starred/WYGIWYH
1
0 Fork 0
mirror of https://github.com/eitchtee/WYGIWYH.git synced 2026-11-13 12:23:44 +01:00
Code Issues 14 Packages Projects Releases 10 Wiki Activity
2,092 Commits 6 Branches 100 Tags
main
Commit Graph
2092 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Herculino Trotta b6833f2b7b ci: run Django test suite on pull requests 2026-10-24 13:57:25 -03:00
eitchtee 2558d601dd chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
 2026-10-24 16:57:23 +00:00
Herculino Trotta d7537b54ad Merge pull request #629 from eitchtee/fix/import-object-authorization 
fix(import): enforce object-level authorization on import profiles and runs
0.24.0 		2026-10-24 13:56:53 -03:00
Herculino Trotta e46e9ad0cf Merge pull request #628 from eitchtee/fix/oidc-tests-allauth-65-20 
test(users): fix OIDC tests after allauth 65.20 bump
 2026-10-24 13:56:26 -03:00
Herculino Trotta 4446db3249 test(users): stop using SocialLogin.state_from_request removed in allauth 65.20 
django-allauth 65.20 removed SocialLogin.state_from_request, breaking the
OIDC email auto-connect tests after the bump in #627.
 2026-10-24 13:27:10 -03:00
Herculino Trotta 1e486a608e fix(import): enforce object-level authorization on import profiles and runs 
ImportProfile and ImportRun had no owner, and neither the web views nor the
REST viewsets filtered by the requesting user, so any authenticated user could
read, edit and delete every other user's import profiles and runs
(GHSA-q668-h56g-mfp4).

- ImportProfile is now a SharedObject, with share and take-ownership views
  like transaction rules; the global unique constraint on name is dropped.
- ImportRun is now an OwnedObject owned by the uploader, so runs made with a
  shared profile stay private to whoever ran them.
- Existing runs are backfilled with the owner of their imported
  transactions; existing profiles stay unowned and usable by everyone.
 2026-10-24 13:26:37 -03:00
Herculino Trotta 8888a850bd Merge pull request #627 from eitchtee/fix/bump-allauth-oauthlib 
build(deps): bump django-allauth to 65.20.1 to unblock oauthlib 4.0.0
 2026-10-24 12:12:12 -03:00
Herculino Trotta 9941c8fb90 build(deps): bump django-allauth to 65.20.1 to allow oauthlib 4.0.0 
django-allauth 65.18 pinned oauthlib<4, preventing Dependabot from
resolving GHSA-hj66-6f7g-4r5v and GHSA-xpv3-w29h-x7cv.
 2026-10-24 12:09:19 -03:00
Herculino Trotta 39a67dfb4e Merge pull request #626 from eitchtee/dependabot/npm_and_yarn/frontend/vite-8.3.5 
build(deps): bump vite from 8.0.16 to 8.3.5 in /frontend
 2026-10-24 12:00:43 -03:00
Herculino Trotta 1b4a2eb3d1 Merge pull request #625 from obervinov/fix/rules-set-mute-writes-to-mute 
fix(rules): write set_mute action to mute instead of is_paid
 2026-10-24 12:00:30 -03:00
Herculino Trotta 73e29e867f Merge pull request #624 from obervinov/fix/bump-certifi-emudhra-distrust 
build(deps): bump certifi to 2026.10.19 (GHSA-6q48-6c7w-9gw2, critical)
 2026-10-24 11:59:39 -03:00
eitchtee a6f56c4989 chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
 2026-10-24 14:59:16 +00:00
Herculino Trotta 601c641bb3 Merge pull request #623 from eitchtee/weblate 
Translations update from Weblate
 2026-10-24 11:58:49 -03:00
dependabot[bot] 0c9ccf797a build(deps): bump vite from 8.0.16 to 8.3.5 in /frontend 
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.16 to 8.3.5.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.5/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 8.3.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-21 17:56:02 +00:00
obervinov aa95ade7ce fix(rules): write set_mute action to mute instead of is_paid 2026-10-21 21:51:22 +04:00
obervinov 03a27002cc build(deps): bump certifi from 2026.5.20 to 2026.10.19 2026-10-21 19:32:10 +04:00
Dimitri Decrock 565a770130 locale(Dutch): update translation 
Currently translated at 100.0% (817 of 817 strings)

Translation: WYGIWYH/App
Translate-URL: https://translations.herculino.com/projects/wygiwyh/app/nl/
 2026-10-14 04:57:23 +00:00
Dimitri Decrock a3d75de836 locale(Dutch): update translation 
Currently translated at 97.3% (795 of 817 strings)

Translation: WYGIWYH/App
Translate-URL: https://translations.herculino.com/projects/wygiwyh/app/nl/
 2026-10-14 03:57:23 +00:00
eitchtee 8794aba1c5 chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
 2026-10-12 05:47:31 +00:00
Herculino Trotta ab0c00f3e0 Merge pull request #621 from eitchtee/fix/convert-applies-form-amount 
fix(transactions): apply the form amount when converting a paid transaction
 2026-10-12 02:46:54 -03:00
Herculino Trotta 3261e5f266 fix(transactions): apply the form amount to a paid transaction converted into an installment plan 2026-10-12 02:41:14 -03:00
Herculino Trotta 35ef1dd716 fix(transactions): apply the form amount to a paid transaction converted into a recurring transaction 2026-10-12 02:41:14 -03:00
Herculino Trotta 8b896cf31f Merge pull request #619 from eitchtee/weblate 
Translations update from Weblate
 2026-10-12 02:34:28 -03:00
Weblate 85426392f8 Merge remote-tracking branch 'origin/main' 2026-10-12 05:34:17 +00:00
Herculino Trotta 66e51bb0b4 Merge pull request #620 from eitchtee/fix/dropdown-submenu-hover-delay 
Keep dropdown submenu open while moving the pointer into it
 2026-10-12 02:34:14 -03:00
Herculino Trotta dfb5cf37b4 fix(dropdown): keep submenu open while the pointer moves into it 
Moving the pointer diagonally from a submenu trigger to its flyout crosses
the items below it, which closed the flyout before it could be reached.
Delay hiding the flyout by 300ms, and show it immediately on hover or focus.
 2026-10-12 02:33:14 -03:00
Herculino Trotta f52a0f8cd5 locale(Portuguese (Brazil)): update translation 
Currently translated at 98.0% (801 of 817 strings)

Translation: WYGIWYH/App
Translate-URL: https://translations.herculino.com/projects/wygiwyh/app/pt_BR/
 2026-10-10 21:57:23 +00:00
eitchtee ac16359ff4 chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
0.23.3 		2026-10-10 21:20:53 +00:00
Herculino Trotta ab7b0c7929 Merge pull request #618 from eitchtee/fix/simulator-amount-mask 
fix(simulator): use money mask on amount field
 2026-10-10 18:20:07 -03:00
Herculino Trotta 174d2eb340 fix(simulator): use money mask on amount field 
Match the other amount fields by using the Alpine money mask, and parse the masked value with the user's separators.
 2026-10-10 18:19:07 -03:00
Herculino Trotta 84416c64d8 Merge pull request #617 from eitchtee/dependabot/npm_and_yarn/frontend/source-map-js-1.2.2 
build(deps): bump source-map-js from 1.2.1 to 1.2.2 in /frontend
 2026-10-10 18:13:45 -03:00
dependabot[bot] 3a91772490 build(deps): bump source-map-js from 1.2.1 to 1.2.2 in /frontend 
Bumps [source-map-js](https://github.com/7rulnik/source-map-js) from 1.2.1 to 1.2.2.
- [Release notes](https://github.com/7rulnik/source-map-js/releases)
- [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/7rulnik/source-map-js/compare/v1.2.1...v1.2.2)

---
updated-dependencies:
- dependency-name: source-map-js
  dependency-version: 1.2.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-10 21:10:30 +00:00
Herculino Trotta 98a1be04e7 Merge pull request #616 from eitchtee/chore/python-3.14 
build: upgrade to Python 3.14
 2026-10-10 18:08:25 -03:00
Herculino Trotta f58c341a84 ci: use python 3.14 in translations workflow 2026-10-10 18:05:25 -03:00
Herculino Trotta 1b9c0ed0b1 build(docker): use python 3.14 base images 2026-10-10 18:05:25 -03:00
Herculino Trotta 10b3c45014 build: require python 3.14 
Python 3.11 has been security-only since 2024. Bump requires-python to >=3.14 and re-lock.
 2026-10-10 18:05:25 -03:00
Herculino Trotta 5f71288e44 Merge pull request #612 from fxmacrodata/fxmacrodata-hardening 
fix(automatic-exchange-rates): don't follow redirects or log the key in the FXMacroData provider
 2026-10-10 17:52:17 -03:00
eitchtee ca267fedef chore(locale): update translation files 
[skip ci] Automatically generated by Django makemessages workflow
 2026-10-10 20:52:09 +00:00
Herculino Trotta 92c33a9fcc Merge pull request #615 from eitchtee/fix/oidc-unverified-email-autoconnect 
feat(auth): make OIDC email trust configurable
 2026-10-10 17:51:37 -03:00
Herculino Trotta d1bb9698a0 Merge pull request #614 from eitchtee/feat/simulation-tool 
feat: add Simulator tool
 2026-10-10 17:51:24 -03:00
Herculino Trotta c274e92f86 Merge pull request #613 from eitchtee/feat/transaction-convert-menu 
feat(transactions): convert a transaction into a quick transaction, recurring transaction or installment plan
 2026-10-10 17:51:13 -03:00
Herculino Trotta 2544820e1a Merge pull request #569 from eitchtee/copilot/fix-code-scanning-alerts 
Stop exposing exception text in OAuth dynamic client registration errors
 2026-10-10 17:50:53 -03:00
Herculino Trotta e925822574 fix(oauth): keep specific DCR errors without exposing exception text 
Parsing helpers now return (value, error) instead of raising, so no
exception object flows into the response while clients keep the
precise messages they had before.

full_clean() failures map to fixed per-field messages; redirect URI
errors surface as NON_FIELD_ERRORS from Application.clean().

Also reject non-string token_endpoint_auth_method with a 400 instead
of crashing with a TypeError.
 2026-10-10 17:48:14 -03:00
Herculino Trotta 89c7a6bd4f docs(auth): explain OIDC email trust modes 2026-10-10 17:01:56 -03:00
Herculino Trotta 59de9f2443 feat(auth): configure OIDC email trust 
Allow verified-only linking with OIDC_TRUST_EMAIL=false while retaining case-insensitive matching. Keep unconditional trust enabled by default for compatibility with #518; that mode retains the documented takeover risk.
 2026-10-10 17:01:52 -03:00
Herculino Trotta 6e72594ec7 test(simulator): cover baseline calculation and page 2026-10-10 15:26:59 -03:00
Herculino Trotta 916c401ce3 feat(sidebar): add simulator to tools menu 2026-10-10 15:26:59 -03:00
Herculino Trotta bdf0cf8d4c feat(simulator): add simulator tool page 
Hyperscript-driven page to simulate one-time, recurring and installment expenses or incomes over the projected balance.
 2026-10-10 15:26:59 -03:00
Herculino Trotta 81e572c8ab feat(simulator): add projected baseline calculation 
Per-currency monthly net changes from active, tracked accounts, plus the exchange rate for currencies with an exchange currency.
 2026-10-10 15:26:59 -03:00
Herculino Trotta 195da63998 feat(transactions): add Convert submenu to the transaction actions menu 
Replaces the "Add as quick transaction" action.
 2026-10-09 23:25:20 -03:00