Merge pull request #11743 from firefly-iii/release-1771253383

🤖 Automatically merge the PR into the develop branch.

.github/mergify.yml

@@ -1,11 +1,4 @@
 pull_request_rules:
-  - name: Make sure PR are up to date before merging
-    description: This automatically updates PRs when they are out-of-date with the
-      base branch to avoid semantic conflicts (next step is using a merge
-      queue).
-    conditions: []
-    actions:
-      update:
   - name: Close all on main
     conditions:
       - base=main

app/Api/V1/Requests/Models/TransactionCurrency/UpdateRequest.php

@@ -63,6 +63,9 @@ class UpdateRequest extends FormRequest
     {
         /** @var TransactionCurrency $currency */
         $currency = $this->route()->parameter('currency_code');
+        if (is_string($currency)) {
+            $currency = TransactionCurrency::whereCode($currency)->first();
+        }
 
         return [
             'name'           => sprintf('min:1|max:255|unique:transaction_currencies,name,%d', $currency->id),

app/Console/Commands/Correction/CorrectsGroupAccounts.php

@@ -56,8 +56,8 @@ class CorrectsGroupAccounts extends Command
             }
         }
         $flags                    = new TransactionGroupEventFlags();
-        $flags->applyRules        = true;
-        $flags->fireWebhooks      = true;
+        $flags->applyRules        = false;
+        $flags->fireWebhooks      = false;
         $flags->recalculateCredit = true;
         $objects                  = new TransactionGroupEventObjects();
         foreach ($groups as $groupId) {

app/Console/Commands/System/CreatesDatabase.php

@@ -25,6 +25,7 @@ declare(strict_types=1);
 namespace FireflyIII\Console\Commands\System;
 
 use FireflyIII\Console\Commands\ShowsFriendlyMessages;
+use FireflyIII\Console\Commands\Tools\VerifiesDatabaseConnectionTrait;
 use Illuminate\Console\Command;
 use PDO;
 use PDOException;
@@ -32,6 +33,7 @@ use PDOException;
 class CreatesDatabase extends Command
 {
     use ShowsFriendlyMessages;
+    use VerifiesDatabaseConnectionTrait;
 
     protected $description = 'Tries to create the database if it doesn\'t exist yet.';
 
@@ -39,21 +41,27 @@ class CreatesDatabase extends Command
 
     public function handle(): int
     {
-        if ('mysql' !== env('DB_CONNECTION')) { // @phpstan-ignore larastan.noEnvCallsOutsideOfConfig */
-            $this->friendlyInfo(sprintf('CreateDB does not apply to "%s", skipped.', env('DB_CONNECTION')));
+        $connected = $this->verifyDatabaseConnection();
+        if (!$connected) {
+            $this->friendlyError('Failed to connect to the database. Is it up?');
+
+            return Command::FAILURE;
+        }
+        if ('mysql' !== config('database.default')) { // @phpstan-ignore larastan.noEnvCallsOutsideOfConfig */
+            $this->friendlyInfo(sprintf('CreateDB does not apply to "%s", skipped.', config('database.default')));
 
             return 0;
         }
         // try to set up a raw connection:
-        $exists  = false;
-        $dsn     = sprintf('mysql:host=%s;port=%d;charset=utf8mb4', env('DB_HOST'), env('DB_PORT'));
+        $exists    = false;
+        $dsn       = sprintf('mysql:host=%s;port=%d;charset=utf8mb4', env('DB_HOST'), env('DB_PORT'));
 
         if ('' !== (string) env('DB_SOCKET')) {
             $dsn = sprintf('mysql:unix_socket=%s;charset=utf8mb4', env('DB_SOCKET'));
         }
         $this->friendlyLine(sprintf('DSN is %s', $dsn));
 
-        $options = [
+        $options   = [
             PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
             PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
             PDO::ATTR_EMULATE_PREPARES   => false,
@@ -71,7 +79,7 @@ class CreatesDatabase extends Command
         // only continue when no error.
         // with PDO, try to list DB's (
         /** @var array $stmt */
-        $stmt    = $pdo->query('SHOW DATABASES;');
+        $stmt      = $pdo->query('SHOW DATABASES;');
         // slightly more complex but less error-prone.
         foreach ($stmt as $row) {
             $name = $row['Database'] ?? false;

app/Console/Commands/Tools/VerifiesDatabaseConnection.php

@@ -26,14 +26,11 @@ namespace FireflyIII\Console\Commands\Tools;
 
 use FireflyIII\Console\Commands\ShowsFriendlyMessages;
 use Illuminate\Console\Command;
-use Illuminate\Database\QueryException;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Log;
-use Exception;
 
 class VerifiesDatabaseConnection extends Command
 {
     use ShowsFriendlyMessages;
+    use VerifiesDatabaseConnectionTrait;
 
     /**
      * The name and signature of the console command.
@@ -54,40 +51,12 @@ class VerifiesDatabaseConnection extends Command
      */
     public function handle(): int
     {
-        $loops     = 30;
-        $loop      = 0;
-        $queries   = ['pgsql'  => 'SELECT * FROM pg_catalog.pg_tables;', 'sqlite' => 'SELECT name FROM sqlite_schema;', 'mysql'  => 'SHOW TABLES;'];
-        $default   = config('database.default');
-        if (!array_key_exists($default, $queries)) {
-            $this->friendlyWarning(sprintf('Cannot validate database connection for "%s"', $default));
-
-            return Command::SUCCESS;
-        }
-        $query     = $queries[$default];
-        $connected = false;
-        Log::debug(sprintf('Connecting to database "%s"...', config('database.default')));
-        while (!$connected && $loop < $loops) {
-            try {
-                DB::select($query);
-                $connected = true;
-            } catch (QueryException $e) {
-                Log::error(sprintf('Loop #%d: connection failed: %s', $loop, $e->getMessage()));
-                $this->friendlyWarning(sprintf('Database connection attempt #%d failed. Sleep for 10 seconds...', $loop + 1));
-                sleep(10);
-            } catch (Exception $e) {
-                Log::error(sprintf('Loop #%d: not connected yet because of a %s: %s', $loop, get_class($e), $e->getMessage()));
-                $this->friendlyWarning(sprintf('Database connection attempt #%d failed. Sleep for 10 seconds...', $loop + 1));
-                sleep(10);
-            }
-            ++$loop;
-        }
+        $connected = $this->verifyDatabaseConnection();
         if ($connected) {
-            Log::debug(sprintf('Connected to database after %d attempt(s).', $loop));
             $this->friendlyPositive('Connected to the database.');
 
             return Command::SUCCESS;
         }
-        Log::error('Failed to connect to database.');
         $this->friendlyError('Failed to connect to the database. Is it up?');
 
         return Command::FAILURE;

app/Console/Commands/Tools/VerifiesDatabaseConnectionTrait.php

@@ -0,0 +1,66 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * VerifiesDatabaseConnectionTrait.php
+ * Copyright (c) 2026 james@firefly-iii.org
+ *
+ * This file is part of Firefly III (https://github.com/firefly-iii).
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+namespace FireflyIII\Console\Commands\Tools;
+
+use Exception;
+use Illuminate\Database\QueryException;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+
+trait VerifiesDatabaseConnectionTrait
+{
+    protected function verifyDatabaseConnection(): bool
+    {
+        $loops     = 30;
+        $loop      = 0;
+        $queries   = ['pgsql'  => 'SELECT * FROM pg_catalog.pg_tables;', 'sqlite' => 'SELECT name FROM sqlite_schema;', 'mysql'  => 'SHOW TABLES;'];
+        $default   = config('database.default');
+        if (!array_key_exists($default, $queries)) {
+            $this->friendlyWarning(sprintf('Cannot validate database connection for "%s"', $default));
+
+            return true;
+        }
+        $query     = $queries[$default];
+        $connected = false;
+        Log::debug(sprintf('Connecting to database "%s"...', config('database.default')));
+        while (!$connected && $loop < $loops) {
+            try {
+                DB::select($query);
+                $connected = true;
+            } catch (QueryException $e) {
+                Log::error(sprintf('Loop #%d: connection failed: %s', $loop, $e->getMessage()));
+                $this->friendlyWarning(sprintf('Database connection attempt #%d failed. Sleep for 10 seconds...', $loop + 1));
+                sleep(10);
+            } catch (Exception $e) {
+                Log::error(sprintf('Loop #%d: not connected yet because of a %s: %s', $loop, get_class($e), $e->getMessage()));
+                $this->friendlyWarning(sprintf('Database connection attempt #%d failed. Sleep for 10 seconds...', $loop + 1));
+                sleep(10);
+            }
+            ++$loop;
+        }
+
+        return $connected;
+    }
+}

app/Events/Model/TransactionGroup/UserRequestedBatchProcessing.php

@@ -25,13 +25,14 @@ declare(strict_types=1);
 namespace FireflyIII\Events\Model\TransactionGroup;
 
 use FireflyIII\Events\Event;
-use Illuminate\Support\Facades\Log;
 
 class UserRequestedBatchProcessing extends Event
 {
+    public TransactionGroupEventObjects $objects;
+
     public function __construct(
         public TransactionGroupEventFlags $flags
     ) {
-        Log::debug(__METHOD__);
+        $this->objects = new TransactionGroupEventObjects();
     }
 }

app/Support/Export/ExportDataGenerator.php

@@ -140,6 +140,24 @@ class ExportDataGenerator
 
     // @phpstan-ignore-line
 
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
     public function __construct()
     {
         $this->accounts = new Collection();

app/Support/JsonApi/Enrichments/AvailableBudgetEnrichment.php

@@ -66,6 +66,15 @@ class AvailableBudgetEnrichment implements EnrichmentInterface
     // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
     private readonly bool $convertToPrimary; // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
@@ -92,6 +101,15 @@ class AvailableBudgetEnrichment implements EnrichmentInterface
     // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
     private array $currencies            = [];
     private array $currencyIds           = [];
     private array $ids                   = [];

app/Support/JsonApi/Enrichments/BudgetLimitEnrichment.php

@@ -66,6 +66,15 @@ class BudgetLimitEnrichment implements EnrichmentInterface
     // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
     private array $currencies  = [];
     private array $currencyIds = [];
     private Carbon $end;

app/Support/JsonApi/Enrichments/PiggyBankEnrichment.php

@@ -68,6 +68,15 @@ class PiggyBankEnrichment implements EnrichmentInterface
     // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
     private array $accounts      = []; // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
@@ -94,6 +103,15 @@ class PiggyBankEnrichment implements EnrichmentInterface
     // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
     private array $amounts       = [];
     private Collection $collection;
     private array $currencies    = [];

app/Support/JsonApi/Enrichments/PiggyBankEventEnrichment.php

@@ -63,6 +63,15 @@ class PiggyBankEventEnrichment implements EnrichmentInterface
     // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
     private array $accountIds        = []; // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
@@ -89,6 +98,15 @@ class PiggyBankEventEnrichment implements EnrichmentInterface
     // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
     private Collection $collection;
     private array $currencies        = [];
     private array $groupIds          = [];

app/Support/JsonApi/Enrichments/SubscriptionEnrichment.php

@@ -72,6 +72,15 @@ class SubscriptionEnrichment implements EnrichmentInterface
     // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
     private readonly bool $convertToPrimary;
     private ?Carbon $end             = null;
     private array   $mappedObjects   = [];

app/Support/JsonApi/Enrichments/TransactionGroupEnrichment.php

@@ -105,6 +105,24 @@ class TransactionGroupEnrichment implements EnrichmentInterface
 
     // @phpstan-ignore-line
 
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
+    // @phpstan-ignore-line
+
     public function __construct()
     {
         $this->dateFields      = ['interest_date', 'book_date', 'process_date', 'due_date', 'payment_date', 'invoice_date'];

app/Support/JsonApi/Enrichments/WebhookEnrichment.php

@@ -68,6 +68,15 @@ class WebhookEnrichment implements EnrichmentInterface
     // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
     private array $ids               = []; // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
@@ -94,6 +103,15 @@ class WebhookEnrichment implements EnrichmentInterface
     // @phpstan-ignore-line
     // @phpstan-ignore-line
     // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
+    // @phpstan-ignore-line
     private array $responses         = [];
     private array $triggers          = [];
     private array $webhookDeliveries = [];

app/Transformers/ObjectGroupTransformer.php

@@ -51,8 +51,8 @@ class ObjectGroupTransformer extends AbstractTransformer
 
         return [
             'id'         => (string) $objectGroup->id,
-            'created_at' => $objectGroup->created_at?->toAtomString(),
-            'updated_at' => $objectGroup->updated_at?->toAtomString(),
+            'created_at' => $objectGroup->created_at->toAtomString(),
+            'updated_at' => $objectGroup->updated_at->toAtomString(),
             'title'      => $objectGroup->title,
             'order'      => $objectGroup->order,
             'links'      => [['rel' => 'self', 'uri' => '/object_groups/'.$objectGroup->id]],

app/Transformers/PiggyBankEventTransformer.php

@@ -66,8 +66,8 @@ class PiggyBankEventTransformer extends AbstractTransformer
 
         return [
             'id'                              => (string) $event->id,
-            'created_at'                      => $event->created_at?->toAtomString(),
-            'updated_at'                      => $event->updated_at?->toAtomString(),
+            'created_at'                      => $event->created_at->toAtomString(),
+            'updated_at'                      => $event->updated_at->toAtomString(),
             'amount'                          => $amount,
             'pc_amount'                       => $primaryAmount,
 

bootstrap/app.php

@@ -130,8 +130,9 @@ $app = Application::configure(basePath: dirname(__DIR__))
                       $middleware->group('api',
                                          [
                                              AcceptHeaders::class,
-                                             EnsureFrontendRequestsAreStateful::class,
+                                             // EnsureFrontendRequestsAreStateful::class,
                                              'auth:api',
+                                             Binder::class,
                           ]
                       );
                       $middleware->appendToGroup('api_basic', [AcceptHeaders::class, Binder::class]);

changelog.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## v6.4.22
+
+This release and several previous ones fix authentication problems mainly. Cleaning up the libraries that make up Firefly III's excellent security (with me standing on the shoulders of giants) means that many edge cases that worked in the past no longer worked. Notable issues are listed below. 
+
+As far as I know it all works as it should, but feel free to open new issues when necessary. My apologies for the mess.
+
+### Fixed
+
+- Removed Laravel Sanctum as it was unused.
+- Migrated away from Laravel 10's kernel and bootstrap structure.
+- Fixed remote user guard for console and unauthenticated routes (like `/up` and `health`)
+- [Issue 11710](https://github.com/firefly-iii/firefly-iii/issues/11710) (Firefly throws error on startup and when trying to use importer) reported by @avee87
+- [Issue 11712](https://github.com/firefly-iii/firefly-iii/issues/11712) (`RemoteUserGuard` regression in v6.4.19 blocks `/health` endpoint and internal Artisan commands) reported by @Dual-0
+- [Issue 11720](https://github.com/firefly-iii/firefly-iii/issues/11720) (`RemoteUserGuard` regression from v6.4.19 (including v6.4.21) blocks `/health` endpoint) reported by @rjhenry
+
 ## v6.4.21
 
 ### Added

composer.json

@@ -90,7 +90,6 @@
         "laravel-notification-channels/pushover": "^4.0",
         "laravel/framework": "^12",
         "laravel/passport": "^12.0",
-        "laravel/sanctum": "^4.1",
         "laravel/slack-notification-channel": "^3.3",
         "laravel/ui": "^4.2",
         "league/commonmark": "^2",

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "c4e7dd2df7bae96ea6e4df82530411b9",
+    "content-hash": "6c4181d945517372c00358f3828806bc",
     "packages": [
         {
             "name": "bacon/bacon-qr-code",
@@ -2233,69 +2233,6 @@
             },
             "time": "2026-02-06T12:17:10+00:00"
         },
-        {
-            "name": "laravel/sanctum",
-            "version": "v4.3.1",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/laravel/sanctum.git",
-                "reference": "e3b85d6e36ad00e5db2d1dcc27c81ffdf15cbf76"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/laravel/sanctum/zipball/e3b85d6e36ad00e5db2d1dcc27c81ffdf15cbf76",
-                "reference": "e3b85d6e36ad00e5db2d1dcc27c81ffdf15cbf76",
-                "shasum": ""
-            },
-            "require": {
-                "ext-json": "*",
-                "illuminate/console": "^11.0|^12.0|^13.0",
-                "illuminate/contracts": "^11.0|^12.0|^13.0",
-                "illuminate/database": "^11.0|^12.0|^13.0",
-                "illuminate/support": "^11.0|^12.0|^13.0",
-                "php": "^8.2",
-                "symfony/console": "^7.0|^8.0"
-            },
-            "require-dev": {
-                "mockery/mockery": "^1.6",
-                "orchestra/testbench": "^9.15|^10.8|^11.0",
-                "phpstan/phpstan": "^1.10"
-            },
-            "type": "library",
-            "extra": {
-                "laravel": {
-                    "providers": [
-                        "Laravel\\Sanctum\\SanctumServiceProvider"
-                    ]
-                }
-            },
-            "autoload": {
-                "psr-4": {
-                    "Laravel\\Sanctum\\": "src/"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Taylor Otwell",
-                    "email": "taylor@laravel.com"
-                }
-            ],
-            "description": "Laravel Sanctum provides a featherweight authentication system for SPAs and simple APIs.",
-            "keywords": [
-                "auth",
-                "laravel",
-                "sanctum"
-            ],
-            "support": {
-                "issues": "https://github.com/laravel/sanctum/issues",
-                "source": "https://github.com/laravel/sanctum"
-            },
-            "time": "2026-02-07T17:19:31+00:00"
-        },
         {
             "name": "laravel/serializable-closure",
             "version": "v2.0.9",
@@ -9648,16 +9585,16 @@
         },
         {
             "name": "thecodingmachine/safe",
-            "version": "v3.3.0",
+            "version": "v3.4.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/thecodingmachine/safe.git",
-                "reference": "2cdd579eeaa2e78e51c7509b50cc9fb89a956236"
+                "reference": "705683a25bacf0d4860c7dea4d7947bfd09eea19"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/thecodingmachine/safe/zipball/2cdd579eeaa2e78e51c7509b50cc9fb89a956236",
-                "reference": "2cdd579eeaa2e78e51c7509b50cc9fb89a956236",
+                "url": "https://api.github.com/repos/thecodingmachine/safe/zipball/705683a25bacf0d4860c7dea4d7947bfd09eea19",
+                "reference": "705683a25bacf0d4860c7dea4d7947bfd09eea19",
                 "shasum": ""
             },
             "require": {
@@ -9767,7 +9704,7 @@
             "description": "PHP core functions that throw exceptions instead of returning FALSE on error",
             "support": {
                 "issues": "https://github.com/thecodingmachine/safe/issues",
-                "source": "https://github.com/thecodingmachine/safe/tree/v3.3.0"
+                "source": "https://github.com/thecodingmachine/safe/tree/v3.4.0"
             },
             "funding": [
                 {
@@ -9778,12 +9715,16 @@
                     "url": "https://github.com/shish",
                     "type": "github"
                 },
+                {
+                    "url": "https://github.com/silasjoisten",
+                    "type": "github"
+                },
                 {
                     "url": "https://github.com/staabm",
                     "type": "github"
                 }
             ],
-            "time": "2025-05-14T06:15:44+00:00"
+            "time": "2026-02-04T18:08:13+00:00"
         },
         {
             "name": "tijsverkoyen/css-to-inline-styles",
@@ -11916,16 +11857,16 @@
         },
         {
             "name": "phpunit/phpunit",
-            "version": "12.5.11",
+            "version": "12.5.12",
             "source": {
                 "type": "git",
                 "url": "https://github.com/sebastianbergmann/phpunit.git",
-                "reference": "9b518cb40f9474572c9f0178e96ff3dc1cf02bf1"
+                "reference": "418e06b3b46b0d54bad749ff4907fc7dfb530199"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/9b518cb40f9474572c9f0178e96ff3dc1cf02bf1",
-                "reference": "9b518cb40f9474572c9f0178e96ff3dc1cf02bf1",
+                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/418e06b3b46b0d54bad749ff4907fc7dfb530199",
+                "reference": "418e06b3b46b0d54bad749ff4907fc7dfb530199",
                 "shasum": ""
             },
             "require": {
@@ -11994,7 +11935,7 @@
             "support": {
                 "issues": "https://github.com/sebastianbergmann/phpunit/issues",
                 "security": "https://github.com/sebastianbergmann/phpunit/security/policy",
-                "source": "https://github.com/sebastianbergmann/phpunit/tree/12.5.11"
+                "source": "https://github.com/sebastianbergmann/phpunit/tree/12.5.12"
             },
             "funding": [
                 {
@@ -12018,7 +11959,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-02-10T12:32:02+00:00"
+            "time": "2026-02-16T08:34:36+00:00"
         },
         {
             "name": "rector/rector",

config/firefly.php

@@ -78,8 +78,8 @@ return [
         'running_balance_column' => (bool)envNonEmpty('USE_RUNNING_BALANCE', true), // this is only the default value, is not used.
         // see cer.php for exchange rates feature flag.
     ],
-    'version'                              => 'develop/2026-02-15',
-    'build_time'                           => 1771152837,
+    'version'                              => 'develop/2026-02-16',
+    'build_time'                           => 1771253250,
     'api_version'                          => '2.1.0', // field is no longer used.
     'db_version'                           => 28, // field is no longer used.
 

package-lock.json

@@ -5221,9 +5221,9 @@
             }
         },
         "node_modules/css-loader": {
-            "version": "7.1.3",
-            "resolved": "https://registry.npmjs.org/css-loader/-/css-loader-7.1.3.tgz",
-            "integrity": "sha512-frbERmjT0UC5lMheWpJmMilnt9GEhbZJN/heUb7/zaJYeIzj5St9HvDcfshzzOqbsS+rYpMk++2SD3vGETDSyA==",
+            "version": "7.1.4",
+            "resolved": "https://registry.npmjs.org/css-loader/-/css-loader-7.1.4.tgz",
+            "integrity": "sha512-vv3J9tlOl04WjiMvHQI/9tmIrCxVrj6PFbHemBB1iihpeRbi/I4h033eoFIhwxBBqLhI0KYFS7yvynBFhIZfTw==",
             "dev": true,
             "license": "MIT",
             "peer": true,
@@ -5245,7 +5245,7 @@
                 "url": "https://opencollective.com/webpack"
             },
             "peerDependencies": {
-                "@rspack/core": "0.x || 1.x",
+                "@rspack/core": "0.x || ^1.0.0 || ^2.0.0-0",
                 "webpack": "^5.27.0"
             },
             "peerDependenciesMeta": {
@@ -7150,9 +7150,9 @@
             }
         },
         "node_modules/i18next": {
-            "version": "25.8.7",
-            "resolved": "https://registry.npmjs.org/i18next/-/i18next-25.8.7.tgz",
-            "integrity": "sha512-ttxxc5+67S/0hhoeVdEgc1lRklZhdfcUSEPp1//uUG2NB88X3667gRsDar+ZWQFdysnOsnb32bcoMsa4mtzhkQ==",
+            "version": "25.8.10",
+            "resolved": "https://registry.npmjs.org/i18next/-/i18next-25.8.10.tgz",
+            "integrity": "sha512-CtPJLMAz1G8sxo+mIzfBjGgLxWs7d6WqIjlmmv9BTsOat4pJIfwZ8cm07n3kFS6bP9c6YwsYutYrwsEeJVBo2g==",
             "funding": [
                 {
                     "type": "individual",
@@ -12248,9 +12248,9 @@
             }
         },
         "node_modules/webpack/node_modules/webpack-sources": {
-            "version": "3.3.3",
-            "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-3.3.3.tgz",
-            "integrity": "sha512-yd1RBzSGanHkitROoPFd6qsrxt+oFhg/129YzheDGqeustzX0vTZJZsSsQjVQC4yzBQ56K55XU8gaNCtIzOnTg==",
+            "version": "3.3.4",
+            "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-3.3.4.tgz",
+            "integrity": "sha512-7tP1PdV4vF+lYPnkMR0jMY5/la2ub5Fc/8VQrrU+lXkiM6C4TjVfGw7iKfyhnTQOsD+6Q/iKw0eFciziRgD58Q==",
             "dev": true,
             "license": "MIT",
             "engines": {

routes/api.php

@@ -732,7 +732,6 @@ Route::group(
 // Users API routes:
 Route::group(
     [
-        'middleware' => ['auth:api,sanctum', 'bindings'],
         'namespace'  => 'FireflyIII\Api\V1\Controllers\System',
         'prefix'     => 'v1/users',
         'as'         => 'api.v1.users.',
@@ -749,7 +748,6 @@ Route::group(
 // Batch API routes:
 Route::group(
     [
-        'middleware' => ['auth:api,sanctum', 'bindings'],
         'namespace'  => 'FireflyIII\Api\V1\Controllers\System',
         'prefix'     => 'v1/batch',
         'as'         => 'api.v1.batch.',

routes/web.php

@@ -81,9 +81,8 @@ Route::group(
 // );
 
 Route::group(
-    ['middleware' => ['binders-only'], 'namespace' => 'FireflyIII\Http\Controllers\System'],
+    ['namespace' => 'FireflyIII\Http\Controllers\System'],
     static function (): void {
-        // Route::get('offline', static fn () => view('errors.offline'));
         Route::get('health', ['uses' => 'HealthcheckController@check', 'as' => 'healthcheck'])->withoutMiddleware(['web']);
     }
 );