0.0 → ^8.4.2) * @capgo/cli (^8.22.0 → ^8.28.2) * express-rate-limit (^8.5.2 → ^8.6.0) * @types/supertest (^7.2.0 → ^7.2.1) * http-proxy-middleware (^4.1.1 → ^4.2.0) * oxlint (^1.69.0 → ^1.74.0) & oxlint-tsgolint (^0.23.0 → ^0.25.0) * @codemirror/state (^6.6.0 → ^6.7.1) & @codemirror/view (^6.43.1 → ^6.43.6) * @tanstack/react-query (^5.101.0 → ^5.101.2) * recharts (^3.8.1 → ^3.9.2) * note * oxfmt (^0.44.0 → ^0.59.0) * @babel/core (^7.29.7 → ^8.0.1) * downshift (9.3.6 → 9.4.0) * react-router (7.17.0 → 8.2.0) * csv-parse (^6.2.1 → ^7.0.1) * pluggy-sdk (^0.85.3 → ^0.89.0) * yarn (4.13.0 -> 4.17.1) * yarn dedupe * Update VRT screenshots Auto-generated by VRT workflow PR: #8533 * crdt version bump * [autofix.ci] apply automated fixes * Update packageManager version to [email protected].1 --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Matiss Janis Aboltins <[email protected]> |
||
|
Nustinuaandautofix-ci[bot]
|
a29d9d81b5 |
Skip Enable Banking PSU headers for local IPs (#8032)
* Skip Enable Banking PSU headers for local IPs * Add release note for Enable Banking PSU headers * Include IPv4 link-local addresses in PSU header filter * Use trusted proxy resolved IP for Enable Banking PSU headers * Avoid logging Enable Banking PSU header values * Use shared SSRF helper for Enable Banking PSU headers * Fix space * Add shared SSRF helper for Enable Banking PSU headers * Use public IP in Enable Banking PSU header test * [autofix.ci] apply automated fixes * Add tests for shared SSRF helper --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
||
|
Matt FiddamanandClaude Fable 5
|
a31cfe7514 |
fix electron GoCardless linking (#8510)
* fix electron invalid origin * [AI] Add tests for the desktop GoCardless linking fix Covers the electron fetch wrapper's derived Origin header and the sync-server /gocardless/create-web-token origin and id validation. Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01TKqNWc6Lbigv8e61uLoopU * note * allow old origin and move link so that it exists on electron bundled server * provide a valid redirect URL to GoCardless --------- Co-authored-by: Claude Fable 5 <[email protected]> |
||
|
lelemmandautofix-ci[bot]
|
4556e9e244 |
🐛 Prevent Pluggy bank sync from repeatedly rewriting transactions (#8392)
* Prevent Pluggy bank sync from repeatedly rewriting uncategorized and transfer transactions * Regression test * Changed solution for the fix * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
||
|
lelemmandautofix-ci[bot]
|
744dd1eaff |
Bank Sync Provider per budget file [2/3] - Sync server - Pluggy.ai use per-budget credentials when available (#8317)
* PR for pluggy ai wiring per file budget ni pluggy * Fixes from rebase * Code rabbit code review * [autofix.ci] apply automated fixes * added md * Restoring client cache * code review --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
||
|
Matt Fiddaman
|
73c1fb19e9 |
recognise EUA expired GoCardless responses (#8383)
* recognise EUA expired GoCardless responses * note * add test |
||
|
+3
|
b054e9a013 |
Bank Sync Provider per budget file [1/3] - Sync server - Add file-scoped bank sync secrets (#8316)
* First PR for secrets per file * md * Code Review * Code rabbit code review * Removed migration (new column) in favor of string concatenation * automation UI: reference schedule by ID not name (#8308) * schedule by id * migrate schedule indicators * add tests * update release note * fix loading states * [AI] feat(budget analysis report): Add Balance & Category selector (#8162) * [AI] feat(budget-report): add balance-only view mode Add a 'Balance only' toggle to the Budget Analysis report that hides the Budgeted, Spent, and Overspending Adjustment series and renders the balance as a plain line chart, similar to the Net Worth graph. Co-Authored-By: Claude Sonnet 4.6 <[email protected]> * [AI] fix(budget-report): always display ending balance for consistent header spacing Co-Authored-By: Claude Sonnet 4.6 <[email protected]> * [AI] feat(budget-report): replace balance toggle buttons with series dropdown Co-Authored-By: Claude Sonnet 4.6 <[email protected]> * [AI] fix(budget-report): capitalize Categories in balance mode dropdown Co-Authored-By: Claude Sonnet 4.6 <[email protected]> * [AI] fix(budget-report): fix test imports and lint errors in BudgetAnalysisGraph test Co-Authored-By: Claude Sonnet 4.6 <[email protected]> * fix: added in release note --------- Co-authored-by: Claude Sonnet 4.6 <[email protected]> * [AI] Fix Age of Money report widget title not saving correctly (#8320) * [AI] Fix Age of Money report widget title not saving correctly Co-Authored-By: Claude Sonnet 4.6 <[email protected]> * [AI] Use mutateAsync to properly await mutations in AgeOfMoney widget Co-Authored-By: Claude Sonnet 4.6 <[email protected]> --------- Co-authored-by: Claude Sonnet 4.6 <[email protected]> * fix flaky vrt by increasing timeout (#8323) * fix test * note * Update docs with Actuali iOS app (#8324) * Update docs with Actuali iOS app * Update packages/docs/docs/community-repos.md Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Initial payee location documentation (#8241) * Initial payee location documentation * Move to dedicated experimental section Based on PR feedback * [AI] feat(budget analysis report): show hidden categories (#8164) * [AI] feat(budget-report): add toggle to include hidden categories Add a 'Show hidden categories' button that includes hidden expense categories in the Budget Analysis report. This prevents historic data from being misrepresented when a category (e.g. a car fund) is hidden. Co-Authored-By: Claude Sonnet 4.6 <[email protected]> * [AI] feat(budget-report): replace hidden categories button with icon toggle Co-Authored-By: Claude Sonnet 4.6 <[email protected]> * [AI] fix(budget-analysis): use correct package alias in test import Co-Authored-By: Claude Sonnet 4.6 <[email protected]> * fix: added in release note * [AI] refactor(budget-analysis): extract isBaseCategory helper and reuse in tests Assisted-by: ClaudeCode:claude-sonnet-4-6 * [AI] feat(budget-report): clarify hidden categories toggle state Replace the ambiguous icon-only toggle with a highlighted active state and explicit click-to-show/hide tooltip text so the current selection is clear. Add aria-pressed for accessibility. Assisted-by: ClaudeCode:claude-opus-4.8 * [AI] feat(budget-report): consolidate chart options into Options dropdown menu Replace the separate chart-type icon toggle, balance/category Select dropdown, and hidden-categories eye icon with a single Options popover (Popover + Menu) matching the pattern used by other reports (Sankey). The menu contains: - Switch to line/bar chart - Show balance (toggle) - Show categories (toggle, replaces balanceOnly) - Show hidden categories (toggle) Also rebases onto upstream/master to incorporate the balanceOnly/Select changes from #8162 before consolidating them. Assisted-by: ClaudeCode:claude-sonnet-4-6 * [AI] fix(budget-report): use static 'Bar chart' toggle in Options menu for i18n Replace the dynamic 'Switch to line/bar chart' string with a static 'Bar chart' label and a boolean toggle (on = bar, off = line), matching the toggle pattern used by other menu items and making the string straightforward to translate. Assisted-by: ClaudeCode:claude-sonnet-4-6 * Enhance budget analysis report with dropdown options Introduced a dropdown to group options and added the ability to show hidden categories in the budget analysis report. --------- Co-authored-by: Claude Sonnet 4.6 <[email protected]> * update release process (#8334) * [AI] Add cross-platform hook adding 🤖 emoji to comments (#8331) * [AI] Add cross-platform hook keeping GitHub comments/issues in Chinese or pirate voice Adds a shared agent hook that requires anything an agent posts to GitHub (PR/issue comments, PR reviews, created issues) to be written in 简体中文 (preferred) or, failing that, a fun pirate voice — never plain English. - scripts/agent-hooks/github-comment-style.sh: shared guard. Reads tool_input.body/.title, allows CJK or pirate-flavoured text, blocks plain English via exit 2. Fails open on malformed payloads. - Wired for Claude (.claude/settings.json PreToolUse), Codex (.codex/config.toml PreToolUse) and Cursor (beforeMCPExecution adapter). - Documents the rule in AGENTS.md, the canonical pr-and-commit-rules.md and the Cursor rule so platforms without hook support apply it manually. Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01Lqu3eZi5djm2cPAEm3yVht * [AI] Use a slug for the release-note filename; document slug naming in AGENTS.md Release-note filenames don't need to be the PR number — a short descriptive slug works too (the PR link is resolved at release time). Rename the new note accordingly and note this in AGENTS.md's directory reference. Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01Lqu3eZi5djm2cPAEm3yVht * [autofix.ci] apply automated fixes * [AI] Auto-label PRs with Chinese descriptions as "ai spam" via CodeRabbit Add a CodeRabbit labeling instruction (auto_apply_labels is already on) that applies the "ai spam" label when a PR description contains Chinese/CJK characters — a strong signal of AI-generated spam for this English-language project. Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01Lqu3eZi5djm2cPAEm3yVht * [AI] Exempt CodeRabbit-addressed comments from the Chinese/pirate voice hook CodeRabbit parses its commands (@coderabbitai review/resolve/etc.) as plain English, so the github-comment-style guard now skips any comment mentioning @coderabbitai / @coderabbit instead of forcing it into Chinese or pirate. Documented the exception in the canonical and Cursor rule files. Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01Lqu3eZi5djm2cPAEm3yVht * [AI] Key CodeRabbit voice exemption on authorship, not mentions The hook only ever runs on the agent's own outgoing comments, so CodeRabbit's own comments are already out of scope (it posts under its own identity). Drop the @coderabbitai mention bypass — a comment merely name-dropping the bot is still the agent's prose and must follow the Chinese/pirate rule, closing an easy plain-English bypass. Docs updated to match. Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01Lqu3eZi5djm2cPAEm3yVht * [AI] Pin CodeRabbit reviews to English CodeRabbit was reading AGENTS.md / pr-and-commit-rules.md (which ask contributors to comment in Chinese/pirate) and applying that to its own reviews, posting them in Chinese. Set `language: en-US` and `tone_instructions` so the bot's own reviews, summaries and replies stay in English; the Chinese/pirate rule is for contributor/agent comments, not CodeRabbit. Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01Lqu3eZi5djm2cPAEm3yVht * [AI] Replace Chinese/pirate comment voice with a robot-emoji prefix Scrap the 简体中文/pirate voice scheme (and its CodeRabbit language override and Chinese-based "ai spam" label) in favour of one simple rule: every GitHub comment, review or issue an agent posts must be prefixed with 🤖. The shared guard now blocks any body — or, for issues, title — that doesn't start with the robot emoji; docs and per-platform wiring updated to match. .coderabbit.yaml is restored to its original state. Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01Lqu3eZi5djm2cPAEm3yVht * [AI] Silence SC1007 false positive on CDPATH= cd in Cursor MCP adapter shellcheck flags the intentional `CDPATH= cd` empty-env prefix as SC1007 (mistaking it for an assignment). Add a scoped inline disable directive on that line; behaviour is unchanged. Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01Lqu3eZi5djm2cPAEm3yVht * [AI] Fail closed on guard execution errors in Cursor MCP adapter The adapter previously allowed the call on any non-0/2 exit from github-comment-style.sh, so a broken or missing guard would silently disable enforcement. Deny on unexpected exits instead (matching guard-shell.sh), with a message that marks it as an execution problem rather than a real policy denial. The shared guard still fails open on malformed payloads (its own exit-0 choice). Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01Lqu3eZi5djm2cPAEm3yVht * [AI] Add hook requiring a blank PR template when agents create PRs New shared guard pr-template-blank.sh blocks mcp__github__create_pull_request unless the body is the repo's PR template, unmodified (cosmetic whitespace aside) — agents must leave it blank for the human, per AGENTS.md. Wired for Claude (PreToolUse), Codex (PreToolUse) and Cursor (the beforeMCPExecution adapter now dispatches per-tool to the right guard). Docs and a release note updated. Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01Lqu3eZi5djm2cPAEm3yVht * [AI] Simplify agent-hook guard scripts - github-comment-style.sh: fold the empty/whitespace-only case into the prefix check, dropping a redundant tr subshell per field. - pr-template-blank.sh: drop the dead CR strip in canon() (the trailing whitespace sub already removes a trailing carriage return). - before-mcp-github.sh: emit the constant allow payload with printf instead of spawning jq on the common (allow) path. Co-Authored-By: Claude Opus 4.8 <[email protected]> * [AI] Drop duplicated PR-template/robot-emoji rules now that hooks enforce them The PR-template-blank and GitHub-comment robot-emoji-prefix rules are enforced by cross-platform hooks, so the copies scattered across AGENTS.md and the Cursor rules file are redundant. Remove them and point at the canonical pr-and-commit-rules.md, which keeps the full rule (including the PR-template Chinese exception that no hook can enforce). Also delete the internal PR-template-guard release note. Co-Authored-By: Claude Opus 4.8 <[email protected]> * [AI] Drop "enforced by hooks" wording from the PR/comment rule docs State the rules plainly without the meta-commentary about hook enforcement. Keeps the actual rules (don't fill the PR template, prefix GitHub comments/reviews/issues with 🤖, the Chinese exception, and the your-own-comments-only note) intact. Co-Authored-By: Claude Opus 4.8 <[email protected]> * [AI] Trim enforcement meta-commentary; shorten robot-emoji release note Drop the "isn't enforced automatically" / "handled by tooling" framing from AGENTS.md and pr-and-commit-rules.md (keeping the rule and the "apply it yourself" responsibility), and shorten the robot-emoji-prefix release note. Co-Authored-By: Claude Opus 4.8 <[email protected]> * [AI] Fail closed on unreadable payloads in the GitHub agent guards Align the new guards with the git-guard.sh / guard-shell.sh convention: fail closed when the hook payload can't be read, fail open only on a genuinely absent optional field. - github-comment-style.sh: block on invalid JSON / missing / non-object .tool_input; allow only an absent body/title within a valid object. - before-mcp-github.sh: deny on a jq parse failure / missing .tool_name instead of falling through to allow. - pr-template-blank.sh: an absent/null body now fails open (previously it normalized to "" and wrongly blocked PR creation); an empty-string body is still treated as a real non-template submission. - .codex/config.toml: describe the full guard scope (comment body + issue title) in the hook comment and statusMessage. Co-Authored-By: Claude Opus 4.8 <[email protected]> --------- Co-authored-by: Claude <[email protected]> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * speed up electron builds (#8337) * size up runners, skip translations where possible * note * mdx -> md (#8338) * mdx -> md * [AI] Outlaw .mdx in the docs package Docusaurus 3 compiles .md through MDX, so JSX and imports work in plain .md files and there is no need for the .mdx extension. Narrow the enforce-doc-links remark plugin to only accept .md: reject any .mdx source file at build time, flag links that target a .mdx file, and drop the .mdx branches from the directory scanner and link resolution. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> --------- Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]> * [AI] Add performance indexes for transactions table (#8335) * [AI] Add performance indexes for transactions table * release notes * [AI] Remove unselective tombstone-only index from performance migration * [AI] api: make the browser build work in consumer production bundles (#8289) * api: make the browser build work in consumer production bundles The browser build shipped `new Worker(new URL("./worker.js", import.meta.url))` in dist/browser.js. A consumer bundler (Vite/Rollup) recognizes that as a worker entry and re-bundles the already-prebuilt worker.js from scratch, which desyncs the absurd-sql/connection RPC so `init` throws a structured-clone error. It only worked in dev and in the package's own e2e because both serve dist verbatim. Make the browser build fully self-contained instead: - Inline the worker into browser.js and spawn it from a Blob URL, so consumer bundlers never see a worker entry to re-bundle. The worker is built as an IIFE (classic worker), mirroring the web app's kcab.worker. - Embed the sql.js wasm and the default filesystem data (migrations + default DB) into the worker so it performs no PUBLIC_URL asset fetches: - loot-core sqlite gains an opt-in `setWasmBinary` (dormant for web/node); - the worker installs a scoped fetch shim serving the embedded data/* files from a sentinel base URL. - Share the asset-collection logic between the Node disk copy and the embedded build via scripts/embedded-assets.mjs so the two never drift. Result: `import '@actual-app/api'` + `init()` works in any bundler with zero config; only COOP/COEP headers remain required (SharedArrayBuffer). Adds an e2e (e2e/consumer + e2e/global-setup.mjs) that builds a real consumer app for production and boots it under COOP/COEP — coverage the verbatim-dist harness can't provide. Docs note the build is self-contained and that cross-origin isolation is still required. Co-Authored-By: Claude Opus 4.8 <[email protected]> * [AI] api: address review feedback (guard DOM lookup, revoke blob URL on worker failure) Co-Authored-By: Claude Opus 4.8 <[email protected]> * [AI] api: address review nitpicks (drop BodyInit cast, reword release note) Co-Authored-By: Claude Opus 4.8 <[email protected]> * [AI] api: build the browser worker via Vite ?worker&inline Replace the hand-rolled worker inlining (a custom Vite plugin that read the prebuilt worker.js off disk and inlined it as a string, plus a second build config and a build-ordering dependency) with Vite's native `?worker&inline` import. This collapses the two browser build configs into one, removes the `virtual:actual-worker-code` module and the manual Blob URL spawn, and drops the worker-before-facade build step. Vite's `?worker&inline` sub-build doesn't receive vite-plugin-node-polyfills' global-shim injection (the plugin writes it to `build.rollupOptions`, but the worker sub-build reads `worker.rollupOptions`), so the worker crashed on `process is not defined`. Patch the plugin to also emit the injection on `worker.rollupOptions` — additive and backwards compatible (the web app build, including loot-core's nodePolyfills worker, is unaffected). Co-Authored-By: Claude Opus 4.8 <[email protected]> * [AI] api: embed browser assets via Vite, drop the embedded-assets script Replace scripts/embedded-assets.mjs with Vite-native asset imports in the worker entry: `?inline` for the sql.js wasm and default DB, `import.meta.glob` (`?raw`) for the migrations. The worker builds the default-filesystem wire format from those at module load, so the embedded set comes straight from loot-core and can't drift. The Node build only needs migrations + the default DB on disk (it reads them at runtime); the old script also wrote sql-wasm.wasm and the data/ fetch tree, which are dead now that the browser worker is self-contained. Replace writeEmbeddedAssetsToDist with a small closeBundle copy of just those two. Co-Authored-By: Claude Opus 4.8 <[email protected]> * [AI] api: simplify embedded data map; drop loot-core comment churn Merge the worker's binData/textData into a single dataFiles map (Response accepts both bytes and strings), collapsing the fetch shim's two lookups into one. Revert the unrelated comment edits to loot-core's backend-worker.ts and fs/index.ts. Co-Authored-By: Claude Opus 4.8 <[email protected]> * [AI] api: rename e2e consumer-dist to consumer/dist; drop a prose comment Use the standard `dist` directory name for the consumer fixture's build output (now e2e/consumer/dist), and remove the verbose comment from index.browser.ts. Co-Authored-By: Claude Opus 4.8 <[email protected]> * [AI] loot-core: own the default-filesystem assets; consumers stop reaching in Add packages/loot-core/default-filesystem.mjs as the single source of truth for loot-core's runtime assets (sql.js wasm, default DB, migrations) and the data-file-index wire format, exported as @actual-app/core/default-filesystem. - @actual-app/api: the browser worker embeds them via the actual-embedded-assets Vite plugin (which calls collectEmbeddedAssets), replacing the relative ?inline/?raw/import.meta.glob reaches into ../loot-core; the Node build copies migrations + default DB using the helper's paths. Drops the direct @jlongster/sql.js devDependency (loot-core resolves the wasm). - @actual-app/web: stagePublicData copies from the helper's paths instead of hardcoding loot-core's tree and the sql.js wasm location. Co-Authored-By: Claude Opus 4.8 <[email protected]> * [AI] loot-core: scan migrations once when collecting embedded assets collectEmbeddedAssets() read the migrations directory twice — once in its own loop and once via buildDataFileIndex(). List the names once and pass them through, keeping the index wire-format defined in a single place. Co-Authored-By: Claude Opus 4.8 <[email protected]> --------- Co-authored-by: Claude Opus 4.8 <[email protected]> * Restore budget table scroll position when navigating back from spent transactions (#8144) * feat: Restore budget table scroll position when navigating back from spent transactions page * fix: Update transaction tests to include new categories and adjust assertions * Add release notes for budget scroll position restoration * refactor: Improve error handling when clicking on visible spent-amount cells, per suggestion from coderabbit bot * refactor: revert changes to test budget, add separate scroll-test test budget * revert previous snapshot changes * Add gitignore pattern for personal devcontainer config * fix: broken tests * refactor: address coderabbitai feedback https://github.com/actualbudget/actual/pull/8144#discussion_r3446850158 * fix: update VRT snapshots for onboarding screen * [autofix.ci] apply automated fixes * refactor: modify scrolling test to add categories to existing test budget instead of creating separate budget --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * [AI] Add design competition blog post for sidenav redesign (#8297) * [AI] Add design competition blog post for sidenav redesign Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01HbXFM9ooWVw9SRA9No7vhF * [AI] Set design competition blog post publish date to 27th July 2026 Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01HbXFM9ooWVw9SRA9No7vhF * [AI] Remove stray closing tags from design competition blog post Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01HbXFM9ooWVw9SRA9No7vhF * Update 2026-07-27-design-competition-sidenav.md --------- Co-authored-by: Claude <[email protected]> * Always show stacked bar graph tooltip label on hover (#8356) * Always show stacked bar graph tooltip label on hover * Handle edge case with maxToolTipItems+1 labels showing * Replace last item label instead of adding new one * Filter visible items on non zero values for consistency * make SimpleFIN token 'forbidden' check more flexible (#8339) * make SimpleFIN token 'forbidden' check more flexible * clear accessKey when token is updated * https -> fetch * [AI] Add tests for SimpleFIN token claim fix Cover the flexible 'Forbidden' matching, full claim-response handling, and access-key invalidation when the setup token changes. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * note * Update upcoming-release-notes/fix-simplefin-token-claim.md Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * coderabbit feedback * [AI] Test SimpleFIN blank access key handling Cover rejecting a blank claim response (not persisted) and re-claiming when an empty access key is cached. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> --------- Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> --------- Co-authored-by: Matt Fiddaman <[email protected]> Co-authored-by: tabedzki <[email protected]> Co-authored-by: Claude Sonnet 4.6 <[email protected]> Co-authored-by: youngcw <[email protected]> Co-authored-by: Matt Farrell <[email protected]> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Dustin Brewer <[email protected]> Co-authored-by: Matiss Janis Aboltins <[email protected]> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Alec Bakholdin <[email protected]> Co-authored-by: clintharris <[email protected]> Co-authored-by: Darwin Do <[email protected]> |
||
|
Matt FiddamanandClaude Opus 4.8
|
e8c7f8040e |
bcrypt -> argon2id (#7829)
* bcrypt -> argon2id * coderabbit feedback * copilot review * switch hashing settings * [AI] Add unit tests for sync-server password hashing Cover password.js, focused on the bcrypt -> argon2id migration: - loginWithPassword upgrades a legacy bcrypt hash to argon2id on a successful login, leaves it untouched on a failed login, and does not needlessly rehash an existing argon2id hash - hashPassword/verifyPassword round-trip, bcrypt backward-compat, and graceful handling of non-string/malformed hashes - bootstrapPassword/changePassword/checkPassword behaviour Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * dedupe minimatch --------- Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]> |
||
|
lelemmandcoderabbitai[bot]
|
ae0594d294 |
✨ Added support to pluggy date correction based on installments (#8380)
* Added support to pluggy date correction based on installments * md * Update packages/sync-server/src/app-pluggyai/app-pluggyai.js Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * date now considers instalments, originalDate is the date without it * creating new instance instead of same obj * code review * aligning to code review * simpler --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> |
||
|
|
8b5b182dbc |
🔖 (26.7.0) (#8332)
* 🔖 (26.7.0) * Generate release notes for v26.7.0 * update blog author * Generate release notes for v26.7.0 * release notes * Generate release notes for v26.7.0 * Generate release notes for v26.7.0 * Generate release notes for v26.7.0 * relink PRs from cherry-picked changes * tweak wording of release summary * update blog post date * akahu experimental --------- Co-authored-by: github-merge-queue <[email protected]> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Matt Fiddaman <[email protected]> |
||
|
Matt Fiddaman
|
e891c2e30e |
reorganise the SimpleFIN key saving logic (#8362)
* remove the simplefin intercept in the secrets handler * note |
||
|
|
617fe63196 |
make SimpleFIN token 'forbidden' check more flexible (#8339)
* make SimpleFIN token 'forbidden' check more flexible * clear accessKey when token is updated * https -> fetch * [AI] Add tests for SimpleFIN token claim fix Cover the flexible 'Forbidden' matching, full claim-response handling, and access-key invalidation when the setup token changes. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * note * Update upcoming-release-notes/fix-simplefin-token-claim.md Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * coderabbit feedback * [AI] Test SimpleFIN blank access key handling Cover rejecting a blank claim response (not persisted) and re-claiming when an empty access key is cached. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> --------- Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> |
||
|
Matiss Janis AboltinsandClaude Opus 4.8
|
c4acaa2951 |
[AI] Add knip to detect unused files, dependencies and exports (#8309)
Adds the knip tool with a monorepo-tuned config (knip.json) and a CI gate in check.yml, plus the dead-code and dependency cleanup it surfaced. The unused-export/type/duplicate rules are disabled so exporting an unused symbol is allowed. Co-authored-by: Claude Opus 4.8 <[email protected]> |
||
|
Matt Fiddamanandautofix-ci[bot]
|
c4775bf288 |
wire tests up to depot test results analysis (#8262)
* emit junit files * wire up the actions * note * [autofix.ci] apply automated fixes * fix overly broad error * scope to master runs --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
c1c4856aa7 |
Bump dompurify in the npm_and_yarn group across 1 directory (#8286)
Bumps the npm_and_yarn group with 1 update in the / directory: [dompurify](https://github.com/cure53/DOMPurify). Updates `dompurify` from 3.4.10 to 3.4.11 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](https://github.com/cure53/DOMPurify/compare/3.4.10...3.4.11) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.11 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Oskarandautofix-ci[bot]
|
4b5642b732 |
EasyBank PayeeName fallback fix (#8243)
* fix fallback logic for easybank payeeName * yarn generate:release-notes * fix type error * expand hasCreditor check * [autofix.ci] apply automated fixes * simplify changelog --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
||
|
Matiss Janis AboltinsandClaude Opus 4.8
|
0e3991ad62 |
[AI] Fix CORS proxy GitHub API allowlist prefix bypass (#8273)
* [AI] Fix CORS proxy GitHub API allowlist prefix bypass The api.github.com branch of the plugin allowlist check used a boundary-less startsWith, so an allowlisted `owner/repo` also authorized prefix-matched repos such as `owner/repo-private`. With a server GitHub token configured, this let authenticated users read private repositories through the proxy. Require an exact match or a trailing-slash path boundary instead, and add regression tests. Co-Authored-By: Claude Opus 4.8 <[email protected]> * [AI] Shorten CORS proxy fix release note Co-Authored-By: Claude Opus 4.8 <[email protected]> --------- Co-authored-by: Claude Opus 4.8 <[email protected]> |
||
|
dependabot[bot]
|
e0880f3901 |
Bump the npm_and_yarn group across 1 directory with 2 updates (#8272)
Bumps the npm_and_yarn group with 2 updates in the / directory: [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) and [undici](https://github.com/nodejs/undici). Updates `http-proxy-middleware` from 3.0.6 to 3.0.7 - [Release notes](https://github.com/chimurai/http-proxy-middleware/releases) - [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v3.0.7/CHANGELOG.md) - [Commits](https://github.com/chimurai/http-proxy-middleware/compare/v3.0.6...v3.0.7) Updates `undici` from 7.27.2 to 7.28.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](https://github.com/nodejs/undici/compare/v7.27.2...v7.28.0) --- updated-dependencies: - dependency-name: http-proxy-middleware dependency-version: 3.0.7 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.28.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Matiss Janis AboltinsandClaude Opus 4.8
|
ac572b5e5f |
[AI] Document user enumeration trade-off on /admin/users endpoint (#8270)
* [AI] Document accepted user-enumeration trade-off on /admin/users endpoint Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01SffVjwqvL1TJPyR2KVjKaN * [AI] Add release note for /admin/users user-enumeration documentation Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01SffVjwqvL1TJPyR2KVjKaN --------- Co-authored-by: Claude <[email protected]> |
||
|
KevinandMatt Fiddaman
|
de245df61f |
Upgrade pluggy-sdk and migrate away from deprecated page-size transactions to cursor-based transactions (#8103)
* Bump pluggy-sdk to include new fetchTransactionsCursor GET /v2/transactions * Use fetchAllTransactions, which uses cursor-based /v2/transactions * Remove weak helper function * Add release note * Fix unused result mapping * Add lelemm's changes Co-authored by: lelemm * Fix lint * Add lelemm as co-author on release note * Update message * Fix comma typo * Update yarn.lock --------- Co-authored-by: Matt Fiddaman <[email protected]> |
||
|
Matt Fiddamanandautofix-ci[bot]
|
fbdad57ff0 |
⬆️ mid month dependency updates (#8235)
* @monorepo-utils/workspaces-to-typescript-project-references (^2.10.3 → ^2.11.0) * @types/node (^22.19.17 → ^22.19.21) * eslint (^10.2.0 → ^10.5.0) * eslint-plugin-perfectionist (^5.8.0 → ^5.9.0) * lage (^2.15.5 → ^2.15.13) * typescript (^6.0.2 → ^6.0.3) * vitest (^4.1.2 → ^4.1.8) * better-sqlite3 (^12.8.0 → ^12.10.0) * vite (^8.0.5 → ^8.0.16) * cosmiconfig (^9.0.1 → ^9.0.2) * react-aria-components (^1.16.0 → ^1.18.0) * @chromatic-com/storybook (^5.1.1 → ^5.2.1) * @storybook/addon-a11y (^10.3.4 → ^10.4.4) * @storybook/addon-docs (^10.3.4 → ^10.4.4) * @storybook/react-vite (^10.3.4 → ^10.4.4) * @types/react (^19.2.14 → ^19.2.17) * @vitejs/plugin-react (^6.0.1 → ^6.0.2) * eslint-plugin-storybook (^10.3.4 → ^10.4.4) * storybook (^10.3.4 → ^10.4.4) * @bufbuild/protobuf (^2.11.0 → ^2.12.0) * @bufbuild/protoc-gen-es (^2.11.0 → ^2.12.0) * @babel/core (^7.29.0 → ^7.29.7) * @codemirror/autocomplete (^6.20.1 → ^6.20.3) * @react-aria/interactions (^3.27.1 → ^3.28.1) * @reduxjs/toolkit (^2.11.2 → ^2.12.0) * @tanstack/react-query (^5.96.2 → ^5.101.0) * @uiw/react-codemirror (^4.25.9 → ^4.25.10) * date-fns (^4.1.0 → ^4.4.0) * hyperformula (^3.2.0 → ^3.3.0) * lru-cache (^11.2.7 → ^11.5.1) * react-aria (^3.47.0 → ^3.49.0) * react-error-boundary (^6.1.1 → ^6.1.2) * react-hotkeys-hook (^5.2.4 → ^5.3.2) * react-redux (^9.2.0 → ^9.3.0) * react-spring (^10.0.3 → ^10.0.4) * rolldown (^1.0.0-rc.13 → ^1.1.1) * sass (^1.99.0 → ^1.101.0) * vite-plugin-pwa (^1.2.0 → ^1.3.0) * @docusaurus/core (^3.10.0 → ^3.10.1) * @docusaurus/plugin-content-docs (^3.10.0 → ^3.10.1) * @docusaurus/plugin-ideal-image (^3.10.0 → ^3.10.1) * @docusaurus/preset-classic (^3.10.0 → ^3.10.1) * @docusaurus/theme-common (^3.10.0 → ^3.10.1) * @docusaurus/theme-mermaid (^3.10.0 → ^3.10.1) * @easyops-cn/docusaurus-search-local (^0.55.1 → ^0.55.2) * @docusaurus/module-type-aliases (^3.10.0 → ^3.10.1) * @oxlint/plugins (^1.60.0 → ^1.69.0) * ua-parser-js (^2.0.9 → ^2.0.10) * fast-check (^4.6.0 → ^4.8.0) * jest-diff (^30.3.0 → ^30.4.1) * workbox-precaching (^7.4.0 → ^7.4.1) * ipaddr.js (^2.3.0 → ^2.4.0) * jws (^3.2.2 → ^3.2.3) * http-proxy-middleware (^3.0.5 → ^3.0.6) * oxlint (^1.59.0 → ^1.69.0) * @codemirror/view (^6.41.0 → ^6.43.1) * yarn dedupe * nano-staged (^0.8.0 → ^1.0.2) * commander (^14.0.3 → ^15.0.0) * react (>=19.2 → 19.2.7) * react-dom (>=19.2 → 19.2.7) * @rolldown/plugin-babel (~0.1.8 → ~0.2.3) * downshift (9.3.2 → 9.3.6) * i18next (^25.10.10 → ^26.3.1) * react-i18next (^16.6.6 → ^17.0.8) * react-router (7.15.0 → 7.17.0) * vite-plugin-node-polyfills (^0.27.0 → ^0.28.0) * jws (^3.2.3 → ^4.0.1) * oxlint-tsgolint (^0.20.0 → ^0.23.0) * jsdom (^27.4.0 → ^29.1.1) * note * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * crdt regenerate and version bump * fix test * yarn dedupe --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
||
|
Tim
|
7b0463cd91 |
Use Akahu transaction description as fallback payee name (#8116)
* Use Akahu transaction description as fallback payee name * tweak guards * ensure dates are in NZ time * update merchant.name to fallback to other_account * fix date format * cleanup |
||
|
|
34b748c002 |
Add Enable Banking PSU type selection (#8028)
* Add Enable Banking PSU type selection * [autofix.ci] apply automated fixes * Add release note for Enable Banking PSU type selection --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Matt Fiddaman <[email protected]> |
||
|
Tim
|
7ee821343b |
Refresh akahu account if stale (#8115)
* Refresh akahu account if stale * Update upcoming-release-notes/akahu-refresh.md * wait for the refresh to complete * check account is defined * use local variable * move into helper * increase poll delay * bump refresh interval to 1 hour * ensure only one account refresh is running at a time |
||
|
ItsThatDudeandautofix-ci[bot]
|
f1c0960fee |
Feature: Add Akahu New Zealand bank sync (#6041)
* add akahu integration for nz banks * akahu fix bank name being set to account name * rename apiToken and fix reset pointing to the wrong function * fix apitoken wording in akahu init modal * add upcoming-release-notes * fix lint issues * fix lint issues * add loan account type to starting balance inversion * fix initial sync balance * initially select 365 days of transactions on first sync for akahu sync * add SyncServerAkahuAccount to onSetLinkedAccount * set transaction currency to account currency * remove unnecessary code * handle TFR TO/FROM payees and account for loan account type in transactions * [autofix.ci] apply automated fixes * rename Error to ErrorAlert and fix intial sync start date * extract note from description for TFR TO/FROM transactions * fix normalizeNotes not referencing the transaction * refactor app-akahu code * [autofix.ci] apply automated fixes * Add Akahu to ExternalAccount type * Update yarn.lock * update yarn.lock * Remove unused error var in catch block * [autofix.ci] apply automated fixes * require authentication for akahu endpoint * fix lint issue in mutations.ts * fix up import paths * fix lint issues * reorder form fields * remove unnecessary handling for debt accounts * lint fixes * Put Akahu bank sync under feature flag * remove incorrect feedback link * [autofix.ci] apply automated fixes * Add feedback link for feature toggle * use uuidv4 * prevent fetch if feature not enabled * change app-akahu to ts and tidy up * fix typecheck errors * [autofix.ci] apply automated fixes * fix browser client build issues * [autofix.ci] apply automated fixes * update akahu npm package to latest version * use amountToInteger for balance reducer * add additional details to transactions * change initial sync start date logic * add akahu fields to mappable fields in desktop-client * [autofix.ci] apply automated fixes * getDate use formatISO to get the timezone adjusted date * remove duplicate payeeName --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
||
|
mheilandandMatiss Janis Aboltins
|
67ea8d9ad0 |
[AI] Skip unimportable Enable Banking transactions instead of failing the whole sync (#8086)
* [AI] Skip unimportable Enable Banking transactions instead of failing the whole sync Enable Banking bank-sync aborts the whole account import with a client-side SQLITE_ERROR when a fetched transaction cannot be inserted — most commonly a pending transaction with no booking/value/transaction date (normalized to date ''), or a non-numeric amount. Add an isImportableTransaction helper and skip such records in the /transactions handler (logging the count) so the rest of the account imports. Dated pending transactions are unaffected. * [AI] Add release note for #8086 * [AI] Reject empty Enable Banking transaction amounts Number('') is 0 (finite), so an empty/whitespace amount slipped through isImportableTransaction as a zero transaction. Trim and reject empty amounts explicitly, with a test. Addresses PR review feedback. * Update packages/sync-server/src/app-enablebanking/services/enablebanking-service.ts Co-authored-by: Matiss Janis Aboltins <[email protected]> * Update packages/sync-server/src/app-enablebanking/app-enablebanking.ts Co-authored-by: Matiss Janis Aboltins <[email protected]> * [AI] Remove now-unused skippedCount counter The summary log that read it was removed when accepting the review suggestion; drop the dangling write-only counter so the loop matches the per-transaction skip log that remains. --------- Co-authored-by: Matiss Janis Aboltins <[email protected]> |
||
|
Matiss Janis AboltinsandClaude Opus 4.8
|
f667b5c656 |
[AI] Add SSRF protection to SimpleFIN bank sync integration (#8012)
* [AI] Add SSRF protection to SimpleFIN bank sync integration The SimpleFIN integration made server-side HTTP requests to user-controlled URLs (the base64-encoded claim token and the resulting access-key base URL) without any validation, unlike the CORS proxy which blocks private IPs via ipaddr.js. Add a shared assertUrlAllowed() helper that rejects non-http(s) URLs and blocks requests to private, loopback, link-local, unique-local, reserved, broadcast and unspecified addresses. Hostnames are resolved via DNS so names pointing at internal addresses are blocked too, not just literal IPs. Apply it before both outbound requests in getAccessKey() and getAccounts(). * [AI] Unify CORS proxy private-IP check with shared SSRF helper The CORS proxy had its own inline ipaddr.js private-IP check that duplicated the logic in the SimpleFIN SSRF helper. Export isBlockedIp() from util/ssrf and reuse it in app-cors-proxy, removing the duplicate. This also widens the CORS proxy's coverage to the reserved and broadcast ranges and normalizes IPv4-mapped IPv6 addresses, matching the SimpleFIN helper. The cors-proxy tests now exercise the real ipaddr.js against real private IPs instead of mocking it. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * [AI] Rename SimpleFIN SSRF release note to match PR number Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * Implement SSRF protection for SimpleFIN bank sync Requests to private, loopback, link-local, and other internal addresses are now blocked. * [AI] Allow self-hosted private SimpleFIN servers by default The SSRF protection blocked all private/loopback addresses, which broke self-hosters running their own SimpleFIN bridge on a LAN or VPN IP with no way to opt back in. Split the blocked ranges into two tiers: link-local (cloud metadata), reserved, broadcast and unspecified stay blocked unconditionally, while private/loopback/unique-local are blocked by default but can be permitted per-caller via { allowPrivateNetwork: true }. SimpleFIN opts in, so self-hosting works out of the box with no env var, while the worst-case cloud-metadata credential-theft vector remains closed. The CORS proxy keeps the strict default. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * [AI] Re-validate SSRF rules on each SimpleFIN redirect hop getAccounts used fetch with redirect: 'follow', so a 3xx response from the validated SimpleFIN URL could redirect to a blocked internal address after only the initial URL had been checked. Follow redirects manually instead, calling assertUrlAllowed on every hop before fetching, capping at 5 redirects, and dropping Authorization on cross-origin hops so the bridge credentials cannot leak to a redirect target. getAccessKey uses https.request, which does not auto-follow redirects, so it is unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> --------- Co-authored-by: Claude <[email protected]> |
||
|
|
1f492387b7 |
🔖 (26.6.0) (#7947)
* 🔖 (26.6.0) * Generate release notes for v26.6.0 * Generate release notes for v26.6.0 * Update check-spelling metadata * Generate release notes for v26.6.0 * add release summary * links * Generate release notes for v26.6.0 * update links * Generate release notes for v26.6.0 * Generate release notes for v26.6.0 * Generate release notes for v26.6.0 * add EB link * Add initial docs for Enable Banking (#7961) * Add initial docs for Enable Banking * Delete upcoming-release-notes/7961.md * [Docs] UI Budget automations & month-end cleanup (#7863) * Add files via upload * Create documentation for budget automation feature Added documentation for the budget automation feature, detailing its functionalities, usage, and examples. * Add files via upload * Revise budget automation documentation for clarity Updated the documentation for budget automation, enhancing clarity and consistency in the descriptions of features and options. * [autofix.ci] apply automated fixes * Update Markdown headers for budget automation section * Add files via upload * Improve formatting in budget automation documentation Updated formatting and added line breaks for better readability in the budget automation documentation. * [autofix.ci] apply automated fixes * Fix HTML line breaks in budget-automation.md Updated HTML line breaks from '</br>' to '<br>' in budget automation documentation. * Fix HTML line breaks in budget automation documentation * Fix headings and formatting in budget-automation.md Updated formatting and corrected headings in budget automation documentation. * Add budget-automation to sidebar items * Add files via upload * Add files via upload * Revise budget automation documentation Updated budget automation documentation to clarify usage of notes templates and detailed instructions for month-end cleanup processes, including named pools and weight calculations. * [autofix.ci] apply automated fixes * Refactor budget automation documentation for clarity Updated various sections for clarity and consistency, including grammar corrections and improved phrasing. * [autofix.ci] apply automated fixes * Enhance budget automation documentation Updated budget automation documentation with new blog links and improved formatting. * Fix links in budget-automation.md Updated links in the budget automation documentation to remove 'docs' prefix for consistency. * Revise budget automation documentation with updates Updated images and text for budget automation documentation, including corrections and enhancements to clarity. * Improve clarity and add save reminders in budget automation Updated wording for clarity and added reminders for saving work. * Update budget automation documentation for clarity Clarify the process of handling leftover funds in the budget automation script. * [autofix.ci] apply automated fixes * Add 'overfund' and 'overfunded' to spelling expect list * Update spelling expectations by removing 'overfunded' Removed 'overfunded' from the spelling expectations. * Add files via upload * 'overfund' to 'overfunded' First the bot tells me overfunded isn't needed if overfund is there. Now, it tells me that overfunded IS needed. I give up. * Enhance budget automation documentation Added new sections on automation adjustments, moved some sections around, added horizontal separators. * Update images and descriptions in budget automation docs * Add files via upload * Add automation notes section to budget automation docs Added a section on automation notes to document how automations, balance caps, and long-term goals can have associated notes for clarity and tracking. * Add files via upload * Update budget automation examples in documentation * Add files via upload * Apply suggestions from code review Co-authored-by: Matt Fiddaman <[email protected]> * [autofix.ci] apply automated fixes * Add 'unmigrate' to spelling expectations * Improve clarity in budget automation documentation Clarified descriptions for budget automation features and improved wording for better understanding. * Correct spelling of 'unmigrate' to 'Unmigrate' They are the same and github is punking me again. * Clarify automation notes description * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Fix typos in budget-automation documentation Corrected typos and improved clarity in the budget automation documentation. --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Matt Fiddaman <[email protected]> --------- Co-authored-by: github-merge-queue <[email protected]> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Matt Fiddaman <[email protected]> Co-authored-by: Mats Nilsson <[email protected]> Co-authored-by: Juulz <[email protected]> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
||
|
|
18a8dc03c4 |
[AI] Restrict owner-only sync-server file management endpoints (#7977)
* [AI] Restrict owner-only sync-server file management endpoints The /delete-user-file, /reset-user-file, and /user-create-key endpoints guarded access via requireFileAccess, which accepted any user holding a user_access row. A shared collaborator could therefore mark another owner's hosted budget file as deleted, reset its sync state, or rewrite its encryption key. Add a stricter requireFileOwner helper (owner or server admin only) and apply it to the three management endpoints. requireFileAccess keeps its shared-access fallback for the collaboration endpoints (sync, upload, download, get/update filename, get/create encryption key consumers). Fixes GHSA-23vm-ffgg-qvjr. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * [AI] Align release-note filename with PR number Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]> * Update release notes for sync-server endpoint restrictions Clarified the restriction on sync-server endpoints to only allow file owners and admins to perform owner-only file-management actions. * Update upcoming-release-notes/7977.md Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> |