budgetpilot: v1.2.0

1.2.0 (2026-09-30)

Features

• config: read the import rate limit from IMPORT_RATE_LIMIT_MAX_ATTEMPTS (#711) (eecd085)
• import: a way forward from the currency refusal (#762) (7ac5a96)
• import: the import remembers which account a statement goes to, visibly and revocably (#787) (4bfae18)

Bug Fixes

• a year the engines cannot store faithfully is refused on the row (#758) (#770) (04099cf)
• bank-sync: a failed bank sync never skips the days it did not fetch (#771) (a36d3df)
• deps: bump fast-uri from 3.1.7 to 3.1.8 (GHSA-hrr3-gc8f-f4qj) (c861f73)
• deps: bump the distroless base image to bb6b03d (libc6 CVE-2026-5450, CVE-2026-5928) (b5118f4)
• import: a refusal names no bank it has nothing to do with, and says what it knows (#764) (3227338)
• import: ask each /import question once per file, and bind every answer to that file (#718) (6c947df)
• import: finish the date-reading question: short columns, the confirmed name, the way back (D5, 3 of 5) (#704) (dec8772)
• import: make every per-row designation fact follow the « Première ligne » switch (#747) (65d22df)
• import: name a reading card's non-date cell instead of leaving an empty slot (#705) (#726) (b282e3d)
• import: never read a counterparty account column as the statement's own account (#725) (67877af)
• import: one answer to whether a designation can help a file (#756) (06cd8e1), closes #351 #628 #712
• import: point the reading question at the column its evidence came from (#739) (aed4d03)
• import: refuse a declared currency the destination account contradicts (#600) (#742) (9cdb542)
• import: speak the Date row's reading in lower case mid-sentence (#728) (#730) (36067ce)
• import: tell the user when the file's proof overrules their date answer (#749) (d87e342)
• import: the column door names file-scoped refusals (#772) (5039858)
• import: the pending state on /import and on the designation screen (#395) (#697) (d9185bf)
• import: the write step owns its failures (D3) (#766) (c6af921)

Documentation

• agents: no private references in anything published, gated over tracked files (#748) (0be808f)
• import: the designation screen's body budget, measured and corrected (#729) (1612cbd)
• readme: correct what 1.2 made untrue, and keep volatile facts out (#751) (57b2e4d)
• records hygiene before 1.2 (H1) (#690) (a512e64)
• referential: record Planche 7f's superseded reading line, and make the reconciliation table the home for design corrections (#688) (24ce1e7)
• referential: register the eight components added since 2026-08-19 (C1) (#706) (615ca2b)
• security: name GitHub push protection among the guards (#768) (cdec974)
• the user pages say what 1.2 does (#773) (555500a)
• troubleshooting: English is the default language, not French (#776) (9cf67a6)

Maintenance

• bump brace-expansion from 5.0.9 to 5.0.12 (#794) (49cab14)
• bump github/codeql-action/upload-sarif (#810) (9228714)
• bump prettier from 3.9.8 to 3.9.9 in the npm-lint-tooling group (#807) (5809255)
• bump the npm-patch-minor group across 1 directory with 4 updates (#809) (1b80346)
• bump the npm-vitest group across 1 directory with 2 updates (#808) (32f203e)
• bump typescript-eslint in the npm-lint-tooling group (#723) (1042c35)

budgetpilot: v1.1.1

1.1.1 (2026-09-23)

Bug Fixes

• ci: remove the expired-in-practice CVE-2026-14456 acknowledgement (#665) (40797be), closes #579
• import: ask the date reading on the auto path instead of defaulting silently (#668) (3ad30fd)
• import: re-import your own export lands back on the account it came from (#674) (a282314)
• import: refuse a control character in a label before it crashes the write (#663) (9d069e6)
• import: refuse a control character in a label before it crashes the write (#663) (9d069e6)
• import: refuse or ask before writing a file that names more than one account (#672) (3923c82)
• test: migrate to vitest 5 / vitest-browser-svelte 3's async render() (#682) (df3c9aa)

Documentation

• calibrate the measurement that proves a fix, not only the gate (#655) (28d6a9d)
• compress AGENTS.md and record the five missing assertion rules (#658) (2ad98b3)

Maintenance

• bump distroless/nodejs24-debian13 from 774b7d0 to 7781e8b (#593) (9593963)
• bump the actions-patch-minor group across 1 directory with 3 updates (#681) (4a1a31e)
• bump the npm-lint-tooling group across 1 directory with 3 updates (#656) (558b5c7)
• bump the npm-lint-tooling group with 2 updates (#678) (53b72d9)
• bump the npm-patch-minor group with 4 updates (#680) (93e44cd)
• deps: bump Node to the 24.21.0 LTS patch, block the 25.x major (#675) (65e242d)
• deps: group the vitest ecosystem so a major bump lands as one PR (#677) (1622323)

budgetpilot: v1.1.0

1.1.0 (2026-09-19)

Features

• import: a file's date order becomes an input the parser honours (#612) (784b7df)
• import: derive a file's date order at the single door, from the column each profile declares (#618) (464113c)
• import: derive, disclose and store how a file's dates are read (#637) (f66e449)
• import: thread the date reading a user answers into the parse and the key (#649) (118d820)

Bug Fixes

• csv: test the first character a consumer sees, not the first code unit (#654) (b9729c7)
• import: bound a parsed file's dimensions at the read, and rate limit the import doors (#604) (8b42eb4)
• reports: apportion displayed shares so a printed set sums to 100 (#585) (9b6ebcb)

Documentation

• audits: the API decision stops citing a document nobody can open (#577) (0e99cd7)
• research: the literature behind the merchant index and the counterparty link (#606) (af907d2)
• research: the perception evidence base leaves the tracker (#578) (dd299c1)

Maintenance

• bump devalue from 5.8.1 to 5.9.2 (#644) (350c9c9)
• bump the npm-patch-minor group across 1 directory with 11 updates (#642) (59dc431)

budgetpilot: v1.0.0

1.0.0 (2026-09-07)

Features

• define the public interface at 1.0 (#574) (612e1c5)

Maintenance

• bump the actions-patch-minor group with 2 updates (#566) (bb2e43c)
• bump the npm-patch-minor group across 1 directory with 3 updates (#565) (41d0bc9)
• bump the npm-prisma group with 5 updates (#564) (4de17dc)

budgetpilot: v0.14.4

0.14.4 (2026-09-03)

Bug Fixes

• deps: clear both blocking image CVEs, mysql2 by override and fast-uri by refresh (#559) (82b6bdb)

budgetpilot: v0.14.3

0.14.3 (2026-09-01)

Bug Fixes

• dashboard,reports: the period control gains the calendar it never had (#549) (b105388)
• deps: bump the distroless runtime to 774b7d0, clearing CVE-2026-14456 (b8b690e)
• deps: force mariadb 3.5.3 so the image stops shipping CVE-2026-55215 (c359955)
• insights: suppress model reasoning so a thinking model can answer at all (#554) (7b99c79)

Maintenance

• bump the npm-patch-minor group with 7 updates (#540) (04b9800)
• deps: bump the npm-lint-tooling group with 2 updates (7923299)
• scripts: a one-command local stack so changes reach a browser before they ship (#551) (5750858)

budgetpilot: v0.14.2

0.14.2 (2026-08-25)

Bug Fixes

• insights: the local AI path says which of six things went wrong (#528) (69f193f), closes #524

Documentation

• audits: the tracker sort, as it was run (#522) (fd8685c)

budgetpilot: v0.14.1

0.14.1 (2026-08-25)

Bug Fixes

• categories: the stored sentinel stops reaching three screens, and a sweep stops the fourth (#494) (83ed6ec)
• net-worth: D4 moves to the column, so /settings cannot walk around it (#508) (c6c59d5)
• net-worth: the Connecté badge stops outliving the connection that earned it (#505) (1d28799)
• reports,dashboard: the period fields stop rendering in the browser's locale (#495) (fab3633)

Documentation

• audits: the architecture audit, as it was run (#517) (e605773)
• bank-sync: a nine-step setup path, and the overlay that makes step 6 possible (#493) (9c2d32b)
• bank-sync: register a certificate over HTTPS, not a public key over HTTP (#490) (3f0df8a)

budgetpilot: v0.14.0

0.14.0 (2026-08-24)

Features

• accounts: the account a statement belongs to (#480) (6cba949)
• import: version 3 of the deduplication key, and the recompute that makes it affordable (#465) (30fdbe9)
• money: a currency field and an exponent field, in the same change, on 64-bit columns (#462) (8dbf68e)

Bug Fixes

• close the four gaps that compose into silent data loss on a major (#450) (542ab87)
• import: the account question is asked where the refusal is (#487) (04115f3)
• net-worth: as of today means now, not noon (#443) (61c6b4a)
• the four 1.0 blockers from the pre-1.0 audit (#439) (5edf309)
• the remaining pre-1.0 interface cleanups, and two corrections to the audit (#456) (57c3a55)

Behaviour and internals

• money: one module that knows an amount is scaled by a power of ten (#461) (ec71b12)

Documentation

• a truthful limitations list, a pin that resolves itself, and a version the app can name (#440) (f77c049)
• agents: how much rigour a change earns, in three tiers (#489) (dea87c2)
• agents: narrow the em dash rule to prose, and gate the half that is a file (#444) (58a5b7f)
• money: the currency and exponent rule, and the design note for the two stored forms (7a86fbc)
• net-worth: the sync comment loses its scenario and keeps its invariant (#448) (50b284e)
• the pre-1.0 interface audit, as it was run (#455) (03e36fe)

Maintenance

• bump eslint-plugin-svelte in the npm-lint-tooling group (#445) (4943c1c)
• bump the actions-patch-minor group across 1 directory with 2 updates (#447) (189925f)
• bump the npm-patch-minor group with 5 updates (#446) (664c069)
• claude: path-scoped rules for skill auto-invocation, and two Skill denies (#463) (b1778a6)

budgetpilot: v0.13.1

0.13.1 (2026-08-20)

Bug Fixes

• five small defects and the half of #372 that does not wait on an account model (#412) (0e0cb56)
• import,budget: a two-date cell is refused, and budget spending agrees with every other money read (#411) (296e204)
• tags: removing a tag says so, instead of leaving « ajoutée » standing (#421) (49b55ad)
• the six things a blind walk of 0.13.0 found, two of which change your numbers (#409) (f4e7cfc)
• transactions: a refused save in the detail panel now says why (#420) (bc9838e)

Maintenance

• stop tracking Serena's project config, which rewrites itself (#398) (1c68f50)