Merge pull request #11590 from firefly-iii/release-1769368675

🤖 Automatically merge the PR into the develop branch.

THANKS.md

@@ -4,6 +4,7 @@ Over time, many people have contributed to Firefly III. Their efforts are not al
 Please find below all the people who contributed to the Firefly III code. Their names are mentioned in the year of their first contribution.
 
 ## 2026
+- mateuszkulapl
 - Gianluca Martino
 - embedded
 

bootstrap/app.php

@@ -40,6 +40,13 @@ use Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse;
 use Illuminate\Foundation\Application;
 use Illuminate\Foundation\Configuration\Exceptions;
 use Illuminate\Foundation\Configuration\Middleware;
+use Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull;
+use Illuminate\Foundation\Http\Middleware\InvokeDeferredCallbacks;
+use Illuminate\Foundation\Http\Middleware\PreventRequestsDuringMaintenance;
+use Illuminate\Foundation\Http\Middleware\TrimStrings;
+use Illuminate\Http\Middleware\HandleCors;
+use Illuminate\Http\Middleware\ValidatePostSize;
+use Illuminate\Routing\Middleware\SubstituteBindings;
 use Illuminate\View\Middleware\ShareErrorsFromSession;
 use Laravel\Passport\Http\Middleware\CreateFreshApiToken;
 use Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful;
@@ -81,11 +88,6 @@ if (!function_exists('stringIsEqual')) {
     }
 }
 
-//$app = new Application(
-//    realpath(__DIR__ . '/../')
-//);
-
-
 $app = Application::configure(basePath: dirname(__DIR__))
                   ->withRouting(
                       web     : __DIR__ . '/../routes/web.php',
@@ -93,22 +95,40 @@ $app = Application::configure(basePath: dirname(__DIR__))
                       health  : '/up',
                   )
                   ->withMiddleware(function (Middleware $middleware): void {
+                      $middleware->trustProxies(at: envNonEmpty('TRUSTED_PROXIES', ''));
+                      // overrule the standard middleware
+                      $middleware->use(
+                          [
+                              InvokeDeferredCallbacks::class,
+                              HandleCors::class,
+                              PreventRequestsDuringMaintenance::class,
+                              ValidatePostSize::class,
+                              TrimStrings::class,
+                              ConvertEmptyStringsToNull::class,
+                              SecureHeaders::class,
+                          ]
+                      );
 
-                      // always append secure header thing.
-                      $middleware->append(SecureHeaders::class);
-
-                      // add stuff to the web group
-                      $middleware->group('web', [
-                          Illuminate\Cookie\Middleware\EncryptCookies::class,
-                          Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
-                          StartFireflySession::class,
-                          Illuminate\View\Middleware\ShareErrorsFromSession::class,
-                          VerifyCsrfToken::class,
-                          Illuminate\Routing\Middleware\SubstituteBindings::class,
-                          CreateFreshApiToken::class,
-                      ]);
+                      // overrule the web group
+                      $middleware->group('web',
+                                         [
+                                             EncryptCookies::class,
+                                             AddQueuedCookiesToResponse::class,
+                                             StartFireflySession::class,
+                                             ShareErrorsFromSession::class,
+                                             VerifyCsrfToken::class,
+                                             SubstituteBindings::class,
+                                             CreateFreshApiToken::class,
+                                         ]
+                      );
                       // new group?
-                      $middleware->appendToGroup('binders-only', [Installer::class, EncryptCookies::class, AddQueuedCookiesToResponse::class, Binder::class]);
+                      $middleware->appendToGroup('binders-only',
+                                                 [
+                                                     Installer::class,
+                                                     EncryptCookies::class,
+                                                     AddQueuedCookiesToResponse::class,
+                                                     Binder::class,
+                                                 ]);
 
                       //
                       $middleware->appendToGroup('user-not-logged-in', [

config/auth.php

@@ -64,6 +64,7 @@ return [
         'web'               => [
             'driver'   => 'session',
             'provider' => 'users',
+            'remember' => true,
         ],
         'remote_user_guard' => [
             'driver'   => 'remote_user_guard',

config/firefly.php

@@ -79,7 +79,7 @@ return [
         // see cer.php for exchange rates feature flag.
     ],
     'version'                              => 'develop/2026-01-25',
-    'build_time'                           => 1769358562,
+    'build_time'                           => 1769368548,
     'api_version'                          => '2.1.0', // field is no longer used.
     'db_version'                           => 28, // field is no longer used.
 

resources/views/layout/default.twig

@@ -11,8 +11,6 @@
     <meta name="csrf-token" content="{{ csrf_token() }}">
     <meta name="robots" content="noindex, nofollow, noarchive, noodp, NoImageIndex, noydir">
     <meta name="apple-mobile-web-app-capable" content="yes">
-    <meta name="color-scheme" content="light dark">
-
     <title>
         {% if pageTitle %}
             {{ pageTitle }} »
@@ -39,6 +37,7 @@
     <link href="v1/lib/adminlte/css/AdminLTE.min.css?v={{ FF_BUILD_TIME }}" rel="stylesheet" type="text/css"
           nonce="{{ JS_NONCE }}">
     {% if 'browser' == darkMode %}
+        <meta name="color-scheme" content="light dark">
         <script nonce="{{ JS_NONCE }}">
             // If `prefers-color-scheme` is not supported, fall back to light mode.
             // In this case, light.css will be downloaded with `highest` priority.
@@ -58,12 +57,14 @@
               nonce="{{ JS_NONCE }}" media="(prefers-color-scheme: light)">
     {% endif %}
     {% if 'dark' == darkMode %}
+        <meta name="color-scheme" content="dark">
         <link href="v1/css/daterangepicker-dark.css?v={{ FF_BUILD_TIME }}" rel="stylesheet" type="text/css"
               nonce="{{ JS_NONCE }}">
         <link href="v1/lib/adminlte/css/skins/skin-dark.min.css?v={{ FF_BUILD_TIME }}" rel="stylesheet" type="text/css"
               nonce="{{ JS_NONCE }}">
     {% endif %}
     {% if 'light' == darkMode %}
+        <meta name="color-scheme" content="light">
         <link href="v1/css/daterangepicker-light.css?v={{ FF_BUILD_TIME }}" rel="stylesheet" type="text/css"
               nonce="{{ JS_NONCE }}">
         <link href="v1/lib/adminlte/css/skins/skin-light.min.css?v={{ FF_BUILD_TIME }}" rel="stylesheet" type="text/css"

resources/views/layout/empty.twig

@@ -9,7 +9,6 @@
     <meta name="csrf-token" content="{{ csrf_token() }}">
     <meta content='width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no' name='viewport'>
     <meta name="apple-mobile-web-app-capable" content="yes">
-    <meta name="color-scheme" content="light dark">
 
     {# CSS things #}
 
@@ -20,6 +19,7 @@
     {# the theme #}
     <link href="v1/lib/adminlte/css/AdminLTE.min.css?v={{ FF_BUILD_TIME }}" rel="stylesheet" type="text/css" nonce="{{ JS_NONCE }}">
     {% if 'browser' == darkMode %}
+        <meta name="color-scheme" content="light dark">
         <script nonce="{{ JS_NONCE }}">
             // If `prefers-color-scheme` is not supported, fall back to light mode.
             // In this case, light.css will be downloaded with `highest` priority.
@@ -35,9 +35,11 @@
         <link href="v1/lib/adminlte/css/skins/skin-light.min.css?v={{ FF_BUILD_TIME }}" rel="stylesheet" type="text/css" nonce="{{ JS_NONCE }}" media="(prefers-color-scheme: light)">
     {% endif %}
     {% if 'dark' == darkMode %}
+        <meta name="color-scheme" content="dark">
         <link href="v1/lib/adminlte/css/skins/skin-dark.min.css?v={{ FF_BUILD_TIME }}" rel="stylesheet" type="text/css" nonce="{{ JS_NONCE }}">
     {% endif %}
     {% if 'light' == darkMode %}
+        <meta name="color-scheme" content="light">
         <link href="v1/lib/adminlte/css/skins/skin-light.min.css?v={{ FF_BUILD_TIME }}" rel="stylesheet" type="text/css" nonce="{{ JS_NONCE }}">
     {% endif %}
 

resources/views/layout/guest.twig

@@ -5,8 +5,6 @@
     <meta charset="UTF-8">
     <meta name="robots" content="noindex, nofollow, noarchive, noodp, NoImageIndex, noydir">
     <meta name="apple-mobile-web-app-capable" content="yes">
-    <meta name="color-scheme" content="light dark">
-
     <title>Firefly III
 
         {% if title != "Firefly" and title != "" %}
@@ -30,6 +28,7 @@
     {# the theme #}
     <link href="v1/lib/adminlte/css/AdminLTE.min.css?v={{ FF_BUILD_TIME }}" rel="stylesheet" type="text/css" nonce="{{ JS_NONCE }}">
     {% if 'browser' == darkMode %}
+        <meta name="color-scheme" content="light dark">
         <script nonce="{{ JS_NONCE }}">
             // If `prefers-color-scheme` is not supported, fall back to light mode.
             // In this case, light.css will be downloaded with `highest` priority.
@@ -45,9 +44,11 @@
         <link href="v1/lib/adminlte/css/skins/skin-light.min.css?v={{ FF_BUILD_TIME }}" rel="stylesheet" type="text/css" nonce="{{ JS_NONCE }}" media="(prefers-color-scheme: light)">
     {% endif %}
     {% if 'dark' == darkMode %}
+        <meta name="color-scheme" content="dark">
         <link href="v1/lib/adminlte/css/skins/skin-dark.min.css?v={{ FF_BUILD_TIME }}" rel="stylesheet" type="text/css" nonce="{{ JS_NONCE }}">
     {% endif %}
     {% if 'light' == darkMode %}
+        <meta name="color-scheme" content="light">
         <link href="v1/lib/adminlte/css/skins/skin-light.min.css?v={{ FF_BUILD_TIME }}" rel="stylesheet" type="text/css" nonce="{{ JS_NONCE }}">
     {% endif %}