Merge pull request #11949 from firefly-iii/release-1773489415

🤖 Automatically merge the PR into the develop branch.

app/Http/Controllers/Json/BudgetController.php

@@ -60,7 +60,7 @@ final class BudgetController extends Controller
             $this->abRepository = app(AvailableBudgetRepositoryInterface::class);
             $this->blRepository = app(BudgetLimitRepositoryInterface::class);
             $this->repository->cleanupBudgets();
-            $this->blRepository->cleanup();
+            $this->abRepository->cleanup();
 
             return $next($request);
         });

app/Http/Middleware/SecureHeaders.php

@@ -59,7 +59,7 @@ class SecureHeaders
             "object-src 'none'",
             sprintf("script-src 'unsafe-eval' 'strict-dynamic' 'nonce-%1s'", $nonce),
             // sprintf("style-src 'self' 'nonce-%1s'", $nonce), // safe variant
-            "style-src 'self' 'unsafe-eval'", // unsafe variant
+            "style-src 'self' 'unsafe-inline'", // unsafe variant
             "base-uri 'self'",
             "form-action 'self'",
             "font-src 'self' data:",

changelog.md

@@ -25,14 +25,12 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 ### Security
 
 > [!NOTE] 
-> A lot of people have access to the new Claude model that has enhanced code scanning capabilities. Many new issues are being reported through (semi-)automated means. I will update the security policy to reflect this. Please stop reporting the following issues:
+> A lot of people have access to the new Claude model that has enhanced code scanning capabilities. Many new issues are being reported through (semi-)automated means. I will update the security policy to reflect this. The following security related issues no longer need reporting:
 
-- Yes, it is possible to point webhooks to private or internal IPs.
-- Yes, you can see all transaction link types. If you are an owner, you can also delete them.
-- Yes, `unsafe-inline` is allowed for CSS, which means you can overrule the layout if you manage to get CSS on the page.
-- Yes, you can make the rule engine print internal enums.
-
-These issues are security issues, but Claude is usually incapable of assessing their impact. 
+- It is possible to point webhooks to private or internal IPs.
+- You can see all transaction link types. If you are an owner, you can also delete them.
+- `unsafe-inline` is allowed for CSS, which means you can overrule the layout if you manage to get CSS on the page.
+- You can make the rule engine print internal enums.
 
 ### API
 

config/firefly.php

@@ -79,7 +79,7 @@ return [
         // see cer.php for exchange rates feature flag.
     ],
     'version'                              => 'develop/2026-03-14',
-    'build_time'                           => 1773474042,
+    'build_time'                           => 1773489235,
     'api_version'                          => '2.1.0', // field is no longer used.
     'db_version'                           => 28, // field is no longer used.