Commit Graph

4729 Commits

Author SHA1 Message Date
Juulz
533cbed106 [Docs] Tour: Update user interface page for clarity (#7402)
* Refine user interface documentation for clarity

Updated text for clarity and corrected typos in the user interface documentation.

* Clarify server status and sync icon details

Updated descriptions for server status and sync icon interactions.

* Clarify server status and sidebar account display

Updated server status descriptions for clarity and improved wording in the sidebar section.
2026-04-06 20:49:23 +00:00
Juulz
221a57e218 [Docs] Tour: remove old files (#7400)
* Delete packages/docs/docs/tour/settings.md

NO longer in use.

* Delete packages/docs/docs/tour/sidebar.md

No longer in use.
2026-04-06 20:48:53 +00:00
Juulz
23bad279a0 [Docs] Tour: Update tour landing page for clarity and accuracy (#7401)
* Update tour documentation for clarity and accuracy

* Fix formatting and phrasing in tour documentation

* Fix link to documentation in tour index
2026-04-06 20:47:06 +00:00
L. Warren Thompson
d262f7d8b2 Fix updateTransaction corrupting split parents with partial updates (#7242)
* [AI] Fix updateTransaction corrupting split parents with partial updates

When `api.updateTransaction(id, { notes: '...' })` is called on a split
parent, the `updateTransaction` helper replaces the parent with the
sparse update object (`{ id, notes }`) instead of merging it with
the existing transaction data.  This causes `recalculateSplit` to see
`amount` as `undefined` (→ 0), which doesn't match the children's
total and sets a `SplitTransactionError` on the parent.  `makeChild`
also inherits undefined `account`, `date`, and `cleared` values,
potentially creating broken child rows.

Fix: merge the incoming partial fields (`{ ...trans, ...transaction }`)
so all existing properties are preserved.

Add a test that performs a notes-only update on a split parent and
asserts no error is set and the amount stays intact.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* [AI] Add release notes for PR #7242

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Address review feedback: remove verbose comment and simplify release note

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: L. Warren Thompson <lwarrenthompson@Warren-MBP.local>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-05 18:12:51 +01:00
James Skinner
c75a94e8b0 Standardise ledger scrolling when using keyboard shortcuts (#7283)
* Standardise table keyboard navigation by preventing browser scroll with arrow keys

* Add release note

* Apply the preventDefault() in specific cases so that it is not applied to default

---------

Co-authored-by: youngcw <calebyoung94@gmail.com>
2026-04-05 18:12:51 +01:00
James Skinner
cb50930d0b Fix yarn generate:icons command (#7281)
* fix icon templates with `module.exports` to `export default`

* Add `@svgr/babel-plugin-add-jsx-attribute` to dependencies

* Run `yarn generate:icons`, and set prettier singleQuote to reduce changes

* Add release note

* Add temporary fix for `SvgChartArea`

* Add `ChartArea` svg from the existing tsx

* CI rerun
2026-04-05 18:12:51 +01:00
Emil Tveden Bjerglund
10b7385ad4 Implement Sankey report for spent and budgeted money (#7220)
* Implement Sankey graph report

* Add release notes

* Update VRT screenshots

Auto-generated by VRT workflow

PR: #6068

* Remove local debug settings

* [autofix.ci] apply automated fixes

* Update VRT screenshots

Auto-generated by VRT workflow

PR: #6068

* Improve graphs from comments

* Fix lints

* coderabit fixes

* Fix filtering and UI enhancements

* remove pngs

* Fix typecheck

* Another type issue

* Update VRT screenshots

Auto-generated by VRT workflow

PR: #6068

* Update VRT screenshots

Auto-generated by VRT workflow

PR: #6068

* Fix strict typing issues

* Update report page

Now better conforms with components from other reports, e.g. by reusing Header
Makes it possible to display a period longer than one month.

* Change view description order

* Formatting and cleanup

* Removed difference section, as it will be difficult to get a reliable view across months

* Introduce the Timeframe param, similar to Spending report, to allow saving a Live sliding window.

* Allow filtering just the last month

* Fix linting errors

* Remove all information about income

* Remove debugging statement

* Sort categories and subcategories by amount

* Move compact mode to spreadsheet to fix Card view more easily

* Update tests file

* Add release notes

* Rename release notes to match PR#

* Fix autofix.ci issues

* Update packages/desktop-client/e2e/sankey.test.ts

Enable experimental feature fall all tests, pr. coderabbit recommendation

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* Add sankey-card to isWidgetType

* Gate Sankey routes to prevent direct URL bypass

* Fix typo

* Change node transformation to work by key instead of name, to remove risk of duplicate issues

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* Prevent false-positive pass in month-change test.

* Translate mode to a proper label

* Fix message for empty data

* Enabled LoadingIndicator until data is ready

* Change card default mode

* More robust filtering

* Fixed issue with budgeted spreadsheet not using 'end' date

* Allow copying SankeyCard to dashboard

* Fix typing and linting issues

* Remove e2e tests

I cannot currently get them to pass, because I dont fully understand playwright and how they are supposed to work. I can see that they don't exist for other reports. We can add them later if required.

* Remove unecessary sankey reference

* Refactor spreadsheet

* Remove dead code from SankeyGraph

* Collect to Other if too many subcategories

* Edit wrong comment

* Linting and typechecking

* Show remaining amount to budget

* Hide description on narrow device

* Add visual clue if 'To budget' is larger than 'Budgeted' and would extend below the edge of the graph

* Add colors to the links

* Fix report card showing subcategories instead of main categories

* Add tooltip info to Other on SankeyCard

* Create globalOther flag and implement greedy category reduction algorithm

* Allow user to select between Global or Per category Other

* Allow user to choose number of subcategories to show

* Allow user to select how subcategories are sorted

* Fix budget filtering

* [autofix.ci] apply automated fixes

* Condense sorting and Other-grouping to one option

* Implement Sort as budget option

* Dynamically adjust topN based on SankeyCard height

* Remove old feature flags from previous PR

---------

Co-authored-by: andrewhumble <43395285+andrewhumble@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: youngcw <calebyoung94@gmail.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
2026-04-05 18:12:51 +01:00
Juulz
78ce7da1b4 [Doc] More tour image (mostly) updates & a hotkey fix (#7328)
* Fix keyboard shortcut Mac key for undo operations

Updated keyboard shortcut instructions for Mac & make consistent.

* Add files via upload

* Fix undo shortcut from 'K' to 'Z'

Updated keyboard shortcut for undo operation in payees guide. COFFEE!

* Revise budget section for clarity and consistency

Updated category descriptions and improved Markdown support details.

* Add files via upload

* Fix grammatical error in budget.md

* Fix typo and clarify Markdown description in budget.md

Corrected a typo in the documentation regarding the chevrons and clarified the description of rendered Markdown.

* Fix spelling error in budget documentation

Corrected the spelling of 'cheverons' to 'chevrons'.

* Add files via upload

* Remove redundant text in budget.md

* Fix formatting issues in payees.md

* count points script should fetch the release note from the PR directly (#7309)

* get pr release note from PR, not top of master

* note

* [AI] Mobile: Post transaction today on global account lists (#7311) (#7322)

* [AI] Mobile: pass today for Post transaction today on global account lists (#7311)

All Accounts, On budget, and Off budget transaction lists now forward the
today flag to schedule/post-transaction, matching single-account mobile
and desktop behavior.

Made-with: Cursor

* [AI] Add release note for PR 7322 (#7311)

Made-with: Cursor

* [AI] Tighten release note wording for PR 7322 (imperative)

Made-with: Cursor

---------

Co-authored-by: Pranay Mac M1 <pranayseela@yahoo.com>

---------

Co-authored-by: Matt Fiddaman <github@m.fiddaman.uk>
Co-authored-by: Pranay S <pranayritvik@gmail.com>
Co-authored-by: Pranay Mac M1 <pranayseela@yahoo.com>
Co-authored-by: youngcw <calebyoung94@gmail.com>
2026-04-05 18:12:51 +01:00
Matt Fiddaman
b03080b246 trim down some unused/unnecessary dependencies (#7350)
* fix github actions inconsistencies

* fix pinning of transitive deps in eslint-plugin

* drop use of node-fetch in api

* drop md5 dependency in favour of node:crypto

* drop slash

* drop unused top level packages

* add note about node-polyfills warning

* remove unused deps from desktop-client

* drop pegjs types

* note

* drop node-jq
2026-04-05 18:12:51 +01:00
Matt Fiddaman
a12b971670 🔖 (26.4.0) (#7389)
* bump versions

* Remove used release notes

* add docs pages

* Update check-spelling metadata

* bump cli

* change release date

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
v26.4.0
2026-04-05 18:12:51 +01:00
youngcw
475272adce Revert "[AI] fix: preserve explicit category on imported transactions" (#7388)
* Revert "[AI] fix: preserve explicit category on imported transactions (#7185)"

This reverts commit 91e839353f.

* Add release notes for PR #7388

* Delete upcoming-release-notes/7388.md

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-04-05 15:22:45 +01:00
youngcw
353e12a009 🐛 fix split popover (#7372)
* pull in change

* note
2026-04-04 12:47:42 +00:00
Matiss Janis Aboltins
9a30a14bf9 [AI] Fix unrecoverable UI error after login (#7341) (#7361)
* [AI] Fix unrecoverable UI error after login (#7341)

The crash was in CommandBar.tsx where item.name.toLowerCase() was called
on items with null/undefined names (from custom reports or dashboard
pages with null name columns in the database). Added optional chaining.

Also hardened React Query data hooks to always return safe defaults even
in error states, and guarded $oneof AQL operator against empty arrays
generating invalid SQL.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* [autofix.ci] apply automated fixes

* [AI] Revert hook/compiler changes, keep CommandBar fix, add release notes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* [AI] Default null names to empty string at data source

Instead of optional chaining at the consumer, ensure names are never
null by defaulting at the data source: reportModel.toJS for custom
reports and dashboardQueries for dashboard pages.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-04-03 20:41:32 +00:00
Matiss Janis Aboltins
c0c2d1630e [AI] Fix password login broken when OIDC is enabled (#7334)
* [AI] Fix password login broken when OIDC is enabled (#7331)

The security fix in PR #7155 added an `active = 1` check to
`getLoginMethod()`, which prevented password login when OIDC was the
active auth method. This caused the server to silently reroute password
login requests to the OpenID flow, which fails.

Remove the `active` requirement when the client explicitly requests a
login method — only require the method to exist in the auth table. The
`active` flag still governs the default method via `getActiveLoginMethod()`.

The `/change-password` endpoint security protections (admin role +
password auth_method checks) remain intact.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add release notes for PR #7334

* Update getLoginMethod to validate client-requested login methods against the auth database

Modified the getLoginMethod function to check if the requested login method exists in the auth table before returning it. Updated the corresponding test to reflect that a client-requested method not found in the database will be ignored, ensuring proper handling of login methods.

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-04-02 18:34:36 +00:00
dependabot[bot]
556bea0953 Bump @xmldom/xmldom from 0.8.11 to 0.8.12 (#7348)
* Bump @xmldom/xmldom from 0.8.11 to 0.8.12

Bumps [@xmldom/xmldom](https://github.com/xmldom/xmldom) from 0.8.11 to 0.8.12.
- [Release notes](https://github.com/xmldom/xmldom/releases)
- [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md)
- [Commits](https://github.com/xmldom/xmldom/compare/0.8.11...0.8.12)

---
updated-dependencies:
- dependency-name: "@xmldom/xmldom"
  dependency-version: 0.8.12
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* note

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Matt Fiddaman <github@m.fiddaman.uk>
2026-04-01 19:41:21 +00:00
Matiss Janis Aboltins
4b5c0a79a7 [AI] Pin axios to 1.14.0 to avoid vulnerable 1.14.1 (#7343)
* [AI] Pin axios to 1.14.0 to avoid vulnerable 1.14.1

Add yarn resolution to prevent axios from being upgraded to 1.14.1,
which contains a critical vulnerability.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add release notes for PR #7343

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-03-31 22:04:54 +00:00
Pranay S
3b14fd08c3 [AI] Mobile: Post transaction today on global account lists (#7311) (#7322)
* [AI] Mobile: pass today for Post transaction today on global account lists (#7311)

All Accounts, On budget, and Off budget transaction lists now forward the
today flag to schedule/post-transaction, matching single-account mobile
and desktop behavior.

Made-with: Cursor

* [AI] Add release note for PR 7322 (#7311)

Made-with: Cursor

* [AI] Tighten release note wording for PR 7322 (imperative)

Made-with: Cursor

---------

Co-authored-by: Pranay Mac M1 <pranayseela@yahoo.com>
2026-03-30 15:46:59 +00:00
Matt Fiddaman
a729b9a4a0 count points script should fetch the release note from the PR directly (#7309)
* get pr release note from PR, not top of master

* note
2026-03-30 15:44:57 +00:00
Juulz
4820331be9 [Doc] A few new images in the tour to fix spelling errors (#7325)
* Add files via upload

* Add files via upload

* Add files via upload
2026-03-29 22:48:41 +01:00
L. Warren Thompson
f7e9ced9e3 Fix balance_current not syncing to API clients after bank sync (#7243)
* [AI] Fix balance_current not syncing to API clients after bank sync

updateAccountBalance() used db.runQuery() (raw SQL) to set
balance_current, which bypasses the CRDT sync layer.  This means
when SimpleFIN or GoCardless updates an account's bank balance on
the server, API clients calling api.sync() never receive the change —
balance_current stays null or stale in their local database.

Fix: use db.update() which goes through sendMessages/CRDT, ensuring
balance_current propagates to all synced clients just like other
account fields (name, closed, etc.).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* [AI] Add release notes for PR #7243

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Address review feedback: remove verbose comment and simplify release note

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: L. Warren Thompson <lwarrenthompson@Warren-MBP.local>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-27 22:19:19 +00:00
dependabot[bot]
4dfba02cba Bump axios from 1.12.2 to 1.14.0 (#7308)
* Bump axios from 1.12.2 to 1.14.0

Bumps [axios](https://github.com/axios/axios) from 1.12.2 to 1.14.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.12.2...v1.14.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.14.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* note

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Matt Fiddaman <github@m.fiddaman.uk>
2026-03-27 21:38:19 +00:00
dependabot[bot]
29f55a18ce Bump brace-expansion from 1.1.12 to 1.1.13 (#7306)
* Bump brace-expansion from 1.1.12 to 1.1.13

Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.12 to 1.1.13.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.12...v1.1.13)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.13
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* note

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Matt Fiddaman <github@m.fiddaman.uk>
2026-03-27 20:44:21 +00:00
dependabot[bot]
1a5dfc4692 Bump node-forge from 1.3.2 to 1.4.0 (#7307)
* Bump node-forge from 1.3.2 to 1.4.0

Bumps [node-forge](https://github.com/digitalbazaar/forge) from 1.3.2 to 1.4.0.
- [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md)
- [Commits](https://github.com/digitalbazaar/forge/compare/v1.3.2...v1.4.0)

---
updated-dependencies:
- dependency-name: node-forge
  dependency-version: 1.4.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* note

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Matt Fiddaman <github@m.fiddaman.uk>
2026-03-27 20:47:28 +00:00
dependabot[bot]
756320ecb7 Bump yaml from 1.10.2 to 1.10.3 (#7286)
* Bump yaml from 1.10.2 to 1.10.3

Bumps [yaml](https://github.com/eemeli/yaml) from 1.10.2 to 1.10.3.
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](https://github.com/eemeli/yaml/compare/v1.10.2...v1.10.3)

---
updated-dependencies:
- dependency-name: yaml
  dependency-version: 1.10.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* note

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Matt Fiddaman <github@m.fiddaman.uk>
2026-03-27 20:20:04 +00:00
dependabot[bot]
216fc747d1 Bump picomatch from 2.3.1 to 2.3.2 (#7287)
* Bump picomatch from 2.3.1 to 2.3.2

Bumps [picomatch](https://github.com/micromatch/picomatch) from 2.3.1 to 2.3.2.
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* note

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Matt Fiddaman <github@m.fiddaman.uk>
2026-03-27 20:08:02 +00:00
dependabot[bot]
82509b053f Bump handlebars from 4.7.8 to 4.7.9 (#7298)
* Bump handlebars from 4.7.8 to 4.7.9

Bumps [handlebars](https://github.com/handlebars-lang/handlebars.js) from 4.7.8 to 4.7.9.
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md)
- [Commits](https://github.com/handlebars-lang/handlebars.js/compare/v4.7.8...v4.7.9)

---
updated-dependencies:
- dependency-name: handlebars
  dependency-version: 4.7.9
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* note

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Matt Fiddaman <github@m.fiddaman.uk>
2026-03-27 19:57:42 +00:00
dependabot[bot]
24382e0e14 Bump convict from 6.2.4 to 6.2.5 (#7293)
* Bump convict from 6.2.4 to 6.2.5

Bumps [convict](https://github.com/mozilla/node-convict) from 6.2.4 to 6.2.5.
- [Changelog](https://github.com/mozilla/node-convict/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mozilla/node-convict/commits)

---
updated-dependencies:
- dependency-name: convict
  dependency-version: 6.2.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* note

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Matt Fiddaman <github@m.fiddaman.uk>
2026-03-27 19:55:04 +00:00
Matt Fiddaman
798fcc9eee amend maintainer points counting script docs file filter (#7305)
* fix

* note
2026-03-27 19:31:29 +00:00
Matt Fiddaman
8504a5a385 fix release note causing CI failure (#7291) 2026-03-26 17:10:28 +00:00
Tyler Davis
acb339be90 fix a typo in the Repair Transactions paragraph (#7275)
* fix typo in the Repair Transcations paragraph

* add release-notes

* add release-notes

* add release-notes

* [autofix.ci] apply automated fixes

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-03-25 16:22:51 +00:00
Ian
c5fe29d50c Fix Scheduled Transactions Not Being Included in Selected Balance (#7274)
* create failing tests to identify schedule bug

* Export SelectedBalance to allow for testing
 #Please enter the commit message for your changes. Lines startin

* fix handling of scheduleIds

* create release notes

* add tests for normal transactions to ensure no regressions introduced

* capitalize first letter of release notes
2026-03-24 16:19:51 +00:00
James Skinner
53db33a2b2 Fix leftover balance usage in budget covering logic (#7131) (#7272)
* Fix leftover balance usage in budget covering logic (#7131)

* [autofix.ci] apply automated fixes

* Add regression unit tests for `coverOverbudgeted` fixes

* Update release note for a more user-facing sentence

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-03-24 15:29:12 +00:00
Matt Fiddaman
9232e0d910 ensure transaction values are saved before adding (#7268)
* ensure transaction values are saved before adding

* note

* fix afterSave deadlock
2026-03-23 16:22:39 +00:00
Matt Fiddaman
335392dae0 fix mobile transactions view hiding older transactions with hide reconciled enabled (#7267)
* fix mobile hide reconcilied transactions from hiding older transactions

* note
2026-03-23 16:19:07 +00:00
Diego Palacios
f88009a166 Add Budgeted type to custom report widgets (#6903)
* feat(reports): add Budgeted type to custom report widgets

* chore(release-notes): add entry for budgeted custom reports

* chore: add feedback link

* fix: address coderabbit review comments

* fix: address coderabbit review comments

* Update VRT screenshots

Auto-generated by VRT workflow

PR: #6903

* fix vrt images

* fixes

* update vrt

* update release category and remove feature flag

* Update VRT screenshots

* fix: also retrieve budgeted values in tracking budgeting mode

* [autofix.ci] apply automated fixes

* show budgeted type in tracking mode

* rename to original budgetAnalysisReportEnabled flag

* fix

* remove unused variable

* remove old unused variables

* implement review comments

* fix navigate filters

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: youngcw <calebyoung94@gmail.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-03-23 15:06:38 +00:00
sys044
cded36f083 docs: update formulas.md for BUDGET_QUERY and QUERY_EXTRACT functions (#7244)
* docs: update formulas.md for BUDGET_QUERY and QUERY_EXTRACT functions

* [autofix.ci] apply automated fixes

* update spellings

---------

Co-authored-by: sys044 <tomgriffin@localhost>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Matt Fiddaman <github@m.fiddaman.uk>
2026-03-23 14:57:13 +00:00
api2062
91e839353f [AI] fix: preserve explicit category on imported transactions (#7185)
* [AI] fix: preserve explicit transaction fields in addTransactions

* [AI] add release notes for PR #7185

---------

Co-authored-by: Aditya Inamdar <api2062@Adityas-MacBook-Air.local>
2026-03-23 13:35:52 +00:00
J-LCRX
429b189edd [AI] Improve autocomplete sorting with tiered ranking (#6972)
Replace binary match/no-match sorting in payee and category dropdowns
with a 4-tier ranking: exact match, prefix match, word-boundary match,
and substring match. This surfaces the most relevant results first
(e.g. typing "me" shows "Me" before "Memory Express" before "Framework").

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-23 13:27:57 +00:00
Nathália Couto
d8af1a7ae7 Fix transactions table context menu bug (#7264)
* fix: transactions table menu

* fix: release notes
2026-03-23 13:24:21 +00:00
dependabot[bot]
b729e547d2 Bump flatted from 3.3.3 to 3.4.2 (#7249)
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.3.3 to 3.4.2.
- [Commits](https://github.com/WebReflection/flatted/compare/v3.3.3...v3.4.2)

---
updated-dependencies:
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-23 13:23:06 +00:00
Igor Loskutov
a00103ff67 fix: retry schedules after sync error (#7245)
* fix: retry schedules after sync error

* add release notes
2026-03-23 13:20:25 +00:00
Matiss Janis Aboltins
b6fbc7dd1e [AI] Custom Themes: custom font family (#7239)
* [AI] Add secure custom font support for custom themes

Implement safe font-family references in custom themes via CSS variables
(--font-body, --font-mono, --font-heading, etc.) validated against a
curated allowlist of system-installed and web-safe fonts.

Security approach: Only fonts already present on the user's OS or bundled
with the app are allowed. No @font-face, no url(), no external font
loading — this prevents third-party tracking via font requests while
still enabling meaningful font customization in themes.

Key changes:
- Add SAFE_FONT_FAMILIES allowlist (~80 fonts: generic families, bundled
  fonts, and common system fonts across platforms)
- Add validateFontFamilyValue() for comma-separated font stack validation
- Route --font-{body,mono,heading,family,ui,display,code} properties
  through the font validator instead of the color validator
- Update index.html to use var(--font-body, ...) with current Inter
  Variable stack as fallback
- Add comprehensive tests for valid/invalid font values and security
  edge cases (url injection, javascript:, expression(), etc.)

https://claude.ai/code/session_01D4ASLpcBCvWF1nzPLz9Tw5

* [AI] Add @font-face support with data: URI embedding for custom themes

Enable truly custom fonts in themes while maintaining zero runtime network
requests. Theme authors can include font files in their GitHub repos, and
fonts are automatically downloaded and embedded as data: URIs at install
time — the same approach used for theme CSS itself.

Security model:
- @font-face blocks only allow data: URIs (no http/https/relative URLs)
- Font MIME types are validated (font/woff2, font/ttf, etc.)
- Individual font files capped at 2MB, total at 10MB
- @font-face properties are allowlisted (font-family, src, font-weight,
  font-style, font-display, font-stretch, unicode-range only)
- Font-family names from @font-face are available in --font-* variables
- No runtime network requests — all fonts stored locally after install

Key additions:
- extractFontFaceBlocks(): parse @font-face from theme CSS
- validateFontFaceBlock(): validate properties and data: URIs
- splitDeclarations(): semicolon-aware parser that respects data: URIs
- embedThemeFonts(): fetch font files from GitHub, convert to data: URIs
- ThemeInstaller calls embedThemeFonts() during catalog theme installation
- 30+ new test cases for @font-face validation and security edge cases

Example theme CSS with custom fonts:
  @font-face {
    font-family: 'My Font';
    src: url('./MyFont.woff2') format('woff2');
  }
  :root { --font-body: 'My Font', sans-serif; }

https://claude.ai/code/session_01D4ASLpcBCvWF1nzPLz9Tw5

* [AI] Rename --font-body CSS variable to --font-family

https://claude.ai/code/session_01D4ASLpcBCvWF1nzPLz9Tw5

* [AI] Remove font-family allowlist and broaden --font-* regex

- Remove SAFE_FONT_FAMILIES allowlist and SAFE_FONT_FAMILIES_LOWER lookup.
  Any font name is now valid in --font-* properties. Referencing a font
  that isn't installed simply triggers the browser's normal fallback — no
  network requests, no security risk. Function calls (url(), expression(),
  etc.) are still blocked.

- Change the --font-* property regex from a specific list
  (family|mono|heading|...) to match all --font-* variables, so theme
  authors can use any --font-prefixed custom property.

https://claude.ai/code/session_01D4ASLpcBCvWF1nzPLz9Tw5

* [AI] Simplify and improve custom font validation code

Code quality improvements from review:

- Remove dead `declaredFonts` Set (was populated but never read after
  allowlist removal)
- Extract `stripQuotes()` helper to deduplicate quote-stripping logic
  between `validateFontFamilyValue` and `validateFontFaceBlock`
- Replace confusing `const searchFrom = 0` loop with `for (;;)` idiom
  in `extractFontFaceBlocks`
- Use index tracking (`content.substring(start, i)`) instead of
  character-by-character string concatenation in `splitDeclarations`
- Use `splitDeclarations` in `validateRootContent` instead of naive
  `split(';')` for consistency and correctness
- Parallelize font fetches in `embedThemeFonts` with `Promise.all`
  instead of sequential awaits
- Replace byte-by-byte base64 conversion with chunked
  `arrayBufferToBase64()` helper (8KB chunks)
- Reuse indexOf-based @font-face parsing in `embedThemeFonts` instead
  of fragile `[^}]*` regex that can't handle large data URIs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Enhance font validation in customThemes.ts

* Add custom release notes for upcoming feature: support for custom fonts in themes

* [AI] Simplify @font-face validation to only block external URLs

Remove ~210 lines of overly thorough font validation (MIME type allowlists,
base64 encoding checks, format hint validation, @font-face property allowlists,
font-family name regex) and replace with a single function that enforces the
actual security goal: rejecting non-data: URIs to prevent external resource
loading. Size limits for DoS prevention are preserved.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Update Content Security Policy to include font-src directive

Enhance the Content Security Policy in both the desktop client and sync server to allow font loading from data URIs. This change ensures that custom fonts can be embedded securely while maintaining the existing security measures for other resources.

* Enhance font-family validation to disallow empty values

Update the `validateFontFamilyValue` function to throw an error for empty font-family values, improving security and validation accuracy. Adjust tests to reflect this change, ensuring that empty values are properly handled as invalid.

* Enhance validation for CSS custom properties in customThemes.ts

Add comprehensive checks in the `validateRootContent` function to ensure CSS custom properties start with '--', contain valid characters, and do not end with a dash. This improves error handling for invalid property names, ensuring better compliance with CSS standards.

* [AI] Fix path traversal, spaces in font URLs, and add embedThemeFonts tests

Reject path-traversal (../) and root-anchored (/) font paths in
embedThemeFonts to prevent URL manipulation. Fix URL regex to handle
quoted filenames with spaces (e.g. "Inter Variable.woff2"). Add unit
tests covering both security validations and normal embedding flow.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Implement font size budget enforcement in embedThemeFonts function

* Add global unstubbing in afterEach for embedThemeFonts tests

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-03-22 07:58:17 +00:00
Matiss Janis Aboltins
23adf06cb0 Add post-merge hook to auto-install dependencies (#7248)
* [AI] Add post-merge hook to auto-install when yarn.lock changes

Mirrors the existing post-checkout hook behavior: after a git pull or
merge, if yarn.lock changed between ORIG_HEAD and HEAD, automatically
runs yarn install to keep dependencies in sync.

https://claude.ai/code/session_01JHoMhGANLTc1q67s1dUHrt

* Add release notes for PR #7248

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-03-20 22:59:05 +00:00
Matiss Janis Aboltins
a8a2d23e63 [AI] Improve CLI query command with new flags, subcommands, and docs (#7240)
* [AI] Improve CLI query command with new flags, subcommands, and docs

Add --last, --count, --where, --offset, --group-by flags and field:desc
order-by syntax to make the query command more usable for both humans
and AI agents. Add query tables/fields subcommands for schema discovery.
Expand CLI and ActualQL documentation with comprehensive examples.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* [AI] Fix parseOrderBy empty field validation and misleading aggregate docs

Validate that order-by field names are non-empty (e.g. ":desc" now throws
a clear error). Move AVAILABLE_TABLES before first use. Update group-by
examples in CLI help text and docs to use --file with proper aggregate
JSON instead of misleading --select with plain field names.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* [autofix.ci] apply automated fixes

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-03-20 19:01:20 +00:00
Matiss Janis Aboltins
f5a72448bd [AI] Refactor ThemeInstaller to handle pasted CSS more gracefully (#7236)
* [AI] Add baseTheme and overrideCss support to custom theme system

Add baseTheme field to InstalledTheme allowing users to choose which
built-in theme (light/dark/midnight) serves as the base for custom
themes. Add overrideCss field for layering additional CSS overrides
on top of a catalog theme's CSS.

ThemeStyle now respects the baseTheme field when rendering base
variables. CustomThemeStyle renders both cssContent and overrideCss
layers.

https://claude.ai/code/session_01PPAkAQB4xfeFCQbmNwvn2k

* [AI] Add base theme selection and CSS override layering for custom themes

- Add baseTheme field to CatalogTheme and InstalledTheme types, allowing
  catalog themes to declare which built-in theme (light/dark/midnight) they
  are based on
- Add overrideCss field to InstalledTheme for layering additional CSS
  overrides on top of a catalog theme
- Update ThemeStyle to render the correct base theme colors when a custom
  theme specifies a baseTheme
- Update CustomThemeStyle to render both cssContent and overrideCss layers
- Update ThemeInstaller UI: catalog selection and free-text CSS now coexist
  so users can pick a catalog theme (e.g. Matrix) and apply extra overrides
- Add baseTheme to all entries in customThemeCatalog.json
- Dynamic label: shows "Additional CSS overrides:" when a catalog theme is
  selected, "or paste CSS directly:" otherwise

https://claude.ai/code/session_01PPAkAQB4xfeFCQbmNwvn2k

* [AI] Remove baseTheme from catalog; derive base from mode instead

Base theme is now automatically determined from the catalog theme's
mode field: light mode themes use "light" as base, dark mode themes
use "dark" as base. No separate baseTheme field needed in catalog.

https://claude.ai/code/session_01PPAkAQB4xfeFCQbmNwvn2k

* Refactor ThemeInstaller to handle pasted CSS more gracefully

* Enhance ThemeInstaller and CustomThemeStyle to support CSS validation for both content and overrides. Refactor pasted CSS handling for improved clarity and efficiency.

* Implement validateAndCombineThemeCss function to streamline CSS validation and combination for light and dark themes in CustomThemeStyle. Refactor existing CSS handling to improve clarity and efficiency.

* Add cachedCatalogCss state to ThemeInstaller for improved CSS handling

* Update ThemeInstaller tests to ensure pasted CSS is preserved when a catalog theme is selected and modify onInstall behavior to correctly handle empty CSS content. Refactor test cases for clarity and accuracy.

* Enhance ThemeInstaller to support dynamic baseTheme selection based on catalog theme or user preference. Refactor CSS installation logic to prioritize selected catalog themes and improve handling of pasted CSS. Update dependencies in the installTheme function for better clarity and functionality.

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-03-19 18:48:02 +00:00
erwannc
0793eb5927 Add Notes to Monthly Budget Cell (#6620)
* Add Notes to Monthly Budget Cell
Changed Modal menus layout to follow month menu on mobile

* Fixed rebase errors

* Update VRT screenshots

Auto-generated by VRT workflow

PR: #6620

* Addressed youngcw's comments (notes id format, notesButton defaultColor and modal layout)

* Update VRT screenshots

Auto-generated by VRT workflow

PR: #6620

* Updated mobile budget menu modal page model

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: youngcw <calebyoung94@gmail.com>
2026-03-19 00:42:30 +00:00
Matiss Janis Aboltins
a43b6f5c47 [AI] Experimental CLI tool for Actual (#7208)
* [AI] Add @actual-app/cli package

New CLI tool wrapping the full @actual-app/api surface for interacting with
Actual Budget from the command line. Connects to a sync server and supports
all CRUD operations across accounts, budgets, categories, transactions,
payees, tags, rules, schedules, and AQL queries.

* Refactor CLI options: replace `--quiet` with `--verbose` for improved message control. Update related configurations and tests to reflect this change. Adjust build command in workflow for consistency.

* Refactor tests: streamline imports in connection and accounts test files for improved clarity and consistency. Remove dynamic imports in favor of static imports.

* Enhance package.json: Add exports configuration for module resolution and publish settings. This includes specifying types and default files for better compatibility and clarity in package usage.

* Update package.json exports configuration to support environment-specific module resolution. Added 'development' and 'default' entries for improved clarity in file usage.

* Enhance CLI functionality: Update configuration loading to support additional search places for config files. Refactor error handling in command options to improve validation and user feedback. Introduce new utility functions for parsing boolean flags and update related commands to utilize these functions. Add comprehensive tests for new utility functions to ensure reliability.

* Update CLI TypeScript configuration to include Vitest globals and streamline test imports across multiple test files for improved clarity and consistency.

* Update CLI dependencies and build workflow

- Upgrade Vite to version 8.0.0 and Vitest to version 4.1.0 in package.json.
- Add rollup-plugin-visualizer for bundle analysis.
- Modify build workflow to prepare and upload CLI bundle stats.
- Update size comparison workflow to include CLI stats.
- Remove obsolete vitest.config.ts file as its configuration is now integrated into vite.config.ts.

* Enhance size comparison workflow to include CLI build checks and artifact downloads

- Added steps to wait for CLI build success in both base and PR workflows.
- Included downloading of CLI build artifacts for comparison between base and PR branches.
- Updated failure reporting to account for CLI build status.

* Update documentation to replace "CLI tool" with "Server CLI" for consistency across multiple files. This change clarifies the distinction between the command-line interface for the Actual Budget application and the sync-server CLI tool.

* Refactor configuration to replace "budgetId" with "syncId" across CLI and documentation

* Enhance configuration validation by adding support for 'ACTUAL_ENCRYPTION_PASSWORD' and implementing a new validation function for config file content. Update documentation to clarify error output format for the CLI tool.

* Enhance configuration tests to include 'encryptionPassword' checks for CLI options and environment variables, ensuring proper priority handling in the configuration resolution process.

* Update nightly versioning script to use yarn

* Align versions

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-03-18 18:22:38 +00:00
Matt Fiddaman
1f821d2849 ⬆️ bump github actions (#7234)
* actions/setup-node

* actions/cache

* actions/checkout

* docker/*

* actions/*-artifact

* actions/stale

* others

* note
2026-03-18 08:53:03 +00:00
Matt Fiddaman
beee16bc8c ⬆️ march dependency updates (#7222)
* @types/node (^22.19.10 → ^22.19.15)

* baseline-browser-mapping (^2.9.19 → ^2.10.0)

* eslint (^9.39.2 → ^9.39.3)

* lage (^2.14.17 → ^2.14.19)

* lint-staged (^16.2.7 → ^16.3.2)

* minimatch (^10.1.2 → ^10.2.4)

* oxlint (^1.47.0 → ^1.51.0)

* rollup-plugin-visualizer (^6.0.5 → ^6.0.11)

* @chromatic-com/storybook (^5.0.0 → ^5.0.1)

* @storybook/addon-a11y (^10.2.7 → ^10.2.16)

* @storybook/addon-docs (^10.2.7 → ^10.2.16)

* @storybook/react-vite (^10.2.7 → ^10.2.16)

* eslint-plugin-storybook (^10.2.7 → ^10.2.16)

* storybook (^10.2.7 → ^10.2.16)

* @codemirror/autocomplete (^6.20.0 → ^6.20.1)

* @codemirror/lang-javascript (^6.2.4 → ^6.2.5)

* @codemirror/language (^6.12.1 → ^6.12.2)

* @rolldown/plugin-babel (~0.1.7 → ~0.1.8)

* @swc/core (^1.15.11 → ^1.15.18)

* @swc/helpers (^0.5.18 → ^0.5.19)

* @tanstack/react-query (^5.90.20 → ^5.90.21)

* @uiw/react-codemirror (^4.25.4 → ^4.25.7)

* hyperformula (^3.1.1 → ^3.2.0)

* i18next (^25.8.4 → ^25.8.14)

* i18next-parser (^9.3.0 → ^9.4.0)

* react-i18next (^16.5.4 → ^16.5.6)

* react-virtualized-auto-sizer (^2.0.2 → ^2.0.3)

* fs-extra (^11.3.3 → ^11.3.4)

* @r74tech/docusaurus-plugin-panzoom (^2.4.0 → ^2.4.2)

* lru-cache (^11.2.5 → ^11.2.6)

* nodemon (^3.1.11 → ^3.1.14)

* eslint-plugin-perfectionist (^4.15.1 → ^5.6.0)

* downshift (9.0.10 → 9.3.2)

* react-router (7.13.0 → 7.13.1)

* @easyops-cn/docusaurus-search-local (^0.52.3 → ^0.55.1)

* peggy (5.0.6 → 5.1.0)

* @types/supertest (^6.0.3 → ^7.2.0)

* note
2026-03-18 08:37:04 +00:00
Karim Kodera
4cdb26f9a7 Adding Concentric Donut Pie Chart type to custom report charts (#7038)
* Initial commit for concentric donut chart implementation

* [autofix.ci] apply automated fixes

* Update upcoming-release-notes/7038.md

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* Fix coderabbit comments (Recalculated total to avoid hidden cats, remove tooltip, add proper types)

* Update packages/desktop-client/src/components/reports/graphs/DonutGraph.tsx

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* Fix zero total group

* lint issues fix

* Fix lint issues

* Empty commit to retriger the process

* [autofix.ci] apply automated fixes

* Removed line betweeen arc and label. I beleive the view is cleaner this way.

* Fixed line for outer donut

* split active shape for concentric circles to avoid impacting original chart

* [autofix.ci] apply automated fixes

* Fixing mid point to align with mid point on inner circle

* 1- make line always start inside the core circle
2- fix bug where inner circle label was showing below the outer circle

* - Fixed Dashboard issue when height too low.
- Rewrite of the activeShape part for simplicity.
- Centralize radius calculation.
- Provide differnt dimensions for compact vs standard rendering
- fix mid line point to auto fix at 70% of the inner radius
- More readable code

* Update VRT screenshots

Auto-generated by VRT workflow

PR: #7038

* Fixed distance issue for arc on single ring.

* [autofix.ci] apply automated fixes

* Update VRT screenshots

Auto-generated by VRT workflow

PR: #7038

* Update packages/desktop-client/src/components/reports/graphs/DonutGraph.tsx

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* Fixing Code Rabbit Comments

* rerunning tests

* Added Group click through passing all categories iwth a workaorund on showActivity

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-03-17 20:10:30 +00:00