Merge pull request #12272 from firefly-iii/release-1779302299

🤖 Automatically merge the PR into the develop branch.
🤖 Auto commit for release 'develop' on 2026-05-20
2026-05-26 02:40:12 +00:00 · 2026-05-20 20:38:28 +02:00 · 2026-05-20 20:38:20 +02:00 · 2026-05-20 20:30:30 +02:00 · 2026-05-20 20:24:50 +02:00 · 2026-05-20 20:18:10 +02:00
23 changed files with 348 additions and 286 deletions
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -38,9 +38,11 @@ Example: Fixes #1234. See also #3456.

 #### AI usage disclosure
 <!--
-If AI tools were involved in creating this PR, please check all boxes that apply
+If AI tools were involved in creating this PR, please check all boxes that apply 
 below and make sure that you adhere to our Automated Contributions Policy:
 https://docs.firefly-iii.org/explanation/support/#automated-contributions-policy
+
+If you remove or skip this disclosure, your PR may be ignored.
 -->
 I used AI assistance for:
 - [ ] Code generation (e.g., when writing an implementation or fixing a bug)
--- a/.github/security.md
+++ b/.github/security.md
@@ -6,7 +6,7 @@ disclosure and response policy to ensure that critical issues are responsibly ha
 ## AI-generated security advisories

 > [!WARNING]  
-> Due to a large number of irrelevant, noisy and uninformed AI-generated security advisories coming my way, reporting any the following security issues may return in a permanent ban from the Firefly III organization on GitHub.
+> Due to a large number of irrelevant, noisy and uninformed AI-generated security advisories coming my way, reporting any the following security issues may result in a permanent ban from the Firefly III organization on GitHub.

 1. Any SSRF in any user provided URL field (webhooks, ntfy, SimpleFIN, Slack). It's by design that users may set-up any URL they want, be it internal, private or non-existing.
 2. Any XSS issue without a viable attack tree. If you can find a spot where Firefly III or the associated tools render unescaped data, it's not a security issue unless you can show me an actual attack that gets that data into the system.
--- a/.github/workflows/pr-reply-no-disclosure.yml
+++ b/.github/workflows/pr-reply-no-disclosure.yml
@@ -0,0 +1,66 @@
+name: 'PRs - Check for AI disclosure'
+
+# the workflow to execute on is comments that are newly created
+on:
+  pull_request:
+    types: [ opened ]
+
+# permissions needed for reacting to IssueOps commands on issues and PRs
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+  checks: read
+
+jobs:
+  respond:
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+          BODY=$(gh pr view $NUMBER --json body)
+          AUTHOR=$(gh pr view $NUMBER --json author)
+
+          if [[ $AUTHOR == *"app/dependabot"* ]]; then
+            echo "Is dependabot, stop"
+            exit 0
+          fi
+
+          # I used AI assistance for:
+          # - [ ] Code generation (e.g., when writing an implementation or fixing a bug)
+          # - [ ] Test/benchmark generation
+          # - [ ] Documentation (including examples)
+          # - [ ] Research and understanding
+
+
+
+          # $BODY must contain one of these four uses.
+          if [[ $BODY != *"Code generation"* &&
+                $BODY != *"Test/benchmark generation"* &&
+                $BODY != *"Documentation"* &&
+                $BODY != *"Research and understanding"* &&
+                $BODY != *"I used AI assistance for"* ]]; then
+            MESSAGE="Hi there!
+
+          This is an automated reply. \`Share and enjoy\`
+
+          You triggered an automated reply, because it seems you removed or changed the AI assistance disclosure from the PR template. Without a valid disclosure, your PR cannot be processed.
+
+          Even if you did not use AI, this disclosure must be present. Please reply to your PR and explain your use of AI in any or all of the following areas:
+
+          1. Code generation (e.g., when writing an implementation or fixing a bug)
+          2. Test/benchmark generation
+          3. Documentation (including examples)
+          4. Research and understanding
+
+          There cannot be interaction with your PR without this disclosure.
+
+          If the disclosure is present but the bot did not pick up on it, please accept my apologies for the intrusion. Contrary to other bots, this one is just a simple \`bash\` script and it may be wrong."
+
+            gh pr comment "$NUMBER" --body "$MESSAGE"
+            echo "Triggered on AI disclosure missing."
+            exit 0
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          NUMBER: ${{ github.event.pull_request.number }}
--- a/THANKS.md
+++ b/THANKS.md
@@ -4,6 +4,7 @@ Over time, many people have contributed to Firefly III. Their efforts are not al
 Please find below all the people who contributed to the Firefly III code. Their names are mentioned in the year of their first contribution.

 ## 2026
+- iaohkut
 - tasnim0tantawi
 - Joe Longendyke
 - Daniel Holøien
--- a/app/Api/V1/Controllers/Insight/Income/TagController.php
+++ b/app/Api/V1/Controllers/Insight/Income/TagController.php
@@ -158,10 +158,7 @@ final class TagController extends Controller
                        'currency_id'      => (string) $foreignCurrencyId,
                        'currency_code'    => $journal['foreign_currency_code'],
                    ];
-                    $response[$foreignKey]['difference']       = bcadd(
-                        (string) $response[$foreignKey]['difference'],
-                        Steam::positive($journal['foreign_amount'])
-                    );
+                    $response[$foreignKey]['difference']       = bcadd((string) $response[$foreignKey]['difference'], Steam::positive($journal['foreign_amount']));
                    $response[$foreignKey]['difference_float'] = (float) $response[$foreignKey]['difference'];
                }
            }
--- a/app/Api/V1/Controllers/Insight/Transfer/TagController.php
+++ b/app/Api/V1/Controllers/Insight/Transfer/TagController.php
@@ -155,10 +155,7 @@ final class TagController extends Controller
                        'currency_id'      => (string) $foreignCurrencyId,
                        'currency_code'    => $journal['foreign_currency_code'],
                    ];
-                    $response[$foreignKey]['difference']       = bcadd(
-                        (string) $response[$foreignKey]['difference'],
-                        Steam::positive($journal['foreign_amount'])
-                    );
+                    $response[$foreignKey]['difference']       = bcadd((string) $response[$foreignKey]['difference'], Steam::positive($journal['foreign_amount']));
                    $response[$foreignKey]['difference_float'] = (float) $response[$foreignKey]['difference']; // intentional float
                }
            }
--- a/app/Factory/PiggyBankFactory.php
+++ b/app/Factory/PiggyBankFactory.php
@@ -245,7 +245,10 @@ class PiggyBankFactory
        );

        // validate amount:
-        if (array_key_exists('target_amount', $piggyBankData) && '' === (string) $piggyBankData['target_amount']) {
+        if (array_key_exists('target_amount', $piggyBankData) && '' === trim((string) $piggyBankData['target_amount'])) {
+            $piggyBankData['target_amount'] = '0';
+        }
+        if (!array_key_exists('target_amount', $piggyBankData)) {
            $piggyBankData['target_amount'] = '0';
        }

--- a/app/Http/Controllers/Bill/IndexController.php
+++ b/app/Http/Controllers/Bill/IndexController.php
@@ -255,10 +255,7 @@ final class IndexController extends Controller
                    if (count($bill['paid_dates']) < count($bill['pay_dates'])) {
                        $count = count($bill['pay_dates']) - count($bill['paid_dates']);
                        if ($count > 0) {
-                            $avg                                                 = bcdiv(
-                                bcadd((string) $bill['amount_min'], (string) $bill['amount_max']),
-                                '2'
-                            );
+                            $avg                                                 = bcdiv(bcadd((string) $bill['amount_min'], (string) $bill['amount_max']), '2');
                            $avg                                                 = bcmul($avg, (string) $count);
                            $sums[$groupOrder][$currencyId]['total_left_to_pay'] = bcadd($sums[$groupOrder][$currencyId]['total_left_to_pay'], $avg);
                            Log::debug(
--- a/app/Http/Controllers/Budget/BudgetLimitController.php
+++ b/app/Http/Controllers/Budget/BudgetLimitController.php
@@ -198,13 +198,7 @@ final class BudgetLimitController extends Controller
        if ($request->expectsJson()) {
            $array                           = $limit->toArray();
            // add some extra metadata:
-            $spentArr                        = $this->opsRepository->sumExpenses(
-                $limit->start_date,
-                $limit->end_date,
-                null,
-                new Collection()->push($budget),
-                $currency
-            );
+            $spentArr                        = $this->opsRepository->sumExpenses($limit->start_date, $limit->end_date, null, new Collection()->push($budget), $currency);
            $array['spent']                  = $spentArr[$currency->id]['sum'] ?? '0';
            $array['left_formatted']         = Amount::formatAnything($limit->transactionCurrency, bcadd($array['spent'], (string) $array['amount']));
            $array['amount_formatted']       = Amount::formatAnything($limit->transactionCurrency, $limit['amount']);
--- a/app/Http/Controllers/Budget/IndexController.php
+++ b/app/Http/Controllers/Budget/IndexController.php
@@ -284,10 +284,7 @@ final class IndexController extends Controller

                if (array_key_exists($currency->id, $spentArr) && array_key_exists('sum', $spentArr[$currency->id])) {
                    $array['spent'][$currency->id]['spent']                   = $spentArr[$currency->id]['sum'];
-                    $array['spent'][$currency->id]['spent_outside']           = Steam::negative(bcsub(
-                        $spentInLimits[$currency->id],
-                        $spentArr[$currency->id]['sum']
-                    ));
+                    $array['spent'][$currency->id]['spent_outside']           = Steam::negative(bcsub($spentInLimits[$currency->id], $spentArr[$currency->id]['sum']));
                    $array['spent'][$currency->id]['currency_id']             = $currency->id;
                    $array['spent'][$currency->id]['currency_symbol']         = $currency->symbol;
                    $array['spent'][$currency->id]['currency_decimal_places'] = $currency->decimal_places;
--- a/app/Http/Controllers/Chart/BudgetController.php
+++ b/app/Http/Controllers/Chart/BudgetController.php
@@ -539,13 +539,7 @@ final class BudgetController extends Controller
            }

            // get spent amount in this period for this currency.
-            $sum                             = $this->opsRepository->sumExpenses(
-                $currentStart,
-                $currentEnd,
-                $accounts,
-                new Collection()->push($budget),
-                $currency
-            );
+            $sum                             = $this->opsRepository->sumExpenses($currentStart, $currentEnd, $accounts, new Collection()->push($budget), $currency);
            $amount                          = Steam::positive($sum[$currency->id]['sum'] ?? '0');
            $chartData[0]['entries'][$title] = Steam::bcround($amount, $currency->decimal_places);

--- a/app/Http/Controllers/Profile/OAuthController.php
+++ b/app/Http/Controllers/Profile/OAuthController.php
@@ -145,6 +145,7 @@ final class OAuthController extends Controller
            ->where('expires_at', '>', Date::now())
            ->get()
            ->filter(fn (#[SensitiveParameter] Token $token) => $token->client->hasGrantType('personal_access'))
+            ->values()
        ;

        return response()->json($tokens);
--- a/app/Jobs/CreateAutoBudgetLimits.php
+++ b/app/Jobs/CreateAutoBudgetLimits.php
@@ -122,13 +122,7 @@ class CreateAutoBudgetLimits implements ShouldQueue
        // if has one, calculate expenses and use that as a base.
        $repository      = app(OperationsRepositoryInterface::class);
        $repository->setUser($autoBudget->budget->user);
-        $spent           = $repository->sumExpenses(
-            $previousStart,
-            $previousEnd,
-            null,
-            new Collection()->push($autoBudget->budget),
-            $autoBudget->transactionCurrency
-        );
+        $spent           = $repository->sumExpenses($previousStart, $previousEnd, null, new Collection()->push($autoBudget->budget), $autoBudget->transactionCurrency);
        $currencyId      = $autoBudget->transaction_currency_id;
        $spentAmount     = $spent[$currencyId]['sum'] ?? '0';
        Log::debug(sprintf('Spent in previous budget period (%s-%s) is %s', $previousStart->format('Y-m-d'), $previousEnd->format('Y-m-d'), $spentAmount));
@@ -218,13 +212,7 @@ class CreateAutoBudgetLimits implements ShouldQueue
        // if has one, calculate expenses and use that as a base.
        $repository    = app(OperationsRepositoryInterface::class);
        $repository->setUser($autoBudget->budget->user);
-        $spent         = $repository->sumExpenses(
-            $previousStart,
-            $previousEnd,
-            null,
-            new Collection()->push($autoBudget->budget),
-            $autoBudget->transactionCurrency
-        );
+        $spent         = $repository->sumExpenses($previousStart, $previousEnd, null, new Collection()->push($autoBudget->budget), $autoBudget->transactionCurrency);
        $currencyId    = $autoBudget->transaction_currency_id;
        $spentAmount   = $spent[$currencyId]['sum'] ?? '0';
        Log::debug(sprintf('Spent in previous budget period (%s-%s) is %s', $previousStart->format('Y-m-d'), $previousEnd->format('Y-m-d'), $spentAmount));
--- a/app/Support/Http/Controllers/AugumentData.php
+++ b/app/Support/Http/Controllers/AugumentData.php
@@ -222,14 +222,7 @@ trait AugumentData
                $currentEnd->addMonth();
            }
            // primary currency amount.
-            $expenses        = $opsRepository->sumExpenses(
-                $currentStart,
-                $currentEnd,
-                null,
-                $budgetCollection,
-                $entry->transactionCurrency,
-                $this->convertToPrimary
-            );
+            $expenses        = $opsRepository->sumExpenses($currentStart, $currentEnd, null, $budgetCollection, $entry->transactionCurrency, $this->convertToPrimary);
            $spent           = $expenses[$currency->id]['sum'] ?? '0';
            $entry->pc_spent = $spent;

--- a/app/Support/JsonApi/Enrichments/RecurringEnrichment.php
+++ b/app/Support/JsonApi/Enrichments/RecurringEnrichment.php
@@ -354,10 +354,7 @@ class RecurringEnrichment implements EnrichmentInterface

        /** @var RecurrenceRepetition $repetition */
        foreach ($set as $repetition) {
-            $recurrence                               = $this->collection
-                ->filter(static fn (Recurrence $item): bool => (int) $item->id === (int) $repetition->recurrence_id)
-                ->first()
-            ;
+            $recurrence                               = $this->collection->filter(static fn (Recurrence $item): bool => (int) $item->id === (int) $repetition->recurrence_id)->first();
            $fromDate                                 = clone ($recurrence->latest_date ?? $recurrence->first_date);
            $recurrenceId                             = (int) $repetition->recurrence_id;
            $repId                                    = (int) $repetition->id;
--- a/app/Support/Models/AccountBalanceCalculator.php
+++ b/app/Support/Models/AccountBalanceCalculator.php
@@ -141,6 +141,9 @@ class AccountBalanceCalculator
        foreach ($set as $entry) {
            // Log::debug(sprintf('Processing transaction #%d with currency #%d and amount %s', $entry->id, $entry->transaction_currency_id, Steam::bcround($entry->amount, 2)));
            // start with empty array:
+            $entry->account_id                                             = (int) $entry->account_id;
+            $entry->transaction_currency_id                                = (int) $entry->transaction_currency_id;
+
            $balances[$entry->account_id]                                  ??= [];
            $balances[$entry->account_id][$entry->transaction_currency_id] ??= [
                self::getLatestBalance($entry->account_id, $entry->transaction_currency_id, $notBefore),
--- a/app/TransactionRules/Engine/SearchRuleEngine.php
+++ b/app/TransactionRules/Engine/SearchRuleEngine.php
@@ -543,12 +543,13 @@ class SearchRuleEngine implements RuleEngineInterface
        }

        // pick up from the action if it actually acted or not:
-        if (true === $ruleAction->stop_processing && $result) {
+        if (true === $ruleAction->stop_processing && true === $result) {
            Log::debug(sprintf('Rule action "%s" reports changes AND asks to break, so break!', $ruleAction->action_type));

            return true;
        }
-        if (true === $ruleAction->stop_processing && false === $result) {
+        //  reset is false at this point.
+        if (true === $ruleAction->stop_processing) {
            Log::debug(sprintf('Rule action "%s" reports NO changes AND asks to break, but we wont break!', $ruleAction->action_type));
        }

--- a/changelog.md
+++ b/changelog.md
@@ -3,6 +3,32 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).

+## v6.6.3 - 2026-05-21
+
+<!-- summary: This release fixes an XSS issue and some minor other bugs -->
+
+### Changed
+
+- Better explanation text for the password validation code.
+
+### Fixed
+
+- [Discussion 11408](https://github.com/orgs/firefly-iii/discussions/11408) (How do I see the content of link notes?) started by @Coderdude112
+- [Discussion 11455](https://github.com/orgs/firefly-iii/discussions/11455) ("Sum" Line In Account Charts) started by @PVTejas
+- [Discussion 12097](https://github.com/orgs/firefly-iii/discussions/12097) (Error updating Exchange Rates) started by @gpampuro
+- [Issue 12204](https://github.com/firefly-iii/firefly-iii/issues/12204) (A change is shown in "Audit log entries" when there was actually no movement (currency values fields)) reported by @jgmm81
+- [Issue 12207](https://github.com/firefly-iii/firefly-iii/issues/12207) (Rule triggers hidden on rules page for rules with multiple triggers) reported by @frankakn7
+- [Discussion 12210](https://github.com/orgs/firefly-iii/discussions/12210) (PiggyBanks and suggested amount per month) started by @Thieume
+- [Issue 12223](https://github.com/firefly-iii/firefly-iii/issues/12223) (Budget figures on the default financial report does not include transactions in liability accounts) reported by @likinon1981
+- [Issue 12243](https://github.com/firefly-iii/firefly-iii/issues/12243) (Abacus App is not working with the new OAuth) reported by @darkmatter18
+- [Issue 12254](https://github.com/firefly-iii/firefly-iii/issues/12254) (Personal Access Tokens not listed on web UI) reported by @imjuzcy
+- [Issue 12257](https://github.com/firefly-iii/firefly-iii/issues/12257) (getLatestBalance(): Argument #2 ($currencyId) must be of type int, string given) reported by @LaCarotteSauvage
+- [Issue 12258](https://github.com/firefly-iii/firefly-iii/issues/12258) (500 Internal Server Error when creating piggy bank) reported by @davbrito
+
+### Security
+
+- [PR 12271](https://github.com/firefly-iii/firefly-iii/pull/12271) (Fix stored XSS in audit log view via piggy bank name (ale.twig)) reported by @alanturing881
+
 ## v6.6.2 - 2026-04-28

 <!-- summary: This releases fixes a security issue and some small UI issues. Please upgrade at your earliest convenience. -->
--- a/composer.lock
+++ b/composer.lock
@@ -1245,16 +1245,16 @@
        },
        {
            "name": "guzzlehttp/guzzle",
-            "version": "7.10.0",
+            "version": "7.10.2",
            "source": {
                "type": "git",
                "url": "https://github.com/guzzle/guzzle.git",
-                "reference": "b51ac707cfa420b7bfd4e4d5e510ba8008e822b4"
+                "reference": "aed36fd5fb4844f284252a999d9abf35d3a9a1ae"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/guzzle/zipball/b51ac707cfa420b7bfd4e4d5e510ba8008e822b4",
-                "reference": "b51ac707cfa420b7bfd4e4d5e510ba8008e822b4",
+                "url": "https://api.github.com/repos/guzzle/guzzle/zipball/aed36fd5fb4844f284252a999d9abf35d3a9a1ae",
+                "reference": "aed36fd5fb4844f284252a999d9abf35d3a9a1ae",
                "shasum": ""
            },
            "require": {
@@ -1272,8 +1272,9 @@
                "bamarni/composer-bin-plugin": "^1.8.2",
                "ext-curl": "*",
                "guzzle/client-integration-tests": "3.0.2",
+                "guzzlehttp/test-server": "^0.3.2",
                "php-http/message-factory": "^1.1",
-                "phpunit/phpunit": "^8.5.39 || ^9.6.20",
+                "phpunit/phpunit": "^8.5.52 || ^9.6.34",
                "psr/log": "^1.1 || ^2.0 || ^3.0"
            },
            "suggest": {
@@ -1351,7 +1352,7 @@
            ],
            "support": {
                "issues": "https://github.com/guzzle/guzzle/issues",
-                "source": "https://github.com/guzzle/guzzle/tree/7.10.0"
+                "source": "https://github.com/guzzle/guzzle/tree/7.10.2"
            },
            "funding": [
                {
@@ -1367,20 +1368,20 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2025-08-23T22:36:01+00:00"
+            "time": "2026-05-20T11:58:52+00:00"
        },
        {
            "name": "guzzlehttp/promises",
-            "version": "2.3.0",
+            "version": "2.3.1",
            "source": {
                "type": "git",
                "url": "https://github.com/guzzle/promises.git",
-                "reference": "481557b130ef3790cf82b713667b43030dc9c957"
+                "reference": "d2d8dfae4757f384d630fdffc2d8d6618d8f4c5e"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/promises/zipball/481557b130ef3790cf82b713667b43030dc9c957",
-                "reference": "481557b130ef3790cf82b713667b43030dc9c957",
+                "url": "https://api.github.com/repos/guzzle/promises/zipball/d2d8dfae4757f384d630fdffc2d8d6618d8f4c5e",
+                "reference": "d2d8dfae4757f384d630fdffc2d8d6618d8f4c5e",
                "shasum": ""
            },
            "require": {
@@ -1388,7 +1389,7 @@
            },
            "require-dev": {
                "bamarni/composer-bin-plugin": "^1.8.2",
-                "phpunit/phpunit": "^8.5.44 || ^9.6.25"
+                "phpunit/phpunit": "^8.5.52 || ^9.6.34"
            },
            "type": "library",
            "extra": {
@@ -1434,7 +1435,7 @@
            ],
            "support": {
                "issues": "https://github.com/guzzle/promises/issues",
-                "source": "https://github.com/guzzle/promises/tree/2.3.0"
+                "source": "https://github.com/guzzle/promises/tree/2.3.1"
            },
            "funding": [
                {
@@ -1450,20 +1451,20 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2025-08-22T14:34:08+00:00"
+            "time": "2026-05-19T18:30:48+00:00"
        },
        {
            "name": "guzzlehttp/psr7",
-            "version": "2.9.0",
+            "version": "2.10.1",
            "source": {
                "type": "git",
                "url": "https://github.com/guzzle/psr7.git",
-                "reference": "7d0ed42f28e42d61352a7a79de682e5e67fec884"
+                "reference": "73ab136360b5dfd858006eae9795e8fe43c80361"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/psr7/zipball/7d0ed42f28e42d61352a7a79de682e5e67fec884",
-                "reference": "7d0ed42f28e42d61352a7a79de682e5e67fec884",
+                "url": "https://api.github.com/repos/guzzle/psr7/zipball/73ab136360b5dfd858006eae9795e8fe43c80361",
+                "reference": "73ab136360b5dfd858006eae9795e8fe43c80361",
                "shasum": ""
            },
            "require": {
@@ -1478,9 +1479,9 @@
            },
            "require-dev": {
                "bamarni/composer-bin-plugin": "^1.8.2",
-                "http-interop/http-factory-tests": "0.9.0",
+                "http-interop/http-factory-tests": "1.1.0",
                "jshttp/mime-db": "1.54.0.1",
-                "phpunit/phpunit": "^8.5.44 || ^9.6.25"
+                "phpunit/phpunit": "^8.5.52 || ^9.6.34"
            },
            "suggest": {
                "laminas/laminas-httphandlerrunner": "Emit PSR-7 responses"
@@ -1551,7 +1552,7 @@
            ],
            "support": {
                "issues": "https://github.com/guzzle/psr7/issues",
-                "source": "https://github.com/guzzle/psr7/tree/2.9.0"
+                "source": "https://github.com/guzzle/psr7/tree/2.10.1"
            },
            "funding": [
                {
@@ -1567,7 +1568,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-03-10T16:41:02+00:00"
+            "time": "2026-05-20T09:27:36+00:00"
        },
        {
            "name": "guzzlehttp/uri-template",
@@ -1879,16 +1880,16 @@
        },
        {
            "name": "laravel/framework",
-            "version": "v13.9.0",
+            "version": "v13.11.2",
            "source": {
                "type": "git",
                "url": "https://github.com/laravel/framework.git",
-                "reference": "a0c6ad03b380287015287d8d5a0fa2459e2332fd"
+                "reference": "4148042bf6ee01edd05408f1f66d91b231f85c25"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/laravel/framework/zipball/a0c6ad03b380287015287d8d5a0fa2459e2332fd",
-                "reference": "a0c6ad03b380287015287d8d5a0fa2459e2332fd",
+                "url": "https://api.github.com/repos/laravel/framework/zipball/4148042bf6ee01edd05408f1f66d91b231f85c25",
+                "reference": "4148042bf6ee01edd05408f1f66d91b231f85c25",
                "shasum": ""
            },
            "require": {
@@ -2099,7 +2100,7 @@
                "issues": "https://github.com/laravel/framework/issues",
                "source": "https://github.com/laravel/framework"
            },
-            "time": "2026-05-13T15:38:40+00:00"
+            "time": "2026-05-20T11:46:02+00:00"
        },
        {
            "name": "laravel/passport",
@@ -2178,16 +2179,16 @@
        },
        {
            "name": "laravel/prompts",
-            "version": "v0.3.17",
+            "version": "v0.3.18",
            "source": {
                "type": "git",
                "url": "https://github.com/laravel/prompts.git",
-                "reference": "6a82ac19a28b916ae0885828795dbd4c59d9a818"
+                "reference": "a19af51bb144bf87f08397921fa619f85c7d4e72"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/laravel/prompts/zipball/6a82ac19a28b916ae0885828795dbd4c59d9a818",
-                "reference": "6a82ac19a28b916ae0885828795dbd4c59d9a818",
+                "url": "https://api.github.com/repos/laravel/prompts/zipball/a19af51bb144bf87f08397921fa619f85c7d4e72",
+                "reference": "a19af51bb144bf87f08397921fa619f85c7d4e72",
                "shasum": ""
            },
            "require": {
@@ -2231,9 +2232,9 @@
            "description": "Add beautiful and user-friendly forms to your command-line applications.",
            "support": {
                "issues": "https://github.com/laravel/prompts/issues",
-                "source": "https://github.com/laravel/prompts/tree/v0.3.17"
+                "source": "https://github.com/laravel/prompts/tree/v0.3.18"
            },
-            "time": "2026-04-20T16:07:33+00:00"
+            "time": "2026-05-19T00:47:18+00:00"
        },
        {
            "name": "laravel/serializable-closure",
@@ -6498,16 +6499,16 @@
        },
        {
            "name": "symfony/cache",
-            "version": "v8.0.10",
+            "version": "v8.0.12",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/cache.git",
-                "reference": "8ff96cde73684bfa32b702f5cff1eb83b1fac429"
+                "reference": "11dc0681506ff07ca80bfb4cbf84c601c3cf04f7"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/cache/zipball/8ff96cde73684bfa32b702f5cff1eb83b1fac429",
-                "reference": "8ff96cde73684bfa32b702f5cff1eb83b1fac429",
+                "url": "https://api.github.com/repos/symfony/cache/zipball/11dc0681506ff07ca80bfb4cbf84c601c3cf04f7",
+                "reference": "11dc0681506ff07ca80bfb4cbf84c601c3cf04f7",
                "shasum": ""
            },
            "require": {
@@ -6573,7 +6574,7 @@
                "psr6"
            ],
            "support": {
-                "source": "https://github.com/symfony/cache/tree/v8.0.10"
+                "source": "https://github.com/symfony/cache/tree/v8.0.12"
            },
            "funding": [
                {
@@ -6593,7 +6594,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-05-05T08:24:00+00:00"
+            "time": "2026-05-20T07:22:03+00:00"
        },
        {
            "name": "symfony/cache-contracts",
@@ -7623,16 +7624,16 @@
        },
        {
            "name": "symfony/http-kernel",
-            "version": "v8.0.11",
+            "version": "v8.0.12",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/http-kernel.git",
-                "reference": "20d3680373f4b791903c09e74b45402b4aeda71c"
+                "reference": "c00291734c59c05c54c5a3abc2ab18e99b070157"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/http-kernel/zipball/20d3680373f4b791903c09e74b45402b4aeda71c",
-                "reference": "20d3680373f4b791903c09e74b45402b4aeda71c",
+                "url": "https://api.github.com/repos/symfony/http-kernel/zipball/c00291734c59c05c54c5a3abc2ab18e99b070157",
+                "reference": "c00291734c59c05c54c5a3abc2ab18e99b070157",
                "shasum": ""
            },
            "require": {
@@ -7703,7 +7704,7 @@
            "description": "Provides a structured process for converting a Request into a Response",
            "homepage": "https://symfony.com",
            "support": {
-                "source": "https://github.com/symfony/http-kernel/tree/v8.0.11"
+                "source": "https://github.com/symfony/http-kernel/tree/v8.0.12"
            },
            "funding": [
                {
@@ -7723,20 +7724,20 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-05-13T18:07:14+00:00"
+            "time": "2026-05-20T09:47:36+00:00"
        },
        {
            "name": "symfony/mailer",
-            "version": "v8.0.8",
+            "version": "v8.0.12",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/mailer.git",
-                "reference": "ca5f6edaf8780ece814404b58a4482b22b509c56"
+                "reference": "5266d594e83593dff3492b5655ff6e8f38d67cfc"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/mailer/zipball/ca5f6edaf8780ece814404b58a4482b22b509c56",
-                "reference": "ca5f6edaf8780ece814404b58a4482b22b509c56",
+                "url": "https://api.github.com/repos/symfony/mailer/zipball/5266d594e83593dff3492b5655ff6e8f38d67cfc",
+                "reference": "5266d594e83593dff3492b5655ff6e8f38d67cfc",
                "shasum": ""
            },
            "require": {
@@ -7783,7 +7784,7 @@
            "description": "Helps sending emails",
            "homepage": "https://symfony.com",
            "support": {
-                "source": "https://github.com/symfony/mailer/tree/v8.0.8"
+                "source": "https://github.com/symfony/mailer/tree/v8.0.12"
            },
            "funding": [
                {
@@ -7803,7 +7804,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-03-30T15:14:47+00:00"
+            "time": "2026-05-20T07:22:03+00:00"
        },
        {
            "name": "symfony/mailgun-mailer",
@@ -7877,16 +7878,16 @@
        },
        {
            "name": "symfony/mime",
-            "version": "v8.0.9",
+            "version": "v8.0.12",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/mime.git",
-                "reference": "a9fcb293650c054b62a5b406f4e92e7b711ea333"
+                "reference": "7d9a72bbf0a9cb169ed1cbbbbbf709a592207fc1"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/mime/zipball/a9fcb293650c054b62a5b406f4e92e7b711ea333",
-                "reference": "a9fcb293650c054b62a5b406f4e92e7b711ea333",
+                "url": "https://api.github.com/repos/symfony/mime/zipball/7d9a72bbf0a9cb169ed1cbbbbbf709a592207fc1",
+                "reference": "7d9a72bbf0a9cb169ed1cbbbbbf709a592207fc1",
                "shasum": ""
            },
            "require": {
@@ -7939,7 +7940,7 @@
                "mime-type"
            ],
            "support": {
-                "source": "https://github.com/symfony/mime/tree/v8.0.9"
+                "source": "https://github.com/symfony/mime/tree/v8.0.12"
            },
            "funding": [
                {
@@ -7959,7 +7960,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-04-29T15:02:55+00:00"
+            "time": "2026-05-20T07:22:03+00:00"
        },
        {
            "name": "symfony/options-resolver",
@@ -8930,16 +8931,16 @@
        },
        {
            "name": "symfony/routing",
-            "version": "v8.0.9",
+            "version": "v8.0.12",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/routing.git",
-                "reference": "75d1bd8e5da3424e4db2fc3ff0222cb4d0c73038"
+                "reference": "c7f22a665faa3e5212b8f042e0c5831a6b85492f"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/routing/zipball/75d1bd8e5da3424e4db2fc3ff0222cb4d0c73038",
-                "reference": "75d1bd8e5da3424e4db2fc3ff0222cb4d0c73038",
+                "url": "https://api.github.com/repos/symfony/routing/zipball/c7f22a665faa3e5212b8f042e0c5831a6b85492f",
+                "reference": "c7f22a665faa3e5212b8f042e0c5831a6b85492f",
                "shasum": ""
            },
            "require": {
@@ -8986,7 +8987,7 @@
                "url"
            ],
            "support": {
-                "source": "https://github.com/symfony/routing/tree/v8.0.9"
+                "source": "https://github.com/symfony/routing/tree/v8.0.12"
            },
            "funding": [
                {
@@ -9006,7 +9007,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-04-29T15:02:55+00:00"
+            "time": "2026-05-20T07:22:03+00:00"
        },
        {
            "name": "symfony/service-contracts",
@@ -9805,16 +9806,16 @@
        },
        {
            "name": "twig/twig",
-            "version": "v3.24.0",
+            "version": "v3.26.0",
            "source": {
                "type": "git",
                "url": "https://github.com/twigphp/Twig.git",
-                "reference": "a6769aefb305efef849dc25c9fd1653358c148f0"
+                "reference": "1fcae487b180d78e6351f4e0afa91f9eab96a2bc"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/twigphp/Twig/zipball/a6769aefb305efef849dc25c9fd1653358c148f0",
-                "reference": "a6769aefb305efef849dc25c9fd1653358c148f0",
+                "url": "https://api.github.com/repos/twigphp/Twig/zipball/1fcae487b180d78e6351f4e0afa91f9eab96a2bc",
+                "reference": "1fcae487b180d78e6351f4e0afa91f9eab96a2bc",
                "shasum": ""
            },
            "require": {
@@ -9869,7 +9870,7 @@
            ],
            "support": {
                "issues": "https://github.com/twigphp/Twig/issues",
-                "source": "https://github.com/twigphp/Twig/tree/v3.24.0"
+                "source": "https://github.com/twigphp/Twig/tree/v3.26.0"
            },
            "funding": [
                {
@@ -9881,7 +9882,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-03-17T21:31:11+00:00"
+            "time": "2026-05-20T07:31:59+00:00"
        },
        {
            "name": "vlucas/phpdotenv",
@@ -10192,16 +10193,16 @@
        },
        {
            "name": "carthage-software/mago",
-            "version": "1.27.1",
+            "version": "1.28.0",
            "source": {
                "type": "git",
                "url": "https://github.com/carthage-software/mago.git",
-                "reference": "f4c31bbcb871e6bcbb96323ce791e06288b39b2a"
+                "reference": "c3daa7199f83bd06c0077b997358c46e80a0bb06"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/carthage-software/mago/zipball/f4c31bbcb871e6bcbb96323ce791e06288b39b2a",
-                "reference": "f4c31bbcb871e6bcbb96323ce791e06288b39b2a",
+                "url": "https://api.github.com/repos/carthage-software/mago/zipball/c3daa7199f83bd06c0077b997358c46e80a0bb06",
+                "reference": "c3daa7199f83bd06c0077b997358c46e80a0bb06",
                "shasum": ""
            },
            "require": {
@@ -10239,7 +10240,7 @@
            ],
            "support": {
                "issues": "https://github.com/carthage-software/mago/issues",
-                "source": "https://github.com/carthage-software/mago/tree/1.27.1"
+                "source": "https://github.com/carthage-software/mago/tree/1.28.0"
            },
            "funding": [
                {
@@ -10247,7 +10248,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-05-13T15:32:36+00:00"
+            "time": "2026-05-19T07:03:29+00:00"
        },
        {
            "name": "cloudcreativity/json-api-testing",
@@ -11513,11 +11514,11 @@
        },
        {
            "name": "phpstan/phpstan",
-            "version": "2.1.54",
+            "version": "2.1.55",
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/8be50c3992107dc837b17da4d140fbbdf9a5c5bd",
-                "reference": "8be50c3992107dc837b17da4d140fbbdf9a5c5bd",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/9eaac3826ed5e9b8427350a43cac825eeca3f566",
+                "reference": "9eaac3826ed5e9b8427350a43cac825eeca3f566",
                "shasum": ""
            },
            "require": {
@@ -11562,7 +11563,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-04-29T13:31:09+00:00"
+            "time": "2026-05-18T11:57:34+00:00"
        },
        {
            "name": "phpstan/phpstan-deprecation-rules",
@@ -12270,16 +12271,16 @@
        },
        {
            "name": "sebastian/comparator",
-            "version": "8.1.4",
+            "version": "8.2.0",
            "source": {
                "type": "git",
                "url": "https://github.com/sebastianbergmann/comparator.git",
-                "reference": "1edd557042bf4ff9978ec125d8131b147d5c8224"
+                "reference": "ddacb462216a4f6d97e84bf08165b9074ddbafeb"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/comparator/zipball/1edd557042bf4ff9978ec125d8131b147d5c8224",
-                "reference": "1edd557042bf4ff9978ec125d8131b147d5c8224",
+                "url": "https://api.github.com/repos/sebastianbergmann/comparator/zipball/ddacb462216a4f6d97e84bf08165b9074ddbafeb",
+                "reference": "ddacb462216a4f6d97e84bf08165b9074ddbafeb",
                "shasum": ""
            },
            "require": {
@@ -12287,10 +12288,10 @@
                "ext-mbstring": "*",
                "php": ">=8.4",
                "sebastian/diff": "^8.3",
-                "sebastian/exporter": "^8.0"
+                "sebastian/exporter": "^8.0.3"
            },
            "require-dev": {
-                "phpunit/phpunit": "^13.0"
+                "phpunit/phpunit": "^13.1.10"
            },
            "suggest": {
                "ext-bcmath": "For comparing BcMath\\Number objects"
@@ -12298,7 +12299,7 @@
            "type": "library",
            "extra": {
                "branch-alias": {
-                    "dev-main": "8.1-dev"
+                    "dev-main": "8.2-dev"
                }
            },
            "autoload": {
@@ -12338,7 +12339,7 @@
            "support": {
                "issues": "https://github.com/sebastianbergmann/comparator/issues",
                "security": "https://github.com/sebastianbergmann/comparator/security/policy",
-                "source": "https://github.com/sebastianbergmann/comparator/tree/8.1.4"
+                "source": "https://github.com/sebastianbergmann/comparator/tree/8.2.0"
            },
            "funding": [
                {
@@ -12358,7 +12359,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-05-15T08:30:51+00:00"
+            "time": "2026-05-20T11:55:37+00:00"
        },
        {
            "name": "sebastian/complexity",
@@ -12587,16 +12588,16 @@
        },
        {
            "name": "sebastian/exporter",
-            "version": "8.0.2",
+            "version": "8.0.3",
            "source": {
                "type": "git",
                "url": "https://github.com/sebastianbergmann/exporter.git",
-                "reference": "9cee180ebe62259e3ed48df2212d1fc8cfd971bb"
+                "reference": "9b54f1afabb977a097ef353600d41a372ccde617"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/exporter/zipball/9cee180ebe62259e3ed48df2212d1fc8cfd971bb",
-                "reference": "9cee180ebe62259e3ed48df2212d1fc8cfd971bb",
+                "url": "https://api.github.com/repos/sebastianbergmann/exporter/zipball/9b54f1afabb977a097ef353600d41a372ccde617",
+                "reference": "9b54f1afabb977a097ef353600d41a372ccde617",
                "shasum": ""
            },
            "require": {
@@ -12605,7 +12606,7 @@
                "sebastian/recursion-context": "^8.0"
            },
            "require-dev": {
-                "phpunit/phpunit": "^13.0"
+                "phpunit/phpunit": "^13.1.10"
            },
            "type": "library",
            "extra": {
@@ -12653,7 +12654,7 @@
            "support": {
                "issues": "https://github.com/sebastianbergmann/exporter/issues",
                "security": "https://github.com/sebastianbergmann/exporter/security/policy",
-                "source": "https://github.com/sebastianbergmann/exporter/tree/8.0.2"
+                "source": "https://github.com/sebastianbergmann/exporter/tree/8.0.3"
            },
            "funding": [
                {
@@ -12673,7 +12674,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-04-15T12:38:05+00:00"
+            "time": "2026-05-20T04:38:47+00:00"
        },
        {
            "name": "sebastian/git-state",
@@ -12820,24 +12821,24 @@
        },
        {
            "name": "sebastian/lines-of-code",
-            "version": "5.0.0",
+            "version": "5.0.1",
            "source": {
                "type": "git",
                "url": "https://github.com/sebastianbergmann/lines-of-code.git",
-                "reference": "4f21bb7768e1c997722ccc7efb1d6b5c11bfd471"
+                "reference": "d2cff273a90c79b0eb590baa682d4b5c318bdbb7"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/lines-of-code/zipball/4f21bb7768e1c997722ccc7efb1d6b5c11bfd471",
-                "reference": "4f21bb7768e1c997722ccc7efb1d6b5c11bfd471",
+                "url": "https://api.github.com/repos/sebastianbergmann/lines-of-code/zipball/d2cff273a90c79b0eb590baa682d4b5c318bdbb7",
+                "reference": "d2cff273a90c79b0eb590baa682d4b5c318bdbb7",
                "shasum": ""
            },
            "require": {
-                "nikic/php-parser": "^5.0",
+                "nikic/php-parser": "^5.7.0",
                "php": ">=8.4"
            },
            "require-dev": {
-                "phpunit/phpunit": "^13.0"
+                "phpunit/phpunit": "^13.1.10"
            },
            "type": "library",
            "extra": {
@@ -12866,7 +12867,7 @@
            "support": {
                "issues": "https://github.com/sebastianbergmann/lines-of-code/issues",
                "security": "https://github.com/sebastianbergmann/lines-of-code/security/policy",
-                "source": "https://github.com/sebastianbergmann/lines-of-code/tree/5.0.0"
+                "source": "https://github.com/sebastianbergmann/lines-of-code/tree/5.0.1"
            },
            "funding": [
                {
@@ -12886,7 +12887,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-02-06T04:45:54+00:00"
+            "time": "2026-05-19T16:23:37+00:00"
        },
        {
            "name": "sebastian/object-enumerator",
@@ -13104,23 +13105,23 @@
        },
        {
            "name": "sebastian/type",
-            "version": "7.0.0",
+            "version": "7.0.1",
            "source": {
                "type": "git",
                "url": "https://github.com/sebastianbergmann/type.git",
-                "reference": "42412224607bd3931241bbd17f38e0f972f5a916"
+                "reference": "fee0309275847fefd7636167085e379c1dbf6990"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/type/zipball/42412224607bd3931241bbd17f38e0f972f5a916",
-                "reference": "42412224607bd3931241bbd17f38e0f972f5a916",
+                "url": "https://api.github.com/repos/sebastianbergmann/type/zipball/fee0309275847fefd7636167085e379c1dbf6990",
+                "reference": "fee0309275847fefd7636167085e379c1dbf6990",
                "shasum": ""
            },
            "require": {
                "php": ">=8.4"
            },
            "require-dev": {
-                "phpunit/phpunit": "^13.0"
+                "phpunit/phpunit": "^13.1.10"
            },
            "type": "library",
            "extra": {
@@ -13149,7 +13150,7 @@
            "support": {
                "issues": "https://github.com/sebastianbergmann/type/issues",
                "security": "https://github.com/sebastianbergmann/type/security/policy",
-                "source": "https://github.com/sebastianbergmann/type/tree/7.0.0"
+                "source": "https://github.com/sebastianbergmann/type/tree/7.0.1"
            },
            "funding": [
                {
@@ -13169,7 +13170,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-02-06T04:52:09+00:00"
+            "time": "2026-05-20T06:49:11+00:00"
        },
        {
            "name": "sebastian/version",
@@ -13399,16 +13400,16 @@
        },
        {
            "name": "webmozart/assert",
-            "version": "2.3.0",
+            "version": "2.4.0",
            "source": {
                "type": "git",
                "url": "https://github.com/webmozarts/assert.git",
-                "reference": "eb0d790f735ba6cff25c683a85a1da0eadeff9e4"
+                "reference": "9007ea6f45ecf352a9422b36644e4bfc039b9155"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/webmozarts/assert/zipball/eb0d790f735ba6cff25c683a85a1da0eadeff9e4",
-                "reference": "eb0d790f735ba6cff25c683a85a1da0eadeff9e4",
+                "url": "https://api.github.com/repos/webmozarts/assert/zipball/9007ea6f45ecf352a9422b36644e4bfc039b9155",
+                "reference": "9007ea6f45ecf352a9422b36644e4bfc039b9155",
                "shasum": ""
            },
            "require": {
@@ -13424,7 +13425,11 @@
            },
            "type": "library",
            "extra": {
+                "psalm": {
+                    "pluginClass": "Webmozart\\Assert\\PsalmPlugin"
+                },
                "branch-alias": {
+                    "dev-master": "2.0-dev",
                    "dev-feature/2-0": "2.0-dev"
                }
            },
@@ -13455,9 +13460,9 @@
            ],
            "support": {
                "issues": "https://github.com/webmozarts/assert/issues",
-                "source": "https://github.com/webmozarts/assert/tree/2.3.0"
+                "source": "https://github.com/webmozarts/assert/tree/2.4.0"
            },
-            "time": "2026-04-11T10:33:05+00:00"
+            "time": "2026-05-20T13:07:01+00:00"
        }
    ],
    "aliases": [],
--- a/config/firefly.php
+++ b/config/firefly.php
@@ -78,8 +78,8 @@ return [
        'running_balance_column' => (bool)env_default_when_empty(env('USE_RUNNING_BALANCE'), true), // this is only the default value, is not used.
        // see cer.php for exchange rates feature flag.
    ],
-'version' => 'develop/2026-05-16',
-'build_time' => 1778957079,
+'version' => 'develop/2026-05-20',
+'build_time' => 1779302299,
    'api_version'                          => '2.1.0', // field is no longer used.
    'db_version'                           => 28, // field is no longer used.

--- a/package-lock.json
+++ b/package-lock.json
@@ -1915,9 +1915,9 @@
            }
        },
        "node_modules/@oxc-project/types": {
-            "version": "0.128.0",
-            "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.128.0.tgz",
-            "integrity": "sha512-huv1Y/LzBJkBVHt3OlC7u0zHBW9qXf1FdD7sGmc1rXc2P1mTwHssYv7jyGx5KAACSCH+9B3Bhn6Z9luHRvf7pQ==",
+            "version": "0.130.0",
+            "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.130.0.tgz",
+            "integrity": "sha512-ibD2usx9JRu7f5pu2tMKMI4cpA4NgXJQoYRP4pQ7Pxmn1l6k/53qWtQWZayhYy3X4QZkt90Ot+mJEaeXouio6Q==",
            "dev": true,
            "license": "MIT",
            "funding": {
@@ -2259,9 +2259,9 @@
            }
        },
        "node_modules/@rolldown/binding-android-arm64": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.0-rc.18.tgz",
-            "integrity": "sha512-lIDyUAfD7U3+BWKzdxMbJcsYHuqXqmGz40aeRqvuAm3y5TkJSYTBW2RDrn65DJFPQqVjUAUqq5uz8urzQ8aBdQ==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.1.tgz",
+            "integrity": "sha512-fJI3I0r3C3Oj/zdBCpaCmBRZYf07xpaq4yCfDDoSFm+beWNzbIl26puW8RraUdugoJw/95zerNOn6jasAhzSmg==",
            "cpu": [
                "arm64"
            ],
@@ -2276,9 +2276,9 @@
            }
        },
        "node_modules/@rolldown/binding-darwin-arm64": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.0-rc.18.tgz",
-            "integrity": "sha512-apJq2ktnGp27nSInMR5Vcj8kY6xJzDAvfdIFlpDcAK/w4cDO58qVoi1YQsES/SKiFNge/6e4CUzgjfHduYqWpQ==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.1.tgz",
+            "integrity": "sha512-cKnAhWEsV7TPcA/5EAteDp6KcJZBQ2G+BqE7zayMMi7kMvwRsbv7WT9aOnn0WNl4SKEIf43vjS31iUPu80nzXg==",
            "cpu": [
                "arm64"
            ],
@@ -2293,9 +2293,9 @@
            }
        },
        "node_modules/@rolldown/binding-darwin-x64": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.0-rc.18.tgz",
-            "integrity": "sha512-5Ofot8xbs+pxRHJqm9/9N/4sTQOvdrwEsmPE9pdLEEoAbdZtG6F2LMDfO1sp6ZAtXJuJV/21ew2srq3W8NXB5g==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.1.tgz",
+            "integrity": "sha512-YKrVwQjIRBPo+5G/u03wGjbdy4q7pyzCe93DK9VJ7zkVmeg8LJ7GbgsiHWdR4xSoe4CAXRD7Bcjgbtr64bkXNg==",
            "cpu": [
                "x64"
            ],
@@ -2310,9 +2310,9 @@
            }
        },
        "node_modules/@rolldown/binding-freebsd-x64": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.0-rc.18.tgz",
-            "integrity": "sha512-7h8eeOTT1eyqJyx64BFCnWZpNm486hGWt2sqeLLgDxA0xI1oGZ9H7gK1S85uNGmBhkdPwa/6reTxfFFKvIsebw==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.1.tgz",
+            "integrity": "sha512-z/oBsREo46SsFqBwYtFe0kpJeBijAT48O/WXLI4suiCLBkr03RTtTJMCzSdDd2znlh8VJizL09XVkQgk8IZonw==",
            "cpu": [
                "x64"
            ],
@@ -2327,9 +2327,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.0-rc.18.tgz",
-            "integrity": "sha512-eRcm/HVt9U/JFu5RKAEKwGQYtDCKWLiaH6wOnsSEp6NMBb/3Os8LgHZlNyzMpFVNmiiMFlfb2zEnebfzJrHFmg==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.1.tgz",
+            "integrity": "sha512-ik8q7GM11zxvYxFc2PeDcT6TBvhCQMaUxfph/M5l9sKuTs/Sjg3L+Byw0F7w0ZVLBZmx30P+gG0ECzzN+MFcmQ==",
            "cpu": [
                "arm"
            ],
@@ -2344,9 +2344,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-arm64-gnu": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.0-rc.18.tgz",
-            "integrity": "sha512-SOrT/cT4ukTmgnrEz/Hg3m7LBnuCLW9psDeMKrimRWY4I8DmnO7Lco8W2vtqPmMkbVu8iJ+g4GFLVLLOVjJ9DQ==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.1.tgz",
+            "integrity": "sha512-QoSx2EkyrrdZ6kcyE8stqZ62t0Yra8Fs5ia9lOxJrh6TMQJK7gQKmscdTHf7pOXKREKrVwOtJcQG3qVSfc866A==",
            "cpu": [
                "arm64"
            ],
@@ -2361,9 +2361,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-arm64-musl": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.0-rc.18.tgz",
-            "integrity": "sha512-QWjdxN1HJCpBTAcZ5N5F7wju3gVPzRzSpmGzx7na0c/1qpN9CFil+xt+l9lV/1M6/gqHSNXCiqPfwhVJPeLnug==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.1.tgz",
+            "integrity": "sha512-uwNwFpwKeNiZawfAWBgg0VIztPTV3ihhh1vV334h9ivnNLorxnQMU6Fz8wG1Zb4Qh9LC1/MkcyT3YlDXG3Rsgg==",
            "cpu": [
                "arm64"
            ],
@@ -2378,9 +2378,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.0-rc.18.tgz",
-            "integrity": "sha512-ugCOyj7a4d9h3q9B+wXmf6g3a68UsjGh6dob5DHevHGMwDUbhsYNbSPxJsENcIttJZ9jv7qGM2UesLw5jqIhdg==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.1.tgz",
+            "integrity": "sha512-zY1bul7OWr7DFBiJ++wofXvnr8B45ce3QsQUhKrIhXsygAh7bTkwyeM1bi1a2g5C/yC/N8TZyGDEoMfm/l9mpg==",
            "cpu": [
                "ppc64"
            ],
@@ -2395,9 +2395,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-s390x-gnu": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.0-rc.18.tgz",
-            "integrity": "sha512-kKWRhbsotpXkGbcd5dllUWg5gEXcDAa8u5YnP9AV5DYNbvJHGzzuwv7dpmhc8NqKMJldl0a+x76IHbspEpEmdA==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.1.tgz",
+            "integrity": "sha512-0frlsT/f4Ft6I7SMESTKnF3cZsdicQn1dCMkF/jT9wDLE+gGoiQfv1nmT9e+s7s/fekvvy6tZM2jHvI2tkbJDQ==",
            "cpu": [
                "s390x"
            ],
@@ -2412,9 +2412,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-x64-gnu": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.0-rc.18.tgz",
-            "integrity": "sha512-uCo8ElcCIAMyYAZyuIZ81oFkhTSIllNvUCHCAlbhlN4ji3uC28h7IIdlXyIvGO7HsuqnV9p3rD/bpH7XhIyhRw==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.1.tgz",
+            "integrity": "sha512-XABVmGp9Tg0WspTVvwduTc4fpqy6JnAUrSQe6OuyqD/03nI7r0O9OWUkMIwFrjKAIqolvqoA4ZrJppgwE0Gxmw==",
            "cpu": [
                "x64"
            ],
@@ -2429,9 +2429,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-x64-musl": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.0-rc.18.tgz",
-            "integrity": "sha512-XNOQZtuE6yUIvx4rwGemwh8kpL1xvU41FXy/s9K7T/3JVcqGzo3NfKM2HrbrGgfPYGFW42f07Wk++aOC6B9NWA==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.1.tgz",
+            "integrity": "sha512-bV4fzswuzVcKD90o/VM6QqKxnxlDq0g2BISDLNVmxrnhpv1DDbyPhCIjYfvzYLV+MvkKKnQt2Q6AO86SEBULUQ==",
            "cpu": [
                "x64"
            ],
@@ -2446,9 +2446,9 @@
            }
        },
        "node_modules/@rolldown/binding-openharmony-arm64": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.0-rc.18.tgz",
-            "integrity": "sha512-tSn/kzrfa7tNOXr7sEacDBN4YsIqTyLqh45IO0nHDwtpKIDNDJr+VFojt+4klSpChxB29JLyduSsE0MKEwa65A==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.1.tgz",
+            "integrity": "sha512-/Mh0Zhq3OP7fVs0kcQHZP6lZEthMGTaSf8UBQYSFEZDWGXXlEC+nJ6EqenaK2t4LBXMe3A+K/G2BVXXdtOr4PQ==",
            "cpu": [
                "arm64"
            ],
@@ -2463,9 +2463,9 @@
            }
        },
        "node_modules/@rolldown/binding-wasm32-wasi": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.0-rc.18.tgz",
-            "integrity": "sha512-+J9YGmc+czgqlhYmwun3S3O0FIZhsH8ep2456xwjAdIOmuJxM7xz4P4PtrxU+Bz17a/5bqPA8o3HAAoX0teUdg==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.1.tgz",
+            "integrity": "sha512-+1xc9X45l8ufsBAm6Gjvx2qDRIY9lTVt0cgWNcJ+1gdhXvkbxePA60yRTwSTuXL09CMhyJmjpV7E3NoyxbqFQQ==",
            "cpu": [
                "wasm32"
            ],
@@ -2482,9 +2482,9 @@
            }
        },
        "node_modules/@rolldown/binding-win32-arm64-msvc": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.0-rc.18.tgz",
-            "integrity": "sha512-zsu47DgU0FQzSwi6sU9dZoEdUv7pc1AptSEz/Z8HBg54sV0Pbs3N0+CrIbTsgiu6EyoaNN9CHboqbLaz9lhOyQ==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.1.tgz",
+            "integrity": "sha512-1D+UqZdfnuR+Jy1GgMJwi85bD40H21uNmOPRWQhw4oRSuolZ/B5rixZ45DK2KXOTCvmVCecauWgEhbw8bI7tOw==",
            "cpu": [
                "arm64"
            ],
@@ -2499,9 +2499,9 @@
            }
        },
        "node_modules/@rolldown/binding-win32-x64-msvc": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.0-rc.18.tgz",
-            "integrity": "sha512-7H+3yqGgmnlDTRRhw/xpYY9J1kf4GC681nVc4GqKhExZTDrVVrV2tsOR9kso0fvgBdcTCcQShx4SLLoHgaLwhg==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.1.tgz",
+            "integrity": "sha512-INAycaWuhlOK3wk4mRHGsdgwYWmd9cChdPdE9bwWmy6rn9VqVNYNFGhOdXrofXUxwHIncSiPNb8tNm8knDVIeQ==",
            "cpu": [
                "x64"
            ],
@@ -2516,9 +2516,9 @@
            }
        },
        "node_modules/@rolldown/pluginutils": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-rc.18.tgz",
-            "integrity": "sha512-CUY5Mnhe64xQBGZEEXQ5WyZwsc1JU3vAZLIxtrsBt3LO6UOb+C8GunVKqe9sT8NeWb4lqSaoJtp2xo6GxT1MNw==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
+            "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
            "dev": true,
            "license": "MIT"
        },
@@ -2800,9 +2800,9 @@
            "license": "MIT"
        },
        "node_modules/@types/node": {
-            "version": "25.8.0",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-25.8.0.tgz",
-            "integrity": "sha512-TCFSk8IZh+iLX1xtksoBVtdmgL+1IX0fC9BeU4QqFSuNdN/K+HUlhqOzEmSYYpZUVsLYcPqc9KX+60iDuninSQ==",
+            "version": "25.9.1",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-25.9.1.tgz",
+            "integrity": "sha512-xfrlY7UD5rMJk3ZVJP8BNzS28J36YJg+xp+LPXV1TdWxr8uMH5A860QNxYDGQe/ylDSgjxE52Q9VnO7p75tJxg==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
@@ -3327,9 +3327,9 @@
            }
        },
        "node_modules/admin-lte": {
-            "version": "4.0.0-rc7",
-            "resolved": "https://registry.npmjs.org/admin-lte/-/admin-lte-4.0.0-rc7.tgz",
-            "integrity": "sha512-v7JYiuxONrpXxvoRVhFJuLpZ9xoBvQ1bHkE1lanVR8+/AqBATWXU3vOO0TAWOoxhG6/26JkU5otXq0Z2SRQjZQ==",
+            "version": "4.0.0",
+            "resolved": "https://registry.npmjs.org/admin-lte/-/admin-lte-4.0.0.tgz",
+            "integrity": "sha512-vuUo9yFI0bxbWXKclLRRuAbxLn3x3PdEAcuXOnzoYQ9EoOAbedj87Fb4FPF4BV2rPLfScFEQLbWngS4WtmPZJA==",
            "license": "MIT"
        },
        "node_modules/agent-base": {
@@ -3713,9 +3713,9 @@
            "license": "MIT"
        },
        "node_modules/baseline-browser-mapping": {
-            "version": "2.10.30",
-            "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.30.tgz",
-            "integrity": "sha512-xjOFN16Ha1+Rz4nFYKqHU/LSB+gx/Vi3yQLX7r7sAW+Wa+8hhF2h4pvqTrTMc8+WcDBEunnUurr46Jvv0jk3Vg==",
+            "version": "2.10.31",
+            "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.31.tgz",
+            "integrity": "sha512-MujYO3eP72uvmSE0i4wltsodRfIpZATP3jvzRNRGGxgzId7aVocVJJV3nf01qnzzKFGxQVC9bpWxl5cjxTr/7Q==",
            "dev": true,
            "license": "Apache-2.0",
            "bin": {
@@ -4149,9 +4149,9 @@
            }
        },
        "node_modules/caniuse-lite": {
-            "version": "1.0.30001792",
-            "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001792.tgz",
-            "integrity": "sha512-hVLMUZFgR4JJ6ACt1uEESvQN1/dBVqPAKY0hgrV70eN3391K6juAfTjKZLKvOMsx8PxA7gsY1/tLMMTcfFLLpw==",
+            "version": "1.0.30001793",
+            "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001793.tgz",
+            "integrity": "sha512-iwSsYWaCOoh26cV8NwNRViHlrfUvYsHDfRVcbtmw0Kg6PJIZZXwMkj1442FYLBGkeUf1juAsU3DTfxW579mrPA==",
            "dev": true,
            "funding": [
                {
@@ -4995,9 +4995,9 @@
            "license": "MIT"
        },
        "node_modules/date-fns": {
-            "version": "4.1.0",
-            "resolved": "https://registry.npmjs.org/date-fns/-/date-fns-4.1.0.tgz",
-            "integrity": "sha512-Ukq0owbQXxa/U3EGtsdVBkR1w7KOQ5gIBqdH2hkvknzZPYvBxb/aa6E8L7tmjFtkwZBu3UXBbjIgPo/Ez4xaNg==",
+            "version": "4.2.1",
+            "resolved": "https://registry.npmjs.org/date-fns/-/date-fns-4.2.1.tgz",
+            "integrity": "sha512-37RhSdxaG1suen6VDCza6rNrQfooyQh57HFVPwQGEq2QWliVLzPQZ8Oa017weOu+HZCnzI7N3Pf/wyoBKfEqrA==",
            "license": "MIT",
            "funding": {
                "type": "github",
@@ -5353,9 +5353,9 @@
            "license": "MIT"
        },
        "node_modules/electron-to-chromium": {
-            "version": "1.5.357",
-            "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.357.tgz",
-            "integrity": "sha512-NHlTIQDK8fmVwHwuIzmXYEJ1Ewq3D9wDNc0cWXxDGysP6Pb21giwGNkxiTifyKy/4SoPuN5l6GLP1W9Sv7zB2g==",
+            "version": "1.5.360",
+            "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.360.tgz",
+            "integrity": "sha512-GkcBt6YYAw9SxFWn+xVar4cLVGlXVuswwtRLBozi2zp0GjXs4ZnOrqV4zbXzg35n7w81hCkyJNYicgXlVHAmBA==",
            "dev": true,
            "license": "ISC"
        },
@@ -5410,9 +5410,9 @@
            }
        },
        "node_modules/enhanced-resolve": {
-            "version": "5.21.3",
-            "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.21.3.tgz",
-            "integrity": "sha512-QyL119InA+XXEkNLNTPCXPugSvOfhwv0JOlGNzvxs0hZaiHLNvXSpudUWsOlsXGWJh8G6ckCScEkVHfX3kw/2Q==",
+            "version": "5.21.6",
+            "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.21.6.tgz",
+            "integrity": "sha512-aNnGCvbJ/RIyWo1IuhNdVjnNF+EjH9wpzpNHt+ci/m9He9LJvUN8wrCcXjp9cWsGNAuvSpVFTx/vraAFQ8qGjQ==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
@@ -8777,9 +8777,9 @@
            }
        },
        "node_modules/postcss": {
-            "version": "8.5.14",
-            "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz",
-            "integrity": "sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==",
+            "version": "8.5.15",
+            "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
+            "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
            "dev": true,
            "funding": [
                {
@@ -8797,7 +8797,7 @@
            ],
            "license": "MIT",
            "dependencies": {
-                "nanoid": "^3.3.11",
+                "nanoid": "^3.3.12",
                "picocolors": "^1.1.1",
                "source-map-js": "^1.2.1"
            },
@@ -9527,9 +9527,9 @@
            "license": "MIT"
        },
        "node_modules/qs": {
-            "version": "6.15.1",
-            "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.1.tgz",
-            "integrity": "sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==",
+            "version": "6.15.2",
+            "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
+            "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
            "dev": true,
            "license": "BSD-3-Clause",
            "dependencies": {
@@ -9914,14 +9914,14 @@
            }
        },
        "node_modules/rolldown": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.0-rc.18.tgz",
-            "integrity": "sha512-phmyKBpuBdRYDf4hgyynGAYn/rDDe+iZXKVJ7WX5b1zQzpLkP5oJRPGsfJuHdzPMlyyEO/4sPW6yfSx2gf7lVg==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.1.tgz",
+            "integrity": "sha512-X0KQHljNnEkWNqqiz9zJrGunh1B0HgOxLXvnFpCOcadzcy5qohZ3tqMEUg00vncoRovXuK3ZqCT9KnnKzoInFQ==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
-                "@oxc-project/types": "=0.128.0",
-                "@rolldown/pluginutils": "1.0.0-rc.18"
+                "@oxc-project/types": "=0.130.0",
+                "@rolldown/pluginutils": "^1.0.0"
            },
            "bin": {
                "rolldown": "bin/cli.mjs"
@@ -9930,21 +9930,21 @@
                "node": "^20.19.0 || >=22.12.0"
            },
            "optionalDependencies": {
-                "@rolldown/binding-android-arm64": "1.0.0-rc.18",
-                "@rolldown/binding-darwin-arm64": "1.0.0-rc.18",
-                "@rolldown/binding-darwin-x64": "1.0.0-rc.18",
-                "@rolldown/binding-freebsd-x64": "1.0.0-rc.18",
-                "@rolldown/binding-linux-arm-gnueabihf": "1.0.0-rc.18",
-                "@rolldown/binding-linux-arm64-gnu": "1.0.0-rc.18",
-                "@rolldown/binding-linux-arm64-musl": "1.0.0-rc.18",
-                "@rolldown/binding-linux-ppc64-gnu": "1.0.0-rc.18",
-                "@rolldown/binding-linux-s390x-gnu": "1.0.0-rc.18",
-                "@rolldown/binding-linux-x64-gnu": "1.0.0-rc.18",
-                "@rolldown/binding-linux-x64-musl": "1.0.0-rc.18",
-                "@rolldown/binding-openharmony-arm64": "1.0.0-rc.18",
-                "@rolldown/binding-wasm32-wasi": "1.0.0-rc.18",
-                "@rolldown/binding-win32-arm64-msvc": "1.0.0-rc.18",
-                "@rolldown/binding-win32-x64-msvc": "1.0.0-rc.18"
+                "@rolldown/binding-android-arm64": "1.0.1",
+                "@rolldown/binding-darwin-arm64": "1.0.1",
+                "@rolldown/binding-darwin-x64": "1.0.1",
+                "@rolldown/binding-freebsd-x64": "1.0.1",
+                "@rolldown/binding-linux-arm-gnueabihf": "1.0.1",
+                "@rolldown/binding-linux-arm64-gnu": "1.0.1",
+                "@rolldown/binding-linux-arm64-musl": "1.0.1",
+                "@rolldown/binding-linux-ppc64-gnu": "1.0.1",
+                "@rolldown/binding-linux-s390x-gnu": "1.0.1",
+                "@rolldown/binding-linux-x64-gnu": "1.0.1",
+                "@rolldown/binding-linux-x64-musl": "1.0.1",
+                "@rolldown/binding-openharmony-arm64": "1.0.1",
+                "@rolldown/binding-wasm32-wasi": "1.0.1",
+                "@rolldown/binding-win32-arm64-msvc": "1.0.1",
+                "@rolldown/binding-win32-x64-msvc": "1.0.1"
            }
        },
        "node_modules/run-parallel": {
@@ -11305,16 +11305,16 @@
            }
        },
        "node_modules/vite": {
-            "version": "8.0.11",
-            "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.11.tgz",
-            "integrity": "sha512-Jz1mxtUBR5xTT65VOdJZUUeoyLtqljmFkiUXhPTLZka3RDc9vpi/xXkyrnsdRcm2lIi3l3GPMnAidTsEGIj3Ow==",
+            "version": "8.0.13",
+            "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.13.tgz",
+            "integrity": "sha512-MFtjBYgzmSxmgA4RAfjIyXWpGe1oALnjgUTzzV7QLx/TKxCzjtMH6Fd9/eVK+5Fg1qNoz5VAwsmMs/NofrmJvw==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
                "lightningcss": "^1.32.0",
                "picomatch": "^4.0.4",
                "postcss": "^8.5.14",
-                "rolldown": "1.0.0-rc.18",
+                "rolldown": "1.0.1",
                "tinyglobby": "^0.2.16"
            },
            "bin": {
@@ -12302,7 +12302,7 @@
                "laravel-vite-plugin": "^3",
                "patch-package": "^8",
                "sass": "^1",
-                "vite": "=8.0.11",
+                "vite": "=8.0.13",
                "vite-plugin-manifest-sri": "^0.2.0"
            }
        }
--- a/resources/assets/v2/package.json
+++ b/resources/assets/v2/package.json
@@ -12,7 +12,7 @@
        "laravel-vite-plugin": "^3",
        "patch-package": "^8",
        "sass": "^1",
-        "vite": "=8.0.11",
+        "vite": "=8.0.13",
        "vite-plugin-manifest-sri": "^0.2.0"
    },
    "dependencies": {
--- a/resources/views/list/ale.twig
+++ b/resources/views/list/ale.twig
@@ -104,10 +104,10 @@
                    <code>{{ logEntry.after }}</code>
                {% endif %}
                {% if 'add_to_piggy' == logEntry.action %}
-                    {{ trans('firefly.ale_action_log_add', {amount: formatAmountBySymbol(logEntry.after.amount, logEntry.after.currency_symbol, logEntry.after.decimal_places, true), name: logEntry.after.piggy})|raw }}
+                    {{ trans('firefly.ale_action_log_add', {amount: formatAmountBySymbol(logEntry.after.amount, logEntry.after.currency_symbol, logEntry.after.decimal_places, true), name: logEntry.after.piggy|e})|raw }}
                {% endif %}
                {% if 'remove_from_piggy' == logEntry.action %}
-                    {{ trans('firefly.ale_action_log_remove', {amount: formatAmountBySymbol(logEntry.after.amount, logEntry.after.currency_symbol, logEntry.after.decimal_places, true), name: logEntry.after.piggy})|raw }}
+                    {{ trans('firefly.ale_action_log_remove', {amount: formatAmountBySymbol(logEntry.after.amount, logEntry.after.currency_symbol, logEntry.after.decimal_places, true), name: logEntry.after.piggy|e})|raw }}
                {% endif %}
            </td>
Author	SHA1	Message	Date
github-actions[bot]	c5ce9fd1e2	Merge pull request #12272 from firefly-iii/release-1779302299 🤖 Automatically merge the PR into the develop branch.	2026-05-20 20:38:28 +02:00
JC5	3d64f7fe08	🤖 Auto commit for release 'develop' on 2026-05-20	2026-05-20 20:38:20 +02:00
James Cole	f2efb69b76	Fix broken if statement	2026-05-20 20:30:30 +02:00
James Cole	7499a414f4	Expand changelog	2026-05-20 20:24:50 +02:00
James Cole	8b0f790a56	Merge branch 'main' into develop	2026-05-20 20:18:10 +02:00
James Cole	b70ed32952	Merge pull request #12271 from alanturing881/fix/stored-xss-ale-piggy-name Fix stored XSS in audit log view via piggy bank name (ale.twig)	2026-05-20 20:16:16 +02:00
James Cole	9e511c822e	Update pr-reply-no-disclosure.yml Signed-off-by: James Cole <james@firefly-iii.org>	2026-05-20 20:12:40 +02:00
iaohkut	fa6c123595	Fix stored XSS in ALE view by HTML-escaping piggy bank name The Twig template ale.twig rendered the piggy bank name from AuditLogEntry.after.piggy using \|raw, bypassing auto-escaping. A user-controlled name containing HTML (e.g. <img onerror=...>) would execute as JavaScript in any browser viewing the transaction audit log (CWE-79). Apply \|e filter to escape only the user-controlled `name` parameter before substitution into the trans() string. The \|raw filter is preserved because the `amount` parameter legitimately contains <span> tags for currency styling. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-20 11:07:57 -04:00
James Cole	ec1dfca2b5	Enhance PR workflow to check for author Added logic to check for the author of the pull request. Signed-off-by: James Cole <james@firefly-iii.org>	2026-05-19 08:15:40 +02:00
James Cole	bebd3b189e	Merge pull request #12265 from firefly-iii/dependabot/npm_and_yarn/develop/vite-8.0.13 Bump vite from 8.0.11 to 8.0.13	2026-05-18 08:11:34 +02:00
github-actions[bot]	e3319dca5d	Merge pull request #12266 from firefly-iii/release-1779078811 🤖 Automatically merge the PR into the develop branch.	2026-05-18 06:33:40 +02:00
JC5	a38cb85f55	🤖 Auto commit for release 'develop' on 2026-05-18	2026-05-18 06:33:31 +02:00
dependabot[bot]	0226673a01	Bump vite from 8.0.11 to 8.0.13 Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.11 to 8.0.13. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.13/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.0.13 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-18 04:27:29 +00:00
github-actions[bot]	7816f1be9b	Merge pull request #12263 from firefly-iii/release-1779030686 🤖 Automatically merge the PR into the develop branch.	2026-05-17 17:11:33 +02:00
JC5	5878173e80	🤖 Auto commit for release 'develop' on 2026-05-17	2026-05-17 17:11:26 +02:00
github-actions[bot]	45c30f11bc	Merge pull request #12260 from firefly-iii/release-1778986654 🤖 Automatically merge the PR into the develop branch.	2026-05-17 04:57:40 +02:00
JC5	fea97efdbf	🤖 Auto commit for release 'develop' on 2026-05-17	2026-05-17 04:57:34 +02:00
James Cole	fe0e8796ca	Merge branch 'main' into develop	2026-05-17 04:50:57 +02:00
James Cole	e83c5b9f86	New workflow.	2026-05-17 04:50:34 +02:00
James Cole	9558f05947	Merge branch 'main' into develop	2026-05-17 04:29:39 +02:00
James Cole	f3d6bb0fb5	Possible fix for https://github.com/firefly-iii/firefly-iii/issues/12258	2026-05-17 04:28:06 +02:00
James Cole	57010cd2e0	Fix https://github.com/firefly-iii/firefly-iii/issues/12257	2026-05-17 04:26:45 +02:00
James Cole	9436eeacaf	Update warning about AI-generated security advisories Clarified consequences of reporting AI-generated security advisories. Signed-off-by: James Cole <james@firefly-iii.org>	2026-05-17 03:44:01 +02:00
github-actions[bot]	7ddf395ea9	Merge pull request #12256 from firefly-iii/release-1778958406 🤖 Automatically merge the PR into the develop branch.	2026-05-16 21:06:52 +02:00
JC5	492c55bd76	🤖 Auto commit for release 'develop' on 2026-05-16	2026-05-16 21:06:46 +02:00
James Cole	894dea5c9c	Fix https://github.com/firefly-iii/firefly-iii/issues/12254 as suggested by @imjuzcy	2026-05-16 21:01:50 +02:00