* bcrypt -> argon2id
* coderabbit feedback
* copilot review
* switch hashing settings
* [AI] Add unit tests for sync-server password hashing
Cover password.js, focused on the bcrypt -> argon2id migration:
- loginWithPassword upgrades a legacy bcrypt hash to argon2id on a
successful login, leaves it untouched on a failed login, and does not
needlessly rehash an existing argon2id hash
- hashPassword/verifyPassword round-trip, bcrypt backward-compat, and
graceful handling of non-string/malformed hashes
- bootstrapPassword/changePassword/checkPassword behaviour
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* dedupe minimatch
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds the knip tool with a monorepo-tuned config (knip.json) and a CI gate
in check.yml, plus the dead-code and dependency cleanup it surfaced. The
unused-export/type/duplicate rules are disabled so exporting an unused
symbol is allowed.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* add akahu integration for nz banks
* akahu fix bank name being set to account name
* rename apiToken and fix reset pointing to the wrong function
* fix apitoken wording in akahu init modal
* add upcoming-release-notes
* fix lint issues
* fix lint issues
* add loan account type to starting balance inversion
* fix initial sync balance
* initially select 365 days of transactions on first sync for akahu sync
* add SyncServerAkahuAccount to onSetLinkedAccount
* set transaction currency to account currency
* remove unnecessary code
* handle TFR TO/FROM payees and account for loan account type in transactions
* [autofix.ci] apply automated fixes
* rename Error to ErrorAlert and fix intial sync start date
* extract note from description for TFR TO/FROM transactions
* fix normalizeNotes not referencing the transaction
* refactor app-akahu code
* [autofix.ci] apply automated fixes
* Add Akahu to ExternalAccount type
* Update yarn.lock
* update yarn.lock
* Remove unused error var in catch block
* [autofix.ci] apply automated fixes
* require authentication for akahu endpoint
* fix lint issue in mutations.ts
* fix up import paths
* fix lint issues
* reorder form fields
* remove unnecessary handling for debt accounts
* lint fixes
* Put Akahu bank sync under feature flag
* remove incorrect feedback link
* [autofix.ci] apply automated fixes
* Add feedback link for feature toggle
* use uuidv4
* prevent fetch if feature not enabled
* change app-akahu to ts and tidy up
* fix typecheck errors
* [autofix.ci] apply automated fixes
* fix browser client build issues
* [autofix.ci] apply automated fixes
* update akahu npm package to latest version
* use amountToInteger for balance reducer
* add additional details to transactions
* change initial sync start date logic
* add akahu fields to mappable fields in desktop-client
* [autofix.ci] apply automated fixes
* getDate use formatISO to get the timezone adjusted date
* remove duplicate payeeName
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* 🔖 (26.6.0)
* Generate release notes for v26.6.0
* Generate release notes for v26.6.0
* Update check-spelling metadata
* Generate release notes for v26.6.0
* add release summary
* links
* Generate release notes for v26.6.0
* update links
* Generate release notes for v26.6.0
* Generate release notes for v26.6.0
* Generate release notes for v26.6.0
* add EB link
* Add initial docs for Enable Banking (#7961)
* Add initial docs for Enable Banking
* Delete upcoming-release-notes/7961.md
* [Docs] UI Budget automations & month-end cleanup (#7863)
* Add files via upload
* Create documentation for budget automation feature
Added documentation for the budget automation feature, detailing its functionalities, usage, and examples.
* Add files via upload
* Revise budget automation documentation for clarity
Updated the documentation for budget automation, enhancing clarity and consistency in the descriptions of features and options.
* [autofix.ci] apply automated fixes
* Update Markdown headers for budget automation section
* Add files via upload
* Improve formatting in budget automation documentation
Updated formatting and added line breaks for better readability in the budget automation documentation.
* [autofix.ci] apply automated fixes
* Fix HTML line breaks in budget-automation.md
Updated HTML line breaks from '</br>' to '<br>' in budget automation documentation.
* Fix HTML line breaks in budget automation documentation
* Fix headings and formatting in budget-automation.md
Updated formatting and corrected headings in budget automation documentation.
* Add budget-automation to sidebar items
* Add files via upload
* Add files via upload
* Revise budget automation documentation
Updated budget automation documentation to clarify usage of notes templates and detailed instructions for month-end cleanup processes, including named pools and weight calculations.
* [autofix.ci] apply automated fixes
* Refactor budget automation documentation for clarity
Updated various sections for clarity and consistency, including grammar corrections and improved phrasing.
* [autofix.ci] apply automated fixes
* Enhance budget automation documentation
Updated budget automation documentation with new blog links and improved formatting.
* Fix links in budget-automation.md
Updated links in the budget automation documentation to remove 'docs' prefix for consistency.
* Revise budget automation documentation with updates
Updated images and text for budget automation documentation, including corrections and enhancements to clarity.
* Improve clarity and add save reminders in budget automation
Updated wording for clarity and added reminders for saving work.
* Update budget automation documentation for clarity
Clarify the process of handling leftover funds in the budget automation script.
* [autofix.ci] apply automated fixes
* Add 'overfund' and 'overfunded' to spelling expect list
* Update spelling expectations by removing 'overfunded'
Removed 'overfunded' from the spelling expectations.
* Add files via upload
* 'overfund' to 'overfunded'
First the bot tells me overfunded isn't needed if overfund is there. Now, it tells me that overfunded IS needed. I give up.
* Enhance budget automation documentation
Added new sections on automation adjustments, moved some sections around, added horizontal separators.
* Update images and descriptions in budget automation docs
* Add files via upload
* Add automation notes section to budget automation docs
Added a section on automation notes to document how automations, balance caps, and long-term goals can have associated notes for clarity and tracking.
* Add files via upload
* Update budget automation examples in documentation
* Add files via upload
* Apply suggestions from code review
Co-authored-by: Matt Fiddaman <github@m.fiddaman.uk>
* [autofix.ci] apply automated fixes
* Add 'unmigrate' to spelling expectations
* Improve clarity in budget automation documentation
Clarified descriptions for budget automation features and improved wording for better understanding.
* Correct spelling of 'unmigrate' to 'Unmigrate'
They are the same and github is punking me again.
* Clarify automation notes description
* Add files via upload
* Add files via upload
* Add files via upload
* Add files via upload
* Add files via upload
* Fix typos in budget-automation documentation
Corrected typos and improved clarity in the budget automation documentation.
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Matt Fiddaman <github@m.fiddaman.uk>
---------
Co-authored-by: github-merge-queue <118344674+github-merge-queue@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Matt Fiddaman <github@m.fiddaman.uk>
Co-authored-by: Mats Nilsson <matni403@gmail.com>
Co-authored-by: Juulz <julesmcn@gmail.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* [AI] Upgrade dependencies to resolve security advisories
Resolve 9 Dependabot security alerts via version upgrades:
- rollup: remove the resolutions pin that forced workbox-build's
rollup ^2.79.2 up to vulnerable 4.40.1; it now resolves to the
patched 2.80.0 (vite 8 uses rolldown, so no rollup 4.x is needed)
(CVE-2026-27606)
- serialize-javascript: add resolution ^7.0.5 (build-time only;
consumers are deep-transitive webpack/terser plugins pinned to ^6)
(GHSA-5c6j-r48x-rmvq, CVE-2026-34043)
- express-rate-limit ^8.3.2 -> ^8.5.2, pulling ip-address 10.2.0
(CVE-2026-42338)
- refresh in-range transitives: bn.js 5.2.3, ajv 8.20.0, glob 10.5.0,
path-to-regexp 8.4.2 (CVE-2026-2739, CVE-2025-69873, CVE-2025-64756,
CVE-2026-4926, CVE-2026-4923)
Not addressed: elliptic (CVE-2025-14505) has no patched release;
uuid 8.3.2 (dev-only via sockjs, not reachable) left as-is.
https://claude.ai/code/session_018obbND7t9dBZvfvUBBJKFz
* [AI] Remove redundant minimatch resolution pins
Five of the six minimatch resolutions were no-ops: their consumers use
caret ranges (^3.x, ^5.x, ^9.x, ^10.x) that already float to versions
patched against CVE-2026-26996 (3.1.5, 5.1.9, 9.0.9, 10.2.5). Only
serve-handler pins minimatch to exactly 3.1.2 (vulnerable), so the
single targeted "minimatch@3.1.2" override is kept. The resolved
lockfile is unchanged.
https://claude.ai/code/session_018obbND7t9dBZvfvUBBJKFz
* Add release notes for PR #7982
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
* [AI] Load @actual-app/crdt from source in dev, only bundle for publish
@actual-app/crdt's local exports now point at src/index.ts so consumers
(sync-server, loot-core, desktop-client) never see a stale Vite bundle.
publishConfig keeps the dist/ mapping for npm consumers. crdt's
tsconfig switches to bundler module resolution to match the rest of
the workspace (no extensions in source imports).
Sync-server's existing extension-resolution loader is extended to also
handle directory-index imports (./crdt → ./crdt/index.ts), and the
standalone `start` / `start-monitor` scripts now invoke Node with
--import ./register-loader.mjs so the loader is in place before crdt's
source resolves.
Electron's utilityProcess.fork accepts execArgv but doesn't actually
preload --import modules, so a new packages/sync-server/start.mjs
bootstrap entry registers the loader imperatively and then dynamic-
imports build/app.js. desktop-electron's startSyncServer() points the
fork at start.mjs. sync-server's "files" array now ships start.mjs,
register-loader.mjs and loader.mjs so packaged Electron / npm
consumers actually receive them.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Add release notes for PR #7702
* [AI] Restructure sync-server to build with Vite
Replace the hand-rolled tsgo + add-import-extensions + copy-static-assets
+ runtime loader pipeline with a single Vite SSR build. Bundles every
entry (app, bin/actual-server, scripts/*) and inlines @actual-app/crdt
source so Node never has to resolve TS at runtime — the
MODULE_TYPELESS_PACKAGE_JSON warning that surfaced via crdt's source
exports is gone. Migrations and bank handlers move from readdir-based
dynamic imports to import.meta.glob; messages.sql becomes a ?raw import.
Drop loader.mjs, register-loader.mjs, start.mjs, and
bin/add-import-extensions.mjs. Electron's startSyncServer() forks
build/app.js directly. publishConfig.imports goes away (subpath imports
are resolved at build time and don't appear in the bundle).
In dev (start:server-dev) sync-server proxies to Vite, so loosen the CSP
to allow Vite's inline preamble script and HMR websocket — production
CSP is unchanged. desktop-client skips registerSW() in dev (and disables
vite-plugin-pwa's devOptions) so stale cached assets don't override
edits between page loads.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* [AI] Address review feedback
- sync-server CSP: drop 'unsafe-eval' from the production script-src;
the bundle has no genuine eval/new Function usage (only a defensive
branch in setimmediate's polyfill that's never hit). Keep it on the
dev branch where Vite's HMR runtime relies on it. Add a comment so
it's obvious which branch needs it and why.
- bank-factory: widen the loader glob to ./banks/*_*.{ts,js} so
TypeScript handlers are discovered too, mirroring migrations.ts.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* [AI] Restore 'unsafe-eval' in production CSP for Electron
The Electron app needs `'unsafe-eval'` at runtime, so revert the dev-only
restriction and keep `'unsafe-eval'` in both branches. Comment updated to
record the actual reason instead of marking it as removable.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* [AI] Revert bank-factory glob change
Widening the glob to ./banks/*_*.{ts,js} broke the desktop e2e tests in
CI even though every current handler is .js and the brace expansion
matches no .ts files locally. Reverting to ./banks/*_*.js — the change
had no behavioural benefit since there are no TS handlers, so the
nitpick isn't worth chasing.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* [AI] Strip CSP comment to restore identical state to 9513c1e16
The desktop e2e has been failing despite my prior commits being a strict
revert (only difference was a 2-line comment, which can't change runtime).
Removing even the comment so the branch matches 9513c1e16's relevant
files exactly, to isolate whether the failure is from the master merge
or from CI-environment drift.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* [AI] Make rebuild-electron actually rebuild better-sqlite3
PR #7712 simplified rebuild-electron to just `electron-rebuild -f -o
better-sqlite3,bcrypt` from the repo root. Two problems with that:
1. Without `-m`, electron-rebuild scans the root workspace's package.json
for native deps. better-sqlite3 isn't a direct root dep — it lives
under packages/sync-server/ — so the scan returns no candidates and
the rebuild silently no-ops.
2. Without --build-from-source, electron-rebuild defers to
prebuild-install, which downloads a stale prebuilt binary keyed off
better-sqlite3's package.json (ABI 127) instead of recompiling
against Electron 39's bundled Node ABI 140. The download succeeds
and "Rebuild Complete" prints, but the resulting `better_sqlite3.node`
can't `dlopen` inside Electron's utility process — sync-server
crashes immediately on db init, the renderer's startSyncServer IPC
never resolves, and the e2e test hangs on "Configure your server".
Point -m at packages/desktop-electron (which transitively pulls in
better-sqlite3 and bcrypt via @actual-app/sync-server) and force a real
compile via --build-from-source. Verified locally: better-sqlite3
rebuilds to darwin-arm64-140 and the desktop e2e onboarding test passes
in 6s instead of hanging for 60s.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* [AI] Restore CSP unsafe-eval comment
Bring back the explanatory comment that was stripped diagnostically in
99682268c. Now that the desktop e2e regression is traced to
rebuild-electron and not to anything in this branch, we can keep the
documentation noting why 'unsafe-eval' is retained in both CSP branches.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* [AI] Restore bank-factory glob to ./banks/*_*.{ts,js}
Re-apply the glob widening originally added in 145868f9d. It was
reverted in 531b1a191 because the desktop e2e was failing — that
failure is now traced to the rebuild-electron breakage (fixed in
6e8ac0784), not to this glob. Mirroring migrations.ts so future TS
bank handlers are picked up.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* [AI] Fix applyAppUpdate hanging in dev mode
In dev mode browser-preload's updateSW was () => undefined, so
applyAppUpdate() — which calls updateSW() and then awaits a
deliberately never-resolving promise (waiting for the SW-driven page
reload) — hung the renderer instead of refreshing. In prod the page
is replaced by the new service worker, so the never-resolving await is
fine. The dev path now triggers a plain window.location.reload() so
the page reloads and the never-settling await is irrelevant, matching
prod's effective behaviour.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* [AI] Revert rebuild-electron to master version
* Revert "[AI] Revert rebuild-electron to master version"
This reverts commit 4b6baab79f.
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Matiss Janis Aboltins <MatissJanis@users.noreply.github.com>
* Integrate Enable Banking as bank sync provider
Rewrite Enable Banking modal to match GoCardless pattern
Resolve Enable Banking bugs and improve auth flow
* [AI] Address code review feedback for Enable Banking integration
Bug fixes:
- Fix double-negative for DBIT transaction amounts (e.g. '--25.99')
- Fix payeeName counterparty mapping (CRDT→debtor, DBIT→creditor)
- Add missing state validation in EnableBankingCallback and /auth_callback
- Fix stuck loading state in useEnableBankingStatus with try/catch/finally
- Make session-expiry error matching case-insensitive
- Prefer CLAV balance type for startingBalance in /transactions route
- Guard setTimeout in post/del/patch when timeout is null
- Distinguish abort from network failure in post() catch
Credential handling:
- Add validateCredentials() to validate before persisting secrets
- Refactor client to use enablebanking-configure instead of manual secret-set
- Distinguish null (loading) from false (not configured) in setup checks
Poll-auth robustness:
- Add unique waiter IDs to prevent superseded waiter cleanup race
- Always cache results in completedAuths for retry resilience
- Add client disconnect cleanup via res.on('close')
- Cancel poll when Enable Banking modal closes via AbortController
- Prevent concurrent poll controller race with local reference check
Code quality:
- Extract buildSessionResult() to deduplicate auth_callback/complete-auth
- Add enabled parameter to useEnableBankingStatus to skip unused requests
- Add re-entrancy guard on onJump, reset bank on country change
- Refetch bank list after Enable Banking setup completes
- Type enableBankingConfigure config, make state required in completeAuth
- Add AbortError→TIMED_OUT test, fix startAuth test assertion
- Add afterAll vi.unstubAllGlobals() for test cleanup
- Add explanatory comments for bank-per-account model and in-memory maps
* [AI] Fix missing patterns in Enable Banking integration
- Add SyncServerEnableBankingAccount to ExternalAccount union and
getInstitutionName parameter type in SelectLinkedAccountsModal
- Use BankSyncProviders type in mobile BankSyncAccountsList instead of
hardcoded union missing enableBanking
- Add getSecretsError handling to EnableBankingInitialiseModal for
proper auth/permission error messages
- Replace hardcoded #666 color with theme.pageTextSubdued
- Wrap onConnectEnableBanking in try/catch with error notification and
init modal re-open, matching SimpleFin/PluggyAI pattern
- Translate hardcoded error string in enablebanking.ts
- Add 60s timeout to downloadEnableBankingTransactions matching PluggyAI
- Revert out-of-scope changes to del()/patch() in post.ts
- Revert shared starting balance dedup logic back to master pattern
* Forward PSU headers to Enable Banking API
* Fix Enable Banking re-auth dispatch
* Respect ASPSP maximum_consent_validity when starting Enable Banking auth
* Fix missing types for module jws
* Add upcoming release notes
* Fix format
Expected "sign" (value-import) to come before "Algorithm"
* Fix code review findings on Enable Banking integration
* [AI] Disable Enable Banking button while status is loading
* typo
* [AI] Migrate enable-banking files to subpath imports
Update all enable-banking files to use # subpath imports and
@actual-app/core paths, matching the migration done in master.
Add #enablebanking entry to desktop-client package.json imports map.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* [AI] Add #app-enablebanking subpath imports to sync-server package.json
Register enablebanking service, utils, and root entries in both
the imports and publishConfig.imports maps.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Add jws to dependencies
* [AI] Harden Enable Banking OAuth callback handoff
Enforce exact OAuth state round-trip in the Enable Banking callback so
mismatched/missing state values no longer silently complete the flow.
Replace unsafe `as`/`!` assertions in the auth handoff with typed
locals so the callback path stays sound under strict TypeScript.
* [AI] Tighten Enable Banking type safety
Make the Enable Banking external-msg modal strict-ts compatible,
annotate the id type in linkEnableBankingAccount, derive
AccountSyncSource from a single SYNC_PROVIDERS list, and annotate the
return type of getJWTBody. No behaviour change.
* [AI] Fix Enable Banking poll lifecycle and abort handling
Make the popup-driven auth poll cancellable and isolated:
- Allow the popup retry path to abort the in-flight poll instead of
leaving it hanging on the previous attempt.
- Clear the Enable Banking stateRef when the retry attempt finishes so
a new attempt starts from a clean state.
- Start useEnableBankingStatus in loading state until the first fetch
resolves so the UI doesn't briefly flash "not connected".
- Cancel only the requested poll, not every in-flight Enable Banking
poll, so unrelated link attempts aren't affected.
- Skip writing the poll response when the client has already
disconnected, with a regression test covering the disconnect path.
* [AI] Tighten Enable Banking client/test plumbing
Misc code-quality improvements with no behaviour change:
- Parallelize Enable Banking secret reset calls so wiping multiple
secrets doesn't serialize the request chain.
- Use absolute imports in the enable-banking client module to match the
rest of desktop-client.
- Document externalSignal usage in the post helper.
- Tighten Enable Banking test fixtures with `satisfies` and dynamic
dates so they stop drifting when the real "now" moves.
* [AI] Fix Enable Banking initial-balance and post-link bookkeeping
Apply the standard post-sync bookkeeping when linking an Enable Banking
account so the new account picks up the same starting-balance
treatment as other bank-sync providers, and skip pending transactions
when computing the initial balance so the figure isn't inflated by
transactions that haven't cleared yet.
* [AI] Refine Enable Banking error model and bank-sync surface
Carry the human-readable Enable Banking message in
EnableBankingError.error_type and the machine-friendly identifier in
error_code, then map error_code to a bank-sync category in the
/transactions wire format so AccountSyncCheck can match on the same
categories as other providers.
* [AI] Improve Enable Banking bank-sync field mapping
Bring the Enable Banking transaction normalizer in line with how other
bank-sync providers feed the field mapper:
- Strip SEPA structured prefixes from remittance text so notes/payee
display the human-meaningful portion instead of the SEPA boilerplate.
- Return the notes field and spread the raw transaction so downstream
field mapping can reach the full payload.
- Expose Enable Banking raw fields in the bank-sync field mapper UI so
users can map any underlying property, not just the curated subset.
* [AI] Use req.ip for Enable Banking PSU header so trust-proxy whitelist applies
* [AI] Address Enable Banking CodeRabbit pass-3 follow-ups
Three small fixes from the latest CodeRabbit re-review:
- Guard the aspsps fetch in EnableBankingExternalMsgModal against stale
responses. Switching countries quickly could let an earlier in-flight
request overwrite the newer selection's bank list. Added a cleanup
flag in the useEffect so only the latest response updates state.
- Clear `enablebanking_auth_state` from localStorage when the auth flow
exits, but only if the stored value still matches this attempt's
state, so a concurrent retry can't wipe a newer session. Wrapping
the poll in try/finally covers every return path (success, timeout,
abort, body-level error).
- Use `Boolean(trans.booked)` in the Enable Banking initial-balance
predicate to match `normalizeBankSyncTransactions`. The Enable
Banking normalizer always sets `booked` to a boolean today, so this
is defensive rather than a live bug, but keeping the two predicates
aligned avoids surprises if the upstream shape ever loosens.
* [AI] Address Enable Banking CodeRabbit pass-3 follow-ups (round 2)
Two more findings from the latest CodeRabbit pass:
- Guard onJump against stale-retry completions. Token each call with a
monotonic jumpIdRef counter and gate every post-await write
(setError/setWaiting after onMoveExternal, the second setWaiting,
and the finally-block ref reset) on `myJumpId === jumpIdRef.current`.
Without this, a retry click while the previous poll was still
unwinding could surface the older call's error in the newer
attempt's UI and clear stateRef/isJumpingRef out from under it,
leaving the new poll un-cancellable.
- Translate the (beta) suffix on Enable Banking ASPSP names so
non-English locales don't surface a hardcoded English token in the
bank list. The existing `actual/no-untranslated-strings` rule misses
this case (regex requires a leading uppercase, and template-literal
interpolations aren't visited as standalone strings).
* [AI] Use SEPA prefix allowlist instead of catch-all regex
The previous `^[A-Z]{3,}\+` regex would incorrectly strip merchant
tokens like `BMW+`, `USB+`, or `COVID+` from the start of a remittance
line. Replaced it with an explicit allowlist of known SEPA / ISO 20022
prefixes and added a regression test covering the false-positive case.
* [AI] Use uuidv4 instead of crypto.randomUUID in Enable Banking
Aligns with master's revert in #7734 (crypto.randomUUID back to uuid
library). Two stray spots remained in Enable Banking code: the
link-account flow in loot-core/server/accounts/app.ts and the OAuth
state token in sync-server/app-enablebanking.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Matiss Janis Aboltins <matiss@mja.lv>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* [AI] Revert crypto.randomUUID back to uuid library
Partial revert of #7529. Restores the `uuid` package dependency in
api, crdt, desktop-client, loot-core, and sync-server, swapping every
`crypto.randomUUID()` call introduced by that PR back to `uuidv4()`
(and the `uuid()` alias in RuleEditor.tsx and ruleUtils.ts where it
was previously used). The lint rule, docs entry, and `vi.mock('uuid')`
test setup are restored as well. The `fs-extra` removals in
desktop-electron from the same PR are left in place.
https://claude.ai/code/session_01KTg1g416Jdjf5feGke8MQw
* Add release notes for PR #7734
* [check-spelling] Update metadata
Update for https://github.com/actualbudget/actual/actions/runs/25480733101/attempts/1
Accepted in https://github.com/actualbudget/actual/pull/7734#issuecomment-4394811498
Signed-off-by: check-spelling-bot <check-spelling-bot@users.noreply.github.com>
on-behalf-of: @check-spelling <check-spelling-bot@check-spelling.dev>
* [AI] Use the uuidv4 alias in RuleEditor and ruleUtils
The previous commit preserved the `v4 as uuid` alias in these two files
to match their pre-#7529 state, but the project convention (and lint
rule message) is `v4 as uuidv4`. CodeRabbit flagged the inconsistency,
so normalize the alias and call sites in both files.
https://claude.ai/code/session_01KTg1g416Jdjf5feGke8MQw
* [AI] Pin uuid to ^11.1.0 to fix Electron e2e
uuid v13 is ESM-only (no CJS entry, only an exports map with `node` and
`default` conditions both pointing to ESM files). The Electron backend is
bundled as CJS by `loot-core/vite.desktop.config.mts` and loaded via a
dynamic `await import(process.env.lootCoreScript!)` in the
desktop-electron utilityProcess; that pipeline appears to fall over on
the ESM-to-CJS transform of uuid v13 in Vite 8 / rolldown, which makes
the Functional Desktop App e2e job fail consistently while every other
check (web e2e, VRT, unit tests, lint, typecheck) passes.
uuid v11 still ships `dist/cjs/index.js`, so pinning each workspace's
uuid range to ^11.1.0 sidesteps the resolution path entirely. The API
is unchanged (`v4` is still the same export), so no source-code changes
are needed.
https://claude.ai/code/session_01KTg1g416Jdjf5feGke8MQw
* [AI] Capture Electron stdout/stderr in desktop e2e fixture (TEMP DEBUG)
Pipe the Electron main+utility process stdout/stderr into both the
playwright runner stderr and an electron.log file inside the test's
output directory. This makes the actual backend error visible in the
Functional Desktop App job output and in the desktop-app-test-results
artifact.
Will be reverted once the failure cause is identified.
https://claude.ai/code/session_01KTg1g416Jdjf5feGke8MQw
* Revert "[AI] Capture Electron stdout/stderr in desktop e2e fixture (TEMP DEBUG)"
This reverts commit 4cb5148859.
* [AI] Fix rebuild-electron and bump uuid back to ^13.0.0
The Functional Desktop App e2e job had been failing with
ERR_DLOPEN_FAILED on better-sqlite3 (NODE_MODULE_VERSION 127 vs 140),
which surfaced because this PR's yarn.lock change invalidated the
GitHub Actions node_modules cache. With a fresh install,
rebuild-electron is responsible for compiling better-sqlite3 and
bcrypt against Electron's ABI — but since #7712 the script has been
running from the repo root, where neither module is a direct
dependency, so electron-rebuild silently exits as a no-op.
Restore the `-m ./packages/desktop-electron` scoping that #7712
removed, so the rebuild actually finds and rebuilds the modules.
This fix is technically out of scope for this PR but it blocks any
PR that touches yarn.lock.
Also revert the `^11.1.0` pin from the previous commit back to
`^13.0.0`. The pin was based on a wrong hypothesis (that uuid v13's
ESM-only packaging was breaking the bundle); now that the real
cause is identified, there is no reason to deviate from the
pre-#7529 version.
https://claude.ai/code/session_01KTg1g416Jdjf5feGke8MQw
---------
Signed-off-by: check-spelling-bot <check-spelling-bot@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Matiss Janis Aboltins <MatissJanis@users.noreply.github.com>
* 🔖 (26.5.0)
* fix release note generation script (#7635)
* fix release note generation script
* note
* fix cherrypicked commits not being respected and lint race in release note generation workflow (#7640)
* fix cherrypicked commits not being respected and lint race
* note
* coderabbit suggestions
* fix lint
* make double restore possibility safe
* fix lint (#7643)
* Generate release notes for v26.5.0
* add release note highlights
* Fix Sankey income bug, when payee it not set (#7632)
* Ensure income categories are shown correct, even if payee is not set
* Add release note
* Generate release notes for v26.5.0
* increase test coverage for budget templates (#7620)
* [AI] cover existing template engine logic with regression tests
Adds tests for goal template behavior that predates this PR so the
suite can be cherry-picked onto master to confirm no regressions. No
production code changes.
Covers:
- init() validation: schedule names, by/schedule priority match, past
by-target with and without annual/repeat, percentage source not
found, special source aliases, duplicate limit/spend/goal
directives, weekly limit missing start date, invalid limit period,
unrecognized periodic period
- runRemainder cap clamping and hideDecimal fraction removal
- Income-category branch in runTemplatesForPriority
- getLimitExcess against an aggregate weekly cap
- Past by-target rolling forward via the annual period
- runSchedule full=true (no sinking accumulation), percent and fixed
adjustments, completed-schedule filtering, past-date error for
non-repeating schedules, monthly/weekly/daily sinking contribution
branches when interval exceeds the pay-month-of cap, surplus
absorption when last-month balance exceeds the target, and
tracking-budget mode forcing all schedules pay-month-of
- applyMultipleCategoryTemplates orchestration: per-category writes,
cross-category priority clamping when funds run out, error
notification path
- applyTemplate force=false skipping already-budgeted categories
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* note
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix infinite loop when remainder is impossible to solve (#7623)
* fix infinite loop when remainder is impossible to solve
* note
* Generate release notes for v26.5.0
* Update author
Updated author information in the release notes.
* Fix shared worker resumption after tab suspend (#7656)
* [AI] Fix SharedWorker tab resume recovery
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* [AI] Fix SharedWorker reload readiness
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add release notes
* Update packages/desktop-client/src/shared-browser-server-core.ts
Co-authored-by: Matiss Janis Aboltins <matiss@mja.lv>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Matiss Janis Aboltins <matiss@mja.lv>
* Update docs release date
* Empty commit to bump CI
* Generate release notes for v26.5.0
* Revert "Generate release notes for v26.5.0"
This reverts commit b42c48bed5.
---------
Co-authored-by: github-merge-queue <118344674+github-merge-queue@users.noreply.github.com>
Co-authored-by: Matt Fiddaman <github@m.fiddaman.uk>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Emil Tveden Bjerglund <emilbp@gmail.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Julian Dominguez-Schatz <julian.dominguezschatz@gmail.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* [AI] sync-server: use workspace reference for @actual-app/crdt
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Update build script in sync-server package to use TypeScript's build mode
* Package electron
* [AI] crdt: add conditional exports so Node can load the built bundle
Before this change the root exports entry pointed at `./src/index.ts`, so
any pure-Node consumer (notably the sync server that Electron forks as a
utility process) failed to import `@actual-app/crdt` — Node can't execute
TypeScript source directly. Sync-server had been masking this by pulling
`@actual-app/crdt@npm:2.1.0` where `publishConfig.exports` resolves to
`./dist/index.js`; once sync-server switched to `workspace:*`, the
Functional Desktop App CI job timed out waiting for the sync server to
boot.
Switch to conditional exports in the same shape `@actual-app/api` already
uses:
- `types` → `./dist/index.d.ts` for TypeScript tooling
- `development` → `./src/index.ts` for Vite/Vitest (HMR, fast feedback)
- `default` → `./dist/index.js` for Node runtime
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* [AI] Enable subpath imports across all packages
Generalize the prefer-subpath-imports ESLint rule to work with any
package (not just loot-core) and enable it globally. Add subpath import
mappings to cli, component-library, and sync-server package.json files.
Auto-fix all backtracked relative imports to use #-prefixed subpath
imports.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* [AI] Add release notes for #7462
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* [AI] Fix mock specifiers in accounts.test.ts to use aliased imports
Co-authored-by: Matiss Janis Aboltins <MatissJanis@users.noreply.github.com>
* [AI] Fix mock specifiers in query.test.ts to use aliased imports
Co-authored-by: Matiss Janis Aboltins <MatissJanis@users.noreply.github.com>
* [AI] Fix ESLint rule to properly validate src/ directory paths
Co-authored-by: Matiss Janis Aboltins <MatissJanis@users.noreply.github.com>
* [AI] Add publishConfig.imports for sync-server to remap aliases to build directory
Co-authored-by: Matiss Janis Aboltins <MatissJanis@users.noreply.github.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Matiss Janis Aboltins <MatissJanis@users.noreply.github.com>
* implement our own GoCardless api class
* switch the service to use the new api
* drop deps
* note
* guard against request forgery
* strip empty params from the request body, add error logging
* coderabbit suggestions
* fix test, make institution nullable
2026-04-07 10:33:04 +00:00
Matt Fiddamanandgithub-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* [AI] Switch typecheck from tsc to tsgo and fix Menu type narrowing
* [autofix.ci] apply automated fixes
* Add .gitignore for dist directory, update typecheck script in package.json to use -b flag, and remove noEmit option from tsconfig.json files in ci-actions and desktop-electron packages. Introduce typesVersions in loot-core package.json for improved type handling.
* Refactor SelectedTransactionsButton to improve type safety and readability. Updated items prop to use spread operator for conditional rendering of menu items, ensuring proper type annotations with MenuItem. This change enhances the clarity of the component's structure and maintains TypeScript compliance.
* Update tsconfig.json in desktop-electron package to maintain consistent formatting for plugins section. No functional changes made.
* [autofix.ci] apply automated fixes
* Update package.json and yarn.lock to add TypeScript 5.8.0 dependency. Adjust typesVersions in loot-core package.json for improved type handling. Enhance tsconfig.json in sync-server package to enable strictFunctionTypes for better type safety.
* Enhance tsconfig.json in ci-actions package by adding composite option for improved project references and build performance.
* [AI] Revert typescript to 5.9.3 for ts-node compatibility
Co-authored-by: Matiss Janis Aboltins <MatissJanis@users.noreply.github.com>
* [AI] Update yarn.lock after TypeScript version change
Co-authored-by: Matiss Janis Aboltins <MatissJanis@users.noreply.github.com>
* Refactor Menu component for improved type safety and readability. Updated type assertions for Menu.line and Menu.label, simplified type checks in filtering and selection logic, and enhanced conditional rendering of menu items. This change ensures better TypeScript compliance and maintains clarity in the component's structure.
* Refactor Select and OpenIdForm components to improve type safety and simplify logic. Updated item mapping to handle Menu.line more effectively, enhancing clarity in selection processes. Adjusted SelectedTransactionsButton to streamline item creation and improve readability.
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Matiss Janis Aboltins <MatissJanis@users.noreply.github.com>
* 🔖 (26.3.0)
* Remove used release notes
* Add release notes for PR #7097
* Remove used release notes
* Remove used release notes
* Add release notes for version 26.3.0
* Add new terms to spelling expectation list
* Fix spelling and capitalization in release notes
Corrected spelling of 'reorganisation' to 'reorganization' and updated 'coderabbit' to 'CodeRabbit' for consistency.
* Update patterns.txt to allowlist 'CodeRabbit'
Add 'CodeRabbit' to allowlist of proper nouns.
* Clarify chart theming support in release notes
Updated the release notes to specify bar/pie chart theming support and added details about theme variables for customization.
* Remove 'CodeRabbit' from spelling expectations
* Refactor release notes and improve formatting
Reorganize release notes for clarity and update content.
* Create 2026-03-02-release-26-3-0.md
* Change release date to 2026-03-02
Updated the release date for version 26.3.0.
* Update release notes for version 26.3.0
---------
Co-authored-by: jfdoming <9922514+jfdoming@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Julian Dominguez-Schatz <julian.dominguezschatz@gmail.com>
* [AI] Add per-package tsconfigs and typescript-strict-plugin for typecheck
Co-authored-by: Cursor <cursoragent@cursor.com>
* Update TypeScript configuration across multiple packages to correct plugin path key from "path" to "paths" and add reference to process-worker typings in index.electron.ts.
* Remove reference to process-worker typings in index.electron.ts and add new process-worker typings file for global Process augmentation.
* Refactor TypeScript build configurations across multiple packages by removing tsconfig.dist.json files and updating build scripts to use default TypeScript compilation. Adjusted compiler options to target ES2021 and enable declaration generation.
* Update TypeScript configuration in api package to refine include and exclude patterns for better file management.
* Update build script in api package to ensure migration SQL files are copied to the correct directory by creating the destination folder if it doesn't exist.
* Update TypeScript configurations in crdt and desktop-electron packages to refine include and exclude patterns for improved file management.
* Update TypeScript dependencies across multiple packages to include typescript-strict-plugin for enhanced type checking and maintain consistency in package.json files.
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* 🔖 (26.1.0)
* Trigger CI
* Remove used release notes
* Add release notes for version 26.1.0
This commit introduces the release notes for version 26.1.0, highlighting notable improvements such as currency display in the budget, mobile schedules functionality, link detection in transaction notes, and an extension of historical data. The release also includes various enhancements, bug fixes, and maintenance updates, acknowledging contributions from multiple developers.
* Update spelling expectations and release notes for version 26.1.0
This commit adds new terms to the spelling expectations file and updates the release notes to reflect changes in the documentation, including formatting improvements for clarity. Notable contributions from various developers are acknowledged.
* Add new terms to spelling expectations file
This commit updates the spelling expectations by adding new terms, enhancing the accuracy of the documentation spell-checking process. The changes include the addition of 'jws' and 'oxc' to the list of expected terms.
* Update release notes for version 26.1.0 to include Flathub availability for Linux users
* Update release notes to reflect Docker tag for version 26.1.0 in documentation
---------
Co-authored-by: MatissJanis <886567+MatissJanis@users.noreply.github.com>
Co-authored-by: Matiss Janis Aboltins <matiss@mja.lv>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* Add ESM loader support and update sync-server modules
* Update TypeScript configuration and fix bank file import filter in sync-server
* Remove deprecated loader and register files, update TypeScript configuration to use ES2021, and add a new script for automatically adding import extensions to JavaScript files.
* Update test script in package.json to include a custom loader and clean up import extensions script by removing unused 'stat' import.
* feat: Add warning for unresolved imports
Co-authored-by: matiss <matiss@mja.lv>
* [autofix.ci] apply automated fixes
* Remove unused 'import/extensions' rule from ESLint configuration
* Refactor import statements in sync-server
- Updated import path for migrations to remove file extension.
- Added ESLint directive to ignore import extension rule for reset-password script.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* 🔖 (25.12.0)
* force ci
* Remove used release notes
* add blog post
* fix spelling
* make netlify happy?
* last one
* fix some formatting
* remove icns from allowed spelling to avoid accidental missspellings
* Update VRT screenshots
Auto-generated by VRT workflow
PR: #6285
* force ci
* force ci
* Update VRT screenshots
Auto-generated by VRT workflow
PR: #6285
* revert flaky vrt. please don't update again...
* make the release dates match
---------
Co-authored-by: youngcw <28542559+youngcw@users.noreply.github.com>
Co-authored-by: youngcw <calebyoung94@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2025-12-03 16:54:03 +00:00
Matt FiddamanGitHubautofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>github-actions[bot] <github-actions[bot]@users.noreply.github.com>
