Remove used release notes

* Bump node-forge from 1.3.1 to 1.3.2

Bumps [node-forge](https://github.com/digitalbazaar/forge) from 1.3.1 to 1.3.2.
- [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md)
- [Commits](https://github.com/digitalbazaar/forge/compare/v1.3.1...v1.3.2)

---
updated-dependencies:
- dependency-name: node-forge
  dependency-version: 1.3.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* note

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Matt Fiddaman <github@m.fiddaman.uk>

.cursor/rules/commands.mdc

@@ -1,12 +0,0 @@
----
-alwaysApply: true
----
-
-When running yarn commands - always run them in the root directory. Do not run them in child workspaces.
-
-The following commands can be useful:
-
-- `yarn typecheck` to run typechecker
-- `yarn lint` to run the code linter and formatter
-- `yarn lint:fix` to fix some of the code lint issues (running this is preferred over `yarn lint`)
-- `yarn test` to run all the tests

.cursor/rules/typescript.mdc

@@ -1,37 +0,0 @@
----
-description:
-globs: *.ts,*.tsx
-alwaysApply: false
----
-
-You are an expert in TypeScript and React.
-
-Code Style and Structure
-
-- Write concise, technical TypeScript code.
-- Use functional and declarative programming patterns; avoid classes.
-- Prefer iteration and modularization over code duplication.
-- Use descriptive variable names with auxiliary verbs (e.g., isLoaded, hasError).
-- Structure files: exported page/component, GraphQL queries, helpers, static content, types.
-- When creating a new component, place it in its own file rather than grouping multiple components in a single file.
-
-Naming Conventions
-
-- Favor named exports for components and utilities.
-
-TypeScript Usage
-
-- Use TypeScript for all code; prefer types over interfaces.
-- Avoid enums; use objects or maps instead.
-- Avoid using `any` or `unknown` unless absolutely necessary. Look for type definitions in the codebase instead.
-- Avoid type assertions with `as` or `!`; prefer using `satisfies`.
-
-Syntax and Formatting
-
-- Use the "function" keyword for pure functions.
-- Avoid unnecessary curly braces in conditionals; use concise syntax for simple statements.
-- Use declarative JSX, keeping JSX minimal and readable.
-
-Change validation
-
-- Run `yarn typecheck` in the root directory to validate that the generated TypeScript code is correct

.cursor/rules/unit-tests.mdc

@@ -1,14 +0,0 @@
----
-description: 
-globs: 
-alwaysApply: true
----
-Vitest test runner is used for unit tests.
-
-When running unit tests, always include the flag `--watch=false` to prevent watch mode.
-
-To run unit tests for a specific package in the monorepo, use the following command:
-
-`yarn workspace <workspaceNameFromPackageJson> run test <pathToTest>`
-
-Recommendation: Minimize the number of dependencies you mock. The fewer dependencies you mock, the better.

.cursor/worktrees.json

@@ -0,0 +1,3 @@
+{
+  "setup-worktree": ["yarn"]
+}

.github/ISSUE_TEMPLATE/documentation.yml

@@ -0,0 +1,69 @@
+name: 'Documentation'
+description: Report documentation issues, request new documentation, or suggest improvements to existing docs.
+title: '[Docs] - <title>'
+labels: ['documentation']
+body:
+  - type: dropdown
+    id: issue-type
+    attributes:
+      label: 'Issue Type'
+      description: What type of documentation issue is this?
+      options:
+        - New Documentation Request
+        - Documentation Improvement
+        - Documentation Bug/Error
+        - Documentation Change Request
+    validations:
+      required: true
+  - type: textarea
+    id: description
+    attributes:
+      label: 'Description'
+      description: Please describe the documentation issue, request, or improvement
+      placeholder: Provide a clear and detailed description...
+    validations:
+      required: true
+  - type: input
+    id: doc-url
+    attributes:
+      label: 'Documentation URL'
+      description: If this relates to existing documentation, please provide the URL
+      placeholder: ex. https://actualbudget.org/docs/budgeting/categories or https://github.com/actualbudget/actual/blob/master/packages/docs/...
+    validations:
+      required: false
+  - type: dropdown
+    id: category
+    attributes:
+      label: 'Documentation Category'
+      description: What category does this relate to?
+      multiple: true
+      options:
+        - Accounts
+        - Backup & Restore
+        - Budgeting
+        - Development
+        - Installation & Configuration
+        - Overview
+        - Reports
+        - Troubleshooting
+        - Other
+    validations:
+      required: false
+  - type: textarea
+    id: expected-behavior
+    attributes:
+      label: 'Expected/Desired Content'
+      description: If applicable, describe what you expect to see or what should be documented
+      placeholder: What should the documentation say or include?
+    validations:
+      required: false
+  - type: textarea
+    id: screenshot
+    attributes:
+      label: 'Screenshots or Examples'
+      description: If applicable, add screenshots or examples to help explain your request
+      value: |
+        ![DESCRIPTION](LINK.png)
+      render: bash
+    validations:
+      required: false

.github/actions/docs-spelling/README.md

@@ -0,0 +1,17 @@
+# check-spelling/check-spelling configuration
+
+| File                                               | Purpose                                                                          | Format                                                                                            | Info                                                                                                 |
+| -------------------------------------------------- | -------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
+| [dictionary.txt](dictionary.txt)                   | Replacement dictionary (creating this file will override the default dictionary) | one word per line                                                                                 | [dictionary](https://github.com/check-spelling/check-spelling/wiki/Configuration#dictionary)         |
+| [allow.txt](allow.txt)                             | Add words to the dictionary                                                      | one word per line (only letters and `'`s allowed)                                                 | [allow](https://github.com/check-spelling/check-spelling/wiki/Configuration#allow)                   |
+| [reject.txt](reject.txt)                           | Remove words from the dictionary (after allow)                                   | grep pattern matching whole dictionary words                                                      | [reject](https://github.com/check-spelling/check-spelling/wiki/Configuration-Examples%3A-reject)     |
+| [excludes.txt](excludes.txt)                       | Files to ignore entirely                                                         | perl regular expression                                                                           | [excludes](https://github.com/check-spelling/check-spelling/wiki/Configuration-Examples%3A-excludes) |
+| [only.txt](only.txt)                               | Only check matching files (applied after excludes)                               | perl regular expression                                                                           | [only](https://github.com/check-spelling/check-spelling/wiki/Configuration-Examples%3A-only)         |
+| [patterns.txt](patterns.txt)                       | Patterns to ignore from checked lines                                            | perl regular expression (order matters, first match wins)                                         | [patterns](https://github.com/check-spelling/check-spelling/wiki/Configuration-Examples%3A-patterns) |
+| [candidate.patterns](candidate.patterns)           | Patterns that might be worth adding to [patterns.txt](patterns.txt)              | perl regular expression with optional comment block introductions (all matches will be suggested) | [candidates](https://github.com/check-spelling/check-spelling/wiki/Feature:-Suggest-patterns)        |
+| [line_forbidden.patterns](line_forbidden.patterns) | Patterns to flag in checked lines                                                | perl regular expression (order matters, first match wins)                                         | [patterns](https://github.com/check-spelling/check-spelling/wiki/Configuration-Examples%3A-patterns) |
+| [expect.txt](expect.txt)                           | Expected words that aren't in the dictionary                                     | one word per line (sorted, alphabetically)                                                        | [expect](https://github.com/check-spelling/check-spelling/wiki/Configuration#expect)                 |
+| [advice.md](advice.md)                             | Supplement for GitHub comment when unrecognized words are found                  | GitHub Markdown                                                                                   | [advice](https://github.com/check-spelling/check-spelling/wiki/Configuration-Examples%3A-advice)     |
+
+Note: you can replace any of these files with a directory by the same name (minus the suffix)
+and then include multiple files inside that directory (with that suffix) to merge multiple files together.

.github/actions/docs-spelling/advice.md

@@ -0,0 +1,24 @@
+<!-- See https://github.com/check-spelling/check-spelling/wiki/Configuration-Examples%3A-advice --> <!-- markdownlint-disable MD033 MD041 -->
+<details>
+<summary>If the flagged items are :exploding_head: false positives</summary>
+
+If items relate to a ...
+
+- binary file (or some other file you wouldn't want to check at all).
+
+  Please add a file path to the `excludes.txt` file matching the containing file.
+
+  File paths are Perl 5 Regular Expressions - you can [test](https://www.regexplanet.com/advanced/perl/) yours before committing to verify it will match your files.
+
+  `^` refers to the file's path from the root of the repository, so `^README\.md$` would exclude [README.md](../tree/HEAD/README.md) (on whichever branch you're using).
+
+- well-formed pattern.
+
+  If you can write a [pattern](https://github.com/check-spelling/check-spelling/wiki/Configuration-Examples:-patterns) that would match it,
+  try adding it to the `patterns.txt` file.
+
+  Patterns are Perl 5 Regular Expressions - you can [test](https://www.regexplanet.com/advanced/perl/) yours before committing to verify it will match your lines.
+
+  Note that patterns can't match multiline strings.
+
+</details>

.github/actions/docs-spelling/allow/contributers.txt

@@ -0,0 +1,8 @@
+trevdor
+Farlow
+Matiss
+Aboltins
+jlongster
+howell
+evequefou
+Fiddaman

.github/actions/docs-spelling/allow/keywords.txt

@@ -0,0 +1,144 @@
+ABANCA
+actualbudget
+addtransactions
+Akahu
+AMZN
+Andelskassen
+AQL
+Authelia
+autocompletes
+Blix
+bnp
+BSCHESMM
+BTC
+CAGLESMM
+Caju
+caniuse
+Cardless
+CAROOT
+categorygroup
+Cembra
+Certbot
+CLI
+clickable
+clsx
+codemirror
+Coinbase
+commandlet
+Coverflex
+Crd
+crdt
+creditcards
+crowdsourced
+debian
+dedupes
+deleteaccount
+DKB
+dmg
+easybank
+Edenred
+Coverfelx
+emojis
+emoji
+escodegen
+EUR
+expando
+Firefox
+flyctl
+Formik
+Fortuneo
+gebabebb
+GEBABEBB
+Greenshot
+HSA
+htpasswd
+IBANs
+iex
+importtransactions
+ING
+invokable
+iwr
+jointaccounts
+jwl
+KBC
+kcab
+keyout
+KREDBEBB
+Kroger
+kubectl
+kubernetes
+ldaplogin
+letsencrypt
+libofx
+linting
+Linuxes
+linuxsvg
+lleskassen
+lte
+mac
+macsvg
+Mariushosting
+minimalistic
+monkeypatch
+Monobank
+Morrisons
+NAIAGB
+NDEADKKK
+Netflix
+netlify
+Nordea
+NORDEA
+nordigen
+notlike
+NRNBGB
+nynab
+offbudget
+ofx
+OFX
+oneof
+payeerule
+pikaday
+pikapods
+playsinline
+portalization
+Postgresql
+protobuf
+publix
+QFX
+QIF
+Quicken
+returnsandreimbursements
+Rezip
+roadmap
+RUpdate
+sankey
+SANTANDER
+screenshots
+SEB
+subfolders
+subreaper
+subtransaction
+subtransactions
+Suisse
+Sztup
+tini
+traefik
+Trafico
+Trumf
+Upstash
+useb
+usernames
+valign
+Venmo
+Weblate
+winsvg
+WSL
+Xxxxx
+ynab
+Ynab
+YNAB
+ZKB
+Zsolt
+IDBy
+isapprox
+isbetween

.github/actions/docs-spelling/excludes.txt

@@ -0,0 +1,76 @@
+# See https://github.com/check-spelling/check-spelling/wiki/Configuration-Examples:-excludes
+(?:^|/)(?i)COPYRIGHT
+(?:^|/)(?i)LICEN[CS]E
+(?:^|/)3rdparty/
+(?:^|/)go\.sum$
+(?:^|/)package(?:-lock|)\.json$
+(?:^|/)pyproject.toml
+(?:^|/)requirements(?:-dev|-doc|-test|)\.txt$
+(?:^|/)vendor/
+ignore$
+\.a$
+\.ai$
+\.avi$
+\.bmp$
+\.bz2$
+\.class$
+\.coveragerc$
+\.crt$
+\.css$
+\.dll$
+\.docx?$
+\.drawio$
+\.DS_Store$
+\.eot$
+\.exe$
+\.gif$
+\.git-blame-ignore-revs$
+\.gitattributes$
+\.graffle$
+\.gz$
+\.icns$
+\.ico$
+\.jar$
+\.jks$
+\.jpe?g$
+\.key$
+\.lib$
+\.lock$
+\.map$
+\.min\..
+\.mod$
+\.mp[34]$
+\.o$
+\.ocf$
+\.otf$
+\.pdf$
+\.pem$
+\.png$
+\.psd$
+\.pyc$
+\.pylintrc$
+\.s$
+\.svgz?$
+\.tar$
+\.tiff?$
+\.ttf$
+\.wav$
+\.webm$
+\.webp$
+\.woff2?$
+\.xlsx?$
+\.zip$
+^\.github/actions/spelling/
+^\.github/ISSUE_TEMPLATE/
+^\Q.github/workflows/spelling.yml\E$
+^\.yarn/
+^\Qnode_modules/\E$
+^\Qsrc/\E$
+^\Qstatic/\E$
+^\Q.github/\E$
+(?:^|/)package(?:-lock|)\.json$
+(?:^|/)yarn\.lock$
+(?:^|/)(?i)docusaurus.config.js
+(?:^|/)(?i)README.md
+^\static/
+\.tsx$

.github/actions/docs-spelling/expect.txt

@@ -0,0 +1,152 @@
+Abanca
+ABNAMRO
+ABNANL
+Activo
+AESUDEF
+ALZEY
+Anglais
+aql
+AUR
+Authentik
+BANKA
+BANKINTER
+BAWAATWW
+Belfius
+Biedenkopf
+BIGBPLPW
+Bizum
+BKBKESMM
+BOFIIE
+Bourso
+Boursobank
+Boursorama
+BPER
+BPMOIT
+brexplpw
+BYLADEM
+Caddyfile
+CAGLPTPL
+Caixa
+CAMT
+cashflow
+Cetelem
+cimode
+Citi
+Citibank
+Cloudflare
+CMCIFRPAXXX
+COBADEFF
+CODEOWNERS
+commerzbank
+Copiar
+CREGBEBB
+crt
+Danske
+datadir
+Depositos
+DIREKT
+Dockerfiles
+Dominguez
+DUSSDEDDXXX
+DUSSELDORF
+ENTERCARD
+Entra
+EUA
+Eurocard
+fidd
+Fineco
+Finicity
+Fintro
+Finverse
+Flathub
+FORTUNEO
+FTNOFRP
+Gemeinschaftsbank
+Geral
+gernes
+Globecard
+GLS
+gocardless
+Grafana
+HABAL
+Hampel
+HELADEF
+INDUSTRIEL
+INGBPLPW
+Ingo
+INR
+Intesa
+INVSTMTMSGSRS
+ISYBANK
+ITBBITMM
+jfdoming
+JMD
+KBCBE
+Keycloak
+Khurozov
+KORT
+Kreditbank
+lage
+LHV
+LHVBEE
+LKR
+mbank
+mdc
+modals
+Moldovan
+murmurhash
+nginx
+OIDC
+overbudgeted
+overbudgeting
+Paribas
+passwordless
+pluggyai
+Poste
+PPABPLPK
+prefs
+Primoco
+Priotecs
+proactively
+pwa
+Qatari
+QNTOFRP
+QONTO
+Raiffeisen
+revolut
+RIED
+RSchedule
+RSD
+SEK
+simplefin
+SKHSFI
+Sparkasse
+SPK
+sseldorf
+SSK
+Stadtsparkasse
+statestore
+SUBASKBX
+SVGR
+swc
+SWEDBANK
+SWEDNOKK
+Synology
+systemctl
+tada
+taskbar
+templating
+THB
+touchscreen
+triaging
+UAH
+ubuntu
+userinfo
+Userscripts
+UZS
+vrt
+VUB
+websecure
+Widiba
+WOR
+youngcw

.github/actions/docs-spelling/line_forbidden.patterns

@@ -0,0 +1,62 @@
+# reject `m_data` as there's a certain OS which has evil defines that break things if it's used elsewhere
+# \bm_data\b
+
+# If you have a framework that uses `it()` for testing and `fit()` for debugging a specific test,
+# you might not want to check in code where you were debugging w/ `fit()`, in which case, you might want
+# to use this:
+#\bfit\(
+
+# s.b. GitHub
+#\bGithub\b
+
+# s.b. GitLab
+\bGitlab\b
+
+# s.b. JavaScript
+\bJavascript\b
+
+# s.b. Microsoft
+\bMicroSoft\b
+
+# s.b. another
+\ban[- ]other\b
+
+# s.b. greater than
+\bgreater then\b
+
+# s.b. into
+#\sin to\s
+
+# s.b. opt-in
+\sopt in\s
+
+# s.b. less than
+\bless then\b
+
+# s.b. otherwise
+\bother[- ]wise\b
+
+# s.b. nonexistent
+\bnon existing\b
+\b[Nn]o[nt][- ]existent\b
+
+# s.b. preexisting
+[Pp]re[- ]existing
+
+# s.b. preempt
+[Pp]re[- ]empt\b
+
+# s.b. preemptively
+[Pp]re[- ]emptively
+
+# s.b. reentrancy
+[Rr]e[- ]entrancy
+
+# s.b. reentrant
+[Rr]e[- ]entrant
+
+# s.b. workaround(s)
+\bwork[- ]arounds?\b
+
+# Reject duplicate words
+\s([A-Z]{3,}|[A-Z][a-z]{2,}|[a-z]{3,})\s\g{-1}\s

.github/actions/docs-spelling/only.txt

@@ -0,0 +1,3 @@
+# Only check files in the packages/docs directory
+^packages/docs/
+

.github/actions/docs-spelling/patterns.txt

@@ -0,0 +1,81 @@
+# See https://github.com/check-spelling/check-spelling/wiki/Configuration-Examples:-patterns
+
+# Questionably acceptable forms of `in to`
+# Personally, I prefer `log into`, but people object
+# https://www.tprteaching.com/log-into-log-in-to-login/
+\b[Ll]og in to\b
+
+# acceptable duplicates
+# ls directory listings
+[-bcdlpsw](?:[-r][-w][-Ssx]){3}\s+\d+\s+\S+\s+\S+\s+\d+\s+
+# C types and repeated CSS values
+\s(center|div|inherit|long|LONG|none|normal|solid|thin|transparent|very)(?: \g{-1})+\s
+# go templates
+\s(\w+)\s+\g{-1}\s+\`(?:graphql|json|yaml):
+# javadoc / .net
+(?:[\\@](?:groupname|param)|(?:public|private)(?:\s+static|\s+readonly)*)\s+(\w+)\s+\g{-1}\s
+
+# Commit message -- Signed-off-by and friends
+^\s*(?:(?:Based-on-patch|Co-authored|Helped|Mentored|Reported|Reviewed|Signed-off)-by|Thanks-to): (?:[^<]*<[^>]*>|[^<]*)\s*$
+
+# Autogenerated revert commit message
+^This reverts commit [0-9a-f]{40}\.$
+
+# ignore long runs of a single character:
+\b([A-Za-z])\g{-1}{3,}\b
+
+# Automatically suggested patterns
+# hit-count: 1255 file-count: 51
+# https/http/file urls
+(?:\b(?:https?|ftp|file)://)[-A-Za-z0-9+&@#/%?=~_|!:,.;]+[-A-Za-z0-9+&@#/%=~_|]
+
+# hit-count: 1174 file-count: 33
+# GitHub SHAs (markdown)
+(?:\[`?[0-9a-f]+`?\]\(https:/|)/(?:www\.|)github\.com(?:/[^/\s"]+){2,}(?:/[^/\s")]+)(?:[0-9a-f]+(?:[-0-9a-zA-Z/#.]*|)\b|)
+
+# hit-count: 6 file-count: 4
+# version suffix <word>v#
+(?:(?<=[A-Z]{2})V|(?<=[a-z]{2}|[A-Z]{2})v)\d+(?:\b|(?=[a-zA-Z_]))
+
+# hit-count: 6 file-count: 2
+# URL escaped characters
+\%[0-9A-F][A-F]
+
+# hit-count: 5 file-count: 4
+# hex runs
+\b[0-9a-fA-F]{16,}\b
+
+# hit-count: 4 file-count: 2
+# uuid:
+\b[0-9a-fA-F]{8}-(?:[0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}\b
+
+# hit-count: 3 file-count: 2
+# discord
+/discord(?:app\.com|\.gg)/(?:invite/)?[a-zA-Z0-9]{7,}
+
+# hit-count: 2 file-count: 2
+# Contributor
+\[[^\]]+\]\(https://github\.com/[^/\s"]+\)
+@[^$\W]*-?\w+
+
+# hit-count: 1 file-count: 1
+# While you could try to match `http://` and `https://` by using `s?` in `https?://`, sometimes there
+# YouTube url
+\b(?:(?:www\.|)youtube\.com|youtu.be)/(?:channel/|embed/|user/|playlist\?list=|watch\?v=|v/|)[-a-zA-Z0-9?&=_%]*
+
+# hit-count: 1 file-count: 1
+# Google Fonts
+\bfonts\.(?:googleapis|gstatic)\.com/[-/?=:;+&0-9a-zA-Z]*
+
+# hit-count: 1 file-count: 1
+# hex digits including css/html color classes:
+(?:[\\0][xX]|\\u|[uU]\+|#x?|\%23)[0-9_a-fA-FgGrR]*?[a-fA-FgGrR]{2,}[0-9_a-fA-FgGrR]*(?:[uUlL]{0,3}|u\d+)\b
+
+# docusaurus image paths, URLs
+[-a-zA-Z0-9@:%_\+.~#?&//=]{2,256}\.[a-z]{2,4}\b(\/[-a-zA-Z0-9@:%_\+.~#?&//=]*)?
+
+# eliminate words like [`nvm`] or [`asdf`] or [heidiSQL] without backquotes
+\[.+?]
+
+# allowlist specific non-English words with non-ASCII characters
+\b(Länsförsäkringar|München|Złoty)\b

.github/actions/docs-spelling/reject.txt

@@ -0,0 +1,10 @@
+^attache$
+benefitting
+occurences?
+^dependan.*
+^oer$
+Sorce
+^[Ss]pae.*
+^untill$
+^untilling$
+^wether.*

.github/actions/setup/action.yml

@@ -15,9 +15,9 @@ runs:
   using: composite
   steps:
     - name: Install node
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
       with:
-        node-version: 20
+        node-version: 22
     - name: Install yarn
       run: npm install -g yarn
       shell: bash
@@ -27,18 +27,28 @@ runs:
       run: echo "version=$(node -v)" >> "$GITHUB_OUTPUT"
       shell: bash
     - name: Cache
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       id: cache
       with:
         path: ${{ format('{0}/**/node_modules', inputs.working-directory) }}
         key: yarn-v1-${{ runner.os }}-${{ steps.get-node.outputs.version }}-${{ hashFiles(format('{0}/**/yarn.lock', inputs.working-directory)) }}
+    - name: Ensure Lage cache directory exists
+      run: mkdir -p ${{ format('{0}/.lage', inputs.working-directory) }}
+      shell: bash
+    - name: Cache Lage
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ${{ format('{0}/.lage', inputs.working-directory) }}
+        key: lage-${{ runner.os }}-${{ github.sha }}
+        restore-keys: |
+          lage-${{ runner.os }}-
     - name: Install
       working-directory: ${{ inputs.working-directory }}
       run: yarn --immutable
       shell: bash
       if: steps.cache.outputs.cache-hit != 'true'
     - name: Download translations
-      uses: actions/checkout@v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         repository: actualbudget/translations
         path: ${{ inputs.working-directory }}/packages/desktop-client/locale

.github/scripts/count-points.mjs

@@ -4,43 +4,32 @@ import pLimit from 'p-limit';
 
 const limit = pLimit(50);
 
-/** Repository-specific configuration for points calculation */
-const REPOSITORY_CONFIG = new Map([
-  [
-    'actual',
-    {
-      POINTS_PER_ISSUE_TRIAGE_ACTION: 1,
-      POINTS_PER_ISSUE_CLOSING_ACTION: 1,
-      POINTS_PER_RELEASE_PR: 0,
-      PR_REVIEW_POINT_TIERS: [
-        { minChanges: 500, points: 8 },
-        { minChanges: 100, points: 6 },
-        { minChanges: 10, points: 2 },
-        { minChanges: 0, points: 1 },
-      ],
-      EXCLUDED_FILES: [
-        'yarn.lock',
-        '.yarn/**/*',
-        'packages/component-library/src/icons/**/*',
-        'release-notes/**/*',
-      ],
-    },
+const CONFIG = {
+  POINTS_PER_ISSUE_TRIAGE_ACTION: 1,
+  POINTS_PER_ISSUE_CLOSING_ACTION: 1,
+  POINTS_PER_RELEASE_PR: 4, // Awarded to whoever merges the release PR
+  // Point tiers for code changes (non-docs)
+  CODE_PR_REVIEW_POINT_TIERS: [
+    { minChanges: 500, points: 8 },
+    { minChanges: 100, points: 6 },
+    { minChanges: 10, points: 2 },
+    { minChanges: 0, points: 1 },
   ],
-  [
-    'docs',
-    {
-      POINTS_PER_ISSUE_TRIAGE_ACTION: 1,
-      POINTS_PER_ISSUE_CLOSING_ACTION: 1,
-      POINTS_PER_RELEASE_PR: 4,
-      PR_REVIEW_POINT_TIERS: [
-        { minChanges: 2000, points: 6 },
-        { minChanges: 200, points: 4 },
-        { minChanges: 0, points: 2 },
-      ],
-      EXCLUDED_FILES: ['yarn.lock', '.yarn/**/*'],
-    },
+  // Point tiers for docs changes (packages/docs/**)
+  DOCS_PR_REVIEW_POINT_TIERS: [
+    { minChanges: 2000, points: 6 },
+    { minChanges: 200, points: 4 },
+    { minChanges: 0, points: 2 },
   ],
-]);
+  EXCLUDED_FILES: [
+    'yarn.lock',
+    '.yarn/**/*',
+    'packages/component-library/src/icons/**/*',
+    'release-notes/**/*',
+    'upcoming-release-notes/**/*',
+  ],
+  DOCS_FILES_PATTERN: 'packages/docs/**/*',
+};
 
 /**
  * Get the start and end dates for the last month.
@@ -76,15 +65,14 @@ function getLastMonthDates() {
 /**
  * Used for calculating the monthly points each core contributor has earned.
  * These are used for payouts depending.
- * @param {string} repo - The repository to analyze ('actual' or 'docs')
- * @returns {number} The total points earned for the repository
+ * @returns {Map} A map of contributor logins to their total points earned
  */
-async function countContributorPoints(repo) {
+async function countContributorPoints() {
   const octokit = new Octokit({
     auth: process.env.GITHUB_TOKEN,
   });
   const owner = 'actualbudget';
-  const config = REPOSITORY_CONFIG.get(repo);
+  const repo = 'actual';
 
   const { since, until } = getLastMonthDates();
 
@@ -99,7 +87,8 @@ async function countContributorPoints(repo) {
     Array.from(orgMemberLogins).map(login => [
       login,
       {
-        reviews: [], // Will store objects with PR number and points
+        codeReviews: [], // Will store objects with PR number and points for main repo changes
+        docsReviews: [], // Will store objects with PR number and points for docs changes
         labelRemovals: [],
         issueClosings: [],
         points: 0,
@@ -156,48 +145,91 @@ async function countContributorPoints(repo) {
           ),
         ]);
 
-        const totalChanges = modifiedFiles
-          .filter(
-            file =>
-              !config.EXCLUDED_FILES.some(pattern =>
-                minimatch(file.filename, pattern),
-              ),
-          )
-          .reduce((sum, file) => sum + file.additions + file.deletions, 0);
+        const filteredFiles = modifiedFiles.filter(
+          file =>
+            !CONFIG.EXCLUDED_FILES.some(pattern =>
+              minimatch(file.filename, pattern, { dot: true }),
+            ),
+        );
+
+        const docsFiles = filteredFiles.filter(file =>
+          minimatch(file.filename, CONFIG.DOCS_FILES_PATTERN, { dot: true }),
+        );
+        const codeFiles = filteredFiles.filter(
+          file =>
+            !minimatch(file.filename, CONFIG.DOCS_FILES_PATTERN, { dot: true }),
+        );
+
+        const docsChanges = docsFiles.reduce(
+          (sum, file) => sum + file.additions + file.deletions,
+          0,
+        );
+        const codeChanges = codeFiles.reduce(
+          (sum, file) => sum + file.additions + file.deletions,
+          0,
+        );
+
+        const docsPoints =
+          docsChanges > 0
+            ? (CONFIG.DOCS_PR_REVIEW_POINT_TIERS.find(
+                t => docsChanges >= t.minChanges,
+              )?.points ?? 0)
+            : 0;
+        const codePoints =
+          codeChanges > 0 || docsChanges === 0
+            ? (CONFIG.CODE_PR_REVIEW_POINT_TIERS.find(
+                t => codeChanges >= t.minChanges,
+              )?.points ?? 0)
+            : 0;
 
         const isReleasePR = pr.title.match(/🔖.*\d+\.\d+\.\d+/);
-        const prPoints =
-          config.PR_REVIEW_POINT_TIERS.find(t => totalChanges >= t.minChanges)
-            ?.points ?? 0;
 
         if (isReleasePR) {
-          if (stats.has(pr.user.login)) {
-            const creatorStats = stats.get(pr.user.login);
-            creatorStats.reviews.push({
+          // release PRs are created by the github-actions bot so we attribute points to the merger
+          const { data: prDetails } = await octokit.pulls.get({
+            owner,
+            repo,
+            pull_number: pr.number,
+          });
+
+          if (prDetails.merged_by && stats.has(prDetails.merged_by.login)) {
+            const mergerStats = stats.get(prDetails.merged_by.login);
+            mergerStats.codeReviews.push({
               pr: pr.number.toString(),
-              points: config.POINTS_PER_RELEASE_PR,
-              isReleaseCreator: true,
+              points: CONFIG.POINTS_PER_RELEASE_PR,
+              isReleaseMerger: true,
             });
-            creatorStats.points += config.POINTS_PER_RELEASE_PR;
+            mergerStats.points += CONFIG.POINTS_PER_RELEASE_PR;
           }
         } else {
           const uniqueReviewers = new Set();
-          reviews.data
-            .filter(
-              review =>
-                stats.has(review.user?.login) &&
-                review.state === 'APPROVED' &&
-                !uniqueReviewers.has(review.user?.login),
-            )
-            .forEach(({ user: { login: reviewer } }) => {
+          reviews.data.forEach(review => {
+            if (
+              review.state === 'APPROVED' &&
+              stats.has(review.user?.login) &&
+              !uniqueReviewers.has(review.user?.login)
+            ) {
+              const reviewer = review.user.login;
               uniqueReviewers.add(reviewer);
               const userStats = stats.get(reviewer);
-              userStats.reviews.push({
-                pr: pr.number.toString(),
-                points: prPoints,
-              });
-              userStats.points += prPoints;
-            });
+
+              if (docsPoints > 0) {
+                userStats.docsReviews.push({
+                  pr: pr.number.toString(),
+                  points: docsPoints,
+                });
+                userStats.points += docsPoints;
+              }
+
+              if (codePoints > 0) {
+                userStats.codeReviews.push({
+                  pr: pr.number.toString(),
+                  points: codePoints,
+                });
+                userStats.points += codePoints;
+              }
+            }
+          });
         }
       }),
     ),
@@ -241,7 +273,7 @@ async function countContributorPoints(repo) {
               const remover = event.actor.login;
               const userStats = stats.get(remover);
               userStats.labelRemovals.push(issue.number.toString());
-              userStats.points += config.POINTS_PER_ISSUE_TRIAGE_ACTION;
+              userStats.points += CONFIG.POINTS_PER_ISSUE_TRIAGE_ACTION;
             }
 
             if (
@@ -251,7 +283,7 @@ async function countContributorPoints(repo) {
               const closer = event.actor.login;
               const userStats = stats.get(closer);
               userStats.issueClosings.push(issue.number.toString());
-              userStats.points += config.POINTS_PER_ISSUE_CLOSING_ACTION;
+              userStats.points += CONFIG.POINTS_PER_ISSUE_CLOSING_ACTION;
             }
           });
       }),
@@ -260,27 +292,39 @@ async function countContributorPoints(repo) {
 
   // Print all statistics
   printStats(
-    `PR Review Statistics (${repo})`,
-    stats => stats.reviews.length,
+    'Code Review Statistics',
+    stats => stats.codeReviews.length,
     (user, count) =>
       `${user}: ${count} (PRs: ${stats
         .get(user)
-        .reviews.map(r => {
-          if (r.isReleaseCreator) {
-            return `#${r.pr} (${r.points}pts - Release Creator)`;
+        .codeReviews.map(r => {
+          if (r.isReleaseMerger) {
+            return `#${r.pr} (${r.points}pts - Release Merger)`;
           }
           return `#${r.pr} (${r.points}pts)`;
         })
         .join(', ')})`,
   );
+
   printStats(
-    `"Needs Triage" Label Removal Statistics (${repo})`,
+    'Docs Review Statistics',
+    stats => stats.docsReviews.length,
+    (user, count) =>
+      `${user}: ${count} (PRs: ${stats
+        .get(user)
+        .docsReviews.map(r => `#${r.pr} (${r.points}pts)`)
+        .join(', ')})`,
+  );
+
+  printStats(
+    '"Needs Triage" Label Removal Statistics',
     stats => stats.labelRemovals.length,
     (user, count) =>
       `${user}: ${count} (Issues: ${stats.get(user).labelRemovals.join(', ')})`,
   );
+
   printStats(
-    `Issue Closing Statistics (${repo})`,
+    'Issue Closing Statistics',
     stats => stats.issueClosings.length,
     (user, count) =>
       `${user}: ${count} (Issues: ${stats.get(user).issueClosings.join(', ')})`,
@@ -288,7 +332,7 @@ async function countContributorPoints(repo) {
 
   // Print points summary
   printStats(
-    `Points Summary (${repo})`,
+    'Points Summary',
     stats => stats.points,
     (user, userPoints) => `${user}: ${userPoints}`,
   );
@@ -298,7 +342,7 @@ async function countContributorPoints(repo) {
     (sum, userStats) => sum + userStats.points,
     0,
   );
-  console.log(`\nTotal points earned for ${repo}: ${totalPoints}`);
+  console.log(`\nTotal points earned: ${totalPoints}`);
 
   // Return the points
   return new Map(
@@ -309,55 +353,5 @@ async function countContributorPoints(repo) {
   );
 }
 
-/**
- * Calculate the points for both repositories and print cumulative results
- */
-async function calculateCumulativePoints() {
-  // Get stats for each repository
-  const repoPointsResults = await Promise.all(
-    Array.from(REPOSITORY_CONFIG.keys()).map(countContributorPoints),
-  );
-
-  // Calculate cumulative stats
-  const cumulativeStats = new Map(repoPointsResults[0]);
-
-  // Combine stats from all repositories
-  for (let i = 1; i < repoPointsResults.length; i++) {
-    for (const [login, points] of repoPointsResults[i].entries()) {
-      if (!cumulativeStats.has(login)) {
-        cumulativeStats.set(login, 0);
-      }
-
-      cumulativeStats.set(login, cumulativeStats.get(login) + points);
-    }
-  }
-
-  // Print cumulative statistics
-  console.log('\n\nCUMULATIVE STATISTICS ACROSS ALL REPOSITORIES');
-  console.log('='.repeat(50));
-
-  console.log('\nCumulative Points Summary:');
-  console.log('='.repeat('Cumulative Points Summary'.length + 1));
-
-  const entries = Array.from(cumulativeStats.entries())
-    .filter(([, count]) => count > 0)
-    .sort((a, b) => b[1] - a[1]);
-
-  if (entries.length === 0) {
-    console.log('No cumulative points summary found.');
-  } else {
-    entries.forEach(([user, points]) => {
-      console.log(`${user}: ${points}`);
-    });
-  }
-
-  // Calculate and print total cumulative points
-  const totalCumulativePoints = Array.from(cumulativeStats.values()).reduce(
-    (sum, points) => sum + points,
-    0,
-  );
-  console.log('\nTotal cumulative points earned: ' + totalCumulativePoints);
-}
-
 // Run the calculations
-calculateCumulativePoints().catch(console.error);
+countContributorPoints().catch(console.error);

.github/workflows/ai-generated-release-notes.yml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
 

.github/workflows/autofix.yml

@@ -15,7 +15,7 @@ jobs:
   autofix:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
       - name: Format code

.github/workflows/build.yml

@@ -12,6 +12,7 @@ on:
     branches:
       - master
   pull_request:
+  merge_group:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -21,31 +22,42 @@ jobs:
   api:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
+        with:
+          download-translations: 'false'
       - name: Build API
         run: cd packages/api && yarn build
       - name: Create package tgz
         run: cd packages/api && yarn pack && mv package.tgz actual-api.tgz
+      - name: Prepare bundle stats artifact
+        run: cp packages/api/app/stats.json api-stats.json
       - name: Upload Build
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: actual-api
           path: packages/api/actual-api.tgz
+      - name: Upload API bundle stats
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: api-build-stats
+          path: api-stats.json
 
   crdt:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
+        with:
+          download-translations: 'false'
       - name: Build CRDT
         run: cd packages/crdt && yarn build
       - name: Create package tgz
         run: cd packages/crdt && yarn pack && mv package.tgz actual-crdt.tgz
       - name: Upload Build
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: actual-crdt
           path: packages/crdt/actual-crdt.tgz
@@ -53,18 +65,18 @@ jobs:
   web:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
       - name: Build Web
         run: yarn build:browser
       - name: Upload Build
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: actual-web
           path: packages/desktop-client/build
       - name: Upload Build Stats
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: build-stats
           path: packages/desktop-client/build-stats
@@ -72,13 +84,15 @@ jobs:
   server:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
+        with:
+          download-translations: 'false'
       - name: Build Server
         run: yarn workspace @actual-app/sync-server build
       - name: Upload Build
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: sync-server
           path: packages/sync-server/build

.github/workflows/check.yml

@@ -5,6 +5,7 @@ on:
     branches:
       - master
   pull_request:
+  merge_group:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -14,25 +15,31 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
+        with:
+          download-translations: 'false'
       - name: Lint
         run: yarn lint
   typecheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
+        with:
+          download-translations: 'false'
       - name: Typecheck
         run: yarn typecheck
   validate-cli:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
+        with:
+          download-translations: 'false'
       - name: Build Web
         run: yarn build:server
       - name: Check that the built CLI works
@@ -40,9 +47,11 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
+        with:
+          download-translations: 'false'
       - name: Test
         run: yarn test
 
@@ -50,9 +59,9 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
-          node-version: 20
+          node-version: 22
       - name: Check migrations
         run: node ./.github/actions/check-migrations.js

.github/workflows/codeql.yml

@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3

.github/workflows/count-points.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
       - name: Count points

.github/workflows/docker-edge.yml

@@ -1,21 +1,16 @@
 name: Build Edge Docker Image
 
-# Edge Docker images are built for every commit, and daily
+# Edge Docker images are built for every push to master
 on:
   push:
     branches:
       - master
-    paths:
-      - 'packages/sync-server/**'
-  pull_request:
-    branches:
-      - master
-    paths:
-      - 'packages/sync-server/**'
-  schedule:
-    - cron: '0 0 * * *'
   workflow_dispatch:
 
+concurrency:
+  group: docker-edge-build
+  cancel-in-progress: true
+
 permissions:
   contents: read
   packages: write
@@ -41,17 +36,17 @@ jobs:
       matrix:
         os: [ubuntu, alpine]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
         with:
           # Push to both Docker Hub and Github Container Registry
           images: ${{ env.IMAGES }}
@@ -59,14 +54,14 @@ jobs:
           tags: ${{ env.TAGS }}
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         if: github.event_name != 'pull_request' && !github.event.repository.fork
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         if: github.event_name != 'pull_request'
         with:
           registry: ghcr.io
@@ -81,7 +76,7 @@ jobs:
         run: yarn build:server
 
       - name: Build image for testing
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
           push: false
@@ -98,7 +93,7 @@ jobs:
       # This will use the cache from the earlier build step and not rebuild the image
       # https://docs.docker.com/build/ci/github-actions/test-before-push/
       - name: Build and push images
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/docker-release.yml

@@ -28,17 +28,17 @@ jobs:
     name: Build Docker image
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
         with:
           # Push to both Docker Hub and Github Container Registry
           images: ${{ env.IMAGES }}
@@ -48,7 +48,7 @@ jobs:
 
       - name: Docker meta for Alpine image
         id: alpine-meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
         with:
           images: ${{ env.IMAGES }}
           # Automatically update :latest
@@ -58,13 +58,13 @@ jobs:
           tags: ${{ env.TAGS }}
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -78,7 +78,7 @@ jobs:
         run: yarn build:server
 
       - name: Build and push ubuntu image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
           push: true
@@ -87,7 +87,7 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
 
       - name: Build and push alpine image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
           push: true

.github/workflows/docs-spelling.yml

@@ -0,0 +1,164 @@
+name: Check Spelling (Docs)
+
+# Comment management is handled through a secondary job, for details see:
+# https://github.com/check-spelling/check-spelling/wiki/Feature%3A-Restricted-Permissions
+#
+# `jobs.comment-push` runs when a push is made to a repository and the `jobs.spelling` job needs to make a comment
+#   (in odd cases, it might actually run just to collapse a comment, but that's fairly rare)
+#   it needs `contents: write` in order to add a comment.
+#
+# `jobs.comment-pr` runs when a pull_request is made to a repository and the `jobs.spelling` job needs to make a comment
+#   or collapse a comment (in the case where it had previously made a comment and now no longer needs to show a comment)
+#   it needs `pull-requests: write` in order to manipulate those comments.
+
+# Updating pull request branches is managed via comment handling.
+# For details, see: https://github.com/check-spelling/check-spelling/wiki/Feature:-Update-expect-list
+#
+# These elements work together to make it happen:
+#
+# `on.issue_comment`
+#   This event listens to comments by users asking to update the metadata.
+#
+# `jobs.update`
+#   This job runs in response to an issue_comment and will push a new commit
+#   to update the spelling metadata.
+#
+# `with.experimental_apply_changes_via_bot`
+#   Tells the action to support and generate messages that enable it
+#   to make a commit to update the spelling metadata.
+#
+# `with.ssh_key`
+#   In order to trigger workflows when the commit is made, you can provide a
+#   secret (typically, a write-enabled github deploy key).
+#
+#   For background, see: https://github.com/check-spelling/check-spelling/wiki/Feature:-Update-with-deploy-key
+
+on:
+  push:
+    branches:
+      - '**'
+    tags-ignore:
+      - '**'
+    paths:
+      - 'packages/docs/**'
+      - '.github/workflows/docs-spelling.yml'
+      - '.github/actions/docs-spelling/**'
+  pull_request_target:
+    branches:
+      - '**'
+    tags-ignore:
+      - '**'
+    paths:
+      - 'packages/docs/**'
+      - '.github/workflows/docs-spelling.yml'
+      - '.github/actions/docs-spelling/**'
+    types:
+      - 'opened'
+      - 'reopened'
+      - 'synchronize'
+  issue_comment:
+    types:
+      - 'created'
+
+jobs:
+  spelling:
+    name: Check Spelling
+    permissions:
+      contents: read
+      pull-requests: read
+      actions: read
+      security-events: write
+    outputs:
+      followup: ${{ steps.spelling.outputs.followup }}
+    runs-on: ubuntu-latest
+    if: "contains(github.event_name, 'pull_request') || github.event_name == 'push'"
+    concurrency:
+      group: spelling-${{ github.event.pull_request.number || github.ref }}
+      # note: If you use only_check_changed_files, you do not want cancel-in-progress
+      cancel-in-progress: true
+    steps:
+      - name: check-spelling
+        id: spelling
+        uses: check-spelling/check-spelling@main
+        with:
+          suppress_push_for_open_pull_request: 1
+          checkout: true
+          check_file_names: 1
+          spell_check_this: check-spelling/spell-check-this@prerelease
+          post_comment: 0
+          use_magic_file: 1
+          experimental_apply_changes_via_bot: 1
+          use_sarif: 1
+          extra_dictionary_limit: 12
+          check_extra_dictionaries: ''
+          extra_dictionaries: cspell:cpp/src/cpp.txt
+            cspell:software-terms/src/software-terms.txt
+            cspell:python/src/python/python-lib.txt
+            cspell:node/node.txt
+            cspell:filetypes/filetypes.txt
+            cspell:aws/aws.txt
+            cspell:typescript/dict/typescript.txt
+            cspell:npm/dict/npm.txt
+            cspell:fullstack/dict/fullstack.txt
+            cspell:html/dict/html.txt
+            cspell:css/dict/css.txt
+          config: .github/actions/docs-spelling
+
+  comment-push:
+    name: Report (Push)
+    # If your workflow isn't running on push, you can remove this job
+    runs-on: ubuntu-latest
+    needs: spelling
+    permissions:
+      contents: write
+    if: (success() || failure()) && needs.spelling.outputs.followup && github.event_name == 'push'
+    steps:
+      - name: comment
+        uses: check-spelling/check-spelling@main
+        with:
+          checkout: true
+          spell_check_this: check-spelling/spell-check-this@prerelease
+          task: ${{ needs.spelling.outputs.followup }}
+          config: .github/actions/docs-spelling
+
+  comment-pr:
+    name: Report (PR)
+    # If you workflow isn't running on pull_request*, you can remove this job
+    runs-on: ubuntu-latest
+    needs: spelling
+    permissions:
+      pull-requests: write
+    if: (success() || failure()) && needs.spelling.outputs.followup && contains(github.event_name, 'pull_request')
+    steps:
+      - name: comment
+        uses: check-spelling/check-spelling@main
+        with:
+          checkout: true
+          spell_check_this: check-spelling/spell-check-this@prerelease
+          task: ${{ needs.spelling.outputs.followup }}
+          experimental_apply_changes_via_bot: 1
+          config: .github/actions/docs-spelling
+
+  update:
+    name: Update PR
+    permissions:
+      contents: write
+      pull-requests: write
+      actions: read
+    runs-on: ubuntu-latest
+    if: ${{
+      github.event_name == 'issue_comment' &&
+      github.event.issue.pull_request &&
+      contains(github.event.comment.body, '@check-spelling-bot apply')
+      }}
+    concurrency:
+      group: spelling-update-${{ github.event.issue.number }}
+      cancel-in-progress: false
+    steps:
+      - name: apply spelling updates
+        uses: check-spelling/check-spelling@main
+        with:
+          experimental_apply_changes_via_bot: 1
+          checkout: true
+          ssh_key: '${{ secrets.CHECK_SPELLING }}'
+          config: .github/actions/docs-spelling

.github/workflows/e2e-test.yml

@@ -17,7 +17,7 @@ jobs:
     outputs:
       netlify_url: ${{ steps.netlify.outputs.url }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
       - name: Wait for Netlify build to finish
@@ -32,16 +32,18 @@ jobs:
     needs: netlify
     runs-on: ubuntu-latest
     container:
-      image: mcr.microsoft.com/playwright:v1.52.0-jammy
+      image: mcr.microsoft.com/playwright:v1.56.0-jammy
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
+      - name: Trust the repository directory
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: Run E2E Tests on Netlify URL
         run: yarn e2e
         env:
           E2E_START_URL: ${{ needs.netlify.outputs.netlify_url }}
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         if: always()
         with:
           name: desktop-client-test-results
@@ -53,15 +55,17 @@ jobs:
     name: Functional Desktop App
     runs-on: ubuntu-latest
     container:
-      image: mcr.microsoft.com/playwright:v1.52.0-jammy
+      image: mcr.microsoft.com/playwright:v1.56.0-jammy
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
+      - name: Trust the repository directory
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: Run Desktop app E2E Tests
         run: |
           xvfb-run --auto-servernum --server-args="-screen 0 1920x1080x24" -- yarn e2e:desktop
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         if: always()
         with:
           name: desktop-app-test-results
@@ -74,16 +78,16 @@ jobs:
     needs: netlify
     runs-on: ubuntu-latest
     container:
-      image: mcr.microsoft.com/playwright:v1.52.0-jammy
+      image: mcr.microsoft.com/playwright:v1.56.0-jammy
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up environment
         uses: ./.github/actions/setup
       - name: Run VRT Tests on Netlify URL
         run: yarn vrt
         env:
           E2E_START_URL: ${{ needs.netlify.outputs.netlify_url }}
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         if: always()
         with:
           name: desktop-client-test-results

.github/workflows/electron-master.yml

@@ -29,7 +29,7 @@ jobs:
           - macos-latest
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - if: ${{ startsWith(matrix.os, 'windows') }}
         run: pip.exe install setuptools
       - if: ${{ ! startsWith(matrix.os, 'windows') }}
@@ -44,9 +44,9 @@ jobs:
           sudo apt-get install flatpak -y
           sudo apt-get install flatpak-builder -y
           sudo flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
-          sudo flatpak install org.freedesktop.Sdk/x86_64/23.08 -y
-          sudo flatpak install org.freedesktop.Platform/x86_64/23.08 -y
-          sudo flatpak install org.electronjs.Electron2.BaseApp/x86_64/23.08 -y
+          sudo flatpak install org.freedesktop.Sdk//24.08 -y
+          sudo flatpak install org.freedesktop.Platform//24.08 -y
+          sudo flatpak install org.electronjs.Electron2.BaseApp//24.08 -y
       - name: Set up environment
         uses: ./.github/actions/setup
       - name: Build Electron for Mac
@@ -57,11 +57,12 @@ jobs:
           CSC_LINK: ${{ secrets.CSC_LINK }}
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
       - name: Build Electron
         if: ${{ ! startsWith(matrix.os, 'macos') }}
         run: ./bin/package-electron
       - name: Upload Build
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: actual-electron-${{ matrix.os }}
           path: |
@@ -72,7 +73,7 @@ jobs:
             packages/desktop-electron/dist/*.flatpak
       - name: Upload Windows Store Build
         if: ${{ startsWith(matrix.os, 'windows') }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: actual-electron-${{ matrix.os }}-appx
           path: |
@@ -82,7 +83,7 @@ jobs:
         run: |
           echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
       - name: Add to new release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@5be0e66d93ac7ed76da52eca8bb058f665c3a5fe # v2.4.2
         with:
           draft: true
           body: |
@@ -112,7 +113,7 @@ jobs:
           Install-Module -Name StoreBroker -AcceptLicense -Force -Scope CurrentUser -Verbose
 
       - name: Download Microsoft Store artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           name: actual-electron-windows-latest-appx
 

.github/workflows/electron-pr.yml

@@ -24,7 +24,7 @@ jobs:
           - macos-latest
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - if: ${{ startsWith(matrix.os, 'windows') }}
         run: pip.exe install setuptools
       - if: ${{ ! startsWith(matrix.os, 'windows') }}
@@ -39,26 +39,73 @@ jobs:
           sudo apt-get install flatpak -y
           sudo apt-get install flatpak-builder -y
           sudo flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
-          sudo flatpak install org.freedesktop.Sdk/x86_64/23.08 -y
-          sudo flatpak install org.freedesktop.Platform/x86_64/23.08 -y
-          sudo flatpak install org.electronjs.Electron2.BaseApp/x86_64/23.08 -y
+          sudo flatpak install org.freedesktop.Sdk//24.08 -y
+          sudo flatpak install org.freedesktop.Platform//24.08 -y
+          sudo flatpak install org.electronjs.Electron2.BaseApp//24.08 -y
       - name: Set up environment
         uses: ./.github/actions/setup
       - name: Build Electron
         run: ./bin/package-electron
-      - name: Upload Build
-        uses: actions/upload-artifact@v4
+
+      - name: Upload Linux x64 AppImage
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
-          name: actual-electron-${{ matrix.os }}
-          path: |
-            packages/desktop-electron/dist/*.dmg
-            packages/desktop-electron/dist/*.exe
-            !packages/desktop-electron/dist/Actual-windows.exe
-            packages/desktop-electron/dist/*.AppImage
-            packages/desktop-electron/dist/*.flatpak
+          name: Actual-linux-x86_64.AppImage
+          if-no-files-found: ignore
+          path: packages/desktop-electron/dist/Actual-linux-x86_64.AppImage
+
+      - name: Upload Linux arm64 AppImage
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: Actual-linux-arm64.AppImage
+          if-no-files-found: ignore
+          path: packages/desktop-electron/dist/Actual-linux-arm64.AppImage
+
+      - name: Upload Linux x64 flatpak
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: Actual-linux-x86_64.flatpak
+          if-no-files-found: ignore
+          path: packages/desktop-electron/dist/Actual-linux-x86_64.flatpak
+
+      - name: Upload Windows x32 exe
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: Actual-windows-ia32.exe
+          if-no-files-found: ignore
+          path: packages/desktop-electron/dist/Actual-windows-ia32.exe
+
+      - name: Upload Windows x64 exe
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: Actual-windows-x64.exe
+          if-no-files-found: ignore
+          path: packages/desktop-electron/dist/Actual-windows-x64.exe
+
+      - name: Upload Windows arm64 exe
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: Actual-windows-arm64.exe
+          if-no-files-found: ignore
+          path: packages/desktop-electron/dist/Actual-windows-arm64.exe
+
+      - name: Upload Mac x64 dmg
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: Actual-mac-x64.dmg
+          if-no-files-found: ignore
+          path: packages/desktop-electron/dist/Actual-mac-x64.dmg
+
+      - name: Upload Mac arm64 dmg
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: Actual-mac-arm64.dmg
+          if-no-files-found: ignore
+          path: packages/desktop-electron/dist/Actual-mac-arm64.dmg
+
       - name: Upload Windows Store Build
         if: ${{ startsWith(matrix.os, 'windows') }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: actual-electron-${{ matrix.os }}-appx
           path: |

.github/workflows/generate-release-pr.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ github.event.inputs.ref }}
       - name: Bump package versions
@@ -48,7 +48,7 @@ jobs:
 
           echo "version=$NEW_WEB_VERSION" >> "$GITHUB_OUTPUT"
       - name: Create PR
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
         with:
           commit-message: '🔖 (${{ steps.bump_package_versions.outputs.version }})'
           title: '🔖 (${{ steps.bump_package_versions.outputs.version }})'

.github/workflows/i18n-string-extract-master.yml

@@ -12,7 +12,7 @@ jobs:
     if: github.repository == 'actualbudget/actual'
     steps:
       - name: Check out main repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           path: actual
       - name: Set up environment
@@ -44,7 +44,7 @@ jobs:
             push \
             actualbudget/actual
       - name: Check out updated translations
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ssh-key: ${{ secrets.STRING_IMPORT_DEPLOY_KEY }}
           repository: actualbudget/translations

.github/workflows/issues-close-feature-requests.yml

@@ -9,16 +9,17 @@ jobs:
     if: ${{ github.event.label.name == 'feature' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions-ecosystem/action-add-labels@v1
+      - uses: actions-ecosystem/action-add-labels@bd52874380e3909a1ac983768df6976535ece7f8 # v1.1.0
         with:
           labels: needs votes
+          github_token: ${{ secrets.GITHUB_TOKEN }}
       - name: Add reactions
-        uses: aidan-mundy/react-to-issue@v1.1.1
+        uses: aidan-mundy/react-to-issue@109392cac5159c2df6c47c8ab3b5d6b708852fe5 # v1.1.2
         with:
           issue-number: ${{ github.event.issue.number }}
           reactions: '+1'
       - name: Create comment
-        uses: peter-evans/create-or-update-comment@v3
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
         with:
           issue-number: ${{ github.event.issue.number }}
           body: |

.github/workflows/issues-feature-implemented.yml

@@ -24,10 +24,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # This is not a security concern because we have approved & merged the PR
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
-          node-version: 20
+          node-version: 22
       - name: Handle feature requests
         run: node .github/actions/handle-feature-requests.js
         env:

.github/workflows/issues-remove-help-wanted.yml

@@ -9,6 +9,6 @@ jobs:
     if: ${{ !contains(github.event.issue.labels.*.name, 'feature') && contains(github.event.issue.labels.*.name, 'help wanted') }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions-ecosystem/action-remove-labels@v1
+      - uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0 # v1.3.0
         with:
           labels: help wanted

.github/workflows/netlify-release.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Repository Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Set up environment
         uses: ./.github/actions/setup

.github/workflows/publish-nightly-electron.yml

@@ -0,0 +1,131 @@
+name: Publish nightly desktop app
+
+# Publish nightly version of desktop app - Runs every day at midnight
+on:
+  schedule:
+    - cron: '0 0 * * *'
+  workflow_dispatch:
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  CI: true
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    strategy:
+      matrix:
+        os:
+          - ubuntu-22.04
+          - windows-latest
+          - macos-latest
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - if: ${{ startsWith(matrix.os, 'windows') }}
+        run: pip.exe install setuptools
+
+      - if: ${{ ! startsWith(matrix.os, 'windows') }}
+        run: |
+          mkdir .venv
+          python3 -m venv .venv
+          source .venv/bin/activate
+          python3 -m pip install setuptools
+
+      - if: ${{ startsWith(matrix.os, 'ubuntu') }}
+        run: |
+          sudo apt-get update
+          sudo apt-get install flatpak -y
+          sudo apt-get install flatpak-builder -y
+          sudo flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
+          sudo flatpak install org.freedesktop.Sdk//24.08 -y
+          sudo flatpak install org.freedesktop.Platform//24.08 -y
+          sudo flatpak install org.electronjs.Electron2.BaseApp//24.08 -y
+
+      - name: Set up environment
+        uses: ./.github/actions/setup
+
+      - name: Update package versions
+        run: |
+          # Get new nightly version
+          NEW_DESKTOP_APP_VERSION=$(node ./packages/ci-actions/bin/get-next-package-version.js --package-json ./packages/desktop-electron/package.json --type nightly)
+
+          # Set package version
+          npm version $NEW_DESKTOP_APP_VERSION --no-git-tag-version --workspace=desktop-electron --no-workspaces-update
+
+      - name: Build Electron for Mac
+        if: ${{ startsWith(matrix.os, 'macos') }}
+        run: ./bin/package-electron
+        env:
+          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+          CSC_LINK: ${{ secrets.CSC_LINK }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+
+      - name: Build Electron
+        if: ${{ ! startsWith(matrix.os, 'macos') }}
+        run: ./bin/package-electron
+
+      - name: Upload Linux x64 AppImage
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: Actual-linux-x86_64.AppImage
+          if-no-files-found: ignore
+          path: packages/desktop-electron/dist/Actual-linux-x86_64.AppImage
+
+      - name: Upload Linux arm64 AppImage
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: Actual-linux-arm64.AppImage
+          if-no-files-found: ignore
+          path: packages/desktop-electron/dist/Actual-linux-arm64.AppImage
+
+      - name: Upload Windows x32 exe
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: Actual-windows-ia32.exe
+          if-no-files-found: ignore
+          path: packages/desktop-electron/dist/Actual-windows-ia32.exe
+
+      - name: Upload Windows x64 exe
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: Actual-windows-x64.exe
+          if-no-files-found: ignore
+          path: packages/desktop-electron/dist/Actual-windows-x64.exe
+
+      - name: Upload Windows arm64 exe
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: Actual-windows-arm64.exe
+          if-no-files-found: ignore
+          path: packages/desktop-electron/dist/Actual-windows-arm64.exe
+
+      - name: Upload Mac x64 dmg
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: Actual-mac-x64.dmg
+          if-no-files-found: ignore
+          path: packages/desktop-electron/dist/Actual-mac-x64.dmg
+
+      - name: Upload Mac arm64 dmg
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: Actual-mac-arm64.dmg
+          if-no-files-found: ignore
+          path: packages/desktop-electron/dist/Actual-mac-arm64.dmg
+
+      - name: Upload Windows Store Build
+        if: ${{ startsWith(matrix.os, 'windows') }}
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: actual-electron-${{ matrix.os }}-appx
+          path: |
+            packages/desktop-electron/dist/*.appx

.github/workflows/publish-nightly-npm-packages.yml

@@ -12,7 +12,7 @@ jobs:
     name: Build and pack npm packages
     if: github.event.repository.fork == false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Set up environment
         uses: ./.github/actions/setup
@@ -49,7 +49,7 @@ jobs:
           yarn workspace @actual-app/api pack --filename @actual-app/api.tgz
 
       - name: Upload package artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: npm-packages
           path: |
@@ -66,14 +66,14 @@ jobs:
       packages: write
     steps:
       - name: Download the artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           name: npm-packages
 
       - name: Setup node and npm registry
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
-          node-version: 20
+          node-version: 22
           registry-url: 'https://registry.npmjs.org'
 
       - name: Publish Web

.github/workflows/publish-npm-packages.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Build and pack npm packages
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Set up environment
         uses: ./.github/actions/setup
@@ -32,7 +32,7 @@ jobs:
           yarn workspace @actual-app/api pack --filename @actual-app/api.tgz
 
       - name: Upload package artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: npm-packages
           path: |
@@ -49,14 +49,14 @@ jobs:
       packages: write
     steps:
       - name: Download the artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           name: npm-packages
 
       - name: Setup node and npm registry
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
-          node-version: 20
+          node-version: 22
           registry-url: 'https://registry.npmjs.org'
 
       - name: Publish Web

.github/workflows/release-notes.yml

@@ -12,10 +12,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-      - name: Check release notes
-        if: startsWith(github.head_ref, 'release/') == false
-        uses: actualbudget/actions/release-notes/check@main
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+      - name: Get changed files
+        id: changed-files
+        run: |
+          git fetch origin ${{ github.base_ref }}
+          CHANGED_FILES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD)
+          NON_DOCS_FILES=$(echo "$CHANGED_FILES" | grep -v -e "^packages/docs/" -e "^\.github/actions/docs-spelling/" || true)
+
+          if [ -z "$NON_DOCS_FILES" ] && [ -n "$CHANGED_FILES" ]; then
+            echo "only_docs=true" >> $GITHUB_OUTPUT
+            echo "only documentation files changed, skipping release notes check"
+          else
+            echo "only_docs=false" >> $GITHUB_OUTPUT
+          fi
       - name: Generate release notes
-        if: startsWith(github.head_ref, 'release/') == true
         uses: actualbudget/actions/release-notes/generate@main

.github/workflows/size-compare.yml

@@ -26,64 +26,120 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write
+      contents: read
     steps:
-      - name: Wait for ${{github.base_ref}} build to succeed
-        uses: fountainhead/action-wait-for-check@v1.2.0
-        id: master-build
+      - name: Checkout base branch
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          ref: ${{ github.base_ref }}
+      - name: Set up environment
+        uses: ./.github/actions/setup
+        with:
+          download-translations: 'false'
+
+      - name: Wait for ${{github.base_ref}} web build to succeed
+        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
+        id: master-web-build
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           checkName: web
           ref: ${{github.base_ref}}
+      - name: Wait for ${{github.base_ref}} API build to succeed
+        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
+        id: master-api-build
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          checkName: api
+          ref: ${{github.base_ref}}
 
       - name: Wait for PR build to succeed
-        uses: fountainhead/action-wait-for-check@v1.2.0
-        id: wait-for-build
+        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
+        id: wait-for-web-build
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           checkName: web
           ref: ${{github.event.pull_request.head.sha}}
+      - name: Wait for API PR build to succeed
+        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
+        id: wait-for-api-build
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          checkName: api
+          ref: ${{github.event.pull_request.head.sha}}
 
       - name: Report build failure
-        if: steps.wait-for-build.outputs.conclusion == 'failure'
+        if: steps.wait-for-web-build.outputs.conclusion == 'failure' || steps.wait-for-api-build.outputs.conclusion == 'failure'
         run: |
           echo "Build failed on PR branch or ${{github.base_ref}}"
           exit 1
-      - name: Download build artifact from ${{github.base_ref}}
-        uses: dawidd6/action-download-artifact@v6
-        id: pr-build
+
+      - name: Download web build artifact from ${{github.base_ref}}
+        uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
+        id: pr-web-build
         with:
           branch: ${{github.base_ref}}
           workflow: build.yml
+          workflow_conclusion: '' # ignore the conclusion of the workflow, since we already checked it
           name: build-stats
           path: base
-
-      - name: Download build artifact from PR
-        uses: dawidd6/action-download-artifact@v6
+      - name: Download API build artifact from ${{github.base_ref}}
+        uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
+        id: pr-api-build
+        with:
+          branch: ${{github.base_ref}}
+          workflow: build.yml
+          workflow_conclusion: '' # ignore the conclusion of the workflow, since we already checked it
+          name: api-build-stats
+          path: base
+      - name: Download build stats from PR
+        uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
         with:
           pr: ${{github.event.pull_request.number}}
           workflow: build.yml
+          workflow_conclusion: '' # ignore the conclusion of the workflow, since we already checked it
           name: build-stats
           path: head
           allow_forks: true
-
+      - name: Download API stats from PR
+        uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
+        with:
+          pr: ${{github.event.pull_request.number}}
+          workflow: build.yml
+          workflow_conclusion: '' # ignore the conclusion of the workflow, since we already checked it
+          name: api-build-stats
+          path: head
+          allow_forks: true
       - name: Strip content hashes from stats files
         run: |
-          sed -i -E 's/index\.[0-9a-zA-Z_-]{8,}\./index./g' ./head/web-stats.json
-          sed -i -E 's/\.[0-9a-zA-Z_-]{8,}\.chunk\././g' ./head/web-stats.json
-          sed -i -E 's/\.[0-9a-f]{8,}\././g' ./head/*.json
-          sed -i -E 's/index\.[0-9a-zA-Z_-]{8,}\./index./g' ./base/web-stats.json
-          sed -i -E 's/\.[0-9a-zA-Z_-]{8,}\.chunk\././g' ./base/web-stats.json
-          sed -i -E 's/\.[0-9a-f]{8,}\././g' ./base/*.json
-      - uses: twk3/rollup-size-compare-action@v1.1.1
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          current-stats-json-path: ./head/web-stats.json
-          base-stats-json-path: ./base/web-stats.json
-          title: desktop-client
-
-      - uses: twk3/rollup-size-compare-action@v1.1.1
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          current-stats-json-path: ./head/loot-core-stats.json
-          base-stats-json-path: ./base/loot-core-stats.json
-          title: loot-core
+          if [ -f ./head/web-stats.json ]; then
+            sed -i -E 's/index\.[0-9a-zA-Z_-]{8,}\./index./g' ./head/web-stats.json
+            sed -i -E 's/\.[0-9a-zA-Z_-]{8,}\.chunk\././g' ./head/web-stats.json
+          fi
+          if [ -f ./base/web-stats.json ]; then
+            sed -i -E 's/index\.[0-9a-zA-Z_-]{8,}\./index./g' ./base/web-stats.json
+            sed -i -E 's/\.[0-9a-zA-Z_-]{8,}\.chunk\././g' ./base/web-stats.json
+          fi
+          for file in ./head/*.json ./base/*.json; do
+            if [ -f "$file" ]; then
+              sed -i -E 's/\.[0-9a-f]{8,}\././g' "$file"
+            fi
+          done
+      - name: Generate combined bundle stats comment
+        run: |
+          node packages/ci-actions/bin/bundle-stats-comment.mjs \
+            --base desktop-client=./base/web-stats.json \
+            --base loot-core=./base/loot-core-stats.json \
+            --base api=./base/api-stats.json \
+            --head desktop-client=./head/web-stats.json \
+            --head loot-core=./head/loot-core-stats.json \
+            --head api=./head/api-stats.json \
+            --identifier combined > bundle-stats-comment.md
+      - name: Post combined bundle stats comment
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          node packages/ci-actions/bin/update-bundle-stats-comment.mjs \
+            --comment-file bundle-stats-comment.md \
+            --identifier '<!--- bundlestats-action-comment key:combined --->'

.github/workflows/stale.yml

@@ -8,7 +8,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
         with:
           stale-pr-message: 'This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.'
           close-pr-message: 'This PR was closed because it has been stalled for 5 days with no activity.'
@@ -18,7 +18,7 @@ jobs:
   stale-wip:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
         with:
           stale-pr-message: ':wave: Hi! It looks like this PR has not had any changes for a week now. Would you like someone to review this PR? If so - please remove the "[WIP]" prefix from the PR title. That will let the community know that this PR is open for a review.'
           days-before-stale: 7
@@ -29,7 +29,7 @@ jobs:
   stale-needs-info:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
         with:
           stale-issue-label: 'needs info'
           days-before-stale: -1

.github/workflows/update-vrt.yml

@@ -1,119 +0,0 @@
-name: /update-vrt
-on:
-  issue_comment:
-    types: [created]
-
-permissions:
-  pull-requests: read
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.issue.number }}-${{ contains(github.event.comment.body, '/update-vrt') }}
-  cancel-in-progress: true
-
-jobs:
-  update-vrt:
-    name: Update VRT
-    runs-on: ubuntu-latest
-    if: |
-      github.event.issue.pull_request &&
-      contains(github.event.comment.body, '/update-vrt')
-    container:
-      image: mcr.microsoft.com/playwright:v1.52.0-jammy
-    steps:
-      - name: Get PR branch
-        #        Until https://github.com/xt0rted/pull-request-comment-branch/issues/322 is resolved we use the forked version
-        uses: gotson/pull-request-comment-branch@head-repo-owner-dist
-        id: comment-branch
-      - uses: actions/checkout@v4
-        with:
-          repository: ${{ steps.comment-branch.outputs.head_owner }}/${{ steps.comment-branch.outputs.head_repo }}
-          ref: ${{ steps.comment-branch.outputs.head_ref }}
-      - name: Set up environment
-        uses: ./.github/actions/setup
-      - name: Run VRT Tests on Desktop app
-        continue-on-error: true
-        run: |
-          xvfb-run --auto-servernum --server-args="-screen 0 1920x1080x24" -- yarn e2e:desktop --update-snapshots
-      - name: Wait for Netlify build to finish
-        id: netlify
-        env:
-          COMMIT_SHA: ${{ steps.comment-branch.outputs.head_sha }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: ./.github/actions/netlify-wait-for-build
-      - name: Run VRT Tests on Netlify URL
-        run: yarn vrt --update-snapshots
-        env:
-          E2E_START_URL: ${{ steps.netlify.outputs.url }}
-      - name: Create patch
-        run: |
-          git config --system --add safe.directory "*"
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "github-actions[bot]@users.noreply.github.com"
-          git reset
-          git add "**/*.png"
-          if git diff --staged --quiet; then
-            echo "No changes to commit"
-            exit 0
-          fi
-          git commit -m "Update VRT"
-          git format-patch -1 HEAD --stdout > Update-VRT.patch
-      - uses: actions/upload-artifact@v4
-        with:
-          name: patch
-          path: Update-VRT.patch
-
-  push-patch:
-    runs-on: ubuntu-latest
-    needs: update-vrt
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - name: Get PR branch
-        #        Until https://github.com/xt0rted/pull-request-comment-branch/issues/322 is resolved we use the forked version
-        uses: gotson/pull-request-comment-branch@head-repo-owner-dist
-        id: comment-branch
-      - uses: actions/checkout@v4
-        with:
-          repository: ${{ steps.comment-branch.outputs.head_owner }}/${{ steps.comment-branch.outputs.head_repo }}
-          ref: ${{ steps.comment-branch.outputs.head_ref }}
-      - uses: actions/download-artifact@v4
-        continue-on-error: true
-        with:
-          name: patch
-      - name: Apply patch and push
-        env:
-          BRANCH_NAME: ${{ steps.comment-branch.outputs.head_ref }}
-        run: |
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "github-actions[bot]@users.noreply.github.com"
-          git apply Update-VRT.patch
-          git add "**/*.png"
-          if git diff --staged --quiet; then
-            echo "No changes to commit"
-            exit 0
-          fi
-          git commit -m "Update VRT"
-          git push origin HEAD:${BRANCH_NAME}
-      - name: Add finished reaction
-        uses: dkershner6/reaction-action@v2
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          commentId: ${{ github.event.comment.id }}
-          reaction: 'rocket'
-
-  add-starting-reaction:
-    runs-on: ubuntu-latest
-    if: |
-      github.event.issue.pull_request &&
-      contains(github.event.comment.body, '/update-vrt')
-    permissions:
-      pull-requests: write
-    steps:
-      - name: React to comment
-        uses: dkershner6/reaction-action@v2
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          commentId: ${{ github.event.comment.id }}
-          reaction: '+1'

.github/workflows/vrt-update-apply.yml

@@ -0,0 +1,151 @@
+name: VRT Update - Apply
+# SECURITY: This workflow runs in trusted base repo context.
+# It treats the patch artifact as untrusted data, validates it contains only PNGs,
+# and safely applies it to the contributor's fork branch.
+on:
+  workflow_run:
+    workflows: ['VRT Update - Generate']
+    types:
+      - completed
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  apply-vrt-updates:
+    name: Apply VRT Updates
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    steps:
+      - name: Download patch artifact
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id }}
+          pattern: vrt-patch-*
+          path: /tmp/artifacts
+
+      - name: Download metadata artifact
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id }}
+          pattern: vrt-metadata-*
+          path: /tmp/metadata
+
+      - name: Extract metadata
+        id: metadata
+        run: |
+          if [ ! -f "/tmp/metadata/pr-number.txt" ]; then
+            echo "No metadata found, skipping..."
+            exit 0
+          fi
+
+          PR_NUMBER=$(cat "/tmp/metadata/pr-number.txt")
+          HEAD_REF=$(cat "/tmp/metadata/head-ref.txt")
+          HEAD_REPO=$(cat "/tmp/metadata/head-repo.txt")
+
+          echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
+          echo "head_ref=$HEAD_REF" >> "$GITHUB_OUTPUT"
+          echo "head_repo=$HEAD_REPO" >> "$GITHUB_OUTPUT"
+
+          echo "Found PR #$PR_NUMBER: $HEAD_REPO @ $HEAD_REF"
+
+      - name: Checkout fork branch
+        if: steps.metadata.outputs.pr_number != ''
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          repository: ${{ steps.metadata.outputs.head_repo }}
+          ref: ${{ steps.metadata.outputs.head_ref }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
+
+      - name: Validate and apply patch
+        if: steps.metadata.outputs.pr_number != ''
+        id: apply
+        run: |
+          PATCH_FILE="/tmp/artifacts/vrt-update.patch"
+
+          if [ ! -f "$PATCH_FILE" ]; then
+            echo "No patch file found"
+            exit 0
+          fi
+
+          echo "Found patch file: $PATCH_FILE"
+
+          # Validate patch only contains PNG files
+          echo "Validating patch contains only PNG files..."
+          if grep -E '^(\+\+\+|---) [ab]/' "$PATCH_FILE" | grep -v '\.png$'; then
+            echo "ERROR: Patch contains non-PNG files! Rejecting for security."
+            echo "applied=false" >> "$GITHUB_OUTPUT"
+            echo "error=Patch validation failed: contains non-PNG files" >> "$GITHUB_OUTPUT"
+            exit 1
+          fi
+
+          # Extract file list for verification
+          FILES_CHANGED=$(grep -E '^\+\+\+ b/' "$PATCH_FILE" | sed 's/^+++ b\///' | wc -l)
+          echo "Patch modifies $FILES_CHANGED PNG file(s)"
+
+          # Configure git
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+
+          # Apply patch
+          echo "Applying patch..."
+          if git apply --check "$PATCH_FILE" 2>&1; then
+            git apply "$PATCH_FILE"
+
+            # Stage only PNG files (extra safety)
+            git add "**/*.png"
+
+            if git diff --staged --quiet; then
+              echo "No changes after applying patch"
+              echo "applied=false" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+
+            # Commit
+            git commit -m "Update VRT screenshots" -m "Auto-generated by VRT workflow" -m "PR: #${{ steps.metadata.outputs.pr_number }}"
+
+            echo "applied=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "Patch could not be applied cleanly"
+            echo "applied=false" >> "$GITHUB_OUTPUT"
+            echo "error=Patch conflicts with current branch state" >> "$GITHUB_OUTPUT"
+            exit 1
+          fi
+
+      - name: Push changes
+        if: steps.apply.outputs.applied == 'true'
+        env:
+          HEAD_REF: ${{ steps.metadata.outputs.head_ref }}
+          HEAD_REPO: ${{ steps.metadata.outputs.head_repo }}
+        run: |
+          git push origin "HEAD:refs/heads/$HEAD_REF"
+          echo "Successfully pushed VRT updates to $HEAD_REPO@$HEAD_REF"
+
+      - name: Comment on PR - Success
+        if: steps.apply.outputs.applied == 'true'
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            await github.rest.issues.createComment({
+              issue_number: ${{ steps.metadata.outputs.pr_number }},
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: '✅ VRT screenshots have been automatically updated.'
+            });
+
+      - name: Comment on PR - Failure
+        if: failure() && steps.metadata.outputs.pr_number != ''
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const error = `${{ steps.apply.outputs.error }}` || 'Unknown error occurred';
+            await github.rest.issues.createComment({
+              issue_number: ${{ steps.metadata.outputs.pr_number }},
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: `❌ Failed to apply VRT updates: ${error}\n\nPlease check the workflow logs for details.`
+            });

.github/workflows/vrt-update-generate.yml

@@ -0,0 +1,105 @@
+name: VRT Update - Generate
+# SECURITY: This workflow runs in untrusted fork context with no write permissions.
+# It only generates VRT patch artifacts that are later applied by vrt-update-apply.yml
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    paths:
+      - 'packages/**'
+      - '.github/workflows/vrt-update-generate.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  generate-vrt-updates:
+    name: Generate VRT Updates
+    runs-on: ubuntu-latest
+    container:
+      image: mcr.microsoft.com/playwright:v1.56.0-jammy
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Set up environment
+        uses: ./.github/actions/setup
+
+      - name: Run VRT Tests on Desktop app
+        continue-on-error: true
+        run: |
+          xvfb-run --auto-servernum --server-args="-screen 0 1920x1080x24" -- yarn e2e:desktop --update-snapshots
+
+      - name: Wait for Netlify build to finish
+        id: netlify
+        env:
+          COMMIT_SHA: ${{ github.event.pull_request.head.sha }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ./.github/actions/netlify-wait-for-build
+
+      - name: Run VRT Tests on Netlify URL
+        continue-on-error: true
+        run: yarn vrt --update-snapshots
+        env:
+          E2E_START_URL: ${{ steps.netlify.outputs.url }}
+
+      - name: Create patch with PNG changes only
+        id: create-patch
+        run: |
+          # Trust the repository directory (required for container environments)
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+
+          # Stage only PNG files
+          git add "**/*.png"
+
+          # Check if there are any changes
+          if git diff --staged --quiet; then
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+            echo "No VRT changes to commit"
+            exit 0
+          fi
+
+          echo "has_changes=true" >> "$GITHUB_OUTPUT"
+
+          # Create commit and patch
+          git commit -m "Update VRT screenshots"
+          git format-patch -1 HEAD --stdout > vrt-update.patch
+
+          # Validate patch only contains PNG files
+          if grep -E '^(\+\+\+|---) [ab]/' vrt-update.patch | grep -v '\.png$'; then
+            echo "ERROR: Patch contains non-PNG files!"
+            exit 1
+          fi
+
+          echo "Patch created successfully with PNG changes only"
+
+      - name: Upload patch artifact
+        if: steps.create-patch.outputs.has_changes == 'true'
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: vrt-patch-${{ github.event.pull_request.number }}
+          path: vrt-update.patch
+          retention-days: 5
+
+      - name: Save PR metadata
+        if: steps.create-patch.outputs.has_changes == 'true'
+        run: |
+          mkdir -p pr-metadata
+          echo "${{ github.event.pull_request.number }}" > pr-metadata/pr-number.txt
+          echo "${{ github.event.pull_request.head.ref }}" > pr-metadata/head-ref.txt
+          echo "${{ github.event.pull_request.head.repo.full_name }}" > pr-metadata/head-repo.txt
+
+      - name: Upload PR metadata
+        if: steps.create-patch.outputs.has_changes == 'true'
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: vrt-metadata-${{ github.event.pull_request.number }}
+          path: pr-metadata/
+          retention-days: 5

.gitignore

@@ -7,9 +7,6 @@ Actual-*
 **/xcuserdata/*
 export-2020-01-10.csv
 
-# Secrets
-.secret-tokens
-
 # MacOS
 .DS_Store
 
@@ -26,6 +23,8 @@ packages/desktop-electron/build
 packages/desktop-electron/.electron-symbols
 packages/desktop-electron/dist
 packages/desktop-electron/loot-core
+packages/desktop-client/service-worker
+packages/plugins-service/dist
 bundle.desktop.js
 bundle.desktop.js.map
 bundle.mobile.js
@@ -63,3 +62,6 @@ build/
 
 # .d.ts files aren't type-checked with skipLibCheck set to true
 *.d.ts
+
+# Lage cache
+.lage/

.nvmrc

@@ -1 +1 @@
-v20/*
+v22/*

.prettierignore

@@ -10,6 +10,7 @@ packages/desktop-client/bundle.browser.js
 packages/desktop-client/stats.json
 packages/desktop-client/.swc/
 packages/desktop-client/build/
+packages/desktop-client/dev-dist/
 packages/desktop-client/locale/
 packages/desktop-client/build-electron/
 packages/desktop-client/build-stats/
@@ -26,5 +27,10 @@ packages/loot-core/**/node_modules/*
 packages/loot-core/**/lib-dist/*
 packages/loot-core/**/proto/*
 packages/sync-server/coverage/
+packages/sync-server/user-files/
+packages/sync-server/server-files/
 .yarn/*
 upcoming-release-notes/*
+
+# temporary
+packages/docs/*

.secret-tokens.example

@@ -1,2 +0,0 @@
-export APPLE_ID=example@email.com
-export APPLE_APP_SPECIFIC_PASSWORD=password

.yarnrc.yml

@@ -6,4 +6,4 @@ enableTransparentWorkspaces: false
 
 nodeLinker: node-modules
 
-yarnPath: .yarn/releases/yarn-4.9.1.cjs
+yarnPath: .yarn/releases/yarn-4.10.3.cjs

AGENTS.md

@@ -0,0 +1,585 @@
+# AGENTS.md - Guide for AI Agents Working with Actual Budget
+
+This guide provides comprehensive information for AI agents (like Cursor) working with the Actual Budget codebase.
+
+## Project Overview
+
+**Actual Budget** is a local-first personal finance tool written in TypeScript/JavaScript. It's 100% free and open-source with synchronization capabilities across devices.
+
+- **Repository**: https://github.com/actualbudget/actual
+- **Community Docs**: https://github.com/actualbudget/actual/tree/master/packages/docs or https://actualbudget.org/docs
+- **License**: MIT
+- **Primary Language**: TypeScript (with React)
+- **Build System**: Yarn 4 workspaces (monorepo)
+
+## Quick Start Commands
+
+### Essential Commands (Run from Root)
+
+```bash
+# Type checking (ALWAYS run before committing)
+yarn typecheck
+
+# Linting and formatting (with auto-fix)
+yarn lint:fix
+
+# Run all tests
+yarn test
+
+# Start development server (browser)
+yarn start
+
+# Start with sync server
+yarn start:server-dev
+
+# Start desktop app development
+yarn start:desktop
+```
+
+### Important Rules
+
+- **ALWAYS run yarn commands from the root directory** - never run them in child workspaces
+- Use `yarn workspace <workspace-name> run <command>` for workspace-specific tasks
+- Tests run once and exit by default (using `vitest --run`)
+
+### Task Orchestration with Lage
+
+The project uses **[lage](https://microsoft.github.io/lage/)** (a task runner for JavaScript monorepos) to efficiently run tests and other tasks across multiple workspaces:
+
+- **Parallel execution**: Runs tests in parallel across workspaces for faster feedback
+- **Smart caching**: Caches test results to skip unchanged packages (cached in `.lage/` directory)
+- **Dependency awareness**: Understands workspace dependencies and execution order
+- **Continues on error**: Uses `--continue` flag to run all packages even if one fails
+
+**Lage Commands:**
+
+```bash
+# Run all tests across all packages
+yarn test                    # Equivalent to: lage test --continue
+
+# Run tests without cache (for debugging/CI)
+yarn test:debug              # Equivalent to: lage test --no-cache --continue
+```
+
+Configuration is in `lage.config.js` at the project root.
+
+## Architecture & Package Structure
+
+### Core Packages
+
+#### 1. **loot-core** (`packages/loot-core/`)
+
+The core application logic that runs on any platform.
+
+- Business logic, database operations, and calculations
+- Platform-agnostic code
+- Exports for both browser and node environments
+- Test commands:
+
+  ```bash
+  # Run all loot-core tests
+  yarn workspace loot-core run test
+
+  # Or run tests across all packages using lage
+  yarn test
+  ```
+
+#### 2. **desktop-client** (`packages/desktop-client/` - aliased as `@actual-app/web`)
+
+The React-based UI for web and desktop.
+
+- React components using functional programming patterns
+- E2E tests using Playwright
+- Vite for bundling
+- Commands:
+
+  ```bash
+  # Development
+  yarn workspace @actual-app/web start:browser
+
+  # Build
+  yarn workspace @actual-app/web build
+
+  # E2E tests
+  yarn workspace @actual-app/web e2e
+
+  # Visual regression tests
+  yarn workspace @actual-app/web vrt
+  ```
+
+#### 3. **desktop-electron** (`packages/desktop-electron/`)
+
+Electron wrapper for the desktop application.
+
+- Window management and native OS integration
+- E2E tests for Electron-specific features
+
+#### 4. **api** (`packages/api/` - aliased as `@actual-app/api`)
+
+Public API for programmatic access to Actual.
+
+- Node.js API
+- Designed for integrations and automation
+- Commands:
+
+  ```bash
+  # Build
+  yarn workspace @actual-app/api build
+
+  # Run tests
+  yarn workspace @actual-app/api test
+
+  # Or use lage to run all tests
+  yarn test
+  ```
+
+#### 5. **sync-server** (`packages/sync-server/` - aliased as `@actual-app/sync-server`)
+
+Synchronization server for multi-device support.
+
+- Express-based server
+- Currently transitioning to TypeScript (mostly JavaScript)
+- Commands:
+  ```bash
+  yarn workspace @actual-app/sync-server start
+  ```
+
+#### 6. **component-library** (`packages/component-library/` - aliased as `@actual-app/components`)
+
+Reusable React UI components.
+
+- Shared components like Button, Input, Menu, etc.
+- Theme system and design tokens
+- Icons (375+ icons in SVG/TSX format)
+
+#### 7. **crdt** (`packages/crdt/` - aliased as `@actual-app/crdt`)
+
+CRDT (Conflict-free Replicated Data Type) implementation for data synchronization.
+
+- Protocol buffers for serialization
+- Core sync logic
+
+#### 8. **plugins-service** (`packages/plugins-service/`)
+
+Service for handling plugins/extensions.
+
+#### 9. **eslint-plugin-actual** (`packages/eslint-plugin-actual/`)
+
+Custom ESLint rules specific to Actual.
+
+- `no-untranslated-strings`: Enforces i18n usage
+- `prefer-trans-over-t`: Prefers Trans component over t() function
+- `prefer-logger-over-console`: Enforces using logger instead of console
+- `typography`: Typography rules
+- `prefer-if-statement`: Prefers explicit if statements
+
+## Development Workflow
+
+### 1. Making Changes
+
+When implementing changes:
+
+1. Read relevant files to understand current implementation
+2. Make focused, incremental changes
+3. Run type checking: `yarn typecheck`
+4. Run linting: `yarn lint:fix`
+5. Run relevant tests
+6. Fix any linter errors that are introduced
+
+### 2. Testing Strategy
+
+**Unit Tests (Vitest)**
+
+The project uses **lage** for running tests across all workspaces efficiently.
+
+```bash
+# Run all tests across all packages (using lage)
+yarn test
+
+# Run tests without cache (for debugging)
+yarn test:debug
+
+# Run tests for a specific package
+yarn workspace loot-core run test
+
+# Run a specific test file (watch mode)
+yarn workspace loot-core run test path/to/test.test.ts
+```
+
+**E2E Tests (Playwright)**
+
+```bash
+# Run E2E tests for web
+yarn e2e
+
+# Desktop Electron E2E (includes full build)
+yarn e2e:desktop
+
+# Visual regression tests
+yarn vrt
+
+# Visual regression in Docker (consistent environment)
+yarn vrt:docker
+
+# Run E2E tests for a specific package
+yarn workspace @actual-app/web e2e
+```
+
+**Testing Best Practices:**
+
+- Minimize mocked dependencies - prefer real implementations
+- Use descriptive test names
+- Vitest globals are available: `describe`, `it`, `expect`, `beforeEach`, etc.
+- For sync-server tests, globals are explicitly defined in config
+
+### 3. Type Checking
+
+TypeScript configuration uses:
+
+- Incremental compilation
+- Strict type checking with `typescript-strict-plugin`
+- Platform-specific exports in `loot-core` (node vs browser)
+
+Always run `yarn typecheck` before committing.
+
+### 4. Internationalization (i18n)
+
+- Use `Trans` component instead of `t()` function when possible
+- All user-facing strings must be translated
+- Generate i18n files: `yarn generate:i18n`
+- Custom ESLint rules enforce translation usage
+
+## Code Style & Conventions
+
+### TypeScript Guidelines
+
+**Type Usage:**
+
+- Use TypeScript for all code
+- Prefer `type` over `interface`
+- Avoid `enum` - use objects or maps
+- Avoid `any` or `unknown` unless absolutely necessary
+- Look for existing type definitions in the codebase
+- Avoid type assertions (`as`, `!`) - prefer `satisfies`
+- Use inline type imports: `import { type MyType } from '...'`
+
+**Naming:**
+
+- Use descriptive variable names with auxiliary verbs (e.g., `isLoaded`, `hasError`)
+- Named exports for components and utilities (avoid default exports except in specific cases)
+
+**Code Structure:**
+
+- Functional and declarative programming patterns - avoid classes
+- Use the `function` keyword for pure functions
+- Prefer iteration and modularization over code duplication
+- Structure files: exported component/page, helpers, static content, types
+- Create new components in their own files
+
+**React Patterns:**
+
+- Don't use `React.FunctionComponent` or `React.FC` - type props directly
+- Don't use `React.*` patterns - use named imports instead
+- Use `<Link>` instead of `<a>` tags
+- Use custom hooks from `src/hooks` (not react-router directly):
+  - `useNavigate()` from `src/hooks` (not react-router)
+  - `useDispatch()`, `useSelector()`, `useStore()` from `src/redux` (not react-redux)
+- Avoid unstable nested components
+- Use `satisfies` for type narrowing
+
+**JSX Style:**
+
+- Declarative JSX, minimal and readable
+- Avoid unnecessary curly braces in conditionals
+- Use concise syntax for simple statements
+- Prefer explicit expressions (`condition && <Component />`)
+
+### Import Organization
+
+Imports are automatically organized by ESLint with the following order:
+
+1. React imports (first)
+2. Built-in Node.js modules
+3. External packages
+4. Actual packages (`loot-core`, `@actual-app/components` - legacy pattern `loot-design` may appear in old code)
+5. Parent imports
+6. Sibling imports
+7. Index imports
+
+Always maintain newlines between import groups.
+
+### Platform-Specific Code
+
+- Don't directly reference platform-specific imports (`.api`, `.web`, `.electron`)
+- Use conditional exports in `loot-core` for platform-specific code
+- Platform resolution happens at build time via package.json exports
+
+### Restricted Patterns
+
+**Never:**
+
+- Use `console.*` (use logger instead - enforced by ESLint)
+- Import from `uuid` without destructuring: use `import { v4 as uuidv4 } from 'uuid'`
+- Import colors directly - use theme instead
+- Import `@actual-app/web/*` in `loot-core`
+
+**Git Commands:**
+
+- Never update git config
+- Never run destructive git operations (force push, hard reset) unless explicitly requested
+- Never skip hooks (--no-verify, --no-gpg-sign)
+- Never force push to main/master
+- Never commit unless explicitly asked
+
+## File Structure Patterns
+
+### Typical Component File
+
+```typescript
+import { type ComponentType } from 'react';
+// ... other imports
+
+type MyComponentProps = {
+  // Props definition
+};
+
+export function MyComponent({ prop1, prop2 }: MyComponentProps) {
+  // Component logic
+  return (
+    // JSX
+  );
+}
+```
+
+### Test File
+
+```typescript
+import { describe, it, expect, beforeEach } from 'vitest';
+// ... imports
+
+describe('ComponentName', () => {
+  it('should behave as expected', () => {
+    // Test logic
+    expect(result).toBe(expected);
+  });
+});
+```
+
+## Important Directories & Files
+
+### Configuration Files
+
+- `/package.json` - Root workspace configuration, scripts
+- `/lage.config.js` - Lage task runner configuration
+- `/eslint.config.mjs` - ESLint configuration (flat config format)
+- `/tsconfig.json` - Root TypeScript configuration
+- `/.cursorignore`, `/.gitignore` - Ignored files
+- `/yarn.lock` - Dependency lockfile (Yarn 4)
+
+### Documentation
+
+- `/README.md` - Project overview
+- `/CONTRIBUTING.md` - Points to community docs
+- `/upcoming-release-notes/` - Release notes for next version
+- `/CODEOWNERS` - Code ownership definitions
+
+### Build Artifacts (Don't Edit)
+
+- `packages/*/lib-dist/` - Built output
+- `packages/*/dist/` - Built output
+- `packages/*/build/` - Built output
+- `packages/desktop-client/playwright-report/` - Test reports
+- `packages/desktop-client/test-results/` - Test results
+- `.lage/` - Lage task runner cache (improves test performance)
+
+### Key Source Directories
+
+- `packages/loot-core/src/client/` - Client-side core logic
+- `packages/loot-core/src/server/` - Server-side core logic
+- `packages/loot-core/src/shared/` - Shared utilities
+- `packages/loot-core/src/types/` - Type definitions
+- `packages/desktop-client/src/components/` - React components
+- `packages/desktop-client/src/hooks/` - Custom React hooks
+- `packages/desktop-client/e2e/` - End-to-end tests
+- `packages/component-library/src/` - Reusable components
+- `packages/component-library/src/icons/` - Icon components (auto-generated, don't edit)
+
+## Common Development Tasks
+
+### Running Specific Tests
+
+```bash
+# Run all tests across all packages (recommended)
+yarn test
+
+# Unit test for a specific file in loot-core (watch mode)
+yarn workspace loot-core run test src/path/to/file.test.ts
+
+# E2E test for a specific file
+yarn workspace @actual-app/web run playwright test accounts.test.ts --browser=chromium
+```
+
+### Building for Production
+
+```bash
+# Browser build
+yarn build:browser
+
+# Desktop build
+yarn build:desktop
+
+# API build
+yarn build:api
+
+# Sync server build
+yarn build:server
+```
+
+### Type Checking Specific Packages
+
+TypeScript uses project references. Run `yarn typecheck` from root to check all packages.
+
+### Debugging Tests
+
+```bash
+# Run tests in debug mode (without parallelization)
+yarn test:debug
+
+# Run specific E2E test with headed browser
+yarn workspace @actual-app/web run playwright test --headed --debug accounts.test.ts
+```
+
+### Working with Icons
+
+Icons in `packages/component-library/src/icons/` are auto-generated. Don't manually edit them.
+
+## Troubleshooting
+
+### Type Errors
+
+1. Run `yarn typecheck` to see all type errors
+2. Check if types are imported correctly
+3. Look for existing type definitions in `packages/loot-core/src/types/`
+4. Use `satisfies` instead of `as` for type narrowing
+
+### Linter Errors
+
+1. Run `yarn lint:fix` to auto-fix many issues
+2. Check ESLint output for specific rule violations
+3. Custom rules:
+   - `actual/no-untranslated-strings` - Add i18n
+   - `actual/prefer-trans-over-t` - Use Trans component
+   - `actual/prefer-logger-over-console` - Use logger
+   - Check `eslint.config.mjs` for complete rules
+
+### Test Failures
+
+1. Check if test is running in correct environment (node vs web)
+2. For Vitest: check `vitest.config.ts` or `vitest.web.config.ts`
+3. For Playwright: check `playwright.config.ts`
+4. Ensure mock minimization - prefer real implementations
+5. **Lage cache issues**: Clear cache with `rm -rf .lage` if tests behave unexpectedly
+6. **Tests continue on error**: With `--continue` flag, all packages run even if one fails
+
+### Import Resolution Issues
+
+1. Check `tsconfig.json` for path mappings
+2. Check package.json `exports` field (especially for loot-core)
+3. Verify platform-specific imports (`.web`, `.electron`, `.api`)
+4. Use absolute imports in `desktop-client` (enforced by ESLint)
+
+### Build Failures
+
+1. Clean build artifacts: `rm -rf packages/*/dist packages/*/lib-dist packages/*/build`
+2. Reinstall dependencies: `yarn install`
+3. Check Node.js version (requires >=20)
+4. Check Yarn version (requires ^4.9.1)
+
+## Testing Patterns
+
+### Unit Tests
+
+- Located alongside source files or in `__tests__` directories
+- Use `.test.ts`, `.test.tsx`, `.spec.js` extensions
+- Vitest is the test runner
+- Minimize mocking - prefer real implementations
+
+### E2E Tests
+
+- Located in `packages/desktop-client/e2e/`
+- Use Playwright test runner
+- Visual regression snapshots in `*-snapshots/` directories
+- Page models in `e2e/page-models/` for reusable page interactions
+- Mobile tests have `.mobile.test.ts` suffix
+
+### Visual Regression Tests (VRT)
+
+- Snapshots stored per test file in `*-snapshots/` directories
+- Use Docker for consistent environment: `yarn vrt:docker`
+
+## Additional Resources
+
+- **Community Documentation**: https://actualbudget.org/docs/contributing/
+- **Discord Community**: https://discord.gg/pRYNYr4W5A
+- **GitHub Issues**: https://github.com/actualbudget/actual/issues
+- **Feature Requests**: Label "needs votes" sorted by reactions
+
+## Code Quality Checklist
+
+Before committing changes, ensure:
+
+- [ ] `yarn typecheck` passes
+- [ ] `yarn lint:fix` has been run
+- [ ] Relevant tests pass
+- [ ] No new console.\* usage (use logger)
+- [ ] User-facing strings are translated
+- [ ] Prefer `type` over `interface`
+- [ ] Named exports used (not default exports)
+- [ ] Imports are properly ordered
+- [ ] Platform-specific code uses proper exports
+- [ ] No unnecessary type assertions
+
+## Pull Request Guidelines
+
+When creating pull requests:
+
+- **AI-Generated PRs**: If you create a PR using AI assistance, add the **"AI generated"** label to the pull request. This helps maintainers understand the nature of the contribution.
+
+## Performance Considerations
+
+- **Bundle Size**: Check with rollup-plugin-visualizer
+- **Type Checking**: Uses incremental compilation
+- **Testing**: Tests run in parallel by default
+- **Linting**: ESLint caches results for faster subsequent runs
+
+## Workspace Commands Reference
+
+```bash
+# List all workspaces
+yarn workspaces list
+
+# Run command in specific workspace
+yarn workspace <workspace-name> run <command>
+
+# Run command in all workspaces
+yarn workspaces foreach --all run <command>
+
+# Install production dependencies only (for server deployment)
+yarn install:server
+```
+
+## Environment Requirements
+
+- **Node.js**: >=20
+- **Yarn**: ^4.9.1 (managed by packageManager field)
+- **Browser Targets**: Electron >= 35.0, modern browsers (see browserslist)
+
+## Migration Notes
+
+The codebase is actively being migrated:
+
+- **JavaScript → TypeScript**: sync-server is in progress
+- **Classes → Functions**: Prefer functional patterns
+- **React.\* → Named Imports**: Legacy React.\* patterns being removed
+
+When working with older code, follow the newer patterns described in this guide.

Dockerfile

@@ -5,7 +5,7 @@
 # you are doing.
 ###################################################
 
-FROM node:20-bullseye as dev
+FROM node:22-bookworm as dev
 RUN apt-get update -y && apt-get upgrade -y && apt-get install -y openssl
 WORKDIR /app
 CMD ["sh", "./bin/docker-start"]

bin/package-browser

@@ -16,6 +16,7 @@ packages/desktop-client/bin/remove-untranslated-languages
 
 export NODE_OPTIONS="--max-old-space-size=4096"
 
+yarn workspace plugins-service build
 yarn workspace loot-core build:browser
 yarn workspace @actual-app/web build:browser
 

bin/package-electron

@@ -41,6 +41,7 @@ packages/desktop-client/bin/remove-untranslated-languages
 
 export NODE_OPTIONS="--max-old-space-size=4096"
 
+yarn workspace plugins-service build
 yarn workspace loot-core build:node
 yarn workspace @actual-app/web build --mode=desktop # electron specific build
 
@@ -61,14 +62,11 @@ yarn workspace desktop-electron update-client
         echo "Skipping exe build"
     else
       if [ "$RELEASE" == "production" ]; then
-          if [ -f ../../.secret-tokens ]; then
-              source ../../.secret-tokens
-          fi
           yarn build
 
           echo "Created release"
       else
-          SKIP_NOTARIZATION=true yarn build
+          yarn build
       fi
     fi
 )

bin/run-vrt

@@ -28,5 +28,5 @@ echo "Running VRT tests with the following parameters:"
 echo "E2E_START_URL: $E2E_START_URL"
 echo "VRT_ARGS: $VRT_ARGS"
 
-MSYS_NO_PATHCONV=1 docker run --rm --network host -v "$(pwd)":/work/ -w /work/ -it mcr.microsoft.com/playwright:v1.52.0-jammy /bin/bash \
+MSYS_NO_PATHCONV=1 docker run --rm --network host -v "$(pwd)":/work/ -w /work/ -it mcr.microsoft.com/playwright:v1.56.0-jammy /bin/bash \
   -c "E2E_START_URL=$E2E_START_URL yarn vrt $VRT_ARGS"

eslint.config.mjs

@@ -1,14 +1,15 @@
-import globals from 'globals';
-
+import tsParser from '@typescript-eslint/parser';
+import { defineConfig } from 'eslint/config';
 import pluginImport from 'eslint-plugin-import';
 import pluginJSXA11y from 'eslint-plugin-jsx-a11y';
 import pluginReact from 'eslint-plugin-react';
 import pluginReactHooks from 'eslint-plugin-react-hooks';
-import pluginTypescript from 'typescript-eslint';
 import pluginTypescriptPaths from 'eslint-plugin-typescript-paths';
-import pluginActual from './packages/eslint-plugin-actual/lib/index.js';
+import globals from 'globals';
+import pluginTypescript from 'typescript-eslint';
 
-import tsParser from '@typescript-eslint/parser';
+// eslint-disable-next-line import/extensions
+import pluginActual from './packages/eslint-plugin-actual/lib/index.js';
 
 const confusingBrowserGlobals = [
   // https://github.com/facebook/create-react-app/tree/main/packages/confusing-browser-globals
@@ -71,35 +72,36 @@ const confusingBrowserGlobals = [
   'top',
 ];
 
-export default pluginTypescript.config(
+export default defineConfig(
   {
     ignores: [
+      //temporary
+      'packages/docs',
+
       'packages/api/app/bundle.api.js',
       'packages/api/app/stats.json',
-      'packages/api/dist',
       'packages/api/@types',
       'packages/api/migrations',
-      'packages/crdt/dist',
       'packages/component-library/src/icons/**/*',
       'packages/desktop-client/bundle.browser.js',
-      'packages/desktop-client/build/',
+      'packages/desktop-client/dev-dist/',
+      'packages/desktop-client/service-worker/*',
       'packages/desktop-client/build-electron/',
       'packages/desktop-client/build-stats/',
       'packages/desktop-client/public/kcab/',
       'packages/desktop-client/public/data/',
-      'packages/desktop-client/**/node_modules/*',
-      'packages/desktop-client/node_modules/',
       'packages/desktop-client/test-results/',
       'packages/desktop-client/playwright-report/',
       'packages/desktop-electron/client-build/',
-      'packages/desktop-electron/build/',
-      'packages/desktop-electron/dist/',
-      'packages/loot-core/**/node_modules/*',
       'packages/loot-core/**/lib-dist/*',
       'packages/loot-core/**/proto/*',
-      'packages/sync-server/build/',
+      'packages/sync-server/user-files/',
+      'packages/sync-server/server-files/',
       '.yarn/*',
       '.github/*',
+      '**/build/',
+      '**/dist/',
+      '**/node_modules/',
     ],
   },
   {
@@ -161,7 +163,7 @@ export default pluginTypescript.config(
     },
   },
   {
-    files: ['**/*.{js,ts,jsx,tsx}'],
+    files: ['**/*.{js,ts,jsx,tsx,mjs,mts}'],
     plugins: {
       'jsx-a11y': pluginJSXA11y,
       'react-hooks': pluginReactHooks,
@@ -445,7 +447,7 @@ export default pluginTypescript.config(
       'react-hooks/exhaustive-deps': [
         'warn',
         {
-          additionalHooks: '(useQuery)',
+          additionalHooks: '(useQuery|useEffectAfterMount)',
         },
       ],
 
@@ -662,7 +664,7 @@ export default pluginTypescript.config(
         'warn',
         {
           types: {
-            // forbid FC as superflous
+            // forbid FC as superfluous
             FunctionComponent: {
               message:
                 'Type the props argument and let TS infer or use ComponentType for a component prop',
@@ -707,14 +709,18 @@ export default pluginTypescript.config(
 
   // Allow configuring vitest with default exports (recommended as per vitest docs)
   {
-    files: ['**/vitest.config.ts', '**/vitest.web.config.ts'],
+    files: [
+      '**/vitest.config.{ts,mts}',
+      '**/vitest.web.config.ts',
+      '**/vite.config.{ts,mts}',
+      'eslint.config.mjs',
+    ],
     rules: {
       'import/no-anonymous-default-export': 'off',
       'import/no-default-export': 'off',
     },
   },
 
-  {},
   {
     // TODO: fix the issues in these files
     files: [

lage.config.js

@@ -0,0 +1,30 @@
+/** @type {import('lage').ConfigOptions} */
+module.exports = {
+  pipeline: {
+    test: {
+      type: 'npmScript',
+      options: {
+        outputGlob: [
+          'coverage/**',
+          '**/test-results/**',
+          '**/playwright-report/**',
+        ],
+      },
+    },
+    build: {
+      type: 'npmScript',
+      cache: true,
+      options: {
+        outputGlob: ['lib-dist/**', 'dist/**', 'build/**'],
+      },
+    },
+  },
+  cacheOptions: {
+    cacheStorageConfig: {
+      provider: 'local',
+      outputGlob: ['lib-dist/**', 'dist/**', 'build/**'],
+    },
+  },
+  npmClient: 'yarn',
+  concurrency: 2,
+};

package.json

@@ -23,28 +23,33 @@
     "start:server-monitor": "yarn workspace @actual-app/sync-server start-monitor",
     "start:server-dev": "NODE_ENV=development BROWSER_OPEN=localhost:5006 yarn npm-run-all --parallel 'start:server-monitor' 'start'",
     "start:desktop": "yarn desktop-dependencies && npm-run-all --parallel 'start:desktop-*'",
-    "desktop-dependencies": "yarn rebuild-electron && yarn workspace loot-core build:browser",
+    "start:docs": "yarn workspace docs start",
+    "desktop-dependencies": "npm-run-all --parallel rebuild-electron build:browser-backend build:plugins-service",
     "start:desktop-node": "yarn workspace loot-core watch:node",
     "start:desktop-client": "yarn workspace @actual-app/web watch",
     "start:desktop-server-client": "yarn workspace @actual-app/web build:browser",
     "start:desktop-electron": "yarn workspace desktop-electron watch",
-    "start:browser": "npm-run-all --parallel 'start:browser-*'",
+    "start:browser": "yarn workspace plugins-service build-dev && npm-run-all --parallel 'start:browser-*'",
+    "start:service-plugins": "yarn workspace plugins-service watch",
     "start:browser-backend": "yarn workspace loot-core watch:browser",
     "start:browser-frontend": "yarn workspace @actual-app/web start:browser",
+    "build:browser-backend": "yarn workspace loot-core build:browser",
     "build:server": "yarn build:browser && yarn workspace @actual-app/sync-server build",
     "build:browser": "./bin/package-browser",
     "build:desktop": "./bin/package-electron",
+    "build:plugins-service": "yarn workspace plugins-service build",
     "build:api": "yarn workspace @actual-app/api build",
+    "build:docs": "yarn workspace docs build",
     "generate:i18n": "yarn workspace @actual-app/web generate:i18n",
     "generate:release-notes": "ts-node ./bin/release-note-generator.ts",
-    "test": "yarn workspaces foreach --all --parallel --verbose run test",
-    "test:debug": "yarn workspaces foreach --all --verbose run test",
-    "e2e": "yarn workspaces foreach --all --exclude desktop-electron --parallel --verbose run e2e",
+    "test": "lage test --continue",
+    "test:debug": "lage test --no-cache --continue",
+    "e2e": "yarn workspace @actual-app/web run e2e",
     "e2e:desktop": "yarn build:desktop --skip-exe-build && yarn workspace desktop-electron e2e",
     "playwright": "yarn workspace @actual-app/web run playwright",
-    "vrt": "yarn workspaces foreach --all --parallel --verbose run vrt",
+    "vrt": "yarn workspace @actual-app/web run vrt",
     "vrt:docker": "./bin/run-vrt",
-    "rebuild-electron": "./node_modules/.bin/electron-rebuild -f -m ./packages/loot-core",
+    "rebuild-electron": "./node_modules/.bin/electron-rebuild -m ./packages/loot-core",
     "rebuild-node": "yarn workspace loot-core rebuild",
     "lint": "prettier --check . && eslint . --max-warnings 0",
     "lint:fix": "prettier --check --write . && eslint . --max-warnings 0 --fix",
@@ -54,33 +59,34 @@
     "prepare": "husky"
   },
   "devDependencies": {
-    "@octokit/rest": "^22.0.0",
-    "@types/node": "^22.17.0",
+    "@octokit/rest": "^22.0.1",
+    "@types/node": "^22.19.1",
     "@types/prompts": "^2.4.9",
-    "@typescript-eslint/parser": "^8.42.0",
-    "cross-env": "^7.0.3",
-    "eslint": "^9.34.0",
-    "eslint-config-prettier": "^10.1.5",
-    "eslint-import-resolver-typescript": "^4.3.5",
-    "eslint-plugin-import": "^2.31.0",
+    "@typescript-eslint/parser": "^8.46.4",
+    "cross-env": "^10.1.0",
+    "eslint": "^9.39.1",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-import-resolver-typescript": "^4.4.4",
+    "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-jsx-a11y": "^6.10.2",
     "eslint-plugin-react": "^7.37.5",
-    "eslint-plugin-react-hooks": "^6.0.0-rc.2",
+    "eslint-plugin-react-hooks": "^7.0.1",
     "eslint-plugin-typescript-paths": "^0.0.33",
-    "globals": "^15.15.0",
+    "globals": "^16.5.0",
     "html-to-image": "^1.11.13",
     "husky": "^9.1.7",
-    "lint-staged": "^15.5.2",
-    "minimatch": "^10.0.3",
-    "node-jq": "^6.0.1",
+    "lage": "^2.14.15",
+    "lint-staged": "^16.2.6",
+    "minimatch": "^10.1.1",
+    "node-jq": "^6.3.1",
     "npm-run-all": "^4.1.5",
-    "p-limit": "^6.2.0",
-    "prettier": "^3.5.3",
+    "p-limit": "^7.2.0",
+    "prettier": "^3.6.2",
     "prompts": "^2.4.2",
     "source-map-support": "^0.5.21",
     "ts-node": "^10.9.2",
-    "typescript": "^5.9.2",
-    "typescript-eslint": "^8.42.0",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.46.4",
     "typescript-strict-plugin": "^2.4.4"
   },
   "resolutions": {
@@ -88,7 +94,7 @@
     "socks": ">=2.8.3"
   },
   "engines": {
-    "node": ">=20",
+    "node": ">=22",
     "yarn": "^4.9.1"
   },
   "lint-staged": {
@@ -97,7 +103,7 @@
       "prettier --write"
     ]
   },
-  "packageManager": "yarn@4.9.1",
+  "packageManager": "yarn@4.10.3",
   "browserslist": [
     "electron >= 35.0",
     "defaults"

packages/api/methods.test.ts

@@ -1,7 +1,8 @@
-// @ts-strict-ignore
 import * as fs from 'fs/promises';
 import * as path from 'path';
 
+import { type RuleEntity } from 'loot-core/types/models';
+
 import * as api from './index';
 
 const budgetName = 'test-budget';
@@ -282,7 +283,7 @@ describe('API CRUD operations', () => {
     expect(await api.getAccountBalance(accountId2)).toEqual(0);
 
     await api.updateAccount(accountId1, { offbudget: false });
-    await api.closeAccount(accountId1, accountId2, null);
+    await api.closeAccount(accountId1, accountId2);
     await api.deleteAccount(accountId2);
 
     // accounts successfully updated, and one of them deleted
@@ -505,7 +506,7 @@ describe('API CRUD operations', () => {
       ...rule,
       stage: 'post',
       conditionsOp: 'or',
-    };
+    } satisfies RuleEntity;
     expect(await api.updateRule(updatedRule)).toEqual(updatedRule);
 
     expect(await api.getRules()).toEqual(
@@ -719,7 +720,7 @@ describe('API CRUD operations', () => {
 
     // Test without notes
     const transactionsWithoutNotes = [
-      { date: '2023-11-03', imported_id: '11', amount: 100, notes: null },
+      { date: '2023-11-03', imported_id: '11', amount: 100 },
     ];
 
     const addResultWithoutNotes = await api.addTransactions(

packages/api/methods.ts

@@ -1,6 +1,18 @@
-// @ts-strict-ignore
+import type {
+  APIAccountEntity,
+  APICategoryEntity,
+  APICategoryGroupEntity,
+  APIFileEntity,
+  APIPayeeEntity,
+  APIScheduleEntity,
+} from 'loot-core/server/api-models';
+import type { Query } from 'loot-core/shared/query';
 import type { Handlers } from 'loot-core/types/handlers';
-import type { ImportTransactionEntity } from 'loot-core/types/models/import-transaction';
+import type {
+  ImportTransactionEntity,
+  RuleEntity,
+  TransactionEntity,
+} from 'loot-core/types/models';
 
 import * as injected from './injected';
 
@@ -13,8 +25,11 @@ function send<K extends keyof Handlers, T extends Handlers[K]>(
   return injected.send(name, args);
 }
 
-export async function runImport(name, func) {
-  await send('api/start-import', { budgetName: name });
+export async function runImport(
+  budgetName: APIFileEntity['name'],
+  func: () => Promise<void>,
+) {
+  await send('api/start-import', { budgetName });
   try {
     await func();
   } catch (e) {
@@ -24,11 +39,14 @@ export async function runImport(name, func) {
   await send('api/finish-import');
 }
 
-export async function loadBudget(budgetId) {
+export async function loadBudget(budgetId: string) {
   return send('api/load-budget', { id: budgetId });
 }
 
-export async function downloadBudget(syncId, { password }: { password? } = {}) {
+export async function downloadBudget(
+  syncId: string,
+  { password }: { password?: string } = {},
+) {
   return send('api/download-budget', { syncId, password });
 }
 
@@ -40,11 +58,13 @@ export async function sync() {
   return send('api/sync');
 }
 
-export async function runBankSync(args?: { accountId: string }) {
+export async function runBankSync(args?: {
+  accountId: APIAccountEntity['id'];
+}) {
   return send('api/bank-sync', args);
 }
 
-export async function batchBudgetUpdates(func) {
+export async function batchBudgetUpdates(func: () => Promise<void>) {
   await send('api/batch-budget-start');
   try {
     await func();
@@ -57,11 +77,11 @@ export async function batchBudgetUpdates(func) {
  * @deprecated Please use `aqlQuery` instead.
  * This function will be removed in a future release.
  */
-export function runQuery(query) {
+export function runQuery(query: Query) {
   return send('api/query', { query: query.serialize() });
 }
 
-export function aqlQuery(query) {
+export function aqlQuery(query: Query) {
   return send('api/query', { query: query.serialize() });
 }
 
@@ -69,22 +89,33 @@ export function getBudgetMonths() {
   return send('api/budget-months');
 }
 
-export function getBudgetMonth(month) {
+export function getBudgetMonth(month: string) {
   return send('api/budget-month', { month });
 }
 
-export function setBudgetAmount(month, categoryId, value) {
+export function setBudgetAmount(
+  month: string,
+  categoryId: APICategoryEntity['id'],
+  value: number,
+) {
   return send('api/budget-set-amount', { month, categoryId, amount: value });
 }
 
-export function setBudgetCarryover(month, categoryId, flag) {
+export function setBudgetCarryover(
+  month: string,
+  categoryId: APICategoryEntity['id'],
+  flag: boolean,
+) {
   return send('api/budget-set-carryover', { month, categoryId, flag });
 }
 
 export function addTransactions(
-  accountId,
-  transactions,
-  { learnCategories = false, runTransfers = false } = {},
+  accountId: APIAccountEntity['id'],
+  transactions: Omit<ImportTransactionEntity, 'account'>[],
+  {
+    learnCategories = false,
+    runTransfers = false,
+  }: { learnCategories?: boolean; runTransfers?: boolean } = {},
 ) {
   return send('api/transactions-add', {
     accountId,
@@ -100,7 +131,7 @@ export interface ImportTransactionsOpts {
 }
 
 export function importTransactions(
-  accountId: string,
+  accountId: APIAccountEntity['id'],
   transactions: ImportTransactionEntity[],
   opts: ImportTransactionsOpts = {
     defaultCleared: true,
@@ -115,15 +146,22 @@ export function importTransactions(
   });
 }
 
-export function getTransactions(accountId, startDate, endDate) {
+export function getTransactions(
+  accountId: APIAccountEntity['id'],
+  startDate: string,
+  endDate: string,
+) {
   return send('api/transactions-get', { accountId, startDate, endDate });
 }
 
-export function updateTransaction(id, fields) {
+export function updateTransaction(
+  id: TransactionEntity['id'],
+  fields: Partial<TransactionEntity>,
+) {
   return send('api/transaction-update', { id, fields });
 }
 
-export function deleteTransaction(id) {
+export function deleteTransaction(id: TransactionEntity['id']) {
   return send('api/transaction-delete', { id });
 }
 
@@ -131,15 +169,25 @@ export function getAccounts() {
   return send('api/accounts-get');
 }
 
-export function createAccount(account, initialBalance?) {
+export function createAccount(
+  account: Omit<APIAccountEntity, 'id'>,
+  initialBalance?: number,
+) {
   return send('api/account-create', { account, initialBalance });
 }
 
-export function updateAccount(id, fields) {
+export function updateAccount(
+  id: APIAccountEntity['id'],
+  fields: Partial<APIAccountEntity>,
+) {
   return send('api/account-update', { id, fields });
 }
 
-export function closeAccount(id, transferAccountId?, transferCategoryId?) {
+export function closeAccount(
+  id: APIAccountEntity['id'],
+  transferAccountId?: APIAccountEntity['id'],
+  transferCategoryId?: APICategoryEntity['id'],
+) {
   return send('api/account-close', {
     id,
     transferAccountId,
@@ -147,15 +195,15 @@ export function closeAccount(id, transferAccountId?, transferCategoryId?) {
   });
 }
 
-export function reopenAccount(id) {
+export function reopenAccount(id: APIAccountEntity['id']) {
   return send('api/account-reopen', { id });
 }
 
-export function deleteAccount(id) {
+export function deleteAccount(id: APIAccountEntity['id']) {
   return send('api/account-delete', { id });
 }
 
-export function getAccountBalance(id, cutoff?) {
+export function getAccountBalance(id: APIAccountEntity['id'], cutoff?: Date) {
   return send('api/account-balance', { id, cutoff });
 }
 
@@ -163,15 +211,21 @@ export function getCategoryGroups() {
   return send('api/category-groups-get');
 }
 
-export function createCategoryGroup(group) {
+export function createCategoryGroup(group: Omit<APICategoryGroupEntity, 'id'>) {
   return send('api/category-group-create', { group });
 }
 
-export function updateCategoryGroup(id, fields) {
+export function updateCategoryGroup(
+  id: APICategoryGroupEntity['id'],
+  fields: Partial<APICategoryGroupEntity>,
+) {
   return send('api/category-group-update', { id, fields });
 }
 
-export function deleteCategoryGroup(id, transferCategoryId?) {
+export function deleteCategoryGroup(
+  id: APICategoryGroupEntity['id'],
+  transferCategoryId?: APICategoryEntity['id'],
+) {
   return send('api/category-group-delete', { id, transferCategoryId });
 }
 
@@ -179,15 +233,21 @@ export function getCategories() {
   return send('api/categories-get', { grouped: false });
 }
 
-export function createCategory(category) {
+export function createCategory(category: Omit<APICategoryEntity, 'id'>) {
   return send('api/category-create', { category });
 }
 
-export function updateCategory(id, fields) {
+export function updateCategory(
+  id: APICategoryEntity['id'],
+  fields: Partial<APICategoryEntity>,
+) {
   return send('api/category-update', { id, fields });
 }
 
-export function deleteCategory(id, transferCategoryId?) {
+export function deleteCategory(
+  id: APICategoryEntity['id'],
+  transferCategoryId?: APICategoryEntity['id'],
+) {
   return send('api/category-delete', { id, transferCategoryId });
 }
 
@@ -199,19 +259,25 @@ export function getPayees() {
   return send('api/payees-get');
 }
 
-export function createPayee(payee) {
+export function createPayee(payee: Omit<APIPayeeEntity, 'id'>) {
   return send('api/payee-create', { payee });
 }
 
-export function updatePayee(id, fields) {
+export function updatePayee(
+  id: APIPayeeEntity['id'],
+  fields: Partial<APIPayeeEntity>,
+) {
   return send('api/payee-update', { id, fields });
 }
 
-export function deletePayee(id) {
+export function deletePayee(id: APIPayeeEntity['id']) {
   return send('api/payee-delete', { id });
 }
 
-export function mergePayees(targetId, mergeIds) {
+export function mergePayees(
+  targetId: APIPayeeEntity['id'],
+  mergeIds: APIPayeeEntity['id'][],
+) {
   return send('api/payees-merge', { targetId, mergeIds });
 }
 
@@ -219,35 +285,39 @@ export function getRules() {
   return send('api/rules-get');
 }
 
-export function getPayeeRules(id) {
+export function getPayeeRules(id: RuleEntity['id']) {
   return send('api/payee-rules-get', { id });
 }
 
-export function createRule(rule) {
+export function createRule(rule: Omit<RuleEntity, 'id'>) {
   return send('api/rule-create', { rule });
 }
 
-export function updateRule(rule) {
+export function updateRule(rule: RuleEntity) {
   return send('api/rule-update', { rule });
 }
 
-export function deleteRule(id: string) {
+export function deleteRule(id: RuleEntity['id']) {
   return send('api/rule-delete', id);
 }
 
-export function holdBudgetForNextMonth(month, amount) {
+export function holdBudgetForNextMonth(month: string, amount: number) {
   return send('api/budget-hold-for-next-month', { month, amount });
 }
 
-export function resetBudgetHold(month) {
+export function resetBudgetHold(month: string) {
   return send('api/budget-reset-hold', { month });
 }
 
-export function createSchedule(schedule) {
+export function createSchedule(schedule: Omit<APIScheduleEntity, 'id'>) {
   return send('api/schedule-create', schedule);
 }
 
-export function updateSchedule(id, fields, resetNextDate?: boolean) {
+export function updateSchedule(
+  id: APIScheduleEntity['id'],
+  fields: Partial<APIScheduleEntity>,
+  resetNextDate?: boolean,
+) {
   return send('api/schedule-update', {
     id,
     fields,
@@ -255,7 +325,7 @@ export function updateSchedule(id, fields, resetNextDate?: boolean) {
   });
 }
 
-export function deleteSchedule(scheduleId) {
+export function deleteSchedule(scheduleId: APIScheduleEntity['id']) {
   return send('api/schedule-delete', scheduleId);
 }
 
@@ -263,7 +333,10 @@ export function getSchedules() {
   return send('api/schedules-get');
 }
 
-export function getIDByName(type, name) {
+export function getIDByName(
+  type: 'accounts' | 'schedules' | 'categories' | 'payees',
+  name: string,
+) {
   return send('api/get-id-by-name', { type, name });
 }
 

packages/api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actual-app/api",
-  "version": "25.10.0",
+  "version": "25.11.0",
   "license": "MIT",
   "description": "An API for Actual",
   "engines": {
@@ -19,19 +19,19 @@
     "build:migrations": "cp migrations/*.sql dist/migrations",
     "build:default-db": "cp default-db.sqlite dist/",
     "build": "yarn run clean && yarn run build:app && yarn run build:node && yarn run build:migrations && yarn run build:default-db",
-    "test": "yarn run build:app && yarn run build:crdt && vitest",
+    "test": "yarn run build:app && yarn run build:crdt && vitest --run",
     "clean": "rm -rf dist @types"
   },
   "dependencies": {
     "@actual-app/crdt": "workspace:^",
-    "better-sqlite3": "^12.2.0",
+    "better-sqlite3": "^12.4.1",
     "compare-versions": "^6.1.1",
     "node-fetch": "^3.3.2",
-    "uuid": "^11.1.0"
+    "uuid": "^13.0.0"
   },
   "devDependencies": {
     "tsc-alias": "^1.8.16",
-    "typescript": "^5.9.2",
-    "vitest": "^3.2.4"
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.9"
   }
 }

packages/api/utils.js

@@ -1,7 +0,0 @@
-export function amountToInteger(n) {
-  return Math.round(n * 100);
-}
-
-export function integerToAmount(n) {
-  return parseFloat((n / 100).toFixed(2));
-}

packages/api/utils.ts

@@ -0,0 +1,6 @@
+// @ts-ignore: bundle not available until we build it
+// eslint-disable-next-line import/extensions
+import * as bundle from './app/bundle.api.js';
+
+export const amountToInteger = bundle.lib.amountToInteger;
+export const integerToAmount = bundle.lib.integerToAmount;

packages/api/vitest.config.ts

@@ -5,5 +5,6 @@ export default {
       // print only console.error
       return type === 'stderr';
     },
+    maxWorkers: 2,
   },
 };

packages/ci-actions/bin/bundle-stats-comment.mjs

@@ -0,0 +1,678 @@
+#!/usr/bin/env node
+
+/**
+ * Generates a combined bundle stats comment for GitHub Actions.
+ * Heavily inspired by https://github.com/twk3/rollup-size-compare-action (MIT).
+ */
+
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import process from 'node:process';
+
+const REQUIRED_ARGS = new Map([
+  ['base', 'Mapping of bundle names to base stats JSON'],
+  ['head', 'Mapping of bundle names to head stats JSON'],
+]);
+
+function parseRawArgs(argv) {
+  const args = new Map();
+
+  for (let index = 2; index < argv.length; index += 1) {
+    const key = argv[index];
+
+    if (!key?.startsWith('--')) {
+      throw new Error(
+        `Unexpected argument “${key ?? ''}”. Use --key value pairs.`,
+      );
+    }
+
+    const values = [];
+
+    while (index + 1 < argv.length && !argv[index + 1].startsWith('--')) {
+      values.push(argv[index + 1]);
+      index += 1;
+    }
+
+    if (values.length === 0) {
+      throw new Error(`Missing value for argument “${key}”.`);
+    }
+
+    const keyName = key.slice(2);
+    // Accumulate values if the key already exists
+    if (args.has(keyName)) {
+      args.set(keyName, [...args.get(keyName), ...values]);
+    } else {
+      args.set(keyName, values);
+    }
+  }
+
+  return args;
+}
+
+function getSingleValue(args, key) {
+  const values = args.get(key);
+  if (!values) {
+    return undefined;
+  }
+  if (values.length !== 1) {
+    throw new Error(`Argument “--${key}” must have exactly one value.`);
+  }
+  return values[0];
+}
+
+function parseMapping(values, key, description) {
+  if (!values || values.length === 0) {
+    throw new Error(`Missing required argument “--${key}” (${description}).`);
+  }
+
+  if (values.length === 1) {
+    const [rawValue] = values;
+    const trimmed = rawValue.trim();
+
+    if (trimmed.startsWith('{')) {
+      try {
+        const parsed = JSON.parse(trimmed);
+
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+          throw new Error('Value must be a JSON object.');
+        }
+
+        return new Map(
+          Object.entries(parsed).map(([name, pathValue]) => {
+            if (typeof pathValue !== 'string') {
+              throw new Error(
+                `Value for “${name}” in “--${key}” must be a string path.`,
+              );
+            }
+            return [name, pathValue];
+          }),
+        );
+      } catch (error) {
+        const message =
+          error instanceof Error ? error.message : 'Unknown parsing error';
+        throw new Error(
+          `Failed to parse “--${key}” value as JSON object: ${message}`,
+        );
+      }
+    }
+  }
+
+  const entries = new Map();
+
+  for (const value of values) {
+    const [rawName, ...rawPathParts] = value.split('=');
+
+    if (!rawName || rawPathParts.length === 0) {
+      throw new Error(
+        `Argument “--${key}” must be provided as name=path pairs or a JSON object.`,
+      );
+    }
+
+    const name = rawName.trim();
+    const pathValue = rawPathParts.join('=').trim();
+
+    if (!name) {
+      throw new Error(`Argument “--${key}” contains an empty bundle name.`);
+    }
+
+    if (!pathValue) {
+      throw new Error(
+        `Argument “--${key}” for bundle “${name}” must include a non-empty path.`,
+      );
+    }
+
+    entries.set(name, pathValue);
+  }
+
+  if (entries.size === 0) {
+    throw new Error(`Argument “--${key}” must define at least one bundle.`);
+  }
+
+  return entries;
+}
+
+function parseArgs(argv) {
+  const args = parseRawArgs(argv);
+
+  const baseMap = parseMapping(
+    args.get('base'),
+    'base',
+    REQUIRED_ARGS.get('base'),
+  );
+  const headMap = parseMapping(
+    args.get('head'),
+    'head',
+    REQUIRED_ARGS.get('head'),
+  );
+
+  const sections = [];
+
+  for (const [name, basePath] of baseMap.entries()) {
+    const headPath = headMap.get(name);
+
+    if (!headPath) {
+      throw new Error(
+        `Bundle “${name}” is missing a corresponding “--head” entry.`,
+      );
+    }
+
+    sections.push({
+      name,
+      basePath,
+      headPath,
+    });
+  }
+
+  for (const name of headMap.keys()) {
+    if (!baseMap.has(name)) {
+      throw new Error(
+        `Bundle “${name}” is missing a corresponding “--base” entry.`,
+      );
+    }
+  }
+
+  return {
+    sections,
+    identifier: getSingleValue(args, 'identifier') ?? 'bundle-stats',
+  };
+}
+
+async function loadStats(filePath) {
+  try {
+    const absolutePath = path.resolve(process.cwd(), filePath);
+    const fileContents = await readFile(absolutePath, 'utf8');
+    const parsed = JSON.parse(fileContents);
+
+    // Validate that we got a meaningful stats object
+    if (!parsed || typeof parsed !== 'object') {
+      throw new Error('Stats file does not contain a valid JSON object');
+    }
+
+    return parsed;
+  } catch (error) {
+    const message =
+      error instanceof Error
+        ? error.message
+        : 'Unknown error while parsing stats file';
+    console.error(`[bundle-stats] Failed to parse “${filePath}”: ${message}`);
+    throw new Error(`Failed to load stats file “${filePath}”: ${message}`);
+  }
+}
+
+function findAllChildren(node = {}) {
+  if (Array.isArray(node.children)) {
+    return node.children.flatMap(findAllChildren);
+  }
+  return [node];
+}
+
+function trimPath(input) {
+  if (!input) {
+    return '';
+  }
+  return input.replace(/.*node_modules/, '/node_modules');
+}
+
+function assetNameToSizeMap(statAssets = {}) {
+  const children = statAssets?.tree?.children;
+
+  if (!Array.isArray(children) || children.length === 0) {
+    return new Map();
+  }
+
+  return new Map(
+    children.map(asset => {
+      const descendants = findAllChildren(asset);
+      let size = 0;
+      let gzipSize = statAssets?.options?.gzip ? 0 : null;
+
+      for (const mod of descendants) {
+        const nodePart = statAssets?.nodeParts?.[mod.uid];
+
+        if (!nodePart) {
+          continue;
+        }
+
+        size += nodePart.renderedLength ?? 0;
+
+        if (gzipSize !== null) {
+          gzipSize += nodePart.gzipLength ?? 0;
+        }
+      }
+
+      return [trimPath(asset.name), { size, gzipSize }];
+    }),
+  );
+}
+
+function chunkModuleNameToSizeMap(statChunks = {}) {
+  if (!statChunks?.tree) {
+    return new Map();
+  }
+
+  return new Map(
+    findAllChildren(statChunks.tree).map(mod => {
+      const modInfo = statChunks?.nodeParts?.[mod.uid] ?? {};
+      const meta = statChunks?.nodeMetas?.[modInfo.metaUid] ?? {};
+      const id = trimPath(meta.id ?? '');
+
+      return [
+        id,
+        {
+          size: modInfo.renderedLength ?? 0,
+          gzipSize: statChunks?.options?.gzip
+            ? (modInfo.gzipLength ?? 0)
+            : null,
+        },
+      ];
+    }),
+  );
+}
+
+function sortDiffDescending(items) {
+  return items.sort((a, b) => Math.abs(b.diff) - Math.abs(a.diff));
+}
+
+function normaliseGzip(value) {
+  if (value == null || Number.isNaN(value)) {
+    return NaN;
+  }
+  return value;
+}
+
+function getAssetDiff(name, oldSize, newSize) {
+  const diff = newSize.size - oldSize.size;
+
+  const percent =
+    oldSize.size === 0
+      ? newSize.size === 0
+        ? 0
+        : Infinity
+      : +((1 - newSize.size / oldSize.size) * -100).toFixed(5) || 0;
+
+  return {
+    name,
+    new: {
+      size: newSize.size,
+      gzipSize: normaliseGzip(newSize.gzipSize),
+    },
+    old: {
+      size: oldSize.size,
+      gzipSize: normaliseGzip(oldSize.gzipSize),
+    },
+    diff,
+    diffPercentage: percent,
+  };
+}
+
+function webpackStatsDiff(oldAssets, newAssets) {
+  const added = [];
+  const removed = [];
+  const bigger = [];
+  const smaller = [];
+  const unchanged = [];
+
+  let newSizeTotal = 0;
+  let oldSizeTotal = 0;
+  let newGzipSizeTotal = 0;
+  let oldGzipSizeTotal = 0;
+
+  for (const [name, oldAssetSizes] of oldAssets) {
+    oldSizeTotal += oldAssetSizes.size;
+    oldGzipSizeTotal += oldAssetSizes.gzipSize ?? NaN;
+
+    const newAsset = newAssets.get(name);
+
+    if (!newAsset) {
+      removed.push(getAssetDiff(name, oldAssetSizes, { size: 0, gzipSize: 0 }));
+      continue;
+    }
+
+    const diff = getAssetDiff(name, oldAssetSizes, newAsset);
+
+    if (diff.diffPercentage > 0) {
+      bigger.push(diff);
+    } else if (diff.diffPercentage < 0) {
+      smaller.push(diff);
+    } else {
+      unchanged.push(diff);
+    }
+  }
+
+  for (const [name, newAssetSizes] of newAssets) {
+    newSizeTotal += newAssetSizes.size;
+    newGzipSizeTotal += newAssetSizes.gzipSize ?? NaN;
+
+    if (!oldAssets.has(name)) {
+      added.push(getAssetDiff(name, { size: 0, gzipSize: 0 }, newAssetSizes));
+    }
+  }
+
+  const oldFilesCount = oldAssets.size;
+  const newFilesCount = newAssets.size;
+
+  return {
+    added: sortDiffDescending(added),
+    removed: sortDiffDescending(removed),
+    bigger: sortDiffDescending(bigger),
+    smaller: sortDiffDescending(smaller),
+    unchanged,
+    total: getAssetDiff(
+      oldFilesCount === newFilesCount
+        ? `${newFilesCount}`
+        : `${oldFilesCount} → ${newFilesCount}`,
+      { size: oldSizeTotal, gzipSize: oldGzipSizeTotal },
+      { size: newSizeTotal, gzipSize: newGzipSizeTotal },
+    ),
+  };
+}
+
+function getStatsDiff(oldStats, newStats) {
+  return webpackStatsDiff(
+    assetNameToSizeMap(oldStats),
+    assetNameToSizeMap(newStats),
+  );
+}
+
+function getChunkModuleDiff(oldStats, newStats) {
+  const diff = webpackStatsDiff(
+    chunkModuleNameToSizeMap(oldStats),
+    chunkModuleNameToSizeMap(newStats),
+  );
+
+  if (
+    diff.added.length === 0 &&
+    diff.removed.length === 0 &&
+    diff.bigger.length === 0 &&
+    diff.smaller.length === 0
+  ) {
+    return null;
+  }
+
+  return diff;
+}
+
+const BYTES_PER_KILOBYTE = 1024;
+const FILE_SIZE_DENOMINATIONS = [
+  'B',
+  'kB',
+  'MB',
+  'GB',
+  'TB',
+  'PB',
+  'EB',
+  'ZB',
+  'YB',
+  'BB',
+];
+
+function formatFileSizeIEC(bytes, precision = 2) {
+  if (bytes == null || Number.isNaN(bytes)) {
+    return 'N/A';
+  }
+
+  if (bytes === 0) {
+    return `0 ${FILE_SIZE_DENOMINATIONS[0]}`;
+  }
+
+  const absBytes = Math.abs(bytes);
+  const denominationIndex = Math.floor(
+    Math.log(absBytes) / Math.log(BYTES_PER_KILOBYTE),
+  );
+  const value = absBytes / Math.pow(BYTES_PER_KILOBYTE, denominationIndex);
+  const stripped = parseFloat(value.toFixed(precision));
+
+  return `${stripped} ${FILE_SIZE_DENOMINATIONS[denominationIndex]}`;
+}
+
+function conditionalPercentage(number) {
+  if (number === Infinity || number === -Infinity) {
+    return '-';
+  }
+
+  const absValue = Math.abs(number);
+
+  if (absValue === 0 || absValue === 100) {
+    return `${number}%`;
+  }
+
+  const value = Number.isFinite(absValue) ? absValue.toFixed(2) : absValue;
+  return `${signFor(number)}${value}%`;
+}
+
+function capitalize(text) {
+  if (!text) return '';
+  return `${text[0].toUpperCase()}${text.slice(1)}`;
+}
+
+function makeHeader(columns) {
+  const header = columns.join(' | ');
+  const separator = columns
+    .map(column =>
+      Array.from({ length: column.length })
+        .map(() => '-')
+        .join(''),
+    )
+    .join(' | ');
+
+  return `${header}\n${separator}`;
+}
+
+const TOTAL_HEADERS = makeHeader([
+  'Files count',
+  'Total bundle size',
+  '% Changed',
+]);
+const TABLE_HEADERS = makeHeader(['Asset', 'File Size', '% Changed']);
+const CHUNK_TABLE_HEADERS = makeHeader(['File', 'Δ', 'Size']);
+
+function signFor(num) {
+  if (num === 0) return '';
+  return num > 0 ? '+' : '-';
+}
+
+function toFileSizeDiff(oldSize, newSize, diff) {
+  const diffLine = [
+    `${formatFileSizeIEC(oldSize)} → ${formatFileSizeIEC(newSize)}`,
+  ];
+
+  if (typeof diff !== 'undefined') {
+    diffLine.push(`(${signFor(diff)}${formatFileSizeIEC(diff)})`);
+  }
+
+  return diffLine.join(' ');
+}
+
+function toFileSizeDiffCell(asset) {
+  const lines = [];
+
+  if (asset.diff === 0) {
+    lines.push(formatFileSizeIEC(asset.new.size));
+
+    if (asset.new.gzipSize) {
+      lines.push(formatFileSizeIEC(asset.new.gzipSize));
+    }
+  } else {
+    lines.push(toFileSizeDiff(asset.old.size, asset.new.size, asset.diff));
+
+    if (asset.old.gzipSize || asset.new.gzipSize) {
+      lines.push(
+        `${toFileSizeDiff(asset.old.gzipSize, asset.new.gzipSize)} (gzip)`,
+      );
+    }
+  }
+
+  return lines.join('<br />');
+}
+
+function printAssetTableRow(asset) {
+  return [
+    asset.name,
+    toFileSizeDiffCell(asset),
+    conditionalPercentage(asset.diffPercentage),
+  ].join(' | ');
+}
+
+function printAssetTablesByGroup(statsDiff) {
+  const statsFields = ['added', 'removed', 'bigger', 'smaller', 'unchanged'];
+
+  return statsFields
+    .map(field => {
+      const assets = statsDiff[field] ?? [];
+
+      if (assets.length === 0) {
+        return `**${capitalize(field)}**\nNo assets were ${field}`;
+      }
+
+      return `**${capitalize(field)}**\n${TABLE_HEADERS}\n${assets
+        .map(asset => printAssetTableRow(asset))
+        .join('\n')}`;
+    })
+    .join('\n\n');
+}
+
+function getDiffEmoji(diff) {
+  if (diff.diffPercentage === Infinity) return '🆕';
+  if (diff.diffPercentage <= -100) return '🔥';
+  if (diff.diffPercentage > 0) return '📈';
+  if (diff.diffPercentage < 0) return '📉';
+  return ' ';
+}
+
+function getTrimmedChunkName(chunkModule) {
+  const chunkName = chunkModule.name ?? '';
+  if (chunkName.startsWith('./')) {
+    return chunkName.substring(2);
+  }
+  if (chunkName.startsWith('/')) {
+    return chunkName.substring(1);
+  }
+  return chunkName;
+}
+
+function printChunkModuleRow(chunkModule) {
+  const emoji = getDiffEmoji(chunkModule);
+  const chunkName = getTrimmedChunkName(chunkModule);
+  const diffPart = `${chunkModule.diff >= 0 ? '+' : '-'}${formatFileSizeIEC(chunkModule.diff)}`;
+  const percentPart = Number.isFinite(chunkModule.diffPercentage)
+    ? ` (${conditionalPercentage(chunkModule.diffPercentage)})`
+    : '';
+
+  return [
+    `\`${chunkName}\``,
+    `${emoji} ${diffPart}${percentPart}`,
+    `${formatFileSizeIEC(chunkModule.old.size)} → ${formatFileSizeIEC(chunkModule.new.size)}`,
+  ].join(' | ');
+}
+
+function printChunkModulesTable(statsDiff) {
+  if (!statsDiff) {
+    return '';
+  }
+
+  const changedModules = [
+    ...(statsDiff.added ?? []),
+    ...(statsDiff.removed ?? []),
+    ...(statsDiff.bigger ?? []),
+    ...(statsDiff.smaller ?? []),
+  ].sort((a, b) => b.diffPercentage - a.diffPercentage);
+
+  if (changedModules.length === 0) {
+    return `<details>\n<summary>Changeset</summary>\nNo files were changed\n</details>`;
+  }
+
+  const rows = changedModules
+    .slice(0, 100)
+    .map(chunkModule => printChunkModuleRow(chunkModule))
+    .join('\n');
+
+  const summarySuffix =
+    changedModules.length > 100 ? ' (largest 100 files by percent change)' : '';
+
+  return `<details>\n<summary>Changeset${summarySuffix}</summary>\n\n${CHUNK_TABLE_HEADERS}\n${rows}\n</details>`;
+}
+
+function printTotalAssetTable(statsDiff) {
+  return `**Total**\n${TOTAL_HEADERS}\n${printAssetTableRow(statsDiff.total)}`;
+}
+
+function renderSection(title, statsDiff, chunkModuleDiff) {
+  const { total, ...groups } = statsDiff;
+  const parts = [`#### ${title}`, '', printTotalAssetTable({ total })];
+
+  const chunkTable = printChunkModulesTable(chunkModuleDiff);
+  if (chunkTable) {
+    parts.push('', chunkTable);
+  }
+
+  parts.push(
+    '',
+    `<details>\n<summary>View detailed bundle breakdown</summary>\n<div>\n\n${printAssetTablesByGroup(
+      groups,
+    )}\n</div>\n</details>`,
+  );
+
+  return parts.join('\n');
+}
+
+async function main() {
+  const args = parseArgs(process.argv);
+
+  console.error(
+    `[bundle-stats] Found ${args.sections.length} sections to process`,
+  );
+  args.sections.forEach((section, index) => {
+    console.error(
+      `[bundle-stats] Section ${index + 1}: ${section.name} (base: ${section.basePath}, head: ${section.headPath})`,
+    );
+  });
+
+  const sections = [];
+
+  for (const section of args.sections) {
+    console.error(`[bundle-stats] Processing section: ${section.name}`);
+    console.error(
+      `[bundle-stats] Loading base stats from: ${section.basePath}`,
+    );
+    const baseStats = await loadStats(section.basePath);
+    console.error(
+      `[bundle-stats] Loading head stats from: ${section.headPath}`,
+    );
+    const headStats = await loadStats(section.headPath);
+
+    const statsDiff = getStatsDiff(baseStats, headStats);
+    const chunkDiff = getChunkModuleDiff(baseStats, headStats);
+
+    console.error(
+      `[bundle-stats] Section ${section.name}: ${statsDiff.total.name} files, total size ${statsDiff.total.old.size} → ${statsDiff.total.new.size}`,
+    );
+
+    sections.push({
+      name: section.name,
+      statsDiff,
+      chunkDiff,
+    });
+  }
+
+  const identifier = `<!--- bundlestats-action-comment key:${args.identifier} --->`;
+
+  const comment = [
+    '### Bundle Stats',
+    '',
+    sections
+      .map(section =>
+        renderSection(section.name, section.statsDiff, section.chunkDiff),
+      )
+      .join('\n\n---\n\n'),
+    '',
+    identifier,
+    '',
+  ].join('\n');
+
+  process.stdout.write(comment);
+}
+
+main().catch(error => {
+  console.error(error);
+  process.exitCode = 1;
+});

packages/ci-actions/bin/update-bundle-stats-comment.mjs

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+
+/**
+ * Updates (or creates) a bundle stats comment on a pull request.
+ * Requires the following environment variables to be set:
+ *  - GITHUB_TOKEN
+ *  - GITHUB_REPOSITORY (owner/repo)
+ *  - PR_NUMBER
+ */
+
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import process from 'node:process';
+
+import { Octokit } from '@octokit/rest';
+
+function parseArgs(argv) {
+  const args = {
+    commentFile: null,
+    identifier: null,
+  };
+
+  for (let i = 2; i < argv.length; i += 2) {
+    const key = argv[i];
+    const value = argv[i + 1];
+
+    if (!key?.startsWith('--')) {
+      throw new Error(
+        `Unexpected argument “${key ?? ''}”. Use --key value pairs.`,
+      );
+    }
+
+    if (typeof value === 'undefined') {
+      throw new Error(`Missing value for argument “${key}”.`);
+    }
+
+    switch (key) {
+      case '--comment-file':
+        args.commentFile = value;
+        break;
+      case '--identifier':
+        args.identifier = value;
+        break;
+      default:
+        throw new Error(`Unknown argument “${key}”.`);
+    }
+  }
+
+  if (!args.commentFile) {
+    throw new Error('Missing required argument “--comment-file“.');
+  }
+
+  if (!args.identifier) {
+    throw new Error('Missing required argument “--identifier“.');
+  }
+
+  return args;
+}
+
+async function loadCommentBody(commentFile) {
+  const absolutePath = path.resolve(process.cwd(), commentFile);
+  return readFile(absolutePath, 'utf8');
+}
+
+function getRepoInfo() {
+  const repository = process.env.GITHUB_REPOSITORY;
+  if (!repository) {
+    throw new Error('GITHUB_REPOSITORY environment variable is required.');
+  }
+
+  const [owner, repo] = repository.split('/');
+  if (!owner || !repo) {
+    throw new Error(`Invalid GITHUB_REPOSITORY value “${repository}”.`);
+  }
+
+  return { owner, repo };
+}
+
+function getPullRequestNumber() {
+  const rawNumber = process.env.PR_NUMBER ?? '';
+  const prNumber = Number.parseInt(rawNumber, 10);
+
+  if (!Number.isInteger(prNumber) || prNumber <= 0) {
+    throw new Error(
+      'PR_NUMBER environment variable must be a positive integer.',
+    );
+  }
+
+  return prNumber;
+}
+
+function assertGitHubToken() {
+  const token = process.env.GITHUB_TOKEN;
+  if (!token) {
+    throw new Error('GITHUB_TOKEN environment variable is required.');
+  }
+  return token;
+}
+
+async function listComments(octokit, owner, repo, issueNumber) {
+  return octokit.paginate(octokit.rest.issues.listComments, {
+    owner,
+    repo,
+    issue_number: issueNumber,
+    per_page: 100,
+  });
+}
+
+function isGitHubActionsBot(comment) {
+  return comment.user?.login === 'github-actions[bot]';
+}
+
+async function main() {
+  const { commentFile, identifier } = parseArgs(process.argv);
+  const commentBody = await loadCommentBody(commentFile);
+  const token = assertGitHubToken();
+  const { owner, repo } = getRepoInfo();
+  const issueNumber = getPullRequestNumber();
+
+  const octokit = new Octokit({ auth: token });
+
+  const comments = await listComments(octokit, owner, repo, issueNumber);
+
+  const existingComment = comments.find(
+    comment =>
+      isGitHubActionsBot(comment) && comment.body?.includes(identifier),
+  );
+
+  if (existingComment) {
+    await octokit.rest.issues.updateComment({
+      owner,
+      repo,
+      comment_id: existingComment.id,
+      body: commentBody,
+    });
+    console.log('Updated existing bundle stats comment.');
+  } else {
+    await octokit.rest.issues.createComment({
+      owner,
+      repo,
+      issue_number: issueNumber,
+      body: commentBody,
+    });
+    console.log('Created new bundle stats comment.');
+  }
+}
+
+main().catch(error => {
+  console.error(error);
+  process.exitCode = 1;
+});

packages/ci-actions/package.json

@@ -3,9 +3,9 @@
   "private": true,
   "type": "module",
   "devDependencies": {
-    "vitest": "^3.2.4"
+    "vitest": "^4.0.9"
   },
   "scripts": {
-    "test": "vitest"
+    "test": "vitest --run"
   }
 }

packages/ci-actions/vitest.config.mts

@@ -5,5 +5,7 @@ export default defineConfig({
     globals: true,
     include: ['src/**/*.test.(js|jsx|ts|tsx)'],
     environment: 'node',
+    maxWorkers: 1,
+    isolate: false,
   },
 });

packages/component-library/package.json

@@ -8,15 +8,15 @@
   },
   "dependencies": {
     "@emotion/css": "^11.13.5",
-    "react-aria-components": "^1.8.0",
+    "react-aria-components": "^1.13.0",
     "usehooks-ts": "^3.1.1"
   },
   "devDependencies": {
     "@svgr/cli": "^8.1.0",
-    "@types/react": "^19.1.12",
-    "react": "19.1.1",
-    "react-dom": "19.1.1",
-    "vitest": "^3.2.4"
+    "@types/react": "^19.2.5",
+    "react": "19.2.0",
+    "react-dom": "19.2.0",
+    "vitest": "^4.0.9"
   },
   "exports": {
     "./hooks/*": "./src/hooks/*.ts",
@@ -40,7 +40,6 @@
     "./popover": "./src/Popover.tsx",
     "./select": "./src/Select.tsx",
     "./space-between": "./src/SpaceBetween.tsx",
-    "./stack": "./src/Stack.tsx",
     "./styles": "./src/styles.ts",
     "./text": "./src/Text.tsx",
     "./text-one-line": "./src/TextOneLine.tsx",
@@ -54,6 +53,6 @@
   "scripts": {
     "generate:icons": "rm src/icons/*/*.tsx; cd src/icons && svgr --template template.ts --index-template index-template.ts --typescript --expand-props start -d . .",
     "test": "npm-run-all -cp 'test:*'",
-    "test:web": "ENV=web vitest -c vitest.web.config.ts"
+    "test:web": "ENV=web vitest --run -c vitest.web.config.ts"
   }
 }

packages/component-library/src/InitialFocus.ts

@@ -4,6 +4,7 @@ import {
   isValidElement,
   type ReactElement,
   Ref,
+  RefObject,
   useEffect,
   useRef,
 } from 'react';
@@ -11,15 +12,20 @@ import {
 type InitialFocusProps<T extends HTMLElement> = {
   /**
    * The child element to focus when the component mounts. This can be either a single React element or a function that returns a React element.
+   * The child element should have a `ref` prop for this to work. For child components which receives a ref via another prop
+   * e.g. `inputRef`, use a function as child and pass the ref to the appropriate prop.
    */
-  children: ReactElement<{ ref: Ref<T> }> | ((ref: Ref<T>) => ReactElement);
+  children:
+    | ReactElement<{ ref: Ref<T> }>
+    | ((ref: RefObject<T | null>) => ReactElement);
 };
 
 /**
  * InitialFocus sets focus on its child element
  * when it mounts.
- * @param {Object} props - The component props.
- * @param {ReactElement | function} props.children - A single React element or a function that returns a React element.
+ * @param {ReactElement | function} children - A single React element or a function that returns a React element.
+ * The child element should have a `ref` prop for this to work. For child components which receives a ref via another prop
+ * e.g. `inputRef`, use a function as child and pass the ref to the appropriate prop.
  */
 export function InitialFocus<T extends HTMLElement = HTMLElement>({
   children,

packages/component-library/src/Popover.tsx

@@ -34,6 +34,7 @@ export const Popover = ({
 
   return (
     <ReactAriaPopover
+      data-popover={true}
       ref={ref}
       placement="bottom end"
       offset={1}

packages/component-library/src/SpaceBetween.tsx

@@ -6,6 +6,8 @@ import { View } from './View';
 type SpaceBetweenProps = {
   direction?: 'horizontal' | 'vertical';
   gap?: number;
+  wrap?: boolean;
+  align?: 'start' | 'center' | 'end' | 'stretch';
   style?: CSSProperties;
   children: ReactNode;
 };
@@ -13,18 +15,22 @@ type SpaceBetweenProps = {
 export const SpaceBetween = ({
   direction = 'horizontal',
   gap = 15,
+  wrap = true,
+  align = 'center',
   style,
   children,
+  ...props
 }: SpaceBetweenProps) => {
   return (
     <View
       style={{
-        flexWrap: 'wrap',
+        flexWrap: wrap ? 'wrap' : 'nowrap',
         flexDirection: direction === 'horizontal' ? 'row' : 'column',
-        alignItems: 'center',
+        alignItems: align,
         gap,
         ...style,
       }}
+      {...props}
     >
       {children}
     </View>

packages/component-library/src/Stack.tsx

@@ -1,105 +0,0 @@
-// @ts-strict-ignore
-import React, {
-  Children,
-  type ComponentProps,
-  Fragment,
-  cloneElement,
-  forwardRef,
-  type ReactNode,
-  type CSSProperties,
-} from 'react';
-
-import { Text } from './Text';
-import { View } from './View';
-
-function getChildren(key, children) {
-  return Children.toArray(children).reduce(
-    (list, child) => {
-      if (child) {
-        if (
-          typeof child === 'object' &&
-          'type' in child &&
-          child.type === Fragment
-        ) {
-          return list.concat(
-            getChildren(
-              child.key,
-              typeof child.props === 'object' && 'children' in child.props
-                ? child.props.children
-                : [],
-            ),
-          );
-        }
-        list.push({ key: key + child['key'], child });
-        return list;
-      }
-      return list;
-    },
-    [] as Array<{ key: string; child: ReactNode }>,
-  );
-}
-
-type StackProps = ComponentProps<typeof View> & {
-  direction?: CSSProperties['flexDirection'];
-  align?: string;
-  justify?: string;
-  spacing?: number;
-  debug?: boolean;
-};
-export const Stack = forwardRef<HTMLDivElement, StackProps>(
-  (
-    {
-      direction = 'column',
-      align,
-      justify,
-      spacing = 3,
-      children,
-      debug,
-      style,
-      ...props
-    },
-    ref,
-  ) => {
-    const isReversed = direction.endsWith('reverse');
-    const isHorizontal = direction.startsWith('row');
-    const validChildren = getChildren('', children);
-
-    return (
-      <View
-        style={{
-          flexDirection: direction,
-          alignItems: align,
-          justifyContent: justify,
-          ...style,
-        }}
-        innerRef={ref}
-        {...props}
-      >
-        {validChildren.map(({ key, child }, index) => {
-          const isLastChild = validChildren.length === index + 1;
-
-          let marginProp;
-          if (isHorizontal) {
-            marginProp = isReversed ? 'marginLeft' : 'marginRight';
-          } else {
-            marginProp = isReversed ? 'marginTop' : 'marginBottom';
-          }
-
-          return cloneElement(
-            typeof child === 'string' ? <Text>{child}</Text> : child,
-            {
-              key,
-              style: {
-                ...(debug && { borderWidth: 1, borderColor: 'red' }),
-                ...(isLastChild ? null : { [marginProp]: spacing * 5 }),
-                ...(child.props ? child.props.style : null),
-              },
-            },
-          );
-        })}
-      </View>
-    );
-  },
-);
-
-Stack.displayName = 'Stack';

packages/component-library/src/Tooltip.tsx

@@ -15,12 +15,14 @@ type TooltipProps = Partial<ComponentProps<typeof AriaTooltip>> & {
   children: ReactNode;
   content: ReactNode;
   triggerProps?: Partial<ComponentProps<typeof TooltipTrigger>>;
+  disablePointerEvents?: boolean;
 };
 
 export const Tooltip = ({
   children,
   content,
   triggerProps = {},
+  disablePointerEvents = false,
   ...props
 }: TooltipProps) => {
   const triggerRef = useRef(null);
@@ -69,7 +71,14 @@ export const Tooltip = ({
       >
         {children}
 
-        <AriaTooltip triggerRef={triggerRef} style={styles.tooltip} {...props}>
+        <AriaTooltip
+          triggerRef={triggerRef}
+          style={{
+            ...styles.tooltip,
+            ...(disablePointerEvents && { pointerEvents: 'none' }),
+          }}
+          {...props}
+        >
           {content}
         </AriaTooltip>
       </TooltipTrigger>

packages/component-library/src/icons/index-template.ts

@@ -1,7 +1,6 @@
-// @ts-strict-ignore
 import path from 'path';
 
-function indexTemplate(filePaths) {
+function indexTemplate(filePaths: { path: string }[]) {
   const exportEntries = filePaths.map(({ path: filePath }) => {
     const basename = path.basename(filePath, path.extname(filePath));
     const exportName = `Svg${basename}`;

packages/component-library/src/icons/template.ts

@@ -1,5 +1,6 @@
-// @ts-strict-ignore
-const tmpl = ({ imports, interfaces, componentName, props, jsx }, { tpl }) => {
+import { type Config } from '@svgr/core';
+
+const tmpl: Config['template'] = ({ imports, interfaces, componentName, props, jsx }, { tpl }) => {
   return tpl`
 ${imports};
 

packages/component-library/vitest.web.config.ts

@@ -21,6 +21,7 @@ export default defineConfig({
     environment: 'jsdom',
     globals: true,
     include: ['src/**/*.web.test.(js|jsx|ts|tsx)'],
+    maxWorkers: 2,
   },
   resolve: {
     alias: [

packages/crdt/package.json

@@ -12,18 +12,18 @@
     "build:node": "tsc --p tsconfig.dist.json",
     "proto:generate": "./bin/generate-proto",
     "build": "rm -rf dist && yarn run build:node",
-    "test": "vitest --globals"
+    "test": "vitest --run --globals"
   },
   "dependencies": {
     "google-protobuf": "^3.21.4",
     "murmurhash": "^2.0.1",
-    "uuid": "^11.1.0"
+    "uuid": "^13.0.0"
   },
   "devDependencies": {
-    "@types/google-protobuf": "^3.15.12",
-    "protoc-gen-js": "^3.21.4-4",
-    "ts-protoc-gen": "^0.15.0",
-    "typescript": "^5.9.2",
-    "vitest": "^3.2.4"
+    "@types/google-protobuf": "3.15.12",
+    "protoc-gen-js": "3.21.4-4",
+    "ts-protoc-gen": "0.15.0",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.9"
   }
 }

packages/crdt/tsconfig.dist.json

@@ -12,5 +12,5 @@
     "outDir": "dist"
   },
   "include": ["."],
-  "exclude": ["dist"]
+  "exclude": ["dist", "**/*.test.ts", "**/*.spec.ts"]
 }

packages/desktop-client/.gitignore

@@ -14,6 +14,9 @@ build-electron
 build-stats
 stats.json
 
+# generated service worker
+service-worker/
+
 # misc
 .DS_Store
 .env
@@ -28,3 +31,6 @@ public/*.wasm
 
 # translations
 locale/
+
+# service worker build output
+dev-dist

packages/desktop-client/README.md

@@ -65,10 +65,10 @@ Run manually:
 
 ```sh
 # Run docker container
-docker run --rm --network host -v $(pwd):/work/ -w /work/ -it mcr.microsoft.com/playwright:v1.52.0-jammy /bin/bash
+docker run --rm --network host -v $(pwd):/work/ -w /work/ -it mcr.microsoft.com/playwright:v1.56.0-jammy /bin/bash
 
     # If you receive an error such as "docker: invalid reference format", please instead use the following command:
-    docker run --rm --network host -v ${pwd}:/work/ -w /work/ -it mcr.microsoft.com/playwright:v1.52.0-jammy /bin/bash
+    docker run --rm --network host -v ${pwd}:/work/ -w /work/ -it mcr.microsoft.com/playwright:v1.56.0-jammy /bin/bash
 
 # Once inside the docker container, run the VRT tests: important - they MUST be ran against a HTTPS server.
 # Use the ip and port noted earlier

packages/desktop-client/e2e/accounts.test.ts

@@ -123,11 +123,14 @@ test.describe('Accounts', () => {
       const fileChooser = await fileChooserPromise;
       await fileChooser.setFiles(join(__dirname, 'data/test.csv'));
 
-      if (screenshot) await expect(page).toMatchThemeScreenshots();
-
       const importButton = accountPage.page.getByRole('button', {
         name: /Import \d+ transactions/,
       });
+
+      await importButton.waitFor({ state: 'visible' });
+
+      if (screenshot) await expect(page).toMatchThemeScreenshots();
+
       await importButton.click();
 
       await expect(importButton).not.toBeVisible();
@@ -146,12 +149,14 @@ test.describe('Accounts', () => {
       const fileChooser = await fileChooserPromise;
       await fileChooser.setFiles(join(__dirname, 'data/test.csv'));
 
-      await expect(page).toMatchThemeScreenshots();
-
       const importButton = accountPage.page.getByRole('button', {
         name: /Import \d+ transactions/,
       });
 
+      await importButton.waitFor({ state: 'visible' });
+
+      await expect(page).toMatchThemeScreenshots();
+
       await expect(importButton).toBeDisabled();
       await expect(await importButton.innerText()).toMatch(
         /Import 0 transactions/,

packages/desktop-client/e2e/bank-sync.mobile.test.ts

@@ -0,0 +1,64 @@
+import { type Page } from '@playwright/test';
+
+import { expect, test } from './fixtures';
+import { ConfigurationPage } from './page-models/configuration-page';
+import { type MobileBankSyncPage } from './page-models/mobile-bank-sync-page';
+import { MobileNavigation } from './page-models/mobile-navigation';
+
+test.describe('Mobile Bank Sync', () => {
+  let page: Page;
+  let navigation: MobileNavigation;
+  let bankSyncPage: MobileBankSyncPage;
+  let configurationPage: ConfigurationPage;
+
+  test.beforeEach(async ({ browser }) => {
+    page = await browser.newPage();
+    navigation = new MobileNavigation(page);
+    configurationPage = new ConfigurationPage(page);
+
+    await page.setViewportSize({
+      width: 350,
+      height: 600,
+    });
+
+    await page.goto('/');
+    await configurationPage.createTestFile();
+
+    bankSyncPage = await navigation.goToBankSyncPage();
+  });
+
+  test.afterEach(async () => {
+    await page.close();
+  });
+
+  test('checks the page visuals', async () => {
+    await bankSyncPage.waitToLoad();
+
+    await expect(
+      page.getByRole('heading', { name: 'Bank Sync' }),
+    ).toBeVisible();
+
+    await expect(bankSyncPage.searchBox).toBeVisible();
+    await expect(bankSyncPage.searchBox).toHaveAttribute(
+      'placeholder',
+      'Filter accounts…',
+    );
+
+    await expect(page).toMatchThemeScreenshots();
+  });
+
+  test('searches for accounts', async () => {
+    await bankSyncPage.searchFor('Checking');
+    await expect(bankSyncPage.searchBox).toHaveValue('Checking');
+    await expect(page).toMatchThemeScreenshots();
+  });
+
+  test('page handles empty state gracefully', async () => {
+    await bankSyncPage.searchFor('NonExistentAccount123456789');
+
+    const emptyMessage = page.getByText(/No accounts found/);
+    await expect(emptyMessage).toBeVisible();
+
+    await expect(page).toMatchThemeScreenshots();
+  });
+});