[1.3.1-beta.3] - 2026-10-24
Bug Fixes
- Adapt TOTP to otplib v13 class API by @John710
otplib v13 removed the authenticator singleton — the server crashed on
boot (CI caught it: container unhealthy). Rewritten to the documented
v13 API (verified via Context7): OTP class with NobleCryptoPlugin and
ScureBase32Plugin, verify({secret, token}) returning a VerifyResult,
generateURI for the otpauth QR link. Full generate/verify flow
smoke-tested locally. - Include avatar_set in the refresh payload by @John710
The app restores the session via /auth/refresh on every page load, but
that payload was the only one of the three (login/refresh/me) missing
avatar_set — the avatar disappeared after a reload despite being stored
in the database.
CI/CD
- Fix stable changelog via explicit range from previous stable tag by @John710
--latest --ignore-tags DROPS prerelease releases from the output instead
of merging their commits into the stable section. Compute the previous
stable tag and pass an explicit range with --ignore-tags instead
Features
- Splits UI, attachments, tag budgets, merge, 2FA, tokens, viewers, offline PWA by @John710
- transaction modal: split-by-categories mode with live sum check;
split children rendered indented under the violet Split badge - attachments modal per transaction (upload/list/download/delete)
- budgets: optional category + tag chips target, tags shown on cards
- categories: merge dialog (same-type target only)
- settings: new Access section — 2FA setup with QR, API tokens (plaintext
shown once), shared read-only viewer management - login: 2FA code field appears on totp_required; api() propagates
response flags to thrown errors - viewer mode: mutating buttons hidden across all views, read-only banner,
Ctrl+Shift+N and settings sections guarded - service worker: offline app shell (network-first navigation,
stale-while-revalidate for hashed assets); API never cached - locale keys for all of the above (en/ru)
- transaction modal: split-by-categories mode with live sum check;
- Splits, attachments, tag budgets, merge, 2FA, API tokens, viewers by @John710
- split transactions: parent row carries the full amount and balance
effect, children hold per-category amounts (reports/budgets count
children for categories, parents for flow totals) - transaction attachments (images/PDF/text up to 5MB, stored as bytea,
served with ETag) - budgets can target a category, tags, or both (budget_tags table);
category becomes optional when tags are set - POST /categories/:id/merge moves transactions, recurring rules and
budgets into the target category - TOTP two-factor auth (otplib + qrcode): setup/enable/disable, code
required at login (totp_required response flag) - personal API tokens (sha256-stored, shown once, Authorization: Bearer)
- shared read-only viewer accounts: viewer JWTs read the owner's data,
every non-GET API call is rejected with 403 - migrations 23-27; errors/auth locale keys (en/ru)
- split transactions: parent row carries the full amount and balance
Full Changelog: v1.3.0...v1.3.1-beta.3