Merge pull request #12273 from firefly-iii/release-1779337714

🤖 Automatically merge the PR into the develop branch.
🤖 Auto commit for release 'develop' on 2026-05-21
2026-06-12 03:44:24 +00:00 · 2026-05-21 06:28:41 +02:00 · 2026-05-21 06:28:34 +02:00 · 2026-05-21 06:23:17 +02:00 · 2026-05-21 06:22:28 +02:00 · 2026-05-21 06:22:15 +02:00
11 changed files with 267 additions and 230 deletions
--- a/.github/workflows/pr-reply-no-disclosure.yml
+++ b/.github/workflows/pr-reply-no-disclosure.yml
@@ -18,6 +18,12 @@ jobs:
    steps:
      - run: |
          BODY=$(gh pr view $NUMBER --json body)
+          AUTHOR=$(gh pr view $NUMBER --json author)
+
+          if [[ $AUTHOR == *"app/dependabot"* ]]; then
+            echo "Is dependabot, stop"
+            exit 0
+          fi

          # I used AI assistance for:
          # - [ ] Code generation (e.g., when writing an implementation or fixing a bug)
@@ -55,6 +61,4 @@ jobs:
            exit 0
          fi
        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
          NUMBER: ${{ github.event.pull_request.number }}
--- a/THANKS.md
+++ b/THANKS.md
@@ -4,6 +4,7 @@ Over time, many people have contributed to Firefly III. Their efforts are not al
 Please find below all the people who contributed to the Firefly III code. Their names are mentioned in the year of their first contribution.

 ## 2026
+- iaohkut
 - tasnim0tantawi
 - Joe Longendyke
 - Daniel Holøien
--- a/app/TransactionRules/Engine/SearchRuleEngine.php
+++ b/app/TransactionRules/Engine/SearchRuleEngine.php
@@ -543,12 +543,13 @@ class SearchRuleEngine implements RuleEngineInterface
        }

        // pick up from the action if it actually acted or not:
-        if (true === $ruleAction->stop_processing && $result) {
+        if (true === $ruleAction->stop_processing && true === $result) {
            Log::debug(sprintf('Rule action "%s" reports changes AND asks to break, so break!', $ruleAction->action_type));

            return true;
        }
-        if (true === $ruleAction->stop_processing && false === $result) {
+        //  reset is false at this point.
+        if (true === $ruleAction->stop_processing) {
            Log::debug(sprintf('Rule action "%s" reports NO changes AND asks to break, but we wont break!', $ruleAction->action_type));
        }

--- a/changelog.md
+++ b/changelog.md
@@ -3,6 +3,32 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).

+## v6.6.3 - 2026-05-21
+
+<!-- summary: This release fixes an XSS issue and some minor other bugs -->
+
+### Changed
+
+- Better explanation text for the password validation code.
+- [Discussion 11408](https://github.com/orgs/firefly-iii/discussions/11408) (How do I see the content of link notes?) started by @Coderdude112
+
+### Fixed
+
+- [Discussion 11455](https://github.com/orgs/firefly-iii/discussions/11455) ("Sum" Line In Account Charts) started by @PVTejas
+- [Discussion 12097](https://github.com/orgs/firefly-iii/discussions/12097) (Error updating Exchange Rates) started by @gpampuro
+- [Issue 12204](https://github.com/firefly-iii/firefly-iii/issues/12204) (A change is shown in "Audit log entries" when there was actually no movement (currency values fields)) reported by @jgmm81
+- [Issue 12207](https://github.com/firefly-iii/firefly-iii/issues/12207) (Rule triggers hidden on rules page for rules with multiple triggers) reported by @frankakn7
+- [Discussion 12210](https://github.com/orgs/firefly-iii/discussions/12210) (PiggyBanks and suggested amount per month) started by @Thieume
+- [Issue 12223](https://github.com/firefly-iii/firefly-iii/issues/12223) (Budget figures on the default financial report does not include transactions in liability accounts) reported by @likinon1981
+- [Issue 12243](https://github.com/firefly-iii/firefly-iii/issues/12243) (Abacus App is not working with the new OAuth) reported by @darkmatter18
+- [Issue 12254](https://github.com/firefly-iii/firefly-iii/issues/12254) (Personal Access Tokens not listed on web UI) reported by @imjuzcy
+- [Issue 12257](https://github.com/firefly-iii/firefly-iii/issues/12257) (getLatestBalance(): Argument #2 ($currencyId) must be of type int, string given) reported by @LaCarotteSauvage
+- [Issue 12258](https://github.com/firefly-iii/firefly-iii/issues/12258) (500 Internal Server Error when creating piggy bank) reported by @davbrito
+
+### Security
+
+- [PR 12271](https://github.com/firefly-iii/firefly-iii/pull/12271) (Fix stored XSS in audit log view via piggy bank name (ale.twig)) reported by @alanturing881
+
 ## v6.6.2 - 2026-04-28

 <!-- summary: This releases fixes a security issue and some small UI issues. Please upgrade at your earliest convenience. -->
--- a/composer.lock
+++ b/composer.lock
@@ -1245,16 +1245,16 @@
        },
        {
            "name": "guzzlehttp/guzzle",
-            "version": "7.10.0",
+            "version": "7.10.3",
            "source": {
                "type": "git",
                "url": "https://github.com/guzzle/guzzle.git",
-                "reference": "b51ac707cfa420b7bfd4e4d5e510ba8008e822b4"
+                "reference": "47ba23c7a55247e2e1b7407aca90e9bbed0d9d86"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/guzzle/zipball/b51ac707cfa420b7bfd4e4d5e510ba8008e822b4",
-                "reference": "b51ac707cfa420b7bfd4e4d5e510ba8008e822b4",
+                "url": "https://api.github.com/repos/guzzle/guzzle/zipball/47ba23c7a55247e2e1b7407aca90e9bbed0d9d86",
+                "reference": "47ba23c7a55247e2e1b7407aca90e9bbed0d9d86",
                "shasum": ""
            },
            "require": {
@@ -1272,8 +1272,9 @@
                "bamarni/composer-bin-plugin": "^1.8.2",
                "ext-curl": "*",
                "guzzle/client-integration-tests": "3.0.2",
+                "guzzlehttp/test-server": "^0.3.2",
                "php-http/message-factory": "^1.1",
-                "phpunit/phpunit": "^8.5.39 || ^9.6.20",
+                "phpunit/phpunit": "^8.5.52 || ^9.6.34",
                "psr/log": "^1.1 || ^2.0 || ^3.0"
            },
            "suggest": {
@@ -1351,7 +1352,7 @@
            ],
            "support": {
                "issues": "https://github.com/guzzle/guzzle/issues",
-                "source": "https://github.com/guzzle/guzzle/tree/7.10.0"
+                "source": "https://github.com/guzzle/guzzle/tree/7.10.3"
            },
            "funding": [
                {
@@ -1367,20 +1368,20 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2025-08-23T22:36:01+00:00"
+            "time": "2026-05-20T22:59:19+00:00"
        },
        {
            "name": "guzzlehttp/promises",
-            "version": "2.3.0",
+            "version": "2.4.1",
            "source": {
                "type": "git",
                "url": "https://github.com/guzzle/promises.git",
-                "reference": "481557b130ef3790cf82b713667b43030dc9c957"
+                "reference": "09e8a212562fb1fb6a512c4156ed71525969d6c2"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/promises/zipball/481557b130ef3790cf82b713667b43030dc9c957",
-                "reference": "481557b130ef3790cf82b713667b43030dc9c957",
+                "url": "https://api.github.com/repos/guzzle/promises/zipball/09e8a212562fb1fb6a512c4156ed71525969d6c2",
+                "reference": "09e8a212562fb1fb6a512c4156ed71525969d6c2",
                "shasum": ""
            },
            "require": {
@@ -1388,7 +1389,7 @@
            },
            "require-dev": {
                "bamarni/composer-bin-plugin": "^1.8.2",
-                "phpunit/phpunit": "^8.5.44 || ^9.6.25"
+                "phpunit/phpunit": "^8.5.52 || ^9.6.34"
            },
            "type": "library",
            "extra": {
@@ -1434,7 +1435,7 @@
            ],
            "support": {
                "issues": "https://github.com/guzzle/promises/issues",
-                "source": "https://github.com/guzzle/promises/tree/2.3.0"
+                "source": "https://github.com/guzzle/promises/tree/2.4.1"
            },
            "funding": [
                {
@@ -1450,20 +1451,20 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2025-08-22T14:34:08+00:00"
+            "time": "2026-05-20T22:57:30+00:00"
        },
        {
            "name": "guzzlehttp/psr7",
-            "version": "2.9.0",
+            "version": "2.10.1",
            "source": {
                "type": "git",
                "url": "https://github.com/guzzle/psr7.git",
-                "reference": "7d0ed42f28e42d61352a7a79de682e5e67fec884"
+                "reference": "73ab136360b5dfd858006eae9795e8fe43c80361"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/psr7/zipball/7d0ed42f28e42d61352a7a79de682e5e67fec884",
-                "reference": "7d0ed42f28e42d61352a7a79de682e5e67fec884",
+                "url": "https://api.github.com/repos/guzzle/psr7/zipball/73ab136360b5dfd858006eae9795e8fe43c80361",
+                "reference": "73ab136360b5dfd858006eae9795e8fe43c80361",
                "shasum": ""
            },
            "require": {
@@ -1478,9 +1479,9 @@
            },
            "require-dev": {
                "bamarni/composer-bin-plugin": "^1.8.2",
-                "http-interop/http-factory-tests": "0.9.0",
+                "http-interop/http-factory-tests": "1.1.0",
                "jshttp/mime-db": "1.54.0.1",
-                "phpunit/phpunit": "^8.5.44 || ^9.6.25"
+                "phpunit/phpunit": "^8.5.52 || ^9.6.34"
            },
            "suggest": {
                "laminas/laminas-httphandlerrunner": "Emit PSR-7 responses"
@@ -1551,7 +1552,7 @@
            ],
            "support": {
                "issues": "https://github.com/guzzle/psr7/issues",
-                "source": "https://github.com/guzzle/psr7/tree/2.9.0"
+                "source": "https://github.com/guzzle/psr7/tree/2.10.1"
            },
            "funding": [
                {
@@ -1567,7 +1568,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-03-10T16:41:02+00:00"
+            "time": "2026-05-20T09:27:36+00:00"
        },
        {
            "name": "guzzlehttp/uri-template",
@@ -1879,16 +1880,16 @@
        },
        {
            "name": "laravel/framework",
-            "version": "v13.9.0",
+            "version": "v13.11.2",
            "source": {
                "type": "git",
                "url": "https://github.com/laravel/framework.git",
-                "reference": "a0c6ad03b380287015287d8d5a0fa2459e2332fd"
+                "reference": "4148042bf6ee01edd05408f1f66d91b231f85c25"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/laravel/framework/zipball/a0c6ad03b380287015287d8d5a0fa2459e2332fd",
-                "reference": "a0c6ad03b380287015287d8d5a0fa2459e2332fd",
+                "url": "https://api.github.com/repos/laravel/framework/zipball/4148042bf6ee01edd05408f1f66d91b231f85c25",
+                "reference": "4148042bf6ee01edd05408f1f66d91b231f85c25",
                "shasum": ""
            },
            "require": {
@@ -2099,7 +2100,7 @@
                "issues": "https://github.com/laravel/framework/issues",
                "source": "https://github.com/laravel/framework"
            },
-            "time": "2026-05-13T15:38:40+00:00"
+            "time": "2026-05-20T11:46:02+00:00"
        },
        {
            "name": "laravel/passport",
@@ -2178,16 +2179,16 @@
        },
        {
            "name": "laravel/prompts",
-            "version": "v0.3.17",
+            "version": "v0.3.18",
            "source": {
                "type": "git",
                "url": "https://github.com/laravel/prompts.git",
-                "reference": "6a82ac19a28b916ae0885828795dbd4c59d9a818"
+                "reference": "a19af51bb144bf87f08397921fa619f85c7d4e72"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/laravel/prompts/zipball/6a82ac19a28b916ae0885828795dbd4c59d9a818",
-                "reference": "6a82ac19a28b916ae0885828795dbd4c59d9a818",
+                "url": "https://api.github.com/repos/laravel/prompts/zipball/a19af51bb144bf87f08397921fa619f85c7d4e72",
+                "reference": "a19af51bb144bf87f08397921fa619f85c7d4e72",
                "shasum": ""
            },
            "require": {
@@ -2231,9 +2232,9 @@
            "description": "Add beautiful and user-friendly forms to your command-line applications.",
            "support": {
                "issues": "https://github.com/laravel/prompts/issues",
-                "source": "https://github.com/laravel/prompts/tree/v0.3.17"
+                "source": "https://github.com/laravel/prompts/tree/v0.3.18"
            },
-            "time": "2026-04-20T16:07:33+00:00"
+            "time": "2026-05-19T00:47:18+00:00"
        },
        {
            "name": "laravel/serializable-closure",
@@ -6498,16 +6499,16 @@
        },
        {
            "name": "symfony/cache",
-            "version": "v8.0.10",
+            "version": "v8.0.12",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/cache.git",
-                "reference": "8ff96cde73684bfa32b702f5cff1eb83b1fac429"
+                "reference": "11dc0681506ff07ca80bfb4cbf84c601c3cf04f7"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/cache/zipball/8ff96cde73684bfa32b702f5cff1eb83b1fac429",
-                "reference": "8ff96cde73684bfa32b702f5cff1eb83b1fac429",
+                "url": "https://api.github.com/repos/symfony/cache/zipball/11dc0681506ff07ca80bfb4cbf84c601c3cf04f7",
+                "reference": "11dc0681506ff07ca80bfb4cbf84c601c3cf04f7",
                "shasum": ""
            },
            "require": {
@@ -6573,7 +6574,7 @@
                "psr6"
            ],
            "support": {
-                "source": "https://github.com/symfony/cache/tree/v8.0.10"
+                "source": "https://github.com/symfony/cache/tree/v8.0.12"
            },
            "funding": [
                {
@@ -6593,7 +6594,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-05-05T08:24:00+00:00"
+            "time": "2026-05-20T07:22:03+00:00"
        },
        {
            "name": "symfony/cache-contracts",
@@ -7623,16 +7624,16 @@
        },
        {
            "name": "symfony/http-kernel",
-            "version": "v8.0.11",
+            "version": "v8.0.12",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/http-kernel.git",
-                "reference": "20d3680373f4b791903c09e74b45402b4aeda71c"
+                "reference": "c00291734c59c05c54c5a3abc2ab18e99b070157"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/http-kernel/zipball/20d3680373f4b791903c09e74b45402b4aeda71c",
-                "reference": "20d3680373f4b791903c09e74b45402b4aeda71c",
+                "url": "https://api.github.com/repos/symfony/http-kernel/zipball/c00291734c59c05c54c5a3abc2ab18e99b070157",
+                "reference": "c00291734c59c05c54c5a3abc2ab18e99b070157",
                "shasum": ""
            },
            "require": {
@@ -7703,7 +7704,7 @@
            "description": "Provides a structured process for converting a Request into a Response",
            "homepage": "https://symfony.com",
            "support": {
-                "source": "https://github.com/symfony/http-kernel/tree/v8.0.11"
+                "source": "https://github.com/symfony/http-kernel/tree/v8.0.12"
            },
            "funding": [
                {
@@ -7723,20 +7724,20 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-05-13T18:07:14+00:00"
+            "time": "2026-05-20T09:47:36+00:00"
        },
        {
            "name": "symfony/mailer",
-            "version": "v8.0.8",
+            "version": "v8.0.12",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/mailer.git",
-                "reference": "ca5f6edaf8780ece814404b58a4482b22b509c56"
+                "reference": "5266d594e83593dff3492b5655ff6e8f38d67cfc"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/mailer/zipball/ca5f6edaf8780ece814404b58a4482b22b509c56",
-                "reference": "ca5f6edaf8780ece814404b58a4482b22b509c56",
+                "url": "https://api.github.com/repos/symfony/mailer/zipball/5266d594e83593dff3492b5655ff6e8f38d67cfc",
+                "reference": "5266d594e83593dff3492b5655ff6e8f38d67cfc",
                "shasum": ""
            },
            "require": {
@@ -7783,7 +7784,7 @@
            "description": "Helps sending emails",
            "homepage": "https://symfony.com",
            "support": {
-                "source": "https://github.com/symfony/mailer/tree/v8.0.8"
+                "source": "https://github.com/symfony/mailer/tree/v8.0.12"
            },
            "funding": [
                {
@@ -7803,7 +7804,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-03-30T15:14:47+00:00"
+            "time": "2026-05-20T07:22:03+00:00"
        },
        {
            "name": "symfony/mailgun-mailer",
@@ -7877,16 +7878,16 @@
        },
        {
            "name": "symfony/mime",
-            "version": "v8.0.9",
+            "version": "v8.0.12",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/mime.git",
-                "reference": "a9fcb293650c054b62a5b406f4e92e7b711ea333"
+                "reference": "7d9a72bbf0a9cb169ed1cbbbbbf709a592207fc1"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/mime/zipball/a9fcb293650c054b62a5b406f4e92e7b711ea333",
-                "reference": "a9fcb293650c054b62a5b406f4e92e7b711ea333",
+                "url": "https://api.github.com/repos/symfony/mime/zipball/7d9a72bbf0a9cb169ed1cbbbbbf709a592207fc1",
+                "reference": "7d9a72bbf0a9cb169ed1cbbbbbf709a592207fc1",
                "shasum": ""
            },
            "require": {
@@ -7939,7 +7940,7 @@
                "mime-type"
            ],
            "support": {
-                "source": "https://github.com/symfony/mime/tree/v8.0.9"
+                "source": "https://github.com/symfony/mime/tree/v8.0.12"
            },
            "funding": [
                {
@@ -7959,7 +7960,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-04-29T15:02:55+00:00"
+            "time": "2026-05-20T07:22:03+00:00"
        },
        {
            "name": "symfony/options-resolver",
@@ -8930,16 +8931,16 @@
        },
        {
            "name": "symfony/routing",
-            "version": "v8.0.9",
+            "version": "v8.0.12",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/routing.git",
-                "reference": "75d1bd8e5da3424e4db2fc3ff0222cb4d0c73038"
+                "reference": "c7f22a665faa3e5212b8f042e0c5831a6b85492f"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/routing/zipball/75d1bd8e5da3424e4db2fc3ff0222cb4d0c73038",
-                "reference": "75d1bd8e5da3424e4db2fc3ff0222cb4d0c73038",
+                "url": "https://api.github.com/repos/symfony/routing/zipball/c7f22a665faa3e5212b8f042e0c5831a6b85492f",
+                "reference": "c7f22a665faa3e5212b8f042e0c5831a6b85492f",
                "shasum": ""
            },
            "require": {
@@ -8986,7 +8987,7 @@
                "url"
            ],
            "support": {
-                "source": "https://github.com/symfony/routing/tree/v8.0.9"
+                "source": "https://github.com/symfony/routing/tree/v8.0.12"
            },
            "funding": [
                {
@@ -9006,7 +9007,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-04-29T15:02:55+00:00"
+            "time": "2026-05-20T07:22:03+00:00"
        },
        {
            "name": "symfony/service-contracts",
@@ -9805,16 +9806,16 @@
        },
        {
            "name": "twig/twig",
-            "version": "v3.25.0",
+            "version": "v3.26.0",
            "source": {
                "type": "git",
                "url": "https://github.com/twigphp/Twig.git",
-                "reference": "0dade995be754556af4dcbf8721d45cb3271f9b4"
+                "reference": "1fcae487b180d78e6351f4e0afa91f9eab96a2bc"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/twigphp/Twig/zipball/0dade995be754556af4dcbf8721d45cb3271f9b4",
-                "reference": "0dade995be754556af4dcbf8721d45cb3271f9b4",
+                "url": "https://api.github.com/repos/twigphp/Twig/zipball/1fcae487b180d78e6351f4e0afa91f9eab96a2bc",
+                "reference": "1fcae487b180d78e6351f4e0afa91f9eab96a2bc",
                "shasum": ""
            },
            "require": {
@@ -9869,7 +9870,7 @@
            ],
            "support": {
                "issues": "https://github.com/twigphp/Twig/issues",
-                "source": "https://github.com/twigphp/Twig/tree/v3.25.0"
+                "source": "https://github.com/twigphp/Twig/tree/v3.26.0"
            },
            "funding": [
                {
@@ -9881,7 +9882,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-05-17T07:41:26+00:00"
+            "time": "2026-05-20T07:31:59+00:00"
        },
        {
            "name": "vlucas/phpdotenv",
@@ -10192,16 +10193,16 @@
        },
        {
            "name": "carthage-software/mago",
-            "version": "1.27.1",
+            "version": "1.28.0",
            "source": {
                "type": "git",
                "url": "https://github.com/carthage-software/mago.git",
-                "reference": "f4c31bbcb871e6bcbb96323ce791e06288b39b2a"
+                "reference": "c3daa7199f83bd06c0077b997358c46e80a0bb06"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/carthage-software/mago/zipball/f4c31bbcb871e6bcbb96323ce791e06288b39b2a",
-                "reference": "f4c31bbcb871e6bcbb96323ce791e06288b39b2a",
+                "url": "https://api.github.com/repos/carthage-software/mago/zipball/c3daa7199f83bd06c0077b997358c46e80a0bb06",
+                "reference": "c3daa7199f83bd06c0077b997358c46e80a0bb06",
                "shasum": ""
            },
            "require": {
@@ -10239,7 +10240,7 @@
            ],
            "support": {
                "issues": "https://github.com/carthage-software/mago/issues",
-                "source": "https://github.com/carthage-software/mago/tree/1.27.1"
+                "source": "https://github.com/carthage-software/mago/tree/1.28.0"
            },
            "funding": [
                {
@@ -10247,7 +10248,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-05-13T15:32:36+00:00"
+            "time": "2026-05-19T07:03:29+00:00"
        },
        {
            "name": "cloudcreativity/json-api-testing",
@@ -11513,11 +11514,11 @@
        },
        {
            "name": "phpstan/phpstan",
-            "version": "2.1.54",
+            "version": "2.1.55",
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/8be50c3992107dc837b17da4d140fbbdf9a5c5bd",
-                "reference": "8be50c3992107dc837b17da4d140fbbdf9a5c5bd",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/9eaac3826ed5e9b8427350a43cac825eeca3f566",
+                "reference": "9eaac3826ed5e9b8427350a43cac825eeca3f566",
                "shasum": ""
            },
            "require": {
@@ -11562,7 +11563,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-04-29T13:31:09+00:00"
+            "time": "2026-05-18T11:57:34+00:00"
        },
        {
            "name": "phpstan/phpstan-deprecation-rules",
@@ -12141,16 +12142,16 @@
        },
        {
            "name": "rector/rector",
-            "version": "2.4.3",
+            "version": "2.4.4",
            "source": {
                "type": "git",
                "url": "https://github.com/rectorphp/rector.git",
-                "reference": "891824c6c59f02a56a5dd58ea8edc44e6c0ece29"
+                "reference": "4661c582a20f03df585d2e3fdc4af1b83d67a091"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/rectorphp/rector/zipball/891824c6c59f02a56a5dd58ea8edc44e6c0ece29",
-                "reference": "891824c6c59f02a56a5dd58ea8edc44e6c0ece29",
+                "url": "https://api.github.com/repos/rectorphp/rector/zipball/4661c582a20f03df585d2e3fdc4af1b83d67a091",
+                "reference": "4661c582a20f03df585d2e3fdc4af1b83d67a091",
                "shasum": ""
            },
            "require": {
@@ -12189,7 +12190,7 @@
            ],
            "support": {
                "issues": "https://github.com/rectorphp/rector/issues",
-                "source": "https://github.com/rectorphp/rector/tree/2.4.3"
+                "source": "https://github.com/rectorphp/rector/tree/2.4.4"
            },
            "funding": [
                {
@@ -12197,7 +12198,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-05-12T11:17:24+00:00"
+            "time": "2026-05-20T19:30:21+00:00"
        },
        {
            "name": "sebastian/cli-parser",
@@ -12270,16 +12271,16 @@
        },
        {
            "name": "sebastian/comparator",
-            "version": "8.1.4",
+            "version": "8.2.0",
            "source": {
                "type": "git",
                "url": "https://github.com/sebastianbergmann/comparator.git",
-                "reference": "1edd557042bf4ff9978ec125d8131b147d5c8224"
+                "reference": "ddacb462216a4f6d97e84bf08165b9074ddbafeb"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/comparator/zipball/1edd557042bf4ff9978ec125d8131b147d5c8224",
-                "reference": "1edd557042bf4ff9978ec125d8131b147d5c8224",
+                "url": "https://api.github.com/repos/sebastianbergmann/comparator/zipball/ddacb462216a4f6d97e84bf08165b9074ddbafeb",
+                "reference": "ddacb462216a4f6d97e84bf08165b9074ddbafeb",
                "shasum": ""
            },
            "require": {
@@ -12287,10 +12288,10 @@
                "ext-mbstring": "*",
                "php": ">=8.4",
                "sebastian/diff": "^8.3",
-                "sebastian/exporter": "^8.0"
+                "sebastian/exporter": "^8.0.3"
            },
            "require-dev": {
-                "phpunit/phpunit": "^13.0"
+                "phpunit/phpunit": "^13.1.10"
            },
            "suggest": {
                "ext-bcmath": "For comparing BcMath\\Number objects"
@@ -12298,7 +12299,7 @@
            "type": "library",
            "extra": {
                "branch-alias": {
-                    "dev-main": "8.1-dev"
+                    "dev-main": "8.2-dev"
                }
            },
            "autoload": {
@@ -12338,7 +12339,7 @@
            "support": {
                "issues": "https://github.com/sebastianbergmann/comparator/issues",
                "security": "https://github.com/sebastianbergmann/comparator/security/policy",
-                "source": "https://github.com/sebastianbergmann/comparator/tree/8.1.4"
+                "source": "https://github.com/sebastianbergmann/comparator/tree/8.2.0"
            },
            "funding": [
                {
@@ -12358,7 +12359,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-05-15T08:30:51+00:00"
+            "time": "2026-05-20T11:55:37+00:00"
        },
        {
            "name": "sebastian/complexity",
@@ -12587,16 +12588,16 @@
        },
        {
            "name": "sebastian/exporter",
-            "version": "8.0.2",
+            "version": "8.0.3",
            "source": {
                "type": "git",
                "url": "https://github.com/sebastianbergmann/exporter.git",
-                "reference": "9cee180ebe62259e3ed48df2212d1fc8cfd971bb"
+                "reference": "9b54f1afabb977a097ef353600d41a372ccde617"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/exporter/zipball/9cee180ebe62259e3ed48df2212d1fc8cfd971bb",
-                "reference": "9cee180ebe62259e3ed48df2212d1fc8cfd971bb",
+                "url": "https://api.github.com/repos/sebastianbergmann/exporter/zipball/9b54f1afabb977a097ef353600d41a372ccde617",
+                "reference": "9b54f1afabb977a097ef353600d41a372ccde617",
                "shasum": ""
            },
            "require": {
@@ -12605,7 +12606,7 @@
                "sebastian/recursion-context": "^8.0"
            },
            "require-dev": {
-                "phpunit/phpunit": "^13.0"
+                "phpunit/phpunit": "^13.1.10"
            },
            "type": "library",
            "extra": {
@@ -12653,7 +12654,7 @@
            "support": {
                "issues": "https://github.com/sebastianbergmann/exporter/issues",
                "security": "https://github.com/sebastianbergmann/exporter/security/policy",
-                "source": "https://github.com/sebastianbergmann/exporter/tree/8.0.2"
+                "source": "https://github.com/sebastianbergmann/exporter/tree/8.0.3"
            },
            "funding": [
                {
@@ -12673,7 +12674,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-04-15T12:38:05+00:00"
+            "time": "2026-05-20T04:38:47+00:00"
        },
        {
            "name": "sebastian/git-state",
@@ -12820,24 +12821,24 @@
        },
        {
            "name": "sebastian/lines-of-code",
-            "version": "5.0.0",
+            "version": "5.0.1",
            "source": {
                "type": "git",
                "url": "https://github.com/sebastianbergmann/lines-of-code.git",
-                "reference": "4f21bb7768e1c997722ccc7efb1d6b5c11bfd471"
+                "reference": "d2cff273a90c79b0eb590baa682d4b5c318bdbb7"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/lines-of-code/zipball/4f21bb7768e1c997722ccc7efb1d6b5c11bfd471",
-                "reference": "4f21bb7768e1c997722ccc7efb1d6b5c11bfd471",
+                "url": "https://api.github.com/repos/sebastianbergmann/lines-of-code/zipball/d2cff273a90c79b0eb590baa682d4b5c318bdbb7",
+                "reference": "d2cff273a90c79b0eb590baa682d4b5c318bdbb7",
                "shasum": ""
            },
            "require": {
-                "nikic/php-parser": "^5.0",
+                "nikic/php-parser": "^5.7.0",
                "php": ">=8.4"
            },
            "require-dev": {
-                "phpunit/phpunit": "^13.0"
+                "phpunit/phpunit": "^13.1.10"
            },
            "type": "library",
            "extra": {
@@ -12866,7 +12867,7 @@
            "support": {
                "issues": "https://github.com/sebastianbergmann/lines-of-code/issues",
                "security": "https://github.com/sebastianbergmann/lines-of-code/security/policy",
-                "source": "https://github.com/sebastianbergmann/lines-of-code/tree/5.0.0"
+                "source": "https://github.com/sebastianbergmann/lines-of-code/tree/5.0.1"
            },
            "funding": [
                {
@@ -12886,7 +12887,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-02-06T04:45:54+00:00"
+            "time": "2026-05-19T16:23:37+00:00"
        },
        {
            "name": "sebastian/object-enumerator",
@@ -13104,23 +13105,23 @@
        },
        {
            "name": "sebastian/type",
-            "version": "7.0.0",
+            "version": "7.0.1",
            "source": {
                "type": "git",
                "url": "https://github.com/sebastianbergmann/type.git",
-                "reference": "42412224607bd3931241bbd17f38e0f972f5a916"
+                "reference": "fee0309275847fefd7636167085e379c1dbf6990"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/type/zipball/42412224607bd3931241bbd17f38e0f972f5a916",
-                "reference": "42412224607bd3931241bbd17f38e0f972f5a916",
+                "url": "https://api.github.com/repos/sebastianbergmann/type/zipball/fee0309275847fefd7636167085e379c1dbf6990",
+                "reference": "fee0309275847fefd7636167085e379c1dbf6990",
                "shasum": ""
            },
            "require": {
                "php": ">=8.4"
            },
            "require-dev": {
-                "phpunit/phpunit": "^13.0"
+                "phpunit/phpunit": "^13.1.10"
            },
            "type": "library",
            "extra": {
@@ -13149,7 +13150,7 @@
            "support": {
                "issues": "https://github.com/sebastianbergmann/type/issues",
                "security": "https://github.com/sebastianbergmann/type/security/policy",
-                "source": "https://github.com/sebastianbergmann/type/tree/7.0.0"
+                "source": "https://github.com/sebastianbergmann/type/tree/7.0.1"
            },
            "funding": [
                {
@@ -13169,7 +13170,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-02-06T04:52:09+00:00"
+            "time": "2026-05-20T06:49:11+00:00"
        },
        {
            "name": "sebastian/version",
@@ -13399,16 +13400,16 @@
        },
        {
            "name": "webmozart/assert",
-            "version": "2.3.0",
+            "version": "2.4.0",
            "source": {
                "type": "git",
                "url": "https://github.com/webmozarts/assert.git",
-                "reference": "eb0d790f735ba6cff25c683a85a1da0eadeff9e4"
+                "reference": "9007ea6f45ecf352a9422b36644e4bfc039b9155"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/webmozarts/assert/zipball/eb0d790f735ba6cff25c683a85a1da0eadeff9e4",
-                "reference": "eb0d790f735ba6cff25c683a85a1da0eadeff9e4",
+                "url": "https://api.github.com/repos/webmozarts/assert/zipball/9007ea6f45ecf352a9422b36644e4bfc039b9155",
+                "reference": "9007ea6f45ecf352a9422b36644e4bfc039b9155",
                "shasum": ""
            },
            "require": {
@@ -13424,7 +13425,11 @@
            },
            "type": "library",
            "extra": {
+                "psalm": {
+                    "pluginClass": "Webmozart\\Assert\\PsalmPlugin"
+                },
                "branch-alias": {
+                    "dev-master": "2.0-dev",
                    "dev-feature/2-0": "2.0-dev"
                }
            },
@@ -13455,9 +13460,9 @@
            ],
            "support": {
                "issues": "https://github.com/webmozarts/assert/issues",
-                "source": "https://github.com/webmozarts/assert/tree/2.3.0"
+                "source": "https://github.com/webmozarts/assert/tree/2.4.0"
            },
-            "time": "2026-04-11T10:33:05+00:00"
+            "time": "2026-05-20T13:07:01+00:00"
        }
    ],
    "aliases": [],
--- a/config/firefly.php
+++ b/config/firefly.php
@@ -78,8 +78,8 @@ return [
        'running_balance_column' => (bool)env_default_when_empty(env('USE_RUNNING_BALANCE'), true), // this is only the default value, is not used.
        // see cer.php for exchange rates feature flag.
    ],
-'version' => 'develop/2026-05-18',
-'build_time' => 1779078811,
+'version' => 'develop/2026-05-21',
+'build_time' => 1779337713,
    'api_version'                          => '2.1.0', // field is no longer used.
    'db_version'                           => 28, // field is no longer used.

--- a/package-lock.json
+++ b/package-lock.json
@@ -1915,9 +1915,9 @@
            }
        },
        "node_modules/@oxc-project/types": {
-            "version": "0.128.0",
-            "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.128.0.tgz",
-            "integrity": "sha512-huv1Y/LzBJkBVHt3OlC7u0zHBW9qXf1FdD7sGmc1rXc2P1mTwHssYv7jyGx5KAACSCH+9B3Bhn6Z9luHRvf7pQ==",
+            "version": "0.130.0",
+            "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.130.0.tgz",
+            "integrity": "sha512-ibD2usx9JRu7f5pu2tMKMI4cpA4NgXJQoYRP4pQ7Pxmn1l6k/53qWtQWZayhYy3X4QZkt90Ot+mJEaeXouio6Q==",
            "dev": true,
            "license": "MIT",
            "funding": {
@@ -2259,9 +2259,9 @@
            }
        },
        "node_modules/@rolldown/binding-android-arm64": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.0-rc.18.tgz",
-            "integrity": "sha512-lIDyUAfD7U3+BWKzdxMbJcsYHuqXqmGz40aeRqvuAm3y5TkJSYTBW2RDrn65DJFPQqVjUAUqq5uz8urzQ8aBdQ==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.1.tgz",
+            "integrity": "sha512-fJI3I0r3C3Oj/zdBCpaCmBRZYf07xpaq4yCfDDoSFm+beWNzbIl26puW8RraUdugoJw/95zerNOn6jasAhzSmg==",
            "cpu": [
                "arm64"
            ],
@@ -2276,9 +2276,9 @@
            }
        },
        "node_modules/@rolldown/binding-darwin-arm64": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.0-rc.18.tgz",
-            "integrity": "sha512-apJq2ktnGp27nSInMR5Vcj8kY6xJzDAvfdIFlpDcAK/w4cDO58qVoi1YQsES/SKiFNge/6e4CUzgjfHduYqWpQ==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.1.tgz",
+            "integrity": "sha512-cKnAhWEsV7TPcA/5EAteDp6KcJZBQ2G+BqE7zayMMi7kMvwRsbv7WT9aOnn0WNl4SKEIf43vjS31iUPu80nzXg==",
            "cpu": [
                "arm64"
            ],
@@ -2293,9 +2293,9 @@
            }
        },
        "node_modules/@rolldown/binding-darwin-x64": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.0-rc.18.tgz",
-            "integrity": "sha512-5Ofot8xbs+pxRHJqm9/9N/4sTQOvdrwEsmPE9pdLEEoAbdZtG6F2LMDfO1sp6ZAtXJuJV/21ew2srq3W8NXB5g==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.1.tgz",
+            "integrity": "sha512-YKrVwQjIRBPo+5G/u03wGjbdy4q7pyzCe93DK9VJ7zkVmeg8LJ7GbgsiHWdR4xSoe4CAXRD7Bcjgbtr64bkXNg==",
            "cpu": [
                "x64"
            ],
@@ -2310,9 +2310,9 @@
            }
        },
        "node_modules/@rolldown/binding-freebsd-x64": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.0-rc.18.tgz",
-            "integrity": "sha512-7h8eeOTT1eyqJyx64BFCnWZpNm486hGWt2sqeLLgDxA0xI1oGZ9H7gK1S85uNGmBhkdPwa/6reTxfFFKvIsebw==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.1.tgz",
+            "integrity": "sha512-z/oBsREo46SsFqBwYtFe0kpJeBijAT48O/WXLI4suiCLBkr03RTtTJMCzSdDd2znlh8VJizL09XVkQgk8IZonw==",
            "cpu": [
                "x64"
            ],
@@ -2327,9 +2327,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.0-rc.18.tgz",
-            "integrity": "sha512-eRcm/HVt9U/JFu5RKAEKwGQYtDCKWLiaH6wOnsSEp6NMBb/3Os8LgHZlNyzMpFVNmiiMFlfb2zEnebfzJrHFmg==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.1.tgz",
+            "integrity": "sha512-ik8q7GM11zxvYxFc2PeDcT6TBvhCQMaUxfph/M5l9sKuTs/Sjg3L+Byw0F7w0ZVLBZmx30P+gG0ECzzN+MFcmQ==",
            "cpu": [
                "arm"
            ],
@@ -2344,9 +2344,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-arm64-gnu": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.0-rc.18.tgz",
-            "integrity": "sha512-SOrT/cT4ukTmgnrEz/Hg3m7LBnuCLW9psDeMKrimRWY4I8DmnO7Lco8W2vtqPmMkbVu8iJ+g4GFLVLLOVjJ9DQ==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.1.tgz",
+            "integrity": "sha512-QoSx2EkyrrdZ6kcyE8stqZ62t0Yra8Fs5ia9lOxJrh6TMQJK7gQKmscdTHf7pOXKREKrVwOtJcQG3qVSfc866A==",
            "cpu": [
                "arm64"
            ],
@@ -2361,9 +2361,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-arm64-musl": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.0-rc.18.tgz",
-            "integrity": "sha512-QWjdxN1HJCpBTAcZ5N5F7wju3gVPzRzSpmGzx7na0c/1qpN9CFil+xt+l9lV/1M6/gqHSNXCiqPfwhVJPeLnug==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.1.tgz",
+            "integrity": "sha512-uwNwFpwKeNiZawfAWBgg0VIztPTV3ihhh1vV334h9ivnNLorxnQMU6Fz8wG1Zb4Qh9LC1/MkcyT3YlDXG3Rsgg==",
            "cpu": [
                "arm64"
            ],
@@ -2378,9 +2378,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.0-rc.18.tgz",
-            "integrity": "sha512-ugCOyj7a4d9h3q9B+wXmf6g3a68UsjGh6dob5DHevHGMwDUbhsYNbSPxJsENcIttJZ9jv7qGM2UesLw5jqIhdg==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.1.tgz",
+            "integrity": "sha512-zY1bul7OWr7DFBiJ++wofXvnr8B45ce3QsQUhKrIhXsygAh7bTkwyeM1bi1a2g5C/yC/N8TZyGDEoMfm/l9mpg==",
            "cpu": [
                "ppc64"
            ],
@@ -2395,9 +2395,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-s390x-gnu": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.0-rc.18.tgz",
-            "integrity": "sha512-kKWRhbsotpXkGbcd5dllUWg5gEXcDAa8u5YnP9AV5DYNbvJHGzzuwv7dpmhc8NqKMJldl0a+x76IHbspEpEmdA==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.1.tgz",
+            "integrity": "sha512-0frlsT/f4Ft6I7SMESTKnF3cZsdicQn1dCMkF/jT9wDLE+gGoiQfv1nmT9e+s7s/fekvvy6tZM2jHvI2tkbJDQ==",
            "cpu": [
                "s390x"
            ],
@@ -2412,9 +2412,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-x64-gnu": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.0-rc.18.tgz",
-            "integrity": "sha512-uCo8ElcCIAMyYAZyuIZ81oFkhTSIllNvUCHCAlbhlN4ji3uC28h7IIdlXyIvGO7HsuqnV9p3rD/bpH7XhIyhRw==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.1.tgz",
+            "integrity": "sha512-XABVmGp9Tg0WspTVvwduTc4fpqy6JnAUrSQe6OuyqD/03nI7r0O9OWUkMIwFrjKAIqolvqoA4ZrJppgwE0Gxmw==",
            "cpu": [
                "x64"
            ],
@@ -2429,9 +2429,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-x64-musl": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.0-rc.18.tgz",
-            "integrity": "sha512-XNOQZtuE6yUIvx4rwGemwh8kpL1xvU41FXy/s9K7T/3JVcqGzo3NfKM2HrbrGgfPYGFW42f07Wk++aOC6B9NWA==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.1.tgz",
+            "integrity": "sha512-bV4fzswuzVcKD90o/VM6QqKxnxlDq0g2BISDLNVmxrnhpv1DDbyPhCIjYfvzYLV+MvkKKnQt2Q6AO86SEBULUQ==",
            "cpu": [
                "x64"
            ],
@@ -2446,9 +2446,9 @@
            }
        },
        "node_modules/@rolldown/binding-openharmony-arm64": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.0-rc.18.tgz",
-            "integrity": "sha512-tSn/kzrfa7tNOXr7sEacDBN4YsIqTyLqh45IO0nHDwtpKIDNDJr+VFojt+4klSpChxB29JLyduSsE0MKEwa65A==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.1.tgz",
+            "integrity": "sha512-/Mh0Zhq3OP7fVs0kcQHZP6lZEthMGTaSf8UBQYSFEZDWGXXlEC+nJ6EqenaK2t4LBXMe3A+K/G2BVXXdtOr4PQ==",
            "cpu": [
                "arm64"
            ],
@@ -2463,9 +2463,9 @@
            }
        },
        "node_modules/@rolldown/binding-wasm32-wasi": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.0-rc.18.tgz",
-            "integrity": "sha512-+J9YGmc+czgqlhYmwun3S3O0FIZhsH8ep2456xwjAdIOmuJxM7xz4P4PtrxU+Bz17a/5bqPA8o3HAAoX0teUdg==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.1.tgz",
+            "integrity": "sha512-+1xc9X45l8ufsBAm6Gjvx2qDRIY9lTVt0cgWNcJ+1gdhXvkbxePA60yRTwSTuXL09CMhyJmjpV7E3NoyxbqFQQ==",
            "cpu": [
                "wasm32"
            ],
@@ -2482,9 +2482,9 @@
            }
        },
        "node_modules/@rolldown/binding-win32-arm64-msvc": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.0-rc.18.tgz",
-            "integrity": "sha512-zsu47DgU0FQzSwi6sU9dZoEdUv7pc1AptSEz/Z8HBg54sV0Pbs3N0+CrIbTsgiu6EyoaNN9CHboqbLaz9lhOyQ==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.1.tgz",
+            "integrity": "sha512-1D+UqZdfnuR+Jy1GgMJwi85bD40H21uNmOPRWQhw4oRSuolZ/B5rixZ45DK2KXOTCvmVCecauWgEhbw8bI7tOw==",
            "cpu": [
                "arm64"
            ],
@@ -2499,9 +2499,9 @@
            }
        },
        "node_modules/@rolldown/binding-win32-x64-msvc": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.0-rc.18.tgz",
-            "integrity": "sha512-7H+3yqGgmnlDTRRhw/xpYY9J1kf4GC681nVc4GqKhExZTDrVVrV2tsOR9kso0fvgBdcTCcQShx4SLLoHgaLwhg==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.1.tgz",
+            "integrity": "sha512-INAycaWuhlOK3wk4mRHGsdgwYWmd9cChdPdE9bwWmy6rn9VqVNYNFGhOdXrofXUxwHIncSiPNb8tNm8knDVIeQ==",
            "cpu": [
                "x64"
            ],
@@ -2516,9 +2516,9 @@
            }
        },
        "node_modules/@rolldown/pluginutils": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-rc.18.tgz",
-            "integrity": "sha512-CUY5Mnhe64xQBGZEEXQ5WyZwsc1JU3vAZLIxtrsBt3LO6UOb+C8GunVKqe9sT8NeWb4lqSaoJtp2xo6GxT1MNw==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
+            "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
            "dev": true,
            "license": "MIT"
        },
@@ -2800,9 +2800,9 @@
            "license": "MIT"
        },
        "node_modules/@types/node": {
-            "version": "25.8.0",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-25.8.0.tgz",
-            "integrity": "sha512-TCFSk8IZh+iLX1xtksoBVtdmgL+1IX0fC9BeU4QqFSuNdN/K+HUlhqOzEmSYYpZUVsLYcPqc9KX+60iDuninSQ==",
+            "version": "25.9.1",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-25.9.1.tgz",
+            "integrity": "sha512-xfrlY7UD5rMJk3ZVJP8BNzS28J36YJg+xp+LPXV1TdWxr8uMH5A860QNxYDGQe/ylDSgjxE52Q9VnO7p75tJxg==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
@@ -3327,9 +3327,9 @@
            }
        },
        "node_modules/admin-lte": {
-            "version": "4.0.0-rc7",
-            "resolved": "https://registry.npmjs.org/admin-lte/-/admin-lte-4.0.0-rc7.tgz",
-            "integrity": "sha512-v7JYiuxONrpXxvoRVhFJuLpZ9xoBvQ1bHkE1lanVR8+/AqBATWXU3vOO0TAWOoxhG6/26JkU5otXq0Z2SRQjZQ==",
+            "version": "4.0.0",
+            "resolved": "https://registry.npmjs.org/admin-lte/-/admin-lte-4.0.0.tgz",
+            "integrity": "sha512-vuUo9yFI0bxbWXKclLRRuAbxLn3x3PdEAcuXOnzoYQ9EoOAbedj87Fb4FPF4BV2rPLfScFEQLbWngS4WtmPZJA==",
            "license": "MIT"
        },
        "node_modules/agent-base": {
@@ -3713,9 +3713,9 @@
            "license": "MIT"
        },
        "node_modules/baseline-browser-mapping": {
-            "version": "2.10.30",
-            "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.30.tgz",
-            "integrity": "sha512-xjOFN16Ha1+Rz4nFYKqHU/LSB+gx/Vi3yQLX7r7sAW+Wa+8hhF2h4pvqTrTMc8+WcDBEunnUurr46Jvv0jk3Vg==",
+            "version": "2.10.31",
+            "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.31.tgz",
+            "integrity": "sha512-MujYO3eP72uvmSE0i4wltsodRfIpZATP3jvzRNRGGxgzId7aVocVJJV3nf01qnzzKFGxQVC9bpWxl5cjxTr/7Q==",
            "dev": true,
            "license": "Apache-2.0",
            "bin": {
@@ -5353,9 +5353,9 @@
            "license": "MIT"
        },
        "node_modules/electron-to-chromium": {
-            "version": "1.5.357",
-            "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.357.tgz",
-            "integrity": "sha512-NHlTIQDK8fmVwHwuIzmXYEJ1Ewq3D9wDNc0cWXxDGysP6Pb21giwGNkxiTifyKy/4SoPuN5l6GLP1W9Sv7zB2g==",
+            "version": "1.5.360",
+            "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.360.tgz",
+            "integrity": "sha512-GkcBt6YYAw9SxFWn+xVar4cLVGlXVuswwtRLBozi2zp0GjXs4ZnOrqV4zbXzg35n7w81hCkyJNYicgXlVHAmBA==",
            "dev": true,
            "license": "ISC"
        },
@@ -5410,9 +5410,9 @@
            }
        },
        "node_modules/enhanced-resolve": {
-            "version": "5.21.3",
-            "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.21.3.tgz",
-            "integrity": "sha512-QyL119InA+XXEkNLNTPCXPugSvOfhwv0JOlGNzvxs0hZaiHLNvXSpudUWsOlsXGWJh8G6ckCScEkVHfX3kw/2Q==",
+            "version": "5.21.6",
+            "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.21.6.tgz",
+            "integrity": "sha512-aNnGCvbJ/RIyWo1IuhNdVjnNF+EjH9wpzpNHt+ci/m9He9LJvUN8wrCcXjp9cWsGNAuvSpVFTx/vraAFQ8qGjQ==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
@@ -8777,9 +8777,9 @@
            }
        },
        "node_modules/postcss": {
-            "version": "8.5.14",
-            "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz",
-            "integrity": "sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==",
+            "version": "8.5.15",
+            "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
+            "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
            "dev": true,
            "funding": [
                {
@@ -8797,7 +8797,7 @@
            ],
            "license": "MIT",
            "dependencies": {
-                "nanoid": "^3.3.11",
+                "nanoid": "^3.3.12",
                "picocolors": "^1.1.1",
                "source-map-js": "^1.2.1"
            },
@@ -9914,14 +9914,14 @@
            }
        },
        "node_modules/rolldown": {
-            "version": "1.0.0-rc.18",
-            "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.0-rc.18.tgz",
-            "integrity": "sha512-phmyKBpuBdRYDf4hgyynGAYn/rDDe+iZXKVJ7WX5b1zQzpLkP5oJRPGsfJuHdzPMlyyEO/4sPW6yfSx2gf7lVg==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.1.tgz",
+            "integrity": "sha512-X0KQHljNnEkWNqqiz9zJrGunh1B0HgOxLXvnFpCOcadzcy5qohZ3tqMEUg00vncoRovXuK3ZqCT9KnnKzoInFQ==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
-                "@oxc-project/types": "=0.128.0",
-                "@rolldown/pluginutils": "1.0.0-rc.18"
+                "@oxc-project/types": "=0.130.0",
+                "@rolldown/pluginutils": "^1.0.0"
            },
            "bin": {
                "rolldown": "bin/cli.mjs"
@@ -9930,21 +9930,21 @@
                "node": "^20.19.0 || >=22.12.0"
            },
            "optionalDependencies": {
-                "@rolldown/binding-android-arm64": "1.0.0-rc.18",
-                "@rolldown/binding-darwin-arm64": "1.0.0-rc.18",
-                "@rolldown/binding-darwin-x64": "1.0.0-rc.18",
-                "@rolldown/binding-freebsd-x64": "1.0.0-rc.18",
-                "@rolldown/binding-linux-arm-gnueabihf": "1.0.0-rc.18",
-                "@rolldown/binding-linux-arm64-gnu": "1.0.0-rc.18",
-                "@rolldown/binding-linux-arm64-musl": "1.0.0-rc.18",
-                "@rolldown/binding-linux-ppc64-gnu": "1.0.0-rc.18",
-                "@rolldown/binding-linux-s390x-gnu": "1.0.0-rc.18",
-                "@rolldown/binding-linux-x64-gnu": "1.0.0-rc.18",
-                "@rolldown/binding-linux-x64-musl": "1.0.0-rc.18",
-                "@rolldown/binding-openharmony-arm64": "1.0.0-rc.18",
-                "@rolldown/binding-wasm32-wasi": "1.0.0-rc.18",
-                "@rolldown/binding-win32-arm64-msvc": "1.0.0-rc.18",
-                "@rolldown/binding-win32-x64-msvc": "1.0.0-rc.18"
+                "@rolldown/binding-android-arm64": "1.0.1",
+                "@rolldown/binding-darwin-arm64": "1.0.1",
+                "@rolldown/binding-darwin-x64": "1.0.1",
+                "@rolldown/binding-freebsd-x64": "1.0.1",
+                "@rolldown/binding-linux-arm-gnueabihf": "1.0.1",
+                "@rolldown/binding-linux-arm64-gnu": "1.0.1",
+                "@rolldown/binding-linux-arm64-musl": "1.0.1",
+                "@rolldown/binding-linux-ppc64-gnu": "1.0.1",
+                "@rolldown/binding-linux-s390x-gnu": "1.0.1",
+                "@rolldown/binding-linux-x64-gnu": "1.0.1",
+                "@rolldown/binding-linux-x64-musl": "1.0.1",
+                "@rolldown/binding-openharmony-arm64": "1.0.1",
+                "@rolldown/binding-wasm32-wasi": "1.0.1",
+                "@rolldown/binding-win32-arm64-msvc": "1.0.1",
+                "@rolldown/binding-win32-x64-msvc": "1.0.1"
            }
        },
        "node_modules/run-parallel": {
@@ -11305,16 +11305,16 @@
            }
        },
        "node_modules/vite": {
-            "version": "8.0.11",
-            "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.11.tgz",
-            "integrity": "sha512-Jz1mxtUBR5xTT65VOdJZUUeoyLtqljmFkiUXhPTLZka3RDc9vpi/xXkyrnsdRcm2lIi3l3GPMnAidTsEGIj3Ow==",
+            "version": "8.0.13",
+            "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.13.tgz",
+            "integrity": "sha512-MFtjBYgzmSxmgA4RAfjIyXWpGe1oALnjgUTzzV7QLx/TKxCzjtMH6Fd9/eVK+5Fg1qNoz5VAwsmMs/NofrmJvw==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
                "lightningcss": "^1.32.0",
                "picomatch": "^4.0.4",
                "postcss": "^8.5.14",
-                "rolldown": "1.0.0-rc.18",
+                "rolldown": "1.0.1",
                "tinyglobby": "^0.2.16"
            },
            "bin": {
@@ -12255,7 +12255,7 @@
        },
        "resources/assets/v1": {
            "dependencies": {
-                "date-fns": "^4.0.0",
+                "date-fns": "4.1.0",
                "stream-browserify": "^3.0.0"
            },
            "devDependencies": {
@@ -12289,7 +12289,7 @@
                "chart.js": "^4",
                "chartjs-adapter-date-fns": "^3.0.0",
                "chartjs-chart-sankey": "^0.14.0",
-                "date-fns": "^4.0.0",
+                "date-fns": "4.1.0",
                "i18next": "^26.0.3",
                "i18next-chained-backend": "^5.0.0",
                "i18next-http-backend": "^3.0.1",
@@ -12302,7 +12302,7 @@
                "laravel-vite-plugin": "^3",
                "patch-package": "^8",
                "sass": "^1",
-                "vite": "=8.0.11",
+                "vite": "=8.0.13",
                "vite-plugin-manifest-sri": "^0.2.0"
            }
        }
--- a/patches/admin-lte+4.0.0-rc7.patch
+++ b/patches/admin-lte+4.0.0-rc7.patch
--- a/resources/assets/v1/package.json
+++ b/resources/assets/v1/package.json
@@ -10,7 +10,7 @@
        "prod": "mix --production"
    },
    "dependencies": {
-        "date-fns": "^4.0.0",
+        "date-fns": "4.1.0",
        "stream-browserify": "^3.0.0"
    },
    "devDependencies": {
--- a/resources/assets/v2/package.json
+++ b/resources/assets/v2/package.json
@@ -12,7 +12,7 @@
        "laravel-vite-plugin": "^3",
        "patch-package": "^8",
        "sass": "^1",
-        "vite": "=8.0.11",
+        "vite": "=8.0.13",
        "vite-plugin-manifest-sri": "^0.2.0"
    },
    "dependencies": {
@@ -26,7 +26,7 @@
        "chart.js": "^4",
        "chartjs-adapter-date-fns": "^3.0.0",
        "chartjs-chart-sankey": "^0.14.0",
-        "date-fns": "^4.0.0",
+        "date-fns": "4.1.0",
        "i18next": "^26.0.3",
        "i18next-chained-backend": "^5.0.0",
        "i18next-http-backend": "^3.0.1",
--- a/resources/views/list/ale.twig
+++ b/resources/views/list/ale.twig
@@ -104,10 +104,10 @@
                    <code>{{ logEntry.after }}</code>
                {% endif %}
                {% if 'add_to_piggy' == logEntry.action %}
-                    {{ trans('firefly.ale_action_log_add', {amount: formatAmountBySymbol(logEntry.after.amount, logEntry.after.currency_symbol, logEntry.after.decimal_places, true), name: logEntry.after.piggy})|raw }}
+                    {{ trans('firefly.ale_action_log_add', {amount: formatAmountBySymbol(logEntry.after.amount, logEntry.after.currency_symbol, logEntry.after.decimal_places, true), name: logEntry.after.piggy|e})|raw }}
                {% endif %}
                {% if 'remove_from_piggy' == logEntry.action %}
-                    {{ trans('firefly.ale_action_log_remove', {amount: formatAmountBySymbol(logEntry.after.amount, logEntry.after.currency_symbol, logEntry.after.decimal_places, true), name: logEntry.after.piggy})|raw }}
+                    {{ trans('firefly.ale_action_log_remove', {amount: formatAmountBySymbol(logEntry.after.amount, logEntry.after.currency_symbol, logEntry.after.decimal_places, true), name: logEntry.after.piggy|e})|raw }}
                {% endif %}
            </td>
Author	SHA1	Message	Date
github-actions[bot]	9ee1b4587c	Merge pull request #12273 from firefly-iii/release-1779337714 🤖 Automatically merge the PR into the develop branch.	2026-05-21 06:28:41 +02:00
JC5	7579ae2615	🤖 Auto commit for release 'develop' on 2026-05-21	2026-05-21 06:28:34 +02:00
James Cole	c002cb795d	Fix date fns	2026-05-21 06:23:17 +02:00
James Cole	f00852aa6a	Merge branch 'main' into develop	2026-05-21 06:22:28 +02:00
James Cole	3e26f21bc4	Fix patch and lock version.	2026-05-21 06:22:15 +02:00
James Cole	195fb6cdb7	Update pr-reply-no-disclosure.yml Signed-off-by: James Cole <james@firefly-iii.org>	2026-05-21 06:07:37 +02:00
James Cole	034280ca17	Update changelog.	2026-05-20 20:53:55 +02:00
github-actions[bot]	c5ce9fd1e2	Merge pull request #12272 from firefly-iii/release-1779302299 🤖 Automatically merge the PR into the develop branch.	2026-05-20 20:38:28 +02:00
JC5	3d64f7fe08	🤖 Auto commit for release 'develop' on 2026-05-20	2026-05-20 20:38:20 +02:00
James Cole	f2efb69b76	Fix broken if statement	2026-05-20 20:30:30 +02:00
James Cole	7499a414f4	Expand changelog	2026-05-20 20:24:50 +02:00
James Cole	8b0f790a56	Merge branch 'main' into develop	2026-05-20 20:18:10 +02:00
James Cole	b70ed32952	Merge pull request #12271 from alanturing881/fix/stored-xss-ale-piggy-name Fix stored XSS in audit log view via piggy bank name (ale.twig)	2026-05-20 20:16:16 +02:00
James Cole	9e511c822e	Update pr-reply-no-disclosure.yml Signed-off-by: James Cole <james@firefly-iii.org>	2026-05-20 20:12:40 +02:00
iaohkut	fa6c123595	Fix stored XSS in ALE view by HTML-escaping piggy bank name The Twig template ale.twig rendered the piggy bank name from AuditLogEntry.after.piggy using \|raw, bypassing auto-escaping. A user-controlled name containing HTML (e.g. <img onerror=...>) would execute as JavaScript in any browser viewing the transaction audit log (CWE-79). Apply \|e filter to escape only the user-controlled `name` parameter before substitution into the trans() string. The \|raw filter is preserved because the `amount` parameter legitimately contains <span> tags for currency styling. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-20 11:07:57 -04:00
James Cole	ec1dfca2b5	Enhance PR workflow to check for author Added logic to check for the author of the pull request. Signed-off-by: James Cole <james@firefly-iii.org>	2026-05-19 08:15:40 +02:00
James Cole	bebd3b189e	Merge pull request #12265 from firefly-iii/dependabot/npm_and_yarn/develop/vite-8.0.13 Bump vite from 8.0.11 to 8.0.13	2026-05-18 08:11:34 +02:00
dependabot[bot]	0226673a01	Bump vite from 8.0.11 to 8.0.13 Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.11 to 8.0.13. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.13/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.0.13 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-18 04:27:29 +00:00