Merge pull request #12266 from firefly-iii/release-1779078811

🤖 Automatically merge the PR into the develop branch.

.github/pull_request_template.md

@@ -38,9 +38,11 @@ Example: Fixes #1234. See also #3456.
 
 #### AI usage disclosure
 <!--
-If AI tools were involved in creating this PR, please check all boxes that apply
+If AI tools were involved in creating this PR, please check all boxes that apply 
 below and make sure that you adhere to our Automated Contributions Policy:
 https://docs.firefly-iii.org/explanation/support/#automated-contributions-policy
+
+If you remove or skip this disclosure, your PR may be ignored.
 -->
 I used AI assistance for:
 - [ ] Code generation (e.g., when writing an implementation or fixing a bug)

.github/security.md

@@ -6,7 +6,7 @@ disclosure and response policy to ensure that critical issues are responsibly ha
 ## AI-generated security advisories
 
 > [!WARNING]  
-> Due to a large number of irrelevant, noisy and uninformed AI-generated security advisories coming my way, reporting any the following security issues may return in a permanent ban from the Firefly III organization on GitHub.
+> Due to a large number of irrelevant, noisy and uninformed AI-generated security advisories coming my way, reporting any the following security issues may result in a permanent ban from the Firefly III organization on GitHub.
 
 1. Any SSRF in any user provided URL field (webhooks, ntfy, SimpleFIN, Slack). It's by design that users may set-up any URL they want, be it internal, private or non-existing.
 2. Any XSS issue without a viable attack tree. If you can find a spot where Firefly III or the associated tools render unescaped data, it's not a security issue unless you can show me an actual attack that gets that data into the system.

.github/workflows/pr-reply-no-disclosure.yml

@@ -0,0 +1,60 @@
+name: 'PRs - Check for AI disclosure'
+
+# the workflow to execute on is comments that are newly created
+on:
+  pull_request:
+    types: [ opened ]
+
+# permissions needed for reacting to IssueOps commands on issues and PRs
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+  checks: read
+
+jobs:
+  respond:
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+          BODY=$(gh pr view $NUMBER --json body)
+
+          # I used AI assistance for:
+          # - [ ] Code generation (e.g., when writing an implementation or fixing a bug)
+          # - [ ] Test/benchmark generation
+          # - [ ] Documentation (including examples)
+          # - [ ] Research and understanding
+
+
+
+          # $BODY must contain one of these four uses.
+          if [[ $BODY != *"Code generation"* &&
+                $BODY != *"Test/benchmark generation"* &&
+                $BODY != *"Documentation"* &&
+                $BODY != *"Research and understanding"* &&
+                $BODY != *"I used AI assistance for"* ]]; then
+            MESSAGE="Hi there!
+
+          This is an automated reply. \`Share and enjoy\`
+
+          You triggered an automated reply, because it seems you removed or changed the AI assistance disclosure from the PR template. Without a valid disclosure, your PR cannot be processed.
+
+          Even if you did not use AI, this disclosure must be present. Please reply to your PR and explain your use of AI in any or all of the following areas:
+
+          1. Code generation (e.g., when writing an implementation or fixing a bug)
+          2. Test/benchmark generation
+          3. Documentation (including examples)
+          4. Research and understanding
+
+          There cannot be interaction with your PR without this disclosure.
+
+          If the disclosure is present but the bot did not pick up on it, please accept my apologies for the intrusion. Contrary to other bots, this one is just a simple \`bash\` script and it may be wrong."
+
+            gh pr comment "$NUMBER" --body "$MESSAGE"
+            echo "Triggered on AI disclosure missing."
+            exit 0
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          NUMBER: ${{ github.event.pull_request.number }}

app/Api/V1/Controllers/Insight/Income/TagController.php

@@ -158,7 +158,10 @@ final class TagController extends Controller
                         'currency_id'      => (string) $foreignCurrencyId,
                         'currency_code'    => $journal['foreign_currency_code'],
                     ];
-                    $response[$foreignKey]['difference']       = bcadd((string) $response[$foreignKey]['difference'], Steam::positive($journal['foreign_amount']));
+                    $response[$foreignKey]['difference']       = bcadd(
+                        (string) $response[$foreignKey]['difference'],
+                        Steam::positive($journal['foreign_amount'])
+                    );
                     $response[$foreignKey]['difference_float'] = (float) $response[$foreignKey]['difference'];
                 }
             }

app/Api/V1/Controllers/Insight/Transfer/TagController.php

@@ -155,7 +155,10 @@ final class TagController extends Controller
                         'currency_id'      => (string) $foreignCurrencyId,
                         'currency_code'    => $journal['foreign_currency_code'],
                     ];
-                    $response[$foreignKey]['difference']       = bcadd((string) $response[$foreignKey]['difference'], Steam::positive($journal['foreign_amount']));
+                    $response[$foreignKey]['difference']       = bcadd(
+                        (string) $response[$foreignKey]['difference'],
+                        Steam::positive($journal['foreign_amount'])
+                    );
                     $response[$foreignKey]['difference_float'] = (float) $response[$foreignKey]['difference']; // intentional float
                 }
             }

app/Factory/PiggyBankFactory.php

@@ -245,7 +245,10 @@ class PiggyBankFactory
         );
 
         // validate amount:
-        if (array_key_exists('target_amount', $piggyBankData) && '' === (string) $piggyBankData['target_amount']) {
+        if (array_key_exists('target_amount', $piggyBankData) && '' === trim((string) $piggyBankData['target_amount'])) {
+            $piggyBankData['target_amount'] = '0';
+        }
+        if (!array_key_exists('target_amount', $piggyBankData)) {
             $piggyBankData['target_amount'] = '0';
         }
 

app/Http/Controllers/Bill/IndexController.php

@@ -255,7 +255,10 @@ final class IndexController extends Controller
                     if (count($bill['paid_dates']) < count($bill['pay_dates'])) {
                         $count = count($bill['pay_dates']) - count($bill['paid_dates']);
                         if ($count > 0) {
-                            $avg                                                 = bcdiv(bcadd((string) $bill['amount_min'], (string) $bill['amount_max']), '2');
+                            $avg                                                 = bcdiv(
+                                bcadd((string) $bill['amount_min'], (string) $bill['amount_max']),
+                                '2'
+                            );
                             $avg                                                 = bcmul($avg, (string) $count);
                             $sums[$groupOrder][$currencyId]['total_left_to_pay'] = bcadd($sums[$groupOrder][$currencyId]['total_left_to_pay'], $avg);
                             Log::debug(

app/Http/Controllers/Budget/BudgetLimitController.php

@@ -198,7 +198,13 @@ final class BudgetLimitController extends Controller
         if ($request->expectsJson()) {
             $array                           = $limit->toArray();
             // add some extra metadata:
-            $spentArr                        = $this->opsRepository->sumExpenses($limit->start_date, $limit->end_date, null, new Collection()->push($budget), $currency);
+            $spentArr                        = $this->opsRepository->sumExpenses(
+                $limit->start_date,
+                $limit->end_date,
+                null,
+                new Collection()->push($budget),
+                $currency
+            );
             $array['spent']                  = $spentArr[$currency->id]['sum'] ?? '0';
             $array['left_formatted']         = Amount::formatAnything($limit->transactionCurrency, bcadd($array['spent'], (string) $array['amount']));
             $array['amount_formatted']       = Amount::formatAnything($limit->transactionCurrency, $limit['amount']);

app/Http/Controllers/Budget/IndexController.php

@@ -284,7 +284,10 @@ final class IndexController extends Controller
 
                 if (array_key_exists($currency->id, $spentArr) && array_key_exists('sum', $spentArr[$currency->id])) {
                     $array['spent'][$currency->id]['spent']                   = $spentArr[$currency->id]['sum'];
-                    $array['spent'][$currency->id]['spent_outside']           = Steam::negative(bcsub($spentInLimits[$currency->id], $spentArr[$currency->id]['sum']));
+                    $array['spent'][$currency->id]['spent_outside']           = Steam::negative(bcsub(
+                        $spentInLimits[$currency->id],
+                        $spentArr[$currency->id]['sum']
+                    ));
                     $array['spent'][$currency->id]['currency_id']             = $currency->id;
                     $array['spent'][$currency->id]['currency_symbol']         = $currency->symbol;
                     $array['spent'][$currency->id]['currency_decimal_places'] = $currency->decimal_places;

app/Http/Controllers/Chart/BudgetController.php

@@ -539,7 +539,13 @@ final class BudgetController extends Controller
             }
 
             // get spent amount in this period for this currency.
-            $sum                             = $this->opsRepository->sumExpenses($currentStart, $currentEnd, $accounts, new Collection()->push($budget), $currency);
+            $sum                             = $this->opsRepository->sumExpenses(
+                $currentStart,
+                $currentEnd,
+                $accounts,
+                new Collection()->push($budget),
+                $currency
+            );
             $amount                          = Steam::positive($sum[$currency->id]['sum'] ?? '0');
             $chartData[0]['entries'][$title] = Steam::bcround($amount, $currency->decimal_places);
 

app/Jobs/CreateAutoBudgetLimits.php

@@ -122,7 +122,13 @@ class CreateAutoBudgetLimits implements ShouldQueue
         // if has one, calculate expenses and use that as a base.
         $repository      = app(OperationsRepositoryInterface::class);
         $repository->setUser($autoBudget->budget->user);
-        $spent           = $repository->sumExpenses($previousStart, $previousEnd, null, new Collection()->push($autoBudget->budget), $autoBudget->transactionCurrency);
+        $spent           = $repository->sumExpenses(
+            $previousStart,
+            $previousEnd,
+            null,
+            new Collection()->push($autoBudget->budget),
+            $autoBudget->transactionCurrency
+        );
         $currencyId      = $autoBudget->transaction_currency_id;
         $spentAmount     = $spent[$currencyId]['sum'] ?? '0';
         Log::debug(sprintf('Spent in previous budget period (%s-%s) is %s', $previousStart->format('Y-m-d'), $previousEnd->format('Y-m-d'), $spentAmount));
@@ -212,7 +218,13 @@ class CreateAutoBudgetLimits implements ShouldQueue
         // if has one, calculate expenses and use that as a base.
         $repository    = app(OperationsRepositoryInterface::class);
         $repository->setUser($autoBudget->budget->user);
-        $spent         = $repository->sumExpenses($previousStart, $previousEnd, null, new Collection()->push($autoBudget->budget), $autoBudget->transactionCurrency);
+        $spent         = $repository->sumExpenses(
+            $previousStart,
+            $previousEnd,
+            null,
+            new Collection()->push($autoBudget->budget),
+            $autoBudget->transactionCurrency
+        );
         $currencyId    = $autoBudget->transaction_currency_id;
         $spentAmount   = $spent[$currencyId]['sum'] ?? '0';
         Log::debug(sprintf('Spent in previous budget period (%s-%s) is %s', $previousStart->format('Y-m-d'), $previousEnd->format('Y-m-d'), $spentAmount));

app/Support/Http/Controllers/AugumentData.php

@@ -222,7 +222,14 @@ trait AugumentData
                 $currentEnd->addMonth();
             }
             // primary currency amount.
-            $expenses        = $opsRepository->sumExpenses($currentStart, $currentEnd, null, $budgetCollection, $entry->transactionCurrency, $this->convertToPrimary);
+            $expenses        = $opsRepository->sumExpenses(
+                $currentStart,
+                $currentEnd,
+                null,
+                $budgetCollection,
+                $entry->transactionCurrency,
+                $this->convertToPrimary
+            );
             $spent           = $expenses[$currency->id]['sum'] ?? '0';
             $entry->pc_spent = $spent;
 

app/Support/JsonApi/Enrichments/RecurringEnrichment.php

@@ -354,7 +354,10 @@ class RecurringEnrichment implements EnrichmentInterface
 
         /** @var RecurrenceRepetition $repetition */
         foreach ($set as $repetition) {
-            $recurrence                               = $this->collection->filter(static fn (Recurrence $item): bool => (int) $item->id === (int) $repetition->recurrence_id)->first();
+            $recurrence                               = $this->collection
+                ->filter(static fn (Recurrence $item): bool => (int) $item->id === (int) $repetition->recurrence_id)
+                ->first()
+            ;
             $fromDate                                 = clone ($recurrence->latest_date ?? $recurrence->first_date);
             $recurrenceId                             = (int) $repetition->recurrence_id;
             $repId                                    = (int) $repetition->id;

app/Support/Models/AccountBalanceCalculator.php

@@ -141,6 +141,9 @@ class AccountBalanceCalculator
         foreach ($set as $entry) {
             // Log::debug(sprintf('Processing transaction #%d with currency #%d and amount %s', $entry->id, $entry->transaction_currency_id, Steam::bcround($entry->amount, 2)));
             // start with empty array:
+            $entry->account_id                                             = (int) $entry->account_id;
+            $entry->transaction_currency_id                                = (int) $entry->transaction_currency_id;
+
             $balances[$entry->account_id]                                  ??= [];
             $balances[$entry->account_id][$entry->transaction_currency_id] ??= [
                 self::getLatestBalance($entry->account_id, $entry->transaction_currency_id, $notBefore),

composer.lock

@@ -9805,16 +9805,16 @@
         },
         {
             "name": "twig/twig",
-            "version": "v3.24.0",
+            "version": "v3.25.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/twigphp/Twig.git",
-                "reference": "a6769aefb305efef849dc25c9fd1653358c148f0"
+                "reference": "0dade995be754556af4dcbf8721d45cb3271f9b4"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/twigphp/Twig/zipball/a6769aefb305efef849dc25c9fd1653358c148f0",
-                "reference": "a6769aefb305efef849dc25c9fd1653358c148f0",
+                "url": "https://api.github.com/repos/twigphp/Twig/zipball/0dade995be754556af4dcbf8721d45cb3271f9b4",
+                "reference": "0dade995be754556af4dcbf8721d45cb3271f9b4",
                 "shasum": ""
             },
             "require": {
@@ -9869,7 +9869,7 @@
             ],
             "support": {
                 "issues": "https://github.com/twigphp/Twig/issues",
-                "source": "https://github.com/twigphp/Twig/tree/v3.24.0"
+                "source": "https://github.com/twigphp/Twig/tree/v3.25.0"
             },
             "funding": [
                 {
@@ -9881,7 +9881,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-03-17T21:31:11+00:00"
+            "time": "2026-05-17T07:41:26+00:00"
         },
         {
             "name": "vlucas/phpdotenv",

config/firefly.php

@@ -78,8 +78,8 @@ return [
         'running_balance_column' => (bool)env_default_when_empty(env('USE_RUNNING_BALANCE'), true), // this is only the default value, is not used.
         // see cer.php for exchange rates feature flag.
     ],
-'version' => 'develop/2026-05-16',
-'build_time' => 1778958405,
+'version' => 'develop/2026-05-18',
+'build_time' => 1779078811,
     'api_version'                          => '2.1.0', // field is no longer used.
     'db_version'                           => 28, // field is no longer used.
 

package-lock.json

@@ -4149,9 +4149,9 @@
             }
         },
         "node_modules/caniuse-lite": {
-            "version": "1.0.30001792",
-            "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001792.tgz",
-            "integrity": "sha512-hVLMUZFgR4JJ6ACt1uEESvQN1/dBVqPAKY0hgrV70eN3391K6juAfTjKZLKvOMsx8PxA7gsY1/tLMMTcfFLLpw==",
+            "version": "1.0.30001793",
+            "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001793.tgz",
+            "integrity": "sha512-iwSsYWaCOoh26cV8NwNRViHlrfUvYsHDfRVcbtmw0Kg6PJIZZXwMkj1442FYLBGkeUf1juAsU3DTfxW579mrPA==",
             "dev": true,
             "funding": [
                 {
@@ -9527,9 +9527,9 @@
             "license": "MIT"
         },
         "node_modules/qs": {
-            "version": "6.15.1",
-            "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.1.tgz",
-            "integrity": "sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==",
+            "version": "6.15.2",
+            "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
+            "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
             "dev": true,
             "license": "BSD-3-Clause",
             "dependencies": {