Merge pull request #12202 from firefly-iii/release-1777358720

🤖 Automatically merge the PR into the develop branch.

.github/ISSUE_TEMPLATE/fr.yml

@@ -12,6 +12,14 @@ body:
           required: true
         - label: I've used [the search](https://github.com/firefly-iii/firefly-iii/issues?q=is%3Aissue) and this has not been requested before.
           required: true
+  - type: checkboxes
+    attributes:
+      label: Use of AI
+      description: AI agents like Claude and CoPilot are not reliable tools. Do not use them.
+      options:
+        - label: I'm a real person and wrote this bug without assistance from AI.
+          required: true
+
 
   - type: textarea
     attributes:

.github/security.md

@@ -5,7 +5,7 @@ disclosure and response policy to ensure that critical issues are responsibly ha
 
 ## Supported versions
 
-Only the latest Firefly III release is maintained. Applicable fixes, including security fixes, will not backported to
+Only the latest Firefly III release is maintained. Applicable fixes, including security fixes, will not be backported to
 older release branches. Please refer to [releases.md](https://github.com/firefly-iii/firefly-iii/blob/main/releases.md) for details.
 
 ## Reporting a vulnerability - private disclosure process

.github/workflows/release.yml

@@ -99,11 +99,6 @@ jobs:
         env:
           FIREFLY_III_ROOT: /github/workspace
           GH_TOKEN: ''
-      - name: Setup Mago
-        uses: nhedger/setup-mago@v1
-        with:
-          version: "latest"
-          working-directory: "."
       - name: Run CI
         run: |
           cp .env.example .env
@@ -113,17 +108,19 @@ jobs:
 
           # format code.
           echo "Will now run Mago Format"
-          mago format
+          ./vendor/bin/mago format
           sudo chown -R runner:docker resources/lang
           echo "Will now run PHPCS"
           .ci/phpcs.sh
 
           # lint and check
           echo "Will now run Mago Lint"
-          mago lint
+          ./vendor/bin/mago lint
           echo "Will now run PHPstan"
           .ci/phpstan.sh
           rm .env
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Crowdin action
         uses: crowdin/github-action@v2
         with:

app/Api/V1/Controllers/Insight/Income/TagController.php

@@ -158,10 +158,7 @@ final class TagController extends Controller
                         'currency_id'      => (string) $foreignCurrencyId,
                         'currency_code'    => $journal['foreign_currency_code'],
                     ];
-                    $response[$foreignKey]['difference']       = bcadd(
-                        (string) $response[$foreignKey]['difference'],
-                        Steam::positive($journal['foreign_amount'])
-                    );
+                    $response[$foreignKey]['difference']       = bcadd((string) $response[$foreignKey]['difference'], Steam::positive($journal['foreign_amount']));
                     $response[$foreignKey]['difference_float'] = (float) $response[$foreignKey]['difference'];
                 }
             }

app/Api/V1/Controllers/Insight/Transfer/TagController.php

@@ -155,10 +155,7 @@ final class TagController extends Controller
                         'currency_id'      => (string) $foreignCurrencyId,
                         'currency_code'    => $journal['foreign_currency_code'],
                     ];
-                    $response[$foreignKey]['difference']       = bcadd(
-                        (string) $response[$foreignKey]['difference'],
-                        Steam::positive($journal['foreign_amount'])
-                    );
+                    $response[$foreignKey]['difference']       = bcadd((string) $response[$foreignKey]['difference'], Steam::positive($journal['foreign_amount']));
                     $response[$foreignKey]['difference_float'] = (float) $response[$foreignKey]['difference']; // intentional float
                 }
             }

app/Http/Controllers/Bill/IndexController.php

@@ -255,10 +255,7 @@ final class IndexController extends Controller
                     if (count($bill['paid_dates']) < count($bill['pay_dates'])) {
                         $count = count($bill['pay_dates']) - count($bill['paid_dates']);
                         if ($count > 0) {
-                            $avg                                                 = bcdiv(
-                                bcadd((string) $bill['amount_min'], (string) $bill['amount_max']),
-                                '2'
-                            );
+                            $avg                                                 = bcdiv(bcadd((string) $bill['amount_min'], (string) $bill['amount_max']), '2');
                             $avg                                                 = bcmul($avg, (string) $count);
                             $sums[$groupOrder][$currencyId]['total_left_to_pay'] = bcadd($sums[$groupOrder][$currencyId]['total_left_to_pay'], $avg);
                             Log::debug(

app/Http/Controllers/Budget/BudgetLimitController.php

@@ -198,13 +198,7 @@ final class BudgetLimitController extends Controller
         if ($request->expectsJson()) {
             $array                           = $limit->toArray();
             // add some extra metadata:
-            $spentArr                        = $this->opsRepository->sumExpenses(
-                $limit->start_date,
-                $limit->end_date,
-                null,
-                new Collection()->push($budget),
-                $currency
-            );
+            $spentArr                        = $this->opsRepository->sumExpenses($limit->start_date, $limit->end_date, null, new Collection()->push($budget), $currency);
             $array['spent']                  = $spentArr[$currency->id]['sum'] ?? '0';
             $array['left_formatted']         = Amount::formatAnything($limit->transactionCurrency, bcadd($array['spent'], (string) $array['amount']));
             $array['amount_formatted']       = Amount::formatAnything($limit->transactionCurrency, $limit['amount']);

app/Http/Controllers/Budget/IndexController.php

@@ -245,7 +245,13 @@ final class IndexController extends Controller
                 $inPast                       = $limitPeriod->startsBefore(now()) && $limitPeriod->endsBefore(now());
                 $currency                     = $limit->transactionCurrency ?? $primaryCurrency;
                 $amount                       = Steam::bcround($limit->amount, $currency->decimal_places);
-                $spent                        = $this->opsRepository->sumExpenses($limit->start_date, $limit->end_date, null, new Collection()->push($budget), $currency);
+                $spent                        = $this->opsRepository->sumExpenses(
+                    $limit->start_date,
+                    $limit->end_date,
+                    null,
+                    new Collection()->push($budget),
+                    $currency
+                );
                 $spentAmount                  = $spent[$currency->id]['sum'] ?? '0';
                 $array['budgeted'][]          = [
                     'id'                      => $limit->id,
@@ -283,10 +289,7 @@ final class IndexController extends Controller
 
                 if (array_key_exists($currency->id, $spentArr) && array_key_exists('sum', $spentArr[$currency->id])) {
                     $array['spent'][$currency->id]['spent']                   = $spentArr[$currency->id]['sum'];
-                    $array['spent'][$currency->id]['spent_outside']           = bcmul(
-                        bcsub($spentInLimits[$currency->id], $spentArr[$currency->id]['sum']),
-                        '-1'
-                    );
+                    $array['spent'][$currency->id]['spent_outside']           = bcmul(bcsub($spentInLimits[$currency->id], $spentArr[$currency->id]['sum']), '-1');
                     $array['spent'][$currency->id]['currency_id']             = $currency->id;
                     $array['spent'][$currency->id]['currency_symbol']         = $currency->symbol;
                     $array['spent'][$currency->id]['currency_decimal_places'] = $currency->decimal_places;

app/Http/Controllers/Chart/BudgetController.php

@@ -539,13 +539,7 @@ final class BudgetController extends Controller
             }
 
             // get spent amount in this period for this currency.
-            $sum                             = $this->opsRepository->sumExpenses(
-                $currentStart,
-                $currentEnd,
-                $accounts,
-                new Collection()->push($budget),
-                $currency
-            );
+            $sum                             = $this->opsRepository->sumExpenses($currentStart, $currentEnd, $accounts, new Collection()->push($budget), $currency);
             $amount                          = Steam::positive($sum[$currency->id]['sum'] ?? '0');
             $chartData[0]['entries'][$title] = Steam::bcround($amount, $currency->decimal_places);
 

app/Jobs/CreateAutoBudgetLimits.php

@@ -122,13 +122,7 @@ class CreateAutoBudgetLimits implements ShouldQueue
         // if has one, calculate expenses and use that as a base.
         $repository      = app(OperationsRepositoryInterface::class);
         $repository->setUser($autoBudget->budget->user);
-        $spent           = $repository->sumExpenses(
-            $previousStart,
-            $previousEnd,
-            null,
-            new Collection()->push($autoBudget->budget),
-            $autoBudget->transactionCurrency
-        );
+        $spent           = $repository->sumExpenses($previousStart, $previousEnd, null, new Collection()->push($autoBudget->budget), $autoBudget->transactionCurrency);
         $currencyId      = $autoBudget->transaction_currency_id;
         $spentAmount     = $spent[$currencyId]['sum'] ?? '0';
         Log::debug(sprintf('Spent in previous budget period (%s-%s) is %s', $previousStart->format('Y-m-d'), $previousEnd->format('Y-m-d'), $spentAmount));
@@ -218,13 +212,7 @@ class CreateAutoBudgetLimits implements ShouldQueue
         // if has one, calculate expenses and use that as a base.
         $repository    = app(OperationsRepositoryInterface::class);
         $repository->setUser($autoBudget->budget->user);
-        $spent         = $repository->sumExpenses(
-            $previousStart,
-            $previousEnd,
-            null,
-            new Collection()->push($autoBudget->budget),
-            $autoBudget->transactionCurrency
-        );
+        $spent         = $repository->sumExpenses($previousStart, $previousEnd, null, new Collection()->push($autoBudget->budget), $autoBudget->transactionCurrency);
         $currencyId    = $autoBudget->transaction_currency_id;
         $spentAmount   = $spent[$currencyId]['sum'] ?? '0';
         Log::debug(sprintf('Spent in previous budget period (%s-%s) is %s', $previousStart->format('Y-m-d'), $previousEnd->format('Y-m-d'), $spentAmount));

app/Support/Http/Controllers/AugumentData.php

@@ -222,14 +222,7 @@ trait AugumentData
                 $currentEnd->addMonth();
             }
             // primary currency amount.
-            $expenses        = $opsRepository->sumExpenses(
-                $currentStart,
-                $currentEnd,
-                null,
-                $budgetCollection,
-                $entry->transactionCurrency,
-                $this->convertToPrimary
-            );
+            $expenses        = $opsRepository->sumExpenses($currentStart, $currentEnd, null, $budgetCollection, $entry->transactionCurrency, $this->convertToPrimary);
             $spent           = $expenses[$currency->id]['sum'] ?? '0';
             $entry->pc_spent = $spent;
 

app/Support/JsonApi/Enrichments/RecurringEnrichment.php

@@ -354,10 +354,7 @@ class RecurringEnrichment implements EnrichmentInterface
 
         /** @var RecurrenceRepetition $repetition */
         foreach ($set as $repetition) {
-            $recurrence                               = $this->collection
-                ->filter(static fn (Recurrence $item): bool => (int) $item->id === (int) $repetition->recurrence_id)
-                ->first()
-            ;
+            $recurrence                               = $this->collection->filter(static fn (Recurrence $item): bool => (int) $item->id === (int) $repetition->recurrence_id)->first();
             $fromDate                                 = clone ($recurrence->latest_date ?? $recurrence->first_date);
             $recurrenceId                             = (int) $repetition->recurrence_id;
             $repId                                    = (int) $repetition->id;

composer.json

@@ -111,7 +111,9 @@
     },
     "require-dev": {
         "barryvdh/laravel-ide-helper": "^3",
+        "carthage-software/mago": "^1.24.0",
         "driftingly/rector-laravel": "^2.0",
+        "ergebnis/phpstan-rules": "^2",
         "fakerphp/faker": "1.*",
         "filp/whoops": "2.*",
         "fruitcake/laravel-debugbar": "^4.0",
@@ -124,8 +126,7 @@
         "phpstan/phpstan-strict-rules": "^2",
         "phpunit/phpunit": "^13",
         "rector/rector": "^2.3",
-        "thecodingmachine/phpstan-safe-rule": "^1.4",
-        "ergebnis/phpstan-rules": "^2"
+        "thecodingmachine/phpstan-safe-rule": "^1.4"
     },
     "replace": {
         "symfony/polyfill-php54": "*",

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "4f1f0dcde32d2f02333bd7af2cbc90eb",
+    "content-hash": "7f960fa15bddd432267fb2bb9b730195",
     "packages": [
         {
             "name": "bacon/bacon-qr-code",
@@ -10093,6 +10093,62 @@
             },
             "time": "2026-03-05T20:09:01+00:00"
         },
+        {
+            "name": "carthage-software/mago",
+            "version": "1.24.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/carthage-software/mago.git",
+                "reference": "ff885e99abe97222bb8b84dc346b59bddbe3a307"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/carthage-software/mago/zipball/ff885e99abe97222bb8b84dc346b59bddbe3a307",
+                "reference": "ff885e99abe97222bb8b84dc346b59bddbe3a307",
+                "shasum": ""
+            },
+            "require": {
+                "php": "~8.1 || ~8.2 || ~8.3 || ~8.4 || ~8.5 || ~8.6"
+            },
+            "suggest": {
+                "ext-curl": "To show binary download progress"
+            },
+            "bin": [
+                "composer/bin/mago"
+            ],
+            "type": "library",
+            "autoload": {
+                "files": [
+                    "composer/functions.php",
+                    "composer/internal.php"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT OR Apache-2.0"
+            ],
+            "authors": [
+                {
+                    "name": "Saif Eddin Gmati",
+                    "email": "azjezz@carthage.software"
+                }
+            ],
+            "description": "Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.",
+            "keywords": [
+                "dev"
+            ],
+            "support": {
+                "issues": "https://github.com/carthage-software/mago/issues",
+                "source": "https://github.com/carthage-software/mago/tree/1.24.0"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/azjezz",
+                    "type": "github"
+                }
+            ],
+            "time": "2026-04-22T07:00:59+00:00"
+        },
         {
             "name": "cloudcreativity/json-api-testing",
             "version": "v6.4.0",

config/firefly.php

@@ -78,8 +78,8 @@ return [
         'running_balance_column' => (bool)env_default_when_empty(env('USE_RUNNING_BALANCE'), true), // this is only the default value, is not used.
         // see cer.php for exchange rates feature flag.
     ],
-'version' => 'develop/2026-04-27',
-'build_time' => 1777306297,
+'version' => 'develop/2026-04-28',
+'build_time' => 1777358720,
     'api_version'                          => '2.1.0', // field is no longer used.
     'db_version'                           => 28, // field is no longer used.
 

resources/lang/en_US/firefly.php

@@ -1621,7 +1621,7 @@ return [
     'secure_pw_ff'                                        => 'Do you use the same password all over the internet? If one site loses your password, hackers have access to all your data. Firefly III relies on you to choose a strong and unique password to protect your financial records.',
     'secure_pw_check_box'                                 => 'To help you do that Firefly III can check if the password you want to use has been stolen in the past. If this is the case, Firefly III advises you NOT to use that password.',
     'secure_pw_working_title'                             => 'How does it work?',
-    'secure_pw_working'                                   => 'By checking the box, Firefly III will send the first five characters of the SHA1 hash of your password to <a href="https://www.troyhunt.com/introducing-306-million-freely-downloadable-pwned-passwords/">the website of Troy Hunt</a> to see if it is on the list. This will stop you from using unsafe passwords as is recommended in the latest <a href="https://pages.nist.gov/800-63-3/sp800-63b.html">NIST Special Publication</a> on this subject.',
+    'secure_pw_working'                                   => 'By checking the box, Firefly III will send the first five characters of the SHA1 hash of your password to <a href="https://haveibeenpwned.com/API/v3#PwnedPasswords">the website of Troy Hunt</a> to see if it is on the list. This will stop you from using unsafe passwords as is recommended in the latest <a href="https://pages.nist.gov/800-63-3/sp800-63b.html">NIST Special Publication</a> on this subject.',
     'secure_pw_should'                                    => 'Should I check the box?',
     'secure_pw_long_password'                             => 'Yes. Always verify your password is safe.',
     'command_line_token'                                  => 'Command line token',

resources/views/auth/register.blade.php

@@ -49,7 +49,7 @@
                 </div>
                 <div class="row">
                     <div class="col-12">
-                            <input type="checkbox" id="verify_password" checked name="verify_password" value="1">
+                            <input type="checkbox" id="verify_password" name="verify_password" value="1">
                             <label for="verify_password">
                                 {{ trans('form.verify_password') }}
                                 <a href="#"