Merge pull request #12202 from firefly-iii/release-1777358720

🤖 Automatically merge the PR into the develop branch.
🤖 Auto commit for release 'develop' on 2026-04-28
2026-05-04 21:23:36 +00:00 · 2026-04-28 08:45:29 +02:00 · 2026-04-28 08:45:20 +02:00 · 2026-04-28 08:38:04 +02:00 · 2026-04-27 18:55:46 +02:00 · 2026-04-27 18:55:40 +02:00
20 changed files with 299 additions and 195 deletions
--- a/.ci/php-cs-fixer/composer.lock
+++ b/.ci/php-cs-fixer/composer.lock
@@ -1861,7 +1861,7 @@
        },
        {
            "name": "symfony/polyfill-ctype",
-            "version": "v1.36.0",
+            "version": "v1.37.0",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/polyfill-ctype.git",
@@ -1920,7 +1920,7 @@
                "portable"
            ],
            "support": {
-                "source": "https://github.com/symfony/polyfill-ctype/tree/v1.36.0"
+                "source": "https://github.com/symfony/polyfill-ctype/tree/v1.37.0"
            },
            "funding": [
                {
@@ -1944,16 +1944,16 @@
        },
        {
            "name": "symfony/polyfill-intl-grapheme",
-            "version": "v1.36.0",
+            "version": "v1.37.0",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/polyfill-intl-grapheme.git",
-                "reference": "ad1b7b9092976d6c948b8a187cec9faaea9ec1df"
+                "reference": "4864388bfbd3001ce88e234fab652acd91fdc57e"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-intl-grapheme/zipball/ad1b7b9092976d6c948b8a187cec9faaea9ec1df",
-                "reference": "ad1b7b9092976d6c948b8a187cec9faaea9ec1df",
+                "url": "https://api.github.com/repos/symfony/polyfill-intl-grapheme/zipball/4864388bfbd3001ce88e234fab652acd91fdc57e",
+                "reference": "4864388bfbd3001ce88e234fab652acd91fdc57e",
                "shasum": ""
            },
            "require": {
@@ -2002,7 +2002,7 @@
                "shim"
            ],
            "support": {
-                "source": "https://github.com/symfony/polyfill-intl-grapheme/tree/v1.36.0"
+                "source": "https://github.com/symfony/polyfill-intl-grapheme/tree/v1.37.0"
            },
            "funding": [
                {
@@ -2022,11 +2022,11 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-04-10T16:19:22+00:00"
+            "time": "2026-04-26T13:13:48+00:00"
        },
        {
            "name": "symfony/polyfill-intl-normalizer",
-            "version": "v1.36.0",
+            "version": "v1.37.0",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/polyfill-intl-normalizer.git",
@@ -2087,7 +2087,7 @@
                "shim"
            ],
            "support": {
-                "source": "https://github.com/symfony/polyfill-intl-normalizer/tree/v1.36.0"
+                "source": "https://github.com/symfony/polyfill-intl-normalizer/tree/v1.37.0"
            },
            "funding": [
                {
@@ -2111,7 +2111,7 @@
        },
        {
            "name": "symfony/polyfill-mbstring",
-            "version": "v1.36.0",
+            "version": "v1.37.0",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/polyfill-mbstring.git",
@@ -2172,7 +2172,7 @@
                "shim"
            ],
            "support": {
-                "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.36.0"
+                "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.37.0"
            },
            "funding": [
                {
@@ -2196,7 +2196,7 @@
        },
        {
            "name": "symfony/polyfill-php80",
-            "version": "v1.36.0",
+            "version": "v1.37.0",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/polyfill-php80.git",
@@ -2256,7 +2256,7 @@
                "shim"
            ],
            "support": {
-                "source": "https://github.com/symfony/polyfill-php80/tree/v1.36.0"
+                "source": "https://github.com/symfony/polyfill-php80/tree/v1.37.0"
            },
            "funding": [
                {
@@ -2280,7 +2280,7 @@
        },
        {
            "name": "symfony/polyfill-php81",
-            "version": "v1.36.0",
+            "version": "v1.37.0",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/polyfill-php81.git",
@@ -2336,7 +2336,7 @@
                "shim"
            ],
            "support": {
-                "source": "https://github.com/symfony/polyfill-php81/tree/v1.36.0"
+                "source": "https://github.com/symfony/polyfill-php81/tree/v1.37.0"
            },
            "funding": [
                {
@@ -2360,7 +2360,7 @@
        },
        {
            "name": "symfony/polyfill-php84",
-            "version": "v1.36.0",
+            "version": "v1.37.0",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/polyfill-php84.git",
@@ -2416,7 +2416,7 @@
                "shim"
            ],
            "support": {
-                "source": "https://github.com/symfony/polyfill-php84/tree/v1.36.0"
+                "source": "https://github.com/symfony/polyfill-php84/tree/v1.37.0"
            },
            "funding": [
                {
--- a/.github/ISSUE_TEMPLATE/fr.yml
+++ b/.github/ISSUE_TEMPLATE/fr.yml
@@ -12,6 +12,14 @@ body:
          required: true
        - label: I've used [the search](https://github.com/firefly-iii/firefly-iii/issues?q=is%3Aissue) and this has not been requested before.
          required: true
+  - type: checkboxes
+    attributes:
+      label: Use of AI
+      description: AI agents like Claude and CoPilot are not reliable tools. Do not use them.
+      options:
+        - label: I'm a real person and wrote this bug without assistance from AI.
+          required: true
+

  - type: textarea
    attributes:
--- a/.github/security.md
+++ b/.github/security.md
@@ -5,7 +5,7 @@ disclosure and response policy to ensure that critical issues are responsibly ha

 ## Supported versions

-Only the latest Firefly III release is maintained. Applicable fixes, including security fixes, will not backported to
+Only the latest Firefly III release is maintained. Applicable fixes, including security fixes, will not be backported to
 older release branches. Please refer to [releases.md](https://github.com/firefly-iii/firefly-iii/blob/main/releases.md) for details.

 ## Reporting a vulnerability - private disclosure process
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -99,11 +99,6 @@ jobs:
        env:
          FIREFLY_III_ROOT: /github/workspace
          GH_TOKEN: ''
-      - name: Setup Mago
-        uses: nhedger/setup-mago@v1
-        with:
-          version: "latest"
-          working-directory: "."
      - name: Run CI
        run: |
          cp .env.example .env
@@ -113,17 +108,19 @@ jobs:

          # format code.
          echo "Will now run Mago Format"
-          mago format
+          ./vendor/bin/mago format
          sudo chown -R runner:docker resources/lang
          echo "Will now run PHPCS"
          .ci/phpcs.sh

          # lint and check
          echo "Will now run Mago Lint"
-          mago lint
+          ./vendor/bin/mago lint
          echo "Will now run PHPstan"
          .ci/phpstan.sh
          rm .env
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Crowdin action
        uses: crowdin/github-action@v2
        with:
--- a/app/Api/V1/Requests/Models/Transaction/StoreRequest.php
+++ b/app/Api/V1/Requests/Models/Transaction/StoreRequest.php
@@ -162,12 +162,12 @@ class StoreRequest extends FormRequest
            'transactions.*.sepa_batch_id'         => 'min:1|max:255|nullable',

            // dates
-            'transactions.*.interest_date'         => 'date|nullable',
-            'transactions.*.book_date'             => 'date|nullable',
-            'transactions.*.process_date'          => 'date|nullable',
-            'transactions.*.due_date'              => 'date|nullable',
-            'transactions.*.payment_date'          => 'date|nullable',
-            'transactions.*.invoice_date'          => 'date|nullable',
+            'transactions.*.interest_date'         => 'date|nullable|after:1970-01-02|before:2038-01-17',
+            'transactions.*.book_date'             => 'date|nullable|after:1970-01-02|before:2038-01-17',
+            'transactions.*.process_date'          => 'date|nullable|after:1970-01-02|before:2038-01-17',
+            'transactions.*.due_date'              => 'date|nullable|after:1970-01-02|before:2038-01-17',
+            'transactions.*.payment_date'          => 'date|nullable|after:1970-01-02|before:2038-01-17',
+            'transactions.*.invoice_date'          => 'date|nullable|after:1970-01-02|before:2038-01-17',
        ];
    }

--- a/app/Api/V1/Requests/Models/Transaction/UpdateRequest.php
+++ b/app/Api/V1/Requests/Models/Transaction/UpdateRequest.php
@@ -209,12 +209,12 @@ class UpdateRequest extends FormRequest
            'transactions.*.sepa_batch_id'          => 'min:1|max:255|nullable',

            // dates
-            'transactions.*.interest_date'          => 'date|nullable',
-            'transactions.*.book_date'              => 'date|nullable',
-            'transactions.*.process_date'           => 'date|nullable',
-            'transactions.*.due_date'               => 'date|nullable',
-            'transactions.*.payment_date'           => 'date|nullable',
-            'transactions.*.invoice_date'           => 'date|nullable',
+            'transactions.*.interest_date'          => 'date|nullable|after:1970-01-02|before:2038-01-17',
+            'transactions.*.book_date'              => 'date|nullable|after:1970-01-02|before:2038-01-17',
+            'transactions.*.process_date'           => 'date|nullable|after:1970-01-02|before:2038-01-17',
+            'transactions.*.due_date'               => 'date|nullable|after:1970-01-02|before:2038-01-17',
+            'transactions.*.payment_date'           => 'date|nullable|after:1970-01-02|before:2038-01-17',
+            'transactions.*.invoice_date'           => 'date|nullable|after:1970-01-02|before:2038-01-17',
        ];
    }

--- a/app/Rules/IsDateOrTime.php
+++ b/app/Rules/IsDateOrTime.php
@@ -50,7 +50,7 @@ class IsDateOrTime implements ValidationRule
        if (10 === strlen($value)) {
            // probably a date format.
            try {
-                Carbon::createFromFormat('Y-m-d', $value);
+                $object = Carbon::createFromFormat('Y-m-d', $value);
            } catch (InvalidDateException $e) {
                Log::error(sprintf('"%s" is not a valid date: %s', $value, $e->getMessage()));

@@ -64,13 +64,18 @@ class IsDateOrTime implements ValidationRule

                return;
            }
+            if ($object->year < 1970) {
+                $fail('validation.date_or_time')->translate();
+
+                return;
+            }

            return;
        }

        // is an atom string, I hope?
        try {
-            Carbon::parse($value);
+            $object = Carbon::parse($value);
        } catch (InvalidDateException $e) {
            Log::error(sprintf('"%s" is not a valid date or time: %s', $value, $e->getMessage()));

@@ -82,6 +87,11 @@ class IsDateOrTime implements ValidationRule

            $fail('validation.date_or_time')->translate();

+            return;
+        }
+        if ($object->year < 1970) {
+            $fail('validation.date_or_time')->translate();
+
            return;
        }
    }
--- a/changelog.md
+++ b/changelog.md
@@ -3,6 +3,24 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).

+## v6.6.2 - 2026-04-28
+
+<!-- summary: This releases fixes a security issue and some small UI issues. Please upgrade at your earliest convenience. -->
+
+### Added
+
+- [PR 12179](https://github.com/firefly-iii/firefly-iii/pull/12179) (implement password validation JS script) reported by @tasnim0tantawi
+- [PR 12182](https://github.com/firefly-iii/firefly-iii/pull/12182) (fix shrinked sidebar expanding when navigating by clicking on icons) reported by @tasnim0tantawi
+
+### Fixed
+
+- [Issue 12169](https://github.com/firefly-iii/firefly-iii/issues/12169) (The 'Running balance' column is not showing the respective calculation instantly for new records that use 'Rules') reported by @jgmm81
+- [Issue 12186](https://github.com/firefly-iii/firefly-iii/issues/12186) (Set a year validator accepted by the system when saving or editing a transaction) reported by @jgmm81
+
+### Security
+
+- Fixed an issue where oAuth tokens could be generated before you confirmed your 2FA state. This would allow access to your data when your password was stolen, despite you having MFA enabled.
+
 ## v6.6.1 - 2026-04-19

 <!-- summary: This releases upgrades many dependencies and will invalidate all of your OAuth-tokens and clients. -->
--- a/composer.json
+++ b/composer.json
@@ -111,7 +111,9 @@
    },
    "require-dev": {
        "barryvdh/laravel-ide-helper": "^3",
+        "carthage-software/mago": "^1.24.0",
        "driftingly/rector-laravel": "^2.0",
+        "ergebnis/phpstan-rules": "^2",
        "fakerphp/faker": "1.*",
        "filp/whoops": "2.*",
        "fruitcake/laravel-debugbar": "^4.0",
@@ -124,8 +126,7 @@
        "phpstan/phpstan-strict-rules": "^2",
        "phpunit/phpunit": "^13",
        "rector/rector": "^2.3",
-        "thecodingmachine/phpstan-safe-rule": "^1.4",
-        "ergebnis/phpstan-rules": "^2"
+        "thecodingmachine/phpstan-safe-rule": "^1.4"
    },
    "replace": {
        "symfony/polyfill-php54": "*",
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "4f1f0dcde32d2f02333bd7af2cbc90eb",
+    "content-hash": "7f960fa15bddd432267fb2bb9b730195",
    "packages": [
        {
            "name": "bacon/bacon-qr-code",
@@ -4776,16 +4776,16 @@
        },
        {
            "name": "phpseclib/phpseclib",
-            "version": "3.0.51",
+            "version": "3.0.52",
            "source": {
                "type": "git",
                "url": "https://github.com/phpseclib/phpseclib.git",
-                "reference": "d59c94077f9c9915abb51ddb52ce85188ece1748"
+                "reference": "2adaefc83df2ec548558307690f376dd7d4f4fce"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/phpseclib/phpseclib/zipball/d59c94077f9c9915abb51ddb52ce85188ece1748",
-                "reference": "d59c94077f9c9915abb51ddb52ce85188ece1748",
+                "url": "https://api.github.com/repos/phpseclib/phpseclib/zipball/2adaefc83df2ec548558307690f376dd7d4f4fce",
+                "reference": "2adaefc83df2ec548558307690f376dd7d4f4fce",
                "shasum": ""
            },
            "require": {
@@ -4866,7 +4866,7 @@
            ],
            "support": {
                "issues": "https://github.com/phpseclib/phpseclib/issues",
-                "source": "https://github.com/phpseclib/phpseclib/tree/3.0.51"
+                "source": "https://github.com/phpseclib/phpseclib/tree/3.0.52"
            },
            "funding": [
                {
@@ -4882,7 +4882,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-04-10T01:33:53+00:00"
+            "time": "2026-04-27T07:02:15+00:00"
        },
        {
            "name": "pragmarx/google2fa",
@@ -8017,7 +8017,7 @@
        },
        {
            "name": "symfony/polyfill-ctype",
-            "version": "v1.36.0",
+            "version": "v1.37.0",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/polyfill-ctype.git",
@@ -8076,7 +8076,7 @@
                "portable"
            ],
            "support": {
-                "source": "https://github.com/symfony/polyfill-ctype/tree/v1.36.0"
+                "source": "https://github.com/symfony/polyfill-ctype/tree/v1.37.0"
            },
            "funding": [
                {
@@ -8100,16 +8100,16 @@
        },
        {
            "name": "symfony/polyfill-intl-grapheme",
-            "version": "v1.36.0",
+            "version": "v1.37.0",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/polyfill-intl-grapheme.git",
-                "reference": "ad1b7b9092976d6c948b8a187cec9faaea9ec1df"
+                "reference": "4864388bfbd3001ce88e234fab652acd91fdc57e"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-intl-grapheme/zipball/ad1b7b9092976d6c948b8a187cec9faaea9ec1df",
-                "reference": "ad1b7b9092976d6c948b8a187cec9faaea9ec1df",
+                "url": "https://api.github.com/repos/symfony/polyfill-intl-grapheme/zipball/4864388bfbd3001ce88e234fab652acd91fdc57e",
+                "reference": "4864388bfbd3001ce88e234fab652acd91fdc57e",
                "shasum": ""
            },
            "require": {
@@ -8158,7 +8158,7 @@
                "shim"
            ],
            "support": {
-                "source": "https://github.com/symfony/polyfill-intl-grapheme/tree/v1.36.0"
+                "source": "https://github.com/symfony/polyfill-intl-grapheme/tree/v1.37.0"
            },
            "funding": [
                {
@@ -8178,11 +8178,11 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-04-10T16:19:22+00:00"
+            "time": "2026-04-26T13:13:48+00:00"
        },
        {
            "name": "symfony/polyfill-intl-idn",
-            "version": "v1.36.0",
+            "version": "v1.37.0",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/polyfill-intl-idn.git",
@@ -8245,7 +8245,7 @@
                "shim"
            ],
            "support": {
-                "source": "https://github.com/symfony/polyfill-intl-idn/tree/v1.36.0"
+                "source": "https://github.com/symfony/polyfill-intl-idn/tree/v1.37.0"
            },
            "funding": [
                {
@@ -8269,7 +8269,7 @@
        },
        {
            "name": "symfony/polyfill-intl-normalizer",
-            "version": "v1.36.0",
+            "version": "v1.37.0",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/polyfill-intl-normalizer.git",
@@ -8330,7 +8330,7 @@
                "shim"
            ],
            "support": {
-                "source": "https://github.com/symfony/polyfill-intl-normalizer/tree/v1.36.0"
+                "source": "https://github.com/symfony/polyfill-intl-normalizer/tree/v1.37.0"
            },
            "funding": [
                {
@@ -8354,7 +8354,7 @@
        },
        {
            "name": "symfony/polyfill-php80",
-            "version": "v1.36.0",
+            "version": "v1.37.0",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/polyfill-php80.git",
@@ -8414,7 +8414,7 @@
                "shim"
            ],
            "support": {
-                "source": "https://github.com/symfony/polyfill-php80/tree/v1.36.0"
+                "source": "https://github.com/symfony/polyfill-php80/tree/v1.37.0"
            },
            "funding": [
                {
@@ -8438,7 +8438,7 @@
        },
        {
            "name": "symfony/polyfill-php84",
-            "version": "v1.36.0",
+            "version": "v1.37.0",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/polyfill-php84.git",
@@ -8494,7 +8494,7 @@
                "shim"
            ],
            "support": {
-                "source": "https://github.com/symfony/polyfill-php84/tree/v1.36.0"
+                "source": "https://github.com/symfony/polyfill-php84/tree/v1.37.0"
            },
            "funding": [
                {
@@ -8518,16 +8518,16 @@
        },
        {
            "name": "symfony/polyfill-php85",
-            "version": "v1.36.0",
+            "version": "v1.37.0",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/polyfill-php85.git",
-                "reference": "2c408a6bb0313e6001a83628dc5506100474254e"
+                "reference": "fcfa4973a9917cef23f2e38774da74a2b7d115ee"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-php85/zipball/2c408a6bb0313e6001a83628dc5506100474254e",
-                "reference": "2c408a6bb0313e6001a83628dc5506100474254e",
+                "url": "https://api.github.com/repos/symfony/polyfill-php85/zipball/fcfa4973a9917cef23f2e38774da74a2b7d115ee",
+                "reference": "fcfa4973a9917cef23f2e38774da74a2b7d115ee",
                "shasum": ""
            },
            "require": {
@@ -8574,7 +8574,7 @@
                "shim"
            ],
            "support": {
-                "source": "https://github.com/symfony/polyfill-php85/tree/v1.36.0"
+                "source": "https://github.com/symfony/polyfill-php85/tree/v1.37.0"
            },
            "funding": [
                {
@@ -8594,11 +8594,11 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-04-10T16:50:15+00:00"
+            "time": "2026-04-26T13:10:57+00:00"
        },
        {
            "name": "symfony/polyfill-uuid",
-            "version": "v1.36.0",
+            "version": "v1.37.0",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/polyfill-uuid.git",
@@ -8657,7 +8657,7 @@
                "uuid"
            ],
            "support": {
-                "source": "https://github.com/symfony/polyfill-uuid/tree/v1.36.0"
+                "source": "https://github.com/symfony/polyfill-uuid/tree/v1.37.0"
            },
            "funding": [
                {
@@ -9872,16 +9872,16 @@
        },
        {
            "name": "voku/portable-ascii",
-            "version": "2.1.0",
+            "version": "2.1.1",
            "source": {
                "type": "git",
                "url": "https://github.com/voku/portable-ascii.git",
-                "reference": "d870a33f0f79d2b4579740b0620200221ee44aeb"
+                "reference": "8e1051fe39379367aecf014f41744ce7539a856f"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/voku/portable-ascii/zipball/d870a33f0f79d2b4579740b0620200221ee44aeb",
-                "reference": "d870a33f0f79d2b4579740b0620200221ee44aeb",
+                "url": "https://api.github.com/repos/voku/portable-ascii/zipball/8e1051fe39379367aecf014f41744ce7539a856f",
+                "reference": "8e1051fe39379367aecf014f41744ce7539a856f",
                "shasum": ""
            },
            "require": {
@@ -9918,7 +9918,7 @@
            ],
            "support": {
                "issues": "https://github.com/voku/portable-ascii/issues",
-                "source": "https://github.com/voku/portable-ascii/tree/2.1.0"
+                "source": "https://github.com/voku/portable-ascii/tree/2.1.1"
            },
            "funding": [
                {
@@ -9942,7 +9942,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-04-16T23:10:39+00:00"
+            "time": "2026-04-26T05:33:54+00:00"
        }
    ],
    "packages-dev": [
@@ -10093,6 +10093,62 @@
            },
            "time": "2026-03-05T20:09:01+00:00"
        },
+        {
+            "name": "carthage-software/mago",
+            "version": "1.24.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/carthage-software/mago.git",
+                "reference": "ff885e99abe97222bb8b84dc346b59bddbe3a307"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/carthage-software/mago/zipball/ff885e99abe97222bb8b84dc346b59bddbe3a307",
+                "reference": "ff885e99abe97222bb8b84dc346b59bddbe3a307",
+                "shasum": ""
+            },
+            "require": {
+                "php": "~8.1 || ~8.2 || ~8.3 || ~8.4 || ~8.5 || ~8.6"
+            },
+            "suggest": {
+                "ext-curl": "To show binary download progress"
+            },
+            "bin": [
+                "composer/bin/mago"
+            ],
+            "type": "library",
+            "autoload": {
+                "files": [
+                    "composer/functions.php",
+                    "composer/internal.php"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT OR Apache-2.0"
+            ],
+            "authors": [
+                {
+                    "name": "Saif Eddin Gmati",
+                    "email": "azjezz@carthage.software"
+                }
+            ],
+            "description": "Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.",
+            "keywords": [
+                "dev"
+            ],
+            "support": {
+                "issues": "https://github.com/carthage-software/mago/issues",
+                "source": "https://github.com/carthage-software/mago/tree/1.24.0"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/azjezz",
+                    "type": "github"
+                }
+            ],
+            "time": "2026-04-22T07:00:59+00:00"
+        },
        {
            "name": "cloudcreativity/json-api-testing",
            "version": "v6.4.0",
--- a/config/firefly.php
+++ b/config/firefly.php
@@ -78,8 +78,8 @@ return [
        'running_balance_column' => (bool)env_default_when_empty(env('USE_RUNNING_BALANCE'), true), // this is only the default value, is not used.
        // see cer.php for exchange rates feature flag.
    ],
-'version' => 'develop/2026-04-25',
-'build_time' => 1777088715,
+'version' => 'develop/2026-04-28',
+'build_time' => 1777358720,
    'api_version'                          => '2.1.0', // field is no longer used.
    'db_version'                           => 28, // field is no longer used.

--- a/package-lock.json
+++ b/package-lock.json
@@ -1703,9 +1703,9 @@
            }
        },
        "node_modules/@emnapi/core": {
-            "version": "1.9.2",
-            "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.9.2.tgz",
-            "integrity": "sha512-UC+ZhH3XtczQYfOlu3lNEkdW/p4dsJ1r/bP7H8+rhao3TTTMO1ATq/4DdIi23XuGoFY+Cz0JmCbdVl0hz9jZcA==",
+            "version": "1.10.0",
+            "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
+            "integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
            "dev": true,
            "license": "MIT",
            "optional": true,
@@ -1715,9 +1715,9 @@
            }
        },
        "node_modules/@emnapi/runtime": {
-            "version": "1.9.2",
-            "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.9.2.tgz",
-            "integrity": "sha512-3U4+MIWHImeyu1wnmVygh5WlgfYDtyf0k8AbLhMFxOipihf6nrWC4syIm/SwEeec0mNSafiiNnMJwbza/Is6Lw==",
+            "version": "1.10.0",
+            "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
+            "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
            "dev": true,
            "license": "MIT",
            "optional": true,
@@ -1897,9 +1897,9 @@
            }
        },
        "node_modules/@oxc-project/types": {
-            "version": "0.124.0",
-            "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.124.0.tgz",
-            "integrity": "sha512-VBFWMTBvHxS11Z5Lvlr3IWgrwhMTXV+Md+EQF0Xf60+wAdsGFTBx7X7K/hP4pi8N7dcm1RvcHwDxZ16Qx8keUg==",
+            "version": "0.127.0",
+            "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.127.0.tgz",
+            "integrity": "sha512-aIYXQBo4lCbO4z0R3FHeucQHpF46l2LbMdxRvqvuRuW2OxdnSkcng5B8+K12spgLDj93rtN3+J2Vac/TIO+ciQ==",
            "dev": true,
            "license": "MIT",
            "funding": {
@@ -2241,9 +2241,9 @@
            }
        },
        "node_modules/@rolldown/binding-android-arm64": {
-            "version": "1.0.0-rc.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.0-rc.15.tgz",
-            "integrity": "sha512-YYe6aWruPZDtHNpwu7+qAHEMbQ/yRl6atqb/AhznLTnD3UY99Q1jE7ihLSahNWkF4EqRPVC4SiR4O0UkLK02tA==",
+            "version": "1.0.0-rc.17",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.0-rc.17.tgz",
+            "integrity": "sha512-s70pVGhw4zqGeFnXWvAzJDlvxhlRollagdCCKRgOsgUOH3N1l0LIxf83AtGzmb5SiVM4Hjl5HyarMRfdfj3DaQ==",
            "cpu": [
                "arm64"
            ],
@@ -2258,9 +2258,9 @@
            }
        },
        "node_modules/@rolldown/binding-darwin-arm64": {
-            "version": "1.0.0-rc.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.0-rc.15.tgz",
-            "integrity": "sha512-oArR/ig8wNTPYsXL+Mzhs0oxhxfuHRfG7Ikw7jXsw8mYOtk71W0OkF2VEVh699pdmzjPQsTjlD1JIOoHkLP1Fg==",
+            "version": "1.0.0-rc.17",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.0-rc.17.tgz",
+            "integrity": "sha512-4ksWc9n0mhlZpZ9PMZgTGjeOPRu8MB1Z3Tz0Mo02eWfWCHMW1zN82Qz/pL/rC+yQa+8ZnutMF0JjJe7PjwasYw==",
            "cpu": [
                "arm64"
            ],
@@ -2275,9 +2275,9 @@
            }
        },
        "node_modules/@rolldown/binding-darwin-x64": {
-            "version": "1.0.0-rc.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.0-rc.15.tgz",
-            "integrity": "sha512-YzeVqOqjPYvUbJSWJ4EDL8ahbmsIXQpgL3JVipmN+MX0XnXMeWomLN3Fb+nwCmP/jfyqte5I3XRSm7OfQrbyxw==",
+            "version": "1.0.0-rc.17",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.0-rc.17.tgz",
+            "integrity": "sha512-SUSDOI6WwUVNcWxd02QEBjLdY1VPHvlEkw6T/8nYG322iYWCTxRb1vzk4E+mWWYehTp7ERibq54LSJGjmouOsw==",
            "cpu": [
                "x64"
            ],
@@ -2292,9 +2292,9 @@
            }
        },
        "node_modules/@rolldown/binding-freebsd-x64": {
-            "version": "1.0.0-rc.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.0-rc.15.tgz",
-            "integrity": "sha512-9Erhx956jeQ0nNTyif1+QWAXDRD38ZNjr//bSHrt6wDwB+QkAfl2q6Mn1k6OBPerznjRmbM10lgRb1Pli4xZPw==",
+            "version": "1.0.0-rc.17",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.0-rc.17.tgz",
+            "integrity": "sha512-hwnz3nw9dbJ05EDO/PvcjaaewqqDy7Y1rn1UO81l8iIK1GjenME75dl16ajbvSSMfv66WXSRCYKIqfgq2KCfxw==",
            "cpu": [
                "x64"
            ],
@@ -2309,9 +2309,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-            "version": "1.0.0-rc.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.0-rc.15.tgz",
-            "integrity": "sha512-cVwk0w8QbZJGTnP/AHQBs5yNwmpgGYStL88t4UIaqcvYJWBfS0s3oqVLZPwsPU6M0zlW4GqjP0Zq5MnAGwFeGA==",
+            "version": "1.0.0-rc.17",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.0-rc.17.tgz",
+            "integrity": "sha512-IS+W7epTcwANmFSQFrS1SivEXHtl1JtuQA9wlxrZTcNi6mx+FDOYrakGevvvTwgj2JvWiK8B29/qD9BELZPyXQ==",
            "cpu": [
                "arm"
            ],
@@ -2326,9 +2326,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-arm64-gnu": {
-            "version": "1.0.0-rc.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.0-rc.15.tgz",
-            "integrity": "sha512-eBZ/u8iAK9SoHGanqe/jrPnY0JvBN6iXbVOsbO38mbz+ZJsaobExAm1Iu+rxa4S1l2FjG0qEZn4Rc6X8n+9M+w==",
+            "version": "1.0.0-rc.17",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.0-rc.17.tgz",
+            "integrity": "sha512-e6usGaHKW5BMNZOymS1UcEYGowQMWcgZ71Z17Sl/h2+ZziNJ1a9n3Zvcz6LdRyIW5572wBCTH/Z+bKuZouGk9Q==",
            "cpu": [
                "arm64"
            ],
@@ -2343,9 +2343,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-arm64-musl": {
-            "version": "1.0.0-rc.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.0-rc.15.tgz",
-            "integrity": "sha512-ZvRYMGrAklV9PEkgt4LQM6MjQX2P58HPAuecwYObY2DhS2t35R0I810bKi0wmaYORt6m/2Sm+Z+nFgb0WhXNcQ==",
+            "version": "1.0.0-rc.17",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.0-rc.17.tgz",
+            "integrity": "sha512-b/CgbwAJpmrRLp02RPfhbudf5tZnN9nsPWK82znefso832etkem8H7FSZwxrOI9djcdTP7U6YfNhbRnh7djErg==",
            "cpu": [
                "arm64"
            ],
@@ -2360,9 +2360,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-            "version": "1.0.0-rc.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.0-rc.15.tgz",
-            "integrity": "sha512-VDpgGBzgfg5hLg+uBpCLoFG5kVvEyafmfxGUV0UHLcL5irxAK7PKNeC2MwClgk6ZAiNhmo9FLhRYgvMmedLtnQ==",
+            "version": "1.0.0-rc.17",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.0-rc.17.tgz",
+            "integrity": "sha512-4EII1iNGRUN5WwGbF/kOh/EIkoDN9HsupgLQoXfY+D1oyJm7/F4t5PYU5n8SWZgG0FEwakyM8pGgwcBYruGTlA==",
            "cpu": [
                "ppc64"
            ],
@@ -2377,9 +2377,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-s390x-gnu": {
-            "version": "1.0.0-rc.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.0-rc.15.tgz",
-            "integrity": "sha512-y1uXY3qQWCzcPgRJATPSOUP4tCemh4uBdY7e3EZbVwCJTY3gLJWnQABgeUetvED+bt1FQ01OeZwvhLS2bpNrAQ==",
+            "version": "1.0.0-rc.17",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.0-rc.17.tgz",
+            "integrity": "sha512-AH8oq3XqQo4IibpVXvPeLDI5pzkpYn0WiZAfT05kFzoJ6tQNzwRdDYQ45M8I/gslbodRZwW8uxLhbSBbkv96rA==",
            "cpu": [
                "s390x"
            ],
@@ -2394,9 +2394,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-x64-gnu": {
-            "version": "1.0.0-rc.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.0-rc.15.tgz",
-            "integrity": "sha512-023bTPBod7J3Y/4fzAN6QtpkSABR0rigtrwaP+qSEabUh5zf6ELr9Nc7GujaROuPY3uwdSIXWrvhn1KxOvurWA==",
+            "version": "1.0.0-rc.17",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.0-rc.17.tgz",
+            "integrity": "sha512-cLnjV3xfo7KslbU41Z7z8BH/E1y5mzUYzAqih1d1MDaIGZRCMqTijqLv76/P7fyHuvUcfGsIpqCdddbxLLK9rA==",
            "cpu": [
                "x64"
            ],
@@ -2411,9 +2411,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-x64-musl": {
-            "version": "1.0.0-rc.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.0-rc.15.tgz",
-            "integrity": "sha512-witB2O0/hU4CgfOOKUoeFgQ4GktPi1eEbAhaLAIpgD6+ZnhcPkUtPsoKKHRzmOoWPZue46IThdSgdo4XneOLYw==",
+            "version": "1.0.0-rc.17",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.0-rc.17.tgz",
+            "integrity": "sha512-0phclDw1spsL7dUB37sIARuis2tAgomCJXAHZlpt8PXZ4Ba0dRP1e+66lsRqrfhISeN9bEGNjQs+T/Fbd7oYGw==",
            "cpu": [
                "x64"
            ],
@@ -2428,9 +2428,9 @@
            }
        },
        "node_modules/@rolldown/binding-openharmony-arm64": {
-            "version": "1.0.0-rc.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.0-rc.15.tgz",
-            "integrity": "sha512-UCL68NJ0Ud5zRipXZE9dF5PmirzJE4E4BCIOOssEnM7wLDsxjc6Qb0sGDxTNRTP53I6MZpygyCpY8Aa8sPfKPg==",
+            "version": "1.0.0-rc.17",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.0-rc.17.tgz",
+            "integrity": "sha512-0ag/hEgXOwgw4t8QyQvUCxvEg+V0KBcA6YuOx9g0r02MprutRF5dyljgm3EmR02O292UX7UeS6HzWHAl6KgyhA==",
            "cpu": [
                "arm64"
            ],
@@ -2445,9 +2445,9 @@
            }
        },
        "node_modules/@rolldown/binding-wasm32-wasi": {
-            "version": "1.0.0-rc.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.0-rc.15.tgz",
-            "integrity": "sha512-ApLruZq/ig+nhaE7OJm4lDjayUnOHVUa77zGeqnqZ9pn0ovdVbbNPerVibLXDmWeUZXjIYIT8V3xkT58Rm9u5Q==",
+            "version": "1.0.0-rc.17",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.0-rc.17.tgz",
+            "integrity": "sha512-LEXei6vo0E5wTGwpkJ4KoT3OZJRnglwldt5ziLzOlc6qqb55z4tWNq2A+PFqCJuvWWdP53CVhG1Z9NtToDPJrA==",
            "cpu": [
                "wasm32"
            ],
@@ -2455,18 +2455,18 @@
            "license": "MIT",
            "optional": true,
            "dependencies": {
-                "@emnapi/core": "1.9.2",
-                "@emnapi/runtime": "1.9.2",
-                "@napi-rs/wasm-runtime": "^1.1.3"
+                "@emnapi/core": "1.10.0",
+                "@emnapi/runtime": "1.10.0",
+                "@napi-rs/wasm-runtime": "^1.1.4"
            },
            "engines": {
-                "node": ">=14.0.0"
+                "node": "^20.19.0 || >=22.12.0"
            }
        },
        "node_modules/@rolldown/binding-win32-arm64-msvc": {
-            "version": "1.0.0-rc.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.0-rc.15.tgz",
-            "integrity": "sha512-KmoUoU7HnN+Si5YWJigfTws1jz1bKBYDQKdbLspz0UaqjjFkddHsqorgiW1mxcAj88lYUE6NC/zJNwT+SloqtA==",
+            "version": "1.0.0-rc.17",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.0-rc.17.tgz",
+            "integrity": "sha512-gUmyzBl3SPMa6hrqFUth9sVfcLBlYsbMzBx5PlexMroZStgzGqlZ26pYG89rBb45Mnia+oil6YAIFeEWGWhoZA==",
            "cpu": [
                "arm64"
            ],
@@ -2481,9 +2481,9 @@
            }
        },
        "node_modules/@rolldown/binding-win32-x64-msvc": {
-            "version": "1.0.0-rc.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.0-rc.15.tgz",
-            "integrity": "sha512-3P2A8L+x75qavWLe/Dll3EYBJLQmtkJN8rfh+U/eR3MqMgL/h98PhYI+JFfXuDPgPeCB7iZAKiqii5vqOvnA0g==",
+            "version": "1.0.0-rc.17",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.0-rc.17.tgz",
+            "integrity": "sha512-3hkiolcUAvPB9FLb3UZdfjVVNWherN1f/skkGWJP/fgSQhYUZpSIRr0/I8ZK9TkF3F7kxvJAk0+IcKvPHk9qQg==",
            "cpu": [
                "x64"
            ],
@@ -2498,9 +2498,9 @@
            }
        },
        "node_modules/@rolldown/pluginutils": {
-            "version": "1.0.0-rc.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-rc.15.tgz",
-            "integrity": "sha512-UromN0peaE53IaBRe9W7CjrZgXl90fqGpK+mIZbA3qSTeYqg3pqpROBdIPvOG3F5ereDHNwoHBI2e50n1BDr1g==",
+            "version": "1.0.0-rc.17",
+            "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-rc.17.tgz",
+            "integrity": "sha512-n8iosDOt6Ig1UhJ2AYqoIhHWh/isz0xpicHTzpKBeotdVsTEcxsSA/i3EVM7gQAj0rU27OLAxCjzlj15IWY7bg==",
            "dev": true,
            "license": "MIT"
        },
@@ -3681,9 +3681,9 @@
            "license": "MIT"
        },
        "node_modules/baseline-browser-mapping": {
-            "version": "2.10.21",
-            "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.21.tgz",
-            "integrity": "sha512-Q+rUQ7Uz8AHM7DEaNdwvfFCTq7a43lNTzuS94eiWqwyxfV/wJv+oUivef51T91mmRY4d4A1u9rcSvkeufCVXlA==",
+            "version": "2.10.23",
+            "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.23.tgz",
+            "integrity": "sha512-xwVXGqevyKPsiuQdLj+dZMVjidjJV508TBqexND5HrF89cGdCYCJFB3qhcxRHSeMctdCfbR1jrxBajhDy7o29g==",
            "dev": true,
            "license": "Apache-2.0",
            "bin": {
@@ -4117,9 +4117,9 @@
            }
        },
        "node_modules/caniuse-lite": {
-            "version": "1.0.30001790",
-            "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001790.tgz",
-            "integrity": "sha512-bOoxfJPyYo+ds6W0YfptaCWbFnJYjh2Y1Eow5lRv+vI2u8ganPZqNm1JwNh0t2ELQCqIWg4B3dWEusgAmsoyOw==",
+            "version": "1.0.30001791",
+            "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001791.tgz",
+            "integrity": "sha512-yk0l/YSrOnFZk3UROpDLQD9+kC1l4meK/wed583AXrzoarMGJcbRi2Q4RaUYbKxYAsZ8sWmaSa/DsLmdBeI1vQ==",
            "dev": true,
            "funding": [
                {
@@ -5446,9 +5446,9 @@
            }
        },
        "node_modules/es-module-lexer": {
-            "version": "2.0.0",
-            "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.0.0.tgz",
-            "integrity": "sha512-5POEcUuZybH7IdmGsD8wlf0AI55wMecM9rVBTI/qEAy2c1kTOm3DjFYjrBdI2K3BaJjJYfYFeRtM0t9ssnRuxw==",
+            "version": "2.1.0",
+            "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.1.0.tgz",
+            "integrity": "sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ==",
            "dev": true,
            "license": "MIT"
        },
@@ -8741,9 +8741,9 @@
            }
        },
        "node_modules/postcss": {
-            "version": "8.5.10",
-            "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.10.tgz",
-            "integrity": "sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ==",
+            "version": "8.5.12",
+            "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.12.tgz",
+            "integrity": "sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==",
            "dev": true,
            "funding": [
                {
@@ -9878,14 +9878,14 @@
            }
        },
        "node_modules/rolldown": {
-            "version": "1.0.0-rc.15",
-            "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.0-rc.15.tgz",
-            "integrity": "sha512-Ff31guA5zT6WjnGp0SXw76X6hzGRk/OQq2hE+1lcDe+lJdHSgnSX6nK3erbONHyCbpSj9a9E+uX/OvytZoWp2g==",
+            "version": "1.0.0-rc.17",
+            "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.0-rc.17.tgz",
+            "integrity": "sha512-ZrT53oAKrtA4+YtBWPQbtPOxIbVDbxT0orcYERKd63VJTF13zPcgXTvD4843L8pcsI7M6MErt8QtON6lrB9tyA==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
-                "@oxc-project/types": "=0.124.0",
-                "@rolldown/pluginutils": "1.0.0-rc.15"
+                "@oxc-project/types": "=0.127.0",
+                "@rolldown/pluginutils": "1.0.0-rc.17"
            },
            "bin": {
                "rolldown": "bin/cli.mjs"
@@ -9894,21 +9894,21 @@
                "node": "^20.19.0 || >=22.12.0"
            },
            "optionalDependencies": {
-                "@rolldown/binding-android-arm64": "1.0.0-rc.15",
-                "@rolldown/binding-darwin-arm64": "1.0.0-rc.15",
-                "@rolldown/binding-darwin-x64": "1.0.0-rc.15",
-                "@rolldown/binding-freebsd-x64": "1.0.0-rc.15",
-                "@rolldown/binding-linux-arm-gnueabihf": "1.0.0-rc.15",
-                "@rolldown/binding-linux-arm64-gnu": "1.0.0-rc.15",
-                "@rolldown/binding-linux-arm64-musl": "1.0.0-rc.15",
-                "@rolldown/binding-linux-ppc64-gnu": "1.0.0-rc.15",
-                "@rolldown/binding-linux-s390x-gnu": "1.0.0-rc.15",
-                "@rolldown/binding-linux-x64-gnu": "1.0.0-rc.15",
-                "@rolldown/binding-linux-x64-musl": "1.0.0-rc.15",
-                "@rolldown/binding-openharmony-arm64": "1.0.0-rc.15",
-                "@rolldown/binding-wasm32-wasi": "1.0.0-rc.15",
-                "@rolldown/binding-win32-arm64-msvc": "1.0.0-rc.15",
-                "@rolldown/binding-win32-x64-msvc": "1.0.0-rc.15"
+                "@rolldown/binding-android-arm64": "1.0.0-rc.17",
+                "@rolldown/binding-darwin-arm64": "1.0.0-rc.17",
+                "@rolldown/binding-darwin-x64": "1.0.0-rc.17",
+                "@rolldown/binding-freebsd-x64": "1.0.0-rc.17",
+                "@rolldown/binding-linux-arm-gnueabihf": "1.0.0-rc.17",
+                "@rolldown/binding-linux-arm64-gnu": "1.0.0-rc.17",
+                "@rolldown/binding-linux-arm64-musl": "1.0.0-rc.17",
+                "@rolldown/binding-linux-ppc64-gnu": "1.0.0-rc.17",
+                "@rolldown/binding-linux-s390x-gnu": "1.0.0-rc.17",
+                "@rolldown/binding-linux-x64-gnu": "1.0.0-rc.17",
+                "@rolldown/binding-linux-x64-musl": "1.0.0-rc.17",
+                "@rolldown/binding-openharmony-arm64": "1.0.0-rc.17",
+                "@rolldown/binding-wasm32-wasi": "1.0.0-rc.17",
+                "@rolldown/binding-win32-arm64-msvc": "1.0.0-rc.17",
+                "@rolldown/binding-win32-x64-msvc": "1.0.0-rc.17"
            }
        },
        "node_modules/run-parallel": {
@@ -11241,17 +11241,17 @@
            }
        },
        "node_modules/vite": {
-            "version": "8.0.8",
-            "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.8.tgz",
-            "integrity": "sha512-dbU7/iLVa8KZALJyLOBOQ88nOXtNG8vxKuOT4I2mD+Ya70KPceF4IAmDsmU0h1Qsn5bPrvsY9HJstCRh3hG6Uw==",
+            "version": "8.0.10",
+            "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.10.tgz",
+            "integrity": "sha512-rZuUu9j6J5uotLDs+cAA4O5H4K1SfPliUlQwqa6YEwSrWDZzP4rhm00oJR5snMewjxF5V/K3D4kctsUTsIU9Mw==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
                "lightningcss": "^1.32.0",
                "picomatch": "^4.0.4",
-                "postcss": "^8.5.8",
-                "rolldown": "1.0.0-rc.15",
-                "tinyglobby": "^0.2.15"
+                "postcss": "^8.5.10",
+                "rolldown": "1.0.0-rc.17",
+                "tinyglobby": "^0.2.16"
            },
            "bin": {
                "vite": "bin/vite.js"
@@ -12238,7 +12238,7 @@
                "laravel-vite-plugin": "^3",
                "patch-package": "^8",
                "sass": "^1",
-                "vite": "=8.0.8",
+                "vite": "=8.0.10",
                "vite-plugin-manifest-sri": "^0.2.0"
            }
        }
--- a/public/v1/js/ff/auth/register.js
+++ b/public/v1/js/ff/auth/register.js
@@ -18,7 +18,8 @@
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

-(function () {
+$(function () {
+    "use strict";
    const form        = document.querySelector('form[action="'+route+'"]');
    const errorBox    = document.getElementById('client-errors');
    const errorList   = document.getElementById('client-errors-list');
--- a/public/v1/js/ff/firefly.js
+++ b/public/v1/js/ff/firefly.js
@@ -38,9 +38,9 @@ function parseToLocalDates() {
        var obj = moment.utc(date).local();

        console.log('auto convert to timezone is:     "' + obj.format() + '"');
-        console.log('moment.js format is:             "'+date_time_js+'"');
+        console.log('moment.js format is:             "' + date_time_js + '"');

-        $(this).text(obj.format(date_time_js) + ' ('+ timeZone +')');
+        $(this).text(obj.format(date_time_js) + ' (' + timeZone + ')');
    });
 }

@@ -50,19 +50,25 @@ $(function () {
    configAccounting(currencySymbol);

    // on submit of logout button:
-    $('.logout-link').click(function(e) {
+    $('.logout-link').click(function (e) {
        e.preventDefault();
        document.getElementById('logout-form').submit();
        return false;
    });

+    // save sidebar collapsed state when page loads.
+    $('[data-toggle="push-menu"]').click(function () {
+        localStorage.setItem('ff3_sidebar_collapsed', (!$('body').hasClass('sidebar-collapse')).toString());
+    });
+
+
+
    // on submit of form, disable any button in form:
    $('form.form-horizontal:not(.nodisablebutton)').on('submit', function () {
        $('button[type="submit"]').prop('disabled', true);
    });


-
    // when you click on a currency, this happens:
    $('.currency-option').on('click', currencySelect);

--- a/resources/assets/v1/src/locales/it.json
+++ b/resources/assets/v1/src/locales/it.json
@@ -1,7 +1,7 @@
 {
    "firefly": {
        "explain_pats": "I token di accesso personale sono chiavi lunghe (con un massimo di 1 anno) che consentono l'accesso diretto e illimitato ai tuoi dati di Firefly III. Strumenti come il Firefly III Data Importer e l'integrazione di Firefly III in Home Assistant utilizzano tali token per connettersi a Firefly III e usarlo. Quando si crea un token, \u00e8 visibile solo una volta. Il token \u00e8 molto lungo.",
-        "profile_oauth_clients_explain": "An OAuth client can be used to connect \"smart\" applications to Firefly III: applications that are capable of redirecting you to your Firefly III, get your permission, and return you back. The Firefly III Data Importer is such an application. OAuth clients can be generated with or without a \"secret\". This secret is used to authenticate the client. Since not all clients are capable of storing the secret, so you have the option to generate a client without one.",
+        "profile_oauth_clients_explain": "Un client OAuth pu\u00f2 essere utilizzato per connettere applicazioni \"intelligenti\" a Firefly III: applicazioni in grado di reindirizzarti al tuo Firefly III, ottenere la tua autorizzazione e riportarti indietro. Firefly III Data Importer \u00e8 un esempio di tale applicazione. I client OAuth possono essere generati con o senza una \"chiave segreta\". Questa chiave segreta viene utilizzata per autenticare il client. Poich\u00e9 non tutti i client sono in grado di memorizzare la chiave segreta, hai la possibilit\u00e0 di generare un client senza di essa.",
        "regenerate_secret": "Rigenera chiave segreta",
        "administrations_page_title": "Amministrazioni finanziarie",
        "administrations_index_menu": "Amministrazioni finanziarie",
@@ -104,8 +104,8 @@
        "piggy_bank": "Salvadanaio",
        "profile_oauth_client_secret_title": "Segreto del client",
        "profile_oauth_client_secret_expl": "Ecco il segreto del nuovo client. Questa \u00e8 l'unica occasione in cui viene mostrato pertanto non perderlo! Ora puoi usare questo segreto per effettuare delle richieste alle API.",
-        "profile_oauth_confidential": "Keep a secret?",
-        "profile_oauth_confidential_help": "Can the application you're using this for keep a secret? The Firefly III Data Importer CANNOT keep a secret, so UNCHECK the box. In other cases, it's up to you.",
+        "profile_oauth_confidential": "Mantenere un segreto?",
+        "profile_oauth_confidential_help": "L'applicazione che stai utilizzando pu\u00f2 mantenere un segreto? Firefly III Data Importer NON pu\u00f2 mantenere un segreto, quindi DESELEZIONARE la casella. Negli altri casi, la scelta \u00e8 a tua discrezione.",
        "multi_account_warning_unknown": "A seconda del tipo di transazione che hai creato, il conto di origine e\/o destinazione delle successive suddivisioni pu\u00f2 essere sovrascritto da qualsiasi cosa sia definita nella prima suddivisione della transazione.",
        "multi_account_warning_withdrawal": "Ricorda che il conto di origine delle successive suddivisioni verr\u00e0 sovrascritto da quello definito nella prima suddivisione del prelievo.",
        "multi_account_warning_deposit": "Ricorda che il conto di destinazione delle successive suddivisioni verr\u00e0 sovrascritto da quello definito nella prima suddivisione del deposito.",
--- a/resources/assets/v2/package.json
+++ b/resources/assets/v2/package.json
@@ -12,7 +12,7 @@
        "laravel-vite-plugin": "^3",
        "patch-package": "^8",
        "sass": "^1",
-        "vite": "=8.0.8",
+        "vite": "=8.0.10",
        "vite-plugin-manifest-sri": "^0.2.0"
    },
    "dependencies": {
--- a/resources/lang/en_US/firefly.php
+++ b/resources/lang/en_US/firefly.php
@@ -1621,7 +1621,7 @@ return [
    'secure_pw_ff'                                        => 'Do you use the same password all over the internet? If one site loses your password, hackers have access to all your data. Firefly III relies on you to choose a strong and unique password to protect your financial records.',
    'secure_pw_check_box'                                 => 'To help you do that Firefly III can check if the password you want to use has been stolen in the past. If this is the case, Firefly III advises you NOT to use that password.',
    'secure_pw_working_title'                             => 'How does it work?',
-    'secure_pw_working'                                   => 'By checking the box, Firefly III will send the first five characters of the SHA1 hash of your password to <a href="https://www.troyhunt.com/introducing-306-million-freely-downloadable-pwned-passwords/">the website of Troy Hunt</a> to see if it is on the list. This will stop you from using unsafe passwords as is recommended in the latest <a href="https://pages.nist.gov/800-63-3/sp800-63b.html">NIST Special Publication</a> on this subject.',
+    'secure_pw_working'                                   => 'By checking the box, Firefly III will send the first five characters of the SHA1 hash of your password to <a href="https://haveibeenpwned.com/API/v3#PwnedPasswords">the website of Troy Hunt</a> to see if it is on the list. This will stop you from using unsafe passwords as is recommended in the latest <a href="https://pages.nist.gov/800-63-3/sp800-63b.html">NIST Special Publication</a> on this subject.',
    'secure_pw_should'                                    => 'Should I check the box?',
    'secure_pw_long_password'                             => 'Yes. Always verify your password is safe.',
    'command_line_token'                                  => 'Command line token',
--- a/resources/views/auth/register.blade.php
+++ b/resources/views/auth/register.blade.php
@@ -49,7 +49,7 @@
                </div>
                <div class="row">
                    <div class="col-12">
-                            <input type="checkbox" id="verify_password" checked name="verify_password" value="1">
+                            <input type="checkbox" id="verify_password" name="verify_password" value="1">
                            <label for="verify_password">
                                {{ trans('form.verify_password') }}
                                <a href="#"
--- a/resources/views/layout/default.twig
+++ b/resources/views/layout/default.twig
@@ -86,14 +86,18 @@
    <script src="v1/js/lib/respond.min.js?v={{ FF_BUILD_TIME }}" nonce="{{ JS_NONCE }}"></script>
    <![endif]-->

-    {# this entry is in the header so it's loaded early #}
-    <script type="text/javascript" nonce="{{ JS_NONCE }}">var forceDemoOff = false;</script>
-
    {# favicons #}
    {% include 'partials.favicons' %}

 </head>
 <body class="skin-firefly-iii sidebar-mini hold-transition">
+{# this entry is in the header so it's loaded early #}
+<script type="text/javascript" nonce="{{ JS_NONCE }}">
+    var forceDemoOff = false;
+    if ('true' === localStorage.getItem('ff3_sidebar_collapsed')) {
+        document.body.classList.add('sidebar-collapse');
+    }
+</script>
 <div class="wrapper" id="app">

    <header class="main-header">
--- a/routes/web.php
+++ b/routes/web.php
@@ -387,6 +387,9 @@ Route::group(
    }
 );

+
+
+
 // exchange rates controller
 Route::group(
    ['middleware' => 'user-full-auth', 'namespace' => 'FireflyIII\Http\Controllers\ExchangeRates', 'prefix' => 'exchange-rates', 'as' => 'exchange-rates.'],
Author	SHA1	Message	Date
github-actions[bot]	e47ce30579	Merge pull request #12202 from firefly-iii/release-1777358720 🤖 Automatically merge the PR into the develop branch.	2026-04-28 08:45:29 +02:00
JC5	7e6eadc047	🤖 Auto commit for release 'develop' on 2026-04-28	2026-04-28 08:45:20 +02:00
Sander Dorigo	dae4f6f351	Add clarity on password validation api	2026-04-28 08:38:04 +02:00
github-actions[bot]	8c8af51bc4	Merge pull request #12200 from firefly-iii/develop 🤖 Automatically merge the PR into the main branch.	2026-04-27 18:55:46 +02:00
github-actions[bot]	a5e1cba39c	Merge pull request #12199 from firefly-iii/release-1777308933 🤖 Automatically merge the PR into the develop branch.	2026-04-27 18:55:40 +02:00
JC5	96d56ad723	🤖 Auto commit for release 'v6.6.2' on 2026-04-27	2026-04-27 18:55:33 +02:00
James Cole	e4b1c3045e	Update Mago Lint command to use vendor path Signed-off-by: James Cole <james@firefly-iii.org>	2026-04-27 18:50:27 +02:00
James Cole	e974594fe3	Merge branch 'main' into develop	2026-04-27 18:46:22 +02:00
James Cole	c93a2dc23a	Refactor CI workflow by removing Mago setup Removed Mago setup step and updated command path. Signed-off-by: James Cole <james@firefly-iii.org>	2026-04-27 18:41:58 +02:00
James Cole	639efee78a	Add mago.	2026-04-27 18:41:49 +02:00
James Cole	eb4971fec6	Add latest version setup for Mago in release workflow Signed-off-by: James Cole <james@firefly-iii.org>	2026-04-27 18:36:24 +02:00
James Cole	0c63a3380d	Refactor Setup Mago step in release workflow Removed working-directory input from Setup Mago step. Signed-off-by: James Cole <james@firefly-iii.org>	2026-04-27 18:32:52 +02:00
James Cole	edd30b2d42	Merge branch 'main' into develop	2026-04-27 18:28:03 +02:00
github-actions[bot]	a4f6c2b748	Merge pull request #12198 from firefly-iii/release-1777307205 🤖 Automatically merge the PR into the develop branch.	2026-04-27 18:26:52 +02:00
JC5	5fc90e0f76	🤖 Auto commit for release 'develop' on 2026-04-27	2026-04-27 18:26:45 +02:00
James Cole	e8ab7d8a93	Specify version for Mago setup in release workflow Update Mago setup to use a specific version. Signed-off-by: James Cole <james@firefly-iii.org>	2026-04-27 18:20:27 +02:00
James Cole	e73d04bc0f	Merge branch 'develop' of github.com:firefly-iii/firefly-iii into develop	2026-04-27 18:15:08 +02:00
James Cole	c0eca4298a	Updated templates.	2026-04-27 18:14:58 +02:00
github-actions[bot]	dafb43393a	Merge pull request #12197 from firefly-iii/release-1777306297 🤖 Automatically merge the PR into the develop branch.	2026-04-27 18:11:47 +02:00
JC5	ba8155a391	🤖 Auto commit for release 'develop' on 2026-04-27	2026-04-27 18:11:37 +02:00
James Cole	9e4329ebfc	Update changelog.	2026-04-27 18:05:39 +02:00
James Cole	60e2645e54	Merge pull request #12194 from firefly-iii/dependabot/npm_and_yarn/develop/vite-8.0.10 Bump vite from 8.0.8 to 8.0.10	2026-04-27 16:18:03 +02:00
github-actions[bot]	33a9e5b3f0	Merge pull request #12196 from firefly-iii/release-1777263537 🤖 Automatically merge the PR into the develop branch.	2026-04-27 06:19:05 +02:00
JC5	cd0290475b	🤖 Auto commit for release 'develop' on 2026-04-27	2026-04-27 06:18:57 +02:00
dependabot[bot]	45528cf7d3	Bump vite from 8.0.8 to 8.0.10 Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.8 to 8.0.10. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.10/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.0.10 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-04-27 03:52:35 +00:00
James Cole	7cfd21362a	Fix https://github.com/firefly-iii/firefly-iii/issues/12186	2026-04-26 05:12:39 +02:00
github-actions[bot]	f91063c88b	Merge pull request #12184 from firefly-iii/release-1777100403 🤖 Automatically merge the PR into the develop branch.	2026-04-25 09:00:10 +02:00
JC5	30c1f4c13d	🤖 Auto commit for release 'develop' on 2026-04-25	2026-04-25 09:00:03 +02:00
James Cole	39be5075eb	Clean up JS scripts.	2026-04-25 08:54:28 +02:00
James Cole	714133dad5	Merge pull request #12182 from tasnim0tantawi/bug/fix-sidebar-expanding-when-navigating fix shrinked sidebar expanding when navigating by clicking on icons	2026-04-25 08:45:47 +02:00
James Cole	1caf639b85	Move to jQuery func	2026-04-25 08:45:20 +02:00
tasnim0tantawi	1ebff22785	fix delay	2026-04-24 22:42:22 +03:00
tasnim0tantawi	8b14a11969	lines	2026-04-24 22:28:06 +03:00
tasnim0tantawi	7b0e40543b	all code in firefly js	2026-04-24 22:26:38 +03:00
tasnim0tantawi	ea57a0a8c8	remove code from default twig	2026-04-24 21:49:37 +03:00
tasnim0tantawi	62ee37f631	implement collapse save in v1	2026-04-24 21:17:19 +03:00
tasnim0tantawi	c96cc8d941	fix shrinked sidebar expanding when navigating by clicking on icons	2026-04-24 21:01:03 +03:00