Merge pull request #12256 from firefly-iii/release-1778958406

🤖 Automatically merge the PR into the develop branch.
🤖 Auto commit for release 'develop' on 2026-05-16
2026-06-10 04:15:00 +00:00 · 2026-05-16 21:06:52 +02:00 · 2026-05-16 21:06:46 +02:00 · 2026-05-16 21:01:50 +02:00 · 2026-05-16 20:44:49 +02:00 · 2026-05-16 20:44:39 +02:00
12 changed files with 247 additions and 200 deletions
--- a/.ci/php-cs-fixer/composer.lock
+++ b/.ci/php-cs-fixer/composer.lock
@@ -471,16 +471,16 @@
        },
        {
            "name": "friendsofphp/php-cs-fixer",
-            "version": "v3.95.1",
+            "version": "v3.95.2",
            "source": {
                "type": "git",
                "url": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer.git",
-                "reference": "a9727678fbd12997f1d9de8f4a37824ed9df1065"
+                "reference": "a28d88a5e172b27e78d0816992b15a9df3da20f1"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/PHP-CS-Fixer/PHP-CS-Fixer/zipball/a9727678fbd12997f1d9de8f4a37824ed9df1065",
-                "reference": "a9727678fbd12997f1d9de8f4a37824ed9df1065",
+                "url": "https://api.github.com/repos/PHP-CS-Fixer/PHP-CS-Fixer/zipball/a28d88a5e172b27e78d0816992b15a9df3da20f1",
+                "reference": "a28d88a5e172b27e78d0816992b15a9df3da20f1",
                "shasum": ""
            },
            "require": {
@@ -512,8 +512,8 @@
                "symfony/stopwatch": "^5.4.45 || ^6.4.24 || ^7.0 || ^8.0"
            },
            "require-dev": {
-                "facile-it/paraunit": "^1.3.1 || ^2.8.0",
-                "infection/infection": "^0.32.6",
+                "facile-it/paraunit": "^1.3.1 || ^2.11.0",
+                "infection/infection": "^0.32.7",
                "justinrainbow/json-schema": "^6.8.0",
                "keradus/cli-executor": "^2.3",
                "mikey179/vfsstream": "^1.6.12",
@@ -564,7 +564,7 @@
            ],
            "support": {
                "issues": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/issues",
-                "source": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/tree/v3.95.1"
+                "source": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/tree/v3.95.2"
            },
            "funding": [
                {
@@ -572,7 +572,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-04-12T17:00:09+00:00"
+            "time": "2026-05-15T09:20:44+00:00"
        },
        {
            "name": "psr/container",
@@ -1255,16 +1255,16 @@
        },
        {
            "name": "sebastian/diff",
-            "version": "8.1.0",
+            "version": "8.3.0",
            "source": {
                "type": "git",
                "url": "https://github.com/sebastianbergmann/diff.git",
-                "reference": "9c957d730257f49c873f3761674559bd90098a7d"
+                "reference": "b36d33b6e796513de7cb7df053afb3f55eefcd47"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/diff/zipball/9c957d730257f49c873f3761674559bd90098a7d",
-                "reference": "9c957d730257f49c873f3761674559bd90098a7d",
+                "url": "https://api.github.com/repos/sebastianbergmann/diff/zipball/b36d33b6e796513de7cb7df053afb3f55eefcd47",
+                "reference": "b36d33b6e796513de7cb7df053afb3f55eefcd47",
                "shasum": ""
            },
            "require": {
@@ -1277,7 +1277,7 @@
            "type": "library",
            "extra": {
                "branch-alias": {
-                    "dev-main": "8.1-dev"
+                    "dev-main": "8.3-dev"
                }
            },
            "autoload": {
@@ -1310,7 +1310,7 @@
            "support": {
                "issues": "https://github.com/sebastianbergmann/diff/issues",
                "security": "https://github.com/sebastianbergmann/diff/security/policy",
-                "source": "https://github.com/sebastianbergmann/diff/tree/8.1.0"
+                "source": "https://github.com/sebastianbergmann/diff/tree/8.3.0"
            },
            "funding": [
                {
@@ -1330,20 +1330,20 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-04-05T12:02:33+00:00"
+            "time": "2026-05-15T04:58:09+00:00"
        },
        {
            "name": "symfony/console",
-            "version": "v8.0.9",
+            "version": "v8.0.11",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/console.git",
-                "reference": "7113778e2e91f4709cb3194a75dfa9c0d028d94d"
+                "reference": "3156577f46a38aa1b9323aad223de7a9cd426782"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/console/zipball/7113778e2e91f4709cb3194a75dfa9c0d028d94d",
-                "reference": "7113778e2e91f4709cb3194a75dfa9c0d028d94d",
+                "url": "https://api.github.com/repos/symfony/console/zipball/3156577f46a38aa1b9323aad223de7a9cd426782",
+                "reference": "3156577f46a38aa1b9323aad223de7a9cd426782",
                "shasum": ""
            },
            "require": {
@@ -1400,7 +1400,7 @@
                "terminal"
            ],
            "support": {
-                "source": "https://github.com/symfony/console/tree/v8.0.9"
+                "source": "https://github.com/symfony/console/tree/v8.0.11"
            },
            "funding": [
                {
@@ -1420,7 +1420,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-04-29T15:02:55+00:00"
+            "time": "2026-05-13T12:07:53+00:00"
        },
        {
            "name": "symfony/deprecation-contracts",
@@ -1660,16 +1660,16 @@
        },
        {
            "name": "symfony/filesystem",
-            "version": "v8.0.9",
+            "version": "v8.0.11",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/filesystem.git",
-                "reference": "d1ec4543d5c6c2dac78503c2fae5ea0b3608ce40"
+                "reference": "224db910898ce1317b892a9a1338f1f8f17eb7c7"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/filesystem/zipball/d1ec4543d5c6c2dac78503c2fae5ea0b3608ce40",
-                "reference": "d1ec4543d5c6c2dac78503c2fae5ea0b3608ce40",
+                "url": "https://api.github.com/repos/symfony/filesystem/zipball/224db910898ce1317b892a9a1338f1f8f17eb7c7",
+                "reference": "224db910898ce1317b892a9a1338f1f8f17eb7c7",
                "shasum": ""
            },
            "require": {
@@ -1706,7 +1706,7 @@
            "description": "Provides basic utilities for the filesystem",
            "homepage": "https://symfony.com",
            "support": {
-                "source": "https://github.com/symfony/filesystem/tree/v8.0.9"
+                "source": "https://github.com/symfony/filesystem/tree/v8.0.11"
            },
            "funding": [
                {
@@ -1726,7 +1726,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-04-18T13:51:42+00:00"
+            "time": "2026-05-11T16:39:47+00:00"
        },
        {
            "name": "symfony/finder",
@@ -2448,16 +2448,16 @@
        },
        {
            "name": "symfony/process",
-            "version": "v8.0.8",
+            "version": "v8.0.11",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/process.git",
-                "reference": "cb8939aff03470d1a9d1d1b66d08c6fa71b3bbdc"
+                "reference": "26d89e459f037d2873300605d0a07e7a8ef84db0"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/process/zipball/cb8939aff03470d1a9d1d1b66d08c6fa71b3bbdc",
-                "reference": "cb8939aff03470d1a9d1d1b66d08c6fa71b3bbdc",
+                "url": "https://api.github.com/repos/symfony/process/zipball/26d89e459f037d2873300605d0a07e7a8ef84db0",
+                "reference": "26d89e459f037d2873300605d0a07e7a8ef84db0",
                "shasum": ""
            },
            "require": {
@@ -2489,7 +2489,7 @@
            "description": "Executes commands in sub-processes",
            "homepage": "https://symfony.com",
            "support": {
-                "source": "https://github.com/symfony/process/tree/v8.0.8"
+                "source": "https://github.com/symfony/process/tree/v8.0.11"
            },
            "funding": [
                {
@@ -2509,7 +2509,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-03-30T15:14:47+00:00"
+            "time": "2026-05-11T16:56:32+00:00"
        },
        {
            "name": "symfony/service-contracts",
@@ -2666,16 +2666,16 @@
        },
        {
            "name": "symfony/string",
-            "version": "v8.0.8",
+            "version": "v8.0.11",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/string.git",
-                "reference": "ae9488f874d7603f9d2dfbf120203882b645d963"
+                "reference": "39be2ad058a3c0bd558edca23e65f009865d75ff"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/string/zipball/ae9488f874d7603f9d2dfbf120203882b645d963",
-                "reference": "ae9488f874d7603f9d2dfbf120203882b645d963",
+                "url": "https://api.github.com/repos/symfony/string/zipball/39be2ad058a3c0bd558edca23e65f009865d75ff",
+                "reference": "39be2ad058a3c0bd558edca23e65f009865d75ff",
                "shasum": ""
            },
            "require": {
@@ -2732,7 +2732,7 @@
                "utf8"
            ],
            "support": {
-                "source": "https://github.com/symfony/string/tree/v8.0.8"
+                "source": "https://github.com/symfony/string/tree/v8.0.11"
            },
            "funding": [
                {
@@ -2752,7 +2752,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-03-30T15:14:47+00:00"
+            "time": "2026-05-13T12:07:53+00:00"
        }
    ],
    "packages-dev": [],
--- a/.github/security.md
+++ b/.github/security.md
@@ -3,6 +3,15 @@
 Firefly III is an application to manage your personal finances. As such, the developer has adopted this security
 disclosure and response policy to ensure that critical issues are responsibly handled.

+## AI-generated security advisories
+
+> [!WARNING]  
+> Due to a large number of irrelevant, noisy and uninformed AI-generated security advisories coming my way, reporting any the following security issues may return in a permanent ban from the Firefly III organization on GitHub.
+
+1. Any SSRF in any user provided URL field (webhooks, ntfy, SimpleFIN, Slack). It's by design that users may set-up any URL they want, be it internal, private or non-existing.
+2. Any XSS issue without a viable attack tree. If you can find a spot where Firefly III or the associated tools render unescaped data, it's not a security issue unless you can show me an actual attack that gets that data into the system.
+3. Any issue that is not true. AI models have already *hallucinated* security issues in Firefly III. They've referred to **non-existing** functions, templates and files. Including line numbers and code excerpts. Validate your findings before you report them to me.
+
 ## Supported versions

 Only the latest Firefly III release is maintained. Applicable fixes, including security fixes, will not be backported to
--- a/.github/workflows/depsreview.yml
+++ b/.github/workflows/depsreview.yml
@@ -13,4 +13,4 @@ jobs:
        with:
          fetch-depth: 0
      - name: 'Dependency review'
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5
--- a/app/Api/V1/Controllers/System/ConfigurationController.php
+++ b/app/Api/V1/Controllers/System/ConfigurationController.php
@@ -158,7 +158,7 @@ final class ConfigurationController extends Controller
        $enableExternalRates   = FireflyConfig::get('enable_external_rates', false);
        $allowWebhooks         = FireflyConfig::get('allow_webhooks', false);
        $enableBatchProcessing = FireflyConfig::get('enable_batch_processing', false);
-        $validUrlProtocols     = FireflyConfig::get('valid_url_protocols', 'http,https');
+        $validUrlProtocols     = FireflyConfig::get('valid_url_protocols', config('firefly.valid_url_protocols'));

        return [
            'is_demo_site'            => $isDemoSite?->data,
@@ -171,7 +171,7 @@ final class ConfigurationController extends Controller
            'enable_external_rates'   => $enableExternalRates?->data,
            'allow_webhooks'          => $allowWebhooks?->data,
            'enable_batch_processing' => $enableBatchProcessing?->data,
-            'valid_url_protocols'     => $validUrlProtocols->data ?? 'http,https',
+            'valid_url_protocols'     => $validUrlProtocols->data ?? config('firefly.valid_url_protocols'),
        ];
    }

--- a/app/Http/Controllers/Profile/OAuthController.php
+++ b/app/Http/Controllers/Profile/OAuthController.php
@@ -25,6 +25,7 @@ declare(strict_types=1);
 namespace FireflyIII\Http\Controllers\Profile;

 use FireflyIII\Http\Controllers\Controller;
+use FireflyIII\Support\Facades\FireflyConfig;
 use Illuminate\Contracts\Validation\Factory as ValidationFactory;
 use Illuminate\Contracts\View\Factory;
 use Illuminate\Http\JsonResponse;
@@ -144,6 +145,7 @@ final class OAuthController extends Controller
            ->where('expires_at', '>', Date::now())
            ->get()
            ->filter(fn (#[SensitiveParameter] Token $token) => $token->client->hasGrantType('personal_access'))
+            ->values()
        ;

        return response()->json($tokens);
@@ -165,9 +167,10 @@ final class OAuthController extends Controller

    public function storeClient(Request $request): JsonResponse
    {
+        $validProtocols     = FireflyConfig::get('valid_url_protocols', config('firefly.valid_url_protocols'))->data;
        $this->validation->make($request->only(['name', 'redirect_uris', 'confidential']), [
            'name'          => ['required', 'string', 'max:255'],
-            'redirect_uris' => ['required', 'url'],
+            'redirect_uris' => ['required', sprintf('url:%s', $validProtocols)],
            'confidential'  => 'boolean',
        ])->validate();

@@ -195,15 +198,15 @@ final class OAuthController extends Controller

    public function updateClient(Request $request, string $clientId): Client|Response
    {
-        $client = auth()->user()->oauthApps()->where('revoked', false)->find($clientId);
-
+        $client         = auth()->user()->oauthApps()->where('revoked', false)->find($clientId);
+        $validProtocols = FireflyConfig::get('valid_url_protocols', config('firefly.valid_url_protocols'))->data;
        if (null === $client) {
            return new Response('', 404);
        }

        $this->validation->make($request->only(['name', 'redirect_uris']), [
            'name'          => ['required', 'string', 'max:255'],
-            'redirect_uris' => ['required', 'url'],
+            'redirect_uris' => ['required', sprintf('url:%s', $validProtocols)],
        ])->validate();

        $this->clients->update($client, $request->input('name'), explode(',', $request->input('redirect_uris'))); // FIXME replace
--- a/app/Http/Requests/NotificationRequest.php
+++ b/app/Http/Requests/NotificationRequest.php
@@ -25,6 +25,7 @@ declare(strict_types=1);
 namespace FireflyIII\Http\Requests;

 use FireflyIII\Rules\Admin\IsValidSlackOrDiscordUrl;
+use FireflyIII\Support\Facades\FireflyConfig;
 use FireflyIII\Support\Request\ChecksLogin;
 use FireflyIII\Support\Request\ConvertsDataTypes;
 use Illuminate\Foundation\Http\FormRequest;
@@ -65,9 +66,10 @@ class NotificationRequest extends FormRequest
     */
    public function rules(): array
    {
-        $rules = [
-            'slack_webhook_url' => ['nullable', 'url', 'min:1', new IsValidSlackOrDiscordUrl()],
-            'ntfy_server'       => ['nullable', 'url', 'min:1'],
+        $validProtocols = FireflyConfig::get('valid_url_protocols', config('firefly.valid_url_protocols'))->data;
+        $rules          = [
+            'slack_webhook_url' => ['nullable', sprintf('url:%s', $validProtocols), 'min:1', new IsValidSlackOrDiscordUrl()],
+            'ntfy_server'       => ['nullable', sprintf('url:%s', $validProtocols), 'min:1'],
            'ntfy_user'         => ['required_with:ntfy_pass,ntfy_auth', 'nullable', 'string', 'min:1'],
            'ntfy_pass'         => ['required_with:ntfy_user,ntfy_auth', 'nullable', 'string', 'min:1'],
        ];
--- a/app/Http/Requests/PreferencesRequest.php
+++ b/app/Http/Requests/PreferencesRequest.php
@@ -25,6 +25,7 @@ declare(strict_types=1);
 namespace FireflyIII\Http\Requests;

 use FireflyIII\Rules\Admin\IsValidSlackOrDiscordUrl;
+use FireflyIII\Support\Facades\FireflyConfig;
 use FireflyIII\Support\Request\ChecksLogin;
 use Illuminate\Foundation\Http\FormRequest;

@@ -39,9 +40,10 @@ class PreferencesRequest extends FormRequest
     */
    public function rules(): array
    {
-        $rules = [
-            'slack_webhook_url' => ['nullable', 'url', 'min:1', new IsValidSlackOrDiscordUrl()],
-            'ntfy_server'       => ['nullable', 'url', 'min:1'],
+        $validProtocols = FireflyConfig::get('valid_url_protocols', config('firefly.valid_url_protocols'))->data;
+        $rules          = [
+            'slack_webhook_url' => ['nullable', sprintf('url:%s', $validProtocols), 'min:1', new IsValidSlackOrDiscordUrl()],
+            'ntfy_server'       => ['nullable', sprintf('url:%s', $validProtocols), 'min:1'],
            'ntfy_user'         => ['required_with:ntfy_pass,ntfy_auth', 'nullable', 'string', 'min:1'],
            'ntfy_pass'         => ['required_with:ntfy_user,ntfy_auth', 'nullable', 'string', 'min:1'],
        ];
--- a/composer.lock
+++ b/composer.lock
@@ -1879,16 +1879,16 @@
        },
        {
            "name": "laravel/framework",
-            "version": "v13.8.0",
+            "version": "v13.9.0",
            "source": {
                "type": "git",
                "url": "https://github.com/laravel/framework.git",
-                "reference": "e7db333a025a1e93ebca7744953069d7719f4bcf"
+                "reference": "a0c6ad03b380287015287d8d5a0fa2459e2332fd"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/laravel/framework/zipball/e7db333a025a1e93ebca7744953069d7719f4bcf",
-                "reference": "e7db333a025a1e93ebca7744953069d7719f4bcf",
+                "url": "https://api.github.com/repos/laravel/framework/zipball/a0c6ad03b380287015287d8d5a0fa2459e2332fd",
+                "reference": "a0c6ad03b380287015287d8d5a0fa2459e2332fd",
                "shasum": ""
            },
            "require": {
@@ -1992,7 +1992,7 @@
                "aws/aws-sdk-php": "^3.322.9",
                "ext-gmp": "*",
                "fakerphp/faker": "^1.24",
-                "guzzlehttp/psr7": "^2.4",
+                "guzzlehttp/psr7": "^2.9",
                "laravel/pint": "^1.18",
                "league/flysystem-aws-s3-v3": "^3.25.1",
                "league/flysystem-ftp": "^3.25.1",
@@ -2099,7 +2099,7 @@
                "issues": "https://github.com/laravel/framework/issues",
                "source": "https://github.com/laravel/framework"
            },
-            "time": "2026-05-05T21:01:14+00:00"
+            "time": "2026-05-13T15:38:40+00:00"
        },
        {
            "name": "laravel/passport",
@@ -2902,16 +2902,16 @@
        },
        {
            "name": "league/flysystem",
-            "version": "3.33.0",
+            "version": "3.34.0",
            "source": {
                "type": "git",
                "url": "https://github.com/thephpleague/flysystem.git",
-                "reference": "570b8871e0ce693764434b29154c54b434905350"
+                "reference": "2daaac3b0d4c83ea7ed5d8586e786f5d00f3540e"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/thephpleague/flysystem/zipball/570b8871e0ce693764434b29154c54b434905350",
-                "reference": "570b8871e0ce693764434b29154c54b434905350",
+                "url": "https://api.github.com/repos/thephpleague/flysystem/zipball/2daaac3b0d4c83ea7ed5d8586e786f5d00f3540e",
+                "reference": "2daaac3b0d4c83ea7ed5d8586e786f5d00f3540e",
                "shasum": ""
            },
            "require": {
@@ -2979,9 +2979,9 @@
            ],
            "support": {
                "issues": "https://github.com/thephpleague/flysystem/issues",
-                "source": "https://github.com/thephpleague/flysystem/tree/3.33.0"
+                "source": "https://github.com/thephpleague/flysystem/tree/3.34.0"
            },
-            "time": "2026-03-25T07:59:30+00:00"
+            "time": "2026-05-14T10:28:08+00:00"
        },
        {
            "name": "league/flysystem-local",
@@ -3848,16 +3848,16 @@
        },
        {
            "name": "nette/utils",
-            "version": "v4.1.3",
+            "version": "v4.1.4",
            "source": {
                "type": "git",
                "url": "https://github.com/nette/utils.git",
-                "reference": "bb3ea637e3d131d72acc033cfc2746ee893349fe"
+                "reference": "7da6c396d7ebe142bc857c20479d5e70a5e1aac7"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/nette/utils/zipball/bb3ea637e3d131d72acc033cfc2746ee893349fe",
-                "reference": "bb3ea637e3d131d72acc033cfc2746ee893349fe",
+                "url": "https://api.github.com/repos/nette/utils/zipball/7da6c396d7ebe142bc857c20479d5e70a5e1aac7",
+                "reference": "7da6c396d7ebe142bc857c20479d5e70a5e1aac7",
                "shasum": ""
            },
            "require": {
@@ -3933,9 +3933,9 @@
            ],
            "support": {
                "issues": "https://github.com/nette/utils/issues",
-                "source": "https://github.com/nette/utils/tree/v4.1.3"
+                "source": "https://github.com/nette/utils/tree/v4.1.4"
            },
-            "time": "2026-02-13T03:05:33+00:00"
+            "time": "2026-05-11T20:49:54+00:00"
        },
        {
            "name": "nunomaduro/collision",
@@ -6119,16 +6119,16 @@
        },
        {
            "name": "spatie/flare-client-php",
-            "version": "1.11.0",
+            "version": "1.11.1",
            "source": {
                "type": "git",
                "url": "https://github.com/spatie/flare-client-php.git",
-                "reference": "fb3ffb946675dba811fbde9122224db2f84daca9"
+                "reference": "53f41b08a27cc039e1a8ed2be9a202e924f31bad"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/spatie/flare-client-php/zipball/fb3ffb946675dba811fbde9122224db2f84daca9",
-                "reference": "fb3ffb946675dba811fbde9122224db2f84daca9",
+                "url": "https://api.github.com/repos/spatie/flare-client-php/zipball/53f41b08a27cc039e1a8ed2be9a202e924f31bad",
+                "reference": "53f41b08a27cc039e1a8ed2be9a202e924f31bad",
                "shasum": ""
            },
            "require": {
@@ -6176,7 +6176,7 @@
            ],
            "support": {
                "issues": "https://github.com/spatie/flare-client-php/issues",
-                "source": "https://github.com/spatie/flare-client-php/tree/1.11.0"
+                "source": "https://github.com/spatie/flare-client-php/tree/1.11.1"
            },
            "funding": [
                {
@@ -6184,7 +6184,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-03-17T08:06:16+00:00"
+            "time": "2026-05-15T09:31:32+00:00"
        },
        {
            "name": "spatie/ignition",
@@ -6754,16 +6754,16 @@
        },
        {
            "name": "symfony/console",
-            "version": "v8.0.9",
+            "version": "v8.0.11",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/console.git",
-                "reference": "7113778e2e91f4709cb3194a75dfa9c0d028d94d"
+                "reference": "3156577f46a38aa1b9323aad223de7a9cd426782"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/console/zipball/7113778e2e91f4709cb3194a75dfa9c0d028d94d",
-                "reference": "7113778e2e91f4709cb3194a75dfa9c0d028d94d",
+                "url": "https://api.github.com/repos/symfony/console/zipball/3156577f46a38aa1b9323aad223de7a9cd426782",
+                "reference": "3156577f46a38aa1b9323aad223de7a9cd426782",
                "shasum": ""
            },
            "require": {
@@ -6820,7 +6820,7 @@
                "terminal"
            ],
            "support": {
-                "source": "https://github.com/symfony/console/tree/v8.0.9"
+                "source": "https://github.com/symfony/console/tree/v8.0.11"
            },
            "funding": [
                {
@@ -6840,7 +6840,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-04-29T15:02:55+00:00"
+            "time": "2026-05-13T12:07:53+00:00"
        },
        {
            "name": "symfony/css-selector",
@@ -7623,16 +7623,16 @@
        },
        {
            "name": "symfony/http-kernel",
-            "version": "v8.0.10",
+            "version": "v8.0.11",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/http-kernel.git",
-                "reference": "fb3f65b3d4ca2dad31c80d323819a762ca31d6ac"
+                "reference": "20d3680373f4b791903c09e74b45402b4aeda71c"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/http-kernel/zipball/fb3f65b3d4ca2dad31c80d323819a762ca31d6ac",
-                "reference": "fb3f65b3d4ca2dad31c80d323819a762ca31d6ac",
+                "url": "https://api.github.com/repos/symfony/http-kernel/zipball/20d3680373f4b791903c09e74b45402b4aeda71c",
+                "reference": "20d3680373f4b791903c09e74b45402b4aeda71c",
                "shasum": ""
            },
            "require": {
@@ -7703,7 +7703,7 @@
            "description": "Provides a structured process for converting a Request into a Response",
            "homepage": "https://symfony.com",
            "support": {
-                "source": "https://github.com/symfony/http-kernel/tree/v8.0.10"
+                "source": "https://github.com/symfony/http-kernel/tree/v8.0.11"
            },
            "funding": [
                {
@@ -7723,7 +7723,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-05-06T12:27:31+00:00"
+            "time": "2026-05-13T18:07:14+00:00"
        },
        {
            "name": "symfony/mailer",
@@ -8778,16 +8778,16 @@
        },
        {
            "name": "symfony/process",
-            "version": "v8.0.8",
+            "version": "v8.0.11",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/process.git",
-                "reference": "cb8939aff03470d1a9d1d1b66d08c6fa71b3bbdc"
+                "reference": "26d89e459f037d2873300605d0a07e7a8ef84db0"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/process/zipball/cb8939aff03470d1a9d1d1b66d08c6fa71b3bbdc",
-                "reference": "cb8939aff03470d1a9d1d1b66d08c6fa71b3bbdc",
+                "url": "https://api.github.com/repos/symfony/process/zipball/26d89e459f037d2873300605d0a07e7a8ef84db0",
+                "reference": "26d89e459f037d2873300605d0a07e7a8ef84db0",
                "shasum": ""
            },
            "require": {
@@ -8819,7 +8819,7 @@
            "description": "Executes commands in sub-processes",
            "homepage": "https://symfony.com",
            "support": {
-                "source": "https://github.com/symfony/process/tree/v8.0.8"
+                "source": "https://github.com/symfony/process/tree/v8.0.11"
            },
            "funding": [
                {
@@ -8839,7 +8839,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-03-30T15:14:47+00:00"
+            "time": "2026-05-11T16:56:32+00:00"
        },
        {
            "name": "symfony/psr-http-message-bridge",
@@ -9097,16 +9097,16 @@
        },
        {
            "name": "symfony/string",
-            "version": "v8.0.8",
+            "version": "v8.0.11",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/string.git",
-                "reference": "ae9488f874d7603f9d2dfbf120203882b645d963"
+                "reference": "39be2ad058a3c0bd558edca23e65f009865d75ff"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/string/zipball/ae9488f874d7603f9d2dfbf120203882b645d963",
-                "reference": "ae9488f874d7603f9d2dfbf120203882b645d963",
+                "url": "https://api.github.com/repos/symfony/string/zipball/39be2ad058a3c0bd558edca23e65f009865d75ff",
+                "reference": "39be2ad058a3c0bd558edca23e65f009865d75ff",
                "shasum": ""
            },
            "require": {
@@ -9163,7 +9163,7 @@
                "utf8"
            ],
            "support": {
-                "source": "https://github.com/symfony/string/tree/v8.0.8"
+                "source": "https://github.com/symfony/string/tree/v8.0.11"
            },
            "funding": [
                {
@@ -9183,7 +9183,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-03-30T15:14:47+00:00"
+            "time": "2026-05-13T12:07:53+00:00"
        },
        {
            "name": "symfony/translation",
@@ -10192,16 +10192,16 @@
        },
        {
            "name": "carthage-software/mago",
-            "version": "1.26.0",
+            "version": "1.27.1",
            "source": {
                "type": "git",
                "url": "https://github.com/carthage-software/mago.git",
-                "reference": "9ae2f7ad58ffeeaa2ff890e736a8658f8e397cdf"
+                "reference": "f4c31bbcb871e6bcbb96323ce791e06288b39b2a"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/carthage-software/mago/zipball/9ae2f7ad58ffeeaa2ff890e736a8658f8e397cdf",
-                "reference": "9ae2f7ad58ffeeaa2ff890e736a8658f8e397cdf",
+                "url": "https://api.github.com/repos/carthage-software/mago/zipball/f4c31bbcb871e6bcbb96323ce791e06288b39b2a",
+                "reference": "f4c31bbcb871e6bcbb96323ce791e06288b39b2a",
                "shasum": ""
            },
            "require": {
@@ -10216,9 +10216,12 @@
            "type": "library",
            "autoload": {
                "files": [
-                    "composer/functions.php",
-                    "composer/internal.php"
-                ]
+                    "composer/src/functions.php",
+                    "composer/src/internal.php"
+                ],
+                "psr-4": {
+                    "Mago\\": "composer/src/"
+                }
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
@@ -10236,7 +10239,7 @@
            ],
            "support": {
                "issues": "https://github.com/carthage-software/mago/issues",
-                "source": "https://github.com/carthage-software/mago/tree/1.26.0"
+                "source": "https://github.com/carthage-software/mago/tree/1.27.1"
            },
            "funding": [
                {
@@ -10244,7 +10247,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-05-06T21:44:02+00:00"
+            "time": "2026-05-13T15:32:36+00:00"
        },
        {
            "name": "cloudcreativity/json-api-testing",
@@ -11664,16 +11667,16 @@
        },
        {
            "name": "phpunit/php-code-coverage",
-            "version": "14.1.8",
+            "version": "14.1.9",
            "source": {
                "type": "git",
                "url": "https://github.com/sebastianbergmann/php-code-coverage.git",
-                "reference": "031856c28c060e1c1d1fc94d256e3ffbe4230c91"
+                "reference": "655533a65696bbc4231cd8027af150dadc40ec88"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/php-code-coverage/zipball/031856c28c060e1c1d1fc94d256e3ffbe4230c91",
-                "reference": "031856c28c060e1c1d1fc94d256e3ffbe4230c91",
+                "url": "https://api.github.com/repos/sebastianbergmann/php-code-coverage/zipball/655533a65696bbc4231cd8027af150dadc40ec88",
+                "reference": "655533a65696bbc4231cd8027af150dadc40ec88",
                "shasum": ""
            },
            "require": {
@@ -11730,7 +11733,7 @@
            "support": {
                "issues": "https://github.com/sebastianbergmann/php-code-coverage/issues",
                "security": "https://github.com/sebastianbergmann/php-code-coverage/security/policy",
-                "source": "https://github.com/sebastianbergmann/php-code-coverage/tree/14.1.8"
+                "source": "https://github.com/sebastianbergmann/php-code-coverage/tree/14.1.9"
            },
            "funding": [
                {
@@ -11750,7 +11753,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-05-09T12:06:52+00:00"
+            "time": "2026-05-16T05:16:14+00:00"
        },
        {
            "name": "phpunit/php-file-iterator",
@@ -12047,16 +12050,16 @@
        },
        {
            "name": "phpunit/phpunit",
-            "version": "13.1.8",
+            "version": "13.1.10",
            "source": {
                "type": "git",
                "url": "https://github.com/sebastianbergmann/phpunit.git",
-                "reference": "f49a2b5e51ffb33421745368cc099cf66830d71b"
+                "reference": "38959098d3c10660a189afaa35a94290c1de67bb"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/f49a2b5e51ffb33421745368cc099cf66830d71b",
-                "reference": "f49a2b5e51ffb33421745368cc099cf66830d71b",
+                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/38959098d3c10660a189afaa35a94290c1de67bb",
+                "reference": "38959098d3c10660a189afaa35a94290c1de67bb",
                "shasum": ""
            },
            "require": {
@@ -12070,14 +12073,14 @@
                "phar-io/manifest": "^2.0.4",
                "phar-io/version": "^3.2.1",
                "php": ">=8.4.1",
-                "phpunit/php-code-coverage": "^14.1.6",
+                "phpunit/php-code-coverage": "^14.1.8",
                "phpunit/php-file-iterator": "^7.0.0",
                "phpunit/php-invoker": "^7.0.0",
                "phpunit/php-text-template": "^6.0.0",
                "phpunit/php-timer": "^9.0.0",
                "sebastian/cli-parser": "^5.0.0",
-                "sebastian/comparator": "^8.1.2",
-                "sebastian/diff": "^8.1.0",
+                "sebastian/comparator": "^8.1.3",
+                "sebastian/diff": "^8.3.0",
                "sebastian/environment": "^9.3.0",
                "sebastian/exporter": "^8.0.2",
                "sebastian/git-state": "^1.0",
@@ -12126,7 +12129,7 @@
            "support": {
                "issues": "https://github.com/sebastianbergmann/phpunit/issues",
                "security": "https://github.com/sebastianbergmann/phpunit/security/policy",
-                "source": "https://github.com/sebastianbergmann/phpunit/tree/13.1.8"
+                "source": "https://github.com/sebastianbergmann/phpunit/tree/13.1.10"
            },
            "funding": [
                {
@@ -12134,20 +12137,20 @@
                    "type": "other"
                }
            ],
-            "time": "2026-05-01T04:22:45+00:00"
+            "time": "2026-05-15T08:03:56+00:00"
        },
        {
            "name": "rector/rector",
-            "version": "2.4.2",
+            "version": "2.4.3",
            "source": {
                "type": "git",
                "url": "https://github.com/rectorphp/rector.git",
-                "reference": "e645b6463c6a88ea5b44b17d3387d35a912c7946"
+                "reference": "891824c6c59f02a56a5dd58ea8edc44e6c0ece29"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/rectorphp/rector/zipball/e645b6463c6a88ea5b44b17d3387d35a912c7946",
-                "reference": "e645b6463c6a88ea5b44b17d3387d35a912c7946",
+                "url": "https://api.github.com/repos/rectorphp/rector/zipball/891824c6c59f02a56a5dd58ea8edc44e6c0ece29",
+                "reference": "891824c6c59f02a56a5dd58ea8edc44e6c0ece29",
                "shasum": ""
            },
            "require": {
@@ -12186,7 +12189,7 @@
            ],
            "support": {
                "issues": "https://github.com/rectorphp/rector/issues",
-                "source": "https://github.com/rectorphp/rector/tree/2.4.2"
+                "source": "https://github.com/rectorphp/rector/tree/2.4.3"
            },
            "funding": [
                {
@@ -12194,7 +12197,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-04-16T13:07:34+00:00"
+            "time": "2026-05-12T11:17:24+00:00"
        },
        {
            "name": "sebastian/cli-parser",
@@ -12267,23 +12270,23 @@
        },
        {
            "name": "sebastian/comparator",
-            "version": "8.1.2",
+            "version": "8.1.4",
            "source": {
                "type": "git",
                "url": "https://github.com/sebastianbergmann/comparator.git",
-                "reference": "b3d09f4360ad97dcad8f82d1c047ad16ff38b7e1"
+                "reference": "1edd557042bf4ff9978ec125d8131b147d5c8224"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/comparator/zipball/b3d09f4360ad97dcad8f82d1c047ad16ff38b7e1",
-                "reference": "b3d09f4360ad97dcad8f82d1c047ad16ff38b7e1",
+                "url": "https://api.github.com/repos/sebastianbergmann/comparator/zipball/1edd557042bf4ff9978ec125d8131b147d5c8224",
+                "reference": "1edd557042bf4ff9978ec125d8131b147d5c8224",
                "shasum": ""
            },
            "require": {
                "ext-dom": "*",
                "ext-mbstring": "*",
                "php": ">=8.4",
-                "sebastian/diff": "^8.1",
+                "sebastian/diff": "^8.3",
                "sebastian/exporter": "^8.0"
            },
            "require-dev": {
@@ -12335,7 +12338,7 @@
            "support": {
                "issues": "https://github.com/sebastianbergmann/comparator/issues",
                "security": "https://github.com/sebastianbergmann/comparator/security/policy",
-                "source": "https://github.com/sebastianbergmann/comparator/tree/8.1.2"
+                "source": "https://github.com/sebastianbergmann/comparator/tree/8.1.4"
            },
            "funding": [
                {
@@ -12355,7 +12358,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-04-14T08:24:42+00:00"
+            "time": "2026-05-15T08:30:51+00:00"
        },
        {
            "name": "sebastian/complexity",
@@ -12429,16 +12432,16 @@
        },
        {
            "name": "sebastian/diff",
-            "version": "8.1.0",
+            "version": "8.3.0",
            "source": {
                "type": "git",
                "url": "https://github.com/sebastianbergmann/diff.git",
-                "reference": "9c957d730257f49c873f3761674559bd90098a7d"
+                "reference": "b36d33b6e796513de7cb7df053afb3f55eefcd47"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/diff/zipball/9c957d730257f49c873f3761674559bd90098a7d",
-                "reference": "9c957d730257f49c873f3761674559bd90098a7d",
+                "url": "https://api.github.com/repos/sebastianbergmann/diff/zipball/b36d33b6e796513de7cb7df053afb3f55eefcd47",
+                "reference": "b36d33b6e796513de7cb7df053afb3f55eefcd47",
                "shasum": ""
            },
            "require": {
@@ -12451,7 +12454,7 @@
            "type": "library",
            "extra": {
                "branch-alias": {
-                    "dev-main": "8.1-dev"
+                    "dev-main": "8.3-dev"
                }
            },
            "autoload": {
@@ -12484,7 +12487,7 @@
            "support": {
                "issues": "https://github.com/sebastianbergmann/diff/issues",
                "security": "https://github.com/sebastianbergmann/diff/security/policy",
-                "source": "https://github.com/sebastianbergmann/diff/tree/8.1.0"
+                "source": "https://github.com/sebastianbergmann/diff/tree/8.3.0"
            },
            "funding": [
                {
@@ -12504,7 +12507,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-04-05T12:02:33+00:00"
+            "time": "2026-05-15T04:58:09+00:00"
        },
        {
            "name": "sebastian/environment",
--- a/config/firefly.php
+++ b/config/firefly.php
@@ -78,8 +78,8 @@ return [
        'running_balance_column' => (bool)env_default_when_empty(env('USE_RUNNING_BALANCE'), true), // this is only the default value, is not used.
        // see cer.php for exchange rates feature flag.
    ],
-'version' => 'develop/2026-05-11',
-'build_time' => 1778473850,
+'version' => 'develop/2026-05-16',
+'build_time' => 1778958405,
    'api_version'                          => '2.1.0', // field is no longer used.
    'db_version'                           => 28, // field is no longer used.

@@ -225,7 +225,7 @@ return [
    'available_dark_modes'                 => ['light', 'dark', 'browser'],
    'bill_reminder_periods'                => [90, 30, 14, 7, 0],
    'valid_view_ranges'                    => ['1D', '1W', '1M', '3M', '6M', '1Y'],
-    'valid_url_protocols'                  => env_default_when_empty(env('VALID_URL_PROTOCOLS'), 'http,https,ftp,ftps,mailto'), // no longer used, only for default.
+    'valid_url_protocols'                  => env_default_when_empty(env('VALID_URL_PROTOCOLS'), 'http,https,ftp,ftps,mailto,abacusfiiiapp'), // no longer used, only for default.
    'allowedMimes'                         => [
        // plain files
        'text/plain',
--- a/package-lock.json
+++ b/package-lock.json
@@ -2800,13 +2800,13 @@
            "license": "MIT"
        },
        "node_modules/@types/node": {
-            "version": "25.6.2",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-25.6.2.tgz",
-            "integrity": "sha512-sokuT28dxf9JT5Kady1fsXOvI4HVpjZa95NKT5y9PNTIrs2AsobR4GFAA90ZG8M+nxVRLysCXsVj6eGC7Vbrlw==",
+            "version": "25.8.0",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-25.8.0.tgz",
+            "integrity": "sha512-TCFSk8IZh+iLX1xtksoBVtdmgL+1IX0fC9BeU4QqFSuNdN/K+HUlhqOzEmSYYpZUVsLYcPqc9KX+60iDuninSQ==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
-                "undici-types": "~7.19.0"
+                "undici-types": ">=7.24.0 <7.24.7"
            }
        },
        "node_modules/@types/node-forge": {
@@ -3332,6 +3332,19 @@
            "integrity": "sha512-v7JYiuxONrpXxvoRVhFJuLpZ9xoBvQ1bHkE1lanVR8+/AqBATWXU3vOO0TAWOoxhG6/26JkU5otXq0Z2SRQjZQ==",
            "license": "MIT"
        },
+        "node_modules/agent-base": {
+            "version": "6.0.2",
+            "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
+            "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "debug": "4"
+            },
+            "engines": {
+                "node": ">= 6.0.0"
+            }
+        },
        "node_modules/ajv": {
            "version": "6.15.0",
            "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
@@ -3587,14 +3600,15 @@
            }
        },
        "node_modules/axios": {
-            "version": "1.16.0",
-            "resolved": "https://registry.npmjs.org/axios/-/axios-1.16.0.tgz",
-            "integrity": "sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==",
+            "version": "1.16.1",
+            "resolved": "https://registry.npmjs.org/axios/-/axios-1.16.1.tgz",
+            "integrity": "sha512-caYkukvroVPO8KrzuJEb50Hm07KwfBZPEC3VeFHTsqWHvKTsy54hjJz9BS/cdaypROE2rH6xvm9mHX4fgWkr3A==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
                "follow-redirects": "^1.16.0",
                "form-data": "^4.0.5",
+                "https-proxy-agent": "^5.0.1",
                "proxy-from-env": "^2.1.0"
            }
        },
@@ -3699,9 +3713,9 @@
            "license": "MIT"
        },
        "node_modules/baseline-browser-mapping": {
-            "version": "2.10.29",
-            "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.29.tgz",
-            "integrity": "sha512-Asa2krT+XTPZINCS+2QcyS8WTkObE77RwkydwF7h6DmnKqbvlalz93m/dnphUyCa6SWSP51VgtEUf2FN+gelFQ==",
+            "version": "2.10.30",
+            "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.30.tgz",
+            "integrity": "sha512-xjOFN16Ha1+Rz4nFYKqHU/LSB+gx/Vi3yQLX7r7sAW+Wa+8hhF2h4pvqTrTMc8+WcDBEunnUurr46Jvv0jk3Vg==",
            "dev": true,
            "license": "Apache-2.0",
            "bin": {
@@ -5339,9 +5353,9 @@
            "license": "MIT"
        },
        "node_modules/electron-to-chromium": {
-            "version": "1.5.353",
-            "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.353.tgz",
-            "integrity": "sha512-kOrWphBi8TOZyiJZqsgqIle0lw+tzmnQK83pV9dZUd01Nm2POECSyFQMAuarzZdYqQW7FH9RaYOuaRo3h+bQ3w==",
+            "version": "1.5.357",
+            "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.357.tgz",
+            "integrity": "sha512-NHlTIQDK8fmVwHwuIzmXYEJ1Ewq3D9wDNc0cWXxDGysP6Pb21giwGNkxiTifyKy/4SoPuN5l6GLP1W9Sv7zB2g==",
            "dev": true,
            "license": "ISC"
        },
@@ -5396,9 +5410,9 @@
            }
        },
        "node_modules/enhanced-resolve": {
-            "version": "5.21.2",
-            "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.21.2.tgz",
-            "integrity": "sha512-xe9vQb5kReirPUxgQrXA3ihgbCqssmTiM7cOZ+Gzu+VeGWgpV98lLZvp0dl4yriyAePcewxGUs9UpKD8PET9KQ==",
+            "version": "5.21.3",
+            "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.21.3.tgz",
+            "integrity": "sha512-QyL119InA+XXEkNLNTPCXPugSvOfhwv0JOlGNzvxs0hZaiHLNvXSpudUWsOlsXGWJh8G6ckCScEkVHfX3kw/2Q==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
@@ -5642,15 +5656,15 @@
            }
        },
        "node_modules/express": {
-            "version": "4.22.1",
-            "resolved": "https://registry.npmjs.org/express/-/express-4.22.1.tgz",
-            "integrity": "sha512-F2X8g9P1X7uCPZMA3MVf9wcTqlyNp7IhH5qPCI0izhaOIYXaW9L535tGA3qmjRzpH+bZczqq7hVKxTR4NWnu+g==",
+            "version": "4.22.2",
+            "resolved": "https://registry.npmjs.org/express/-/express-4.22.2.tgz",
+            "integrity": "sha512-IuL+Elrou2ZvCFHs18/CIzy2Nzvo25nZ1/D2eIZlz7c+QUayAcYoiM2BthCjs+EBHVpjYjcuLDAiCWgeIX3X1Q==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
                "accepts": "~1.3.8",
                "array-flatten": "1.1.1",
-                "body-parser": "~1.20.3",
+                "body-parser": "~1.20.5",
                "content-disposition": "~0.5.4",
                "content-type": "~1.0.4",
                "cookie": "~0.7.1",
@@ -5669,7 +5683,7 @@
                "parseurl": "~1.3.3",
                "path-to-regexp": "~0.1.12",
                "proxy-addr": "~2.0.7",
-                "qs": "~6.14.0",
+                "qs": "~6.15.1",
                "range-parser": "~1.2.1",
                "safe-buffer": "5.2.1",
                "send": "~0.19.0",
@@ -5705,22 +5719,6 @@
            "dev": true,
            "license": "MIT"
        },
-        "node_modules/express/node_modules/qs": {
-            "version": "6.14.2",
-            "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.2.tgz",
-            "integrity": "sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==",
-            "dev": true,
-            "license": "BSD-3-Clause",
-            "dependencies": {
-                "side-channel": "^1.1.0"
-            },
-            "engines": {
-                "node": ">=0.6"
-            },
-            "funding": {
-                "url": "https://github.com/sponsors/ljharb"
-            }
-        },
        "node_modules/fast-deep-equal": {
            "version": "3.1.3",
            "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -6637,6 +6635,20 @@
            "dev": true,
            "license": "MIT"
        },
+        "node_modules/https-proxy-agent": {
+            "version": "5.0.1",
+            "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
+            "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "agent-base": "6",
+                "debug": "4"
+            },
+            "engines": {
+                "node": ">= 6"
+            }
+        },
        "node_modules/human-signals": {
            "version": "2.1.0",
            "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-2.1.0.tgz",
@@ -6648,9 +6660,9 @@
            }
        },
        "node_modules/i18next": {
-            "version": "26.0.10",
-            "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.0.10.tgz",
-            "integrity": "sha512-k3yGPAlWR2RdMYoVXJoDZDT87qeHIWKH7gVksdZMpRty7QX/D9QZeYGvN08KGbKHke9wn01eYT+EEsrqX/YTlw==",
+            "version": "26.2.0",
+            "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.2.0.tgz",
+            "integrity": "sha512-zwBHldHdTmwN7r6UNc7lC6GWNN+YYg3DrRSeHR5PRRBf5QnJZcYHrQc0uaU26qZeYxR7iFZD+Y315dPnKP47wA==",
            "funding": [
                {
                    "type": "individual",
@@ -8274,9 +8286,9 @@
            }
        },
        "node_modules/node-releases": {
-            "version": "2.0.38",
-            "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.38.tgz",
-            "integrity": "sha512-3qT/88Y3FbH/Kx4szpQQ4HzUbVrHPKTLVpVocKiLfoYvw9XSGOX2FmD2d6DrXbVYyAQTF2HeF6My8jmzx7/CRw==",
+            "version": "2.0.44",
+            "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.44.tgz",
+            "integrity": "sha512-5WUyunoPMsvvEhS8AxHtRzP+oA8UCkJ7YRxatWKjngndhDGLiqEVAQKWjFAiAiuL8zMRGzGSJxFnLetoa43qGQ==",
            "dev": true,
            "license": "MIT"
        },
@@ -11096,9 +11108,9 @@
            }
        },
        "node_modules/undici-types": {
-            "version": "7.19.2",
-            "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.19.2.tgz",
-            "integrity": "sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg==",
+            "version": "7.24.6",
+            "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.24.6.tgz",
+            "integrity": "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==",
            "dev": true,
            "license": "MIT"
        },
@@ -12149,9 +12161,9 @@
            "license": "ISC"
        },
        "node_modules/ws": {
-            "version": "8.20.0",
-            "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.0.tgz",
-            "integrity": "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==",
+            "version": "8.20.1",
+            "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.1.tgz",
+            "integrity": "sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w==",
            "dev": true,
            "license": "MIT",
            "engines": {
@@ -12198,9 +12210,9 @@
            "license": "ISC"
        },
        "node_modules/yaml": {
-            "version": "2.8.4",
-            "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.4.tgz",
-            "integrity": "sha512-ml/JPOj9fOQK8RNnWojA67GbZ0ApXAUlN2UQclwv2eVgTgn7O9gg9o7paZWKMp4g0H3nTLtS9LVzhkpOFIKzog==",
+            "version": "2.9.0",
+            "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
+            "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
            "license": "ISC",
            "bin": {
                "yaml": "bin.mjs"
--- a/resources/assets/v1/src/components/passport/Clients.vue
+++ b/resources/assets/v1/src/components/passport/Clients.vue
@@ -442,11 +442,16 @@ export default {
                    }
                })
                .catch(error => {
+
                    if (typeof error.response.data === 'object') {
-                        form.errors = _.flatten(_.toArray(error.response.data.errors));
+                        for (const [key, value] of Object.entries(error.response.data.errors)) {
+                            console.log(`${key}: ${value}`);
+                            form.errors.push(value);
+                        }
                    } else {
                        form.errors = ['Something went wrong. Please try again.'];
                    }
+                    console.log(form.errors);
                });
        },

--- a/resources/assets/v1/src/components/passport/PersonalAccessTokens.vue
+++ b/resources/assets/v1/src/components/passport/PersonalAccessTokens.vue
@@ -213,6 +213,7 @@ export default {
     * Prepare the component (Vue 1.x).
     */
    ready() {
+        console.log('ready()');
        this.prepareComponent();
    },

@@ -220,6 +221,7 @@ export default {
     * Prepare the component (Vue 2.x).
     */
    mounted() {
+        console.log('mounted()');
        this.prepareComponent();
    },

@@ -228,6 +230,7 @@ export default {
         * Prepare the component.
         */
        prepareComponent() {
+            console.log('prepareComponent()');
            this.getTokens();
            // this.getScopes();

@@ -251,8 +254,10 @@ export default {
         * Get all of the personal access tokens for the user.
         */
        getTokens() {
+            console.log('getTokens()');
            axios.get('./oauth/personal-access-tokens')
                .then(response => {
+                    console.log(response.data);
                    this.tokens = response.data;
                });
        },
@@ -261,6 +266,7 @@ export default {
         * Get all the available scopes.
         */
        getScopes() {
+            console.log('getScopes()');
            axios.get('./oauth/scopes')
                .then(response => {
                    this.scopes = response.data;
@@ -271,6 +277,7 @@ export default {
         * Show the form for creating new tokens.
         */
        showCreateTokenForm() {
+            console.log('showCreateTokenForm()');
            $('#modal-create-token').modal('show');
        },

@@ -278,12 +285,14 @@ export default {
         * Create a new personal access token.
         */
        store() {
+            console.log('store()');
            this.accessToken = null;

            this.form.errors = [];

            axios.post('./oauth/personal-access-tokens', this.form)
                .then(response => {
+                    console.log('Successful POST new token, reset form content.');
                    this.form.name = '';
                    this.form.scopes = [];
                    this.form.errors = [];
@@ -293,6 +302,7 @@ export default {

                })
                .catch(error => {
+                    console.warn('Bad POST new token, show error.');
                    if (typeof error.response.data === 'object') {
                        this.form.errors = _.flatten(_.toArray(error.response.data.errors));
                    } else {
@@ -323,6 +333,7 @@ export default {
         * Show the given access token to the user.
         */
        showAccessToken(accessToken) {
+            console.log('showAccessToken');
            $('#modal-create-token').modal('hide');

            this.accessToken = accessToken;
Author	SHA1	Message	Date
github-actions[bot]	7ddf395ea9	Merge pull request #12256 from firefly-iii/release-1778958406 🤖 Automatically merge the PR into the develop branch.	2026-05-16 21:06:52 +02:00
JC5	492c55bd76	🤖 Auto commit for release 'develop' on 2026-05-16	2026-05-16 21:06:46 +02:00
James Cole	894dea5c9c	Fix https://github.com/firefly-iii/firefly-iii/issues/12254 as suggested by @imjuzcy	2026-05-16 21:01:50 +02:00
github-actions[bot]	fecf12790d	Merge pull request #12255 from firefly-iii/release-1778957079 🤖 Automatically merge the PR into the develop branch.	2026-05-16 20:44:49 +02:00
JC5	883c083860	🤖 Auto commit for release 'develop' on 2026-05-16	2026-05-16 20:44:39 +02:00
James Cole	e059753c43	Merge branch 'main' into develop	2026-05-16 20:39:12 +02:00
James Cole	0bac0aaaee	Add some debug logging.	2026-05-16 20:38:50 +02:00
James Cole	2a68c48e2a	Update security reporting guidelines in security.md Clarified instructions for reporting false security issues. Signed-off-by: James Cole <james@firefly-iii.org>	2026-05-16 20:05:44 +02:00
James Cole	c394034876	Clarify AI hallucinations in security reporting Reworded the third point to clarify AI hallucinations in security issues. Signed-off-by: James Cole <james@firefly-iii.org>	2026-05-16 20:05:20 +02:00
James Cole	7bd91048ea	Update security.md with reporting guidelines Clarified reporting guidelines for security issues to prevent false reports. Signed-off-by: James Cole <james@firefly-iii.org>	2026-05-16 20:03:49 +02:00
James Cole	d64bca7700	Merge branch 'main' into develop	2026-05-16 19:54:22 +02:00
James Cole	7d768cfa23	Add AI-generated security advisories section Added a section regarding AI-generated security advisories to clarify reporting policies and potential consequences. Signed-off-by: James Cole <james@firefly-iii.org>	2026-05-16 19:52:56 +02:00
James Cole	fd50fbf193	Merge branch 'main' into develop	2026-05-12 18:48:04 +02:00
James Cole	134c232f45	Merge branch 'develop' of github.com:firefly-iii/firefly-iii into develop	2026-05-12 18:47:48 +02:00
James Cole	ce603f50d8	Fix https://github.com/firefly-iii/firefly-iii/issues/12243	2026-05-12 18:45:33 +02:00
James Cole	c4ee3598e1	Merge pull request #12239 from firefly-iii/dependabot/github_actions/actions/dependency-review-action-5 Bump actions/dependency-review-action from 4 to 5	2026-05-11 06:08:49 +02:00
dependabot[bot]	8cf8e91448	Bump actions/dependency-review-action from 4 to 5 Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 4 to 5. - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](https://github.com/actions/dependency-review-action/compare/v4...v5) --- updated-dependencies: - dependency-name: actions/dependency-review-action dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-11 03:56:03 +00:00