v0.5.0

Upgrading from 0.4.0

• Reverse proxies and CDNs must not cache /sw.js or /workbox-*.js. Kept sends
  Cache-Control: no-cache for them; a proxy that caches them anyway keeps browsers on an old
  version after an upgrade.

Added

• Installable app (PWA): a service worker precaches the static, content-hashed assets so the app
  loads faster, shows an offline page when the server cannot be reached, and offers to reload
  when a new version is available. Pages, data, documents and API responses are never cached in
  the browser.

What's Changed

• test: upgrade migration tests from 0.3.0 and a docker upgrade check on pull requests by @OrellBuehler in #76
• feat: import camt.054 and mt940 statements by @OrellBuehler in #75
• feat: add pwa service worker with offline fallback by @OrellBuehler in #81
• chore: release 0.5.0 by @OrellBuehler in #82

Full Changelog: v0.4.0...v0.5.0

v0.4.0

Upgrading from 0.3.0

• Back up kept.db first. Migrations 0017–0031 run automatically on the first start, in one
  transaction (a failure leaves the database as it was). Two of them rewrite existing rows.
• Finish or cancel open imports before upgrading. Uploads waiting for confirmation now live in
  the database and blob store; previews started on 0.3.0 are not carried over.
• Tax payments may move to a different deduction year. Outflows mapped to a deduction that
  have no matching line on the tax statement are reclassified. The tax year page lists the moved
  payments and lets you undo or dismiss the change.
• Email notifications are limited to administrators. Users have no verified address yet, so
  a member's existing email channel now fails with "limited to administrators". Use ntfy or a
  webhook instead.
• Members can no longer reach private network addresses (webhooks, ntfy, Paperless) unless
  you set KEPT_ALLOW_PRIVATE_NETWORK=true. Administrators still can.
  KEPT_NOTIFY_BLOCK_PRIVATE=true blocks them for everyone.
• KEPT_SECRET_KEY is required by every built server, not only with NODE_ENV=production.
  The Docker image already required it; bun run start without it now refuses to start. Use
  KEPT_ALLOW_INSECURE_KEY=true only for throwaway local runs.
• Stored tokens that cannot be decrypted (for example after changing the key) are now flagged
  as needing re-entry in settings instead of failing on use.
• Admin actions ask for your password (and second factor, when enabled) and are recorded in
  an audit log.
• SQLite migrations moved from drizzle/ to drizzle/sqlite/. Only relevant if you run Kept
  from source with your own paths; already applied migrations are recognised.

Added

• Investments: securities, trades, holdings valuation, stock splits, and daily prices and FX
  rates from Yahoo Finance.
• Pillar 3a: portfolios, values and contributions, yearly limits and buy-in rules, overview page
  and tax summary.
• Transfers between own accounts, linked on import and manual entry, with mirrored transactions.
• Liquidity: notice periods, liquid cash and invested totals.
• PostgreSQL (17+) as an alternative to SQLite, via DATABASE_URL, and S3-compatible blob
  storage via KEPT_STORAGE=s3.
• Several instances can share one PostgreSQL database: scheduled jobs and cleanups run on one
  instance, and every instance shuts down gracefully.
• Security headers and a content security policy; app error pages.
• External API for companion apps: scoped, revocable tokens (Settings → API tokens) with read
  access to bills, transactions, categories, recurring payments and accounts, and links back to
  bills and transactions. See docs/external-api.md.
• Warning about lost edits before undoing an import.

Fixed

• Bills: editing a payment can no longer over-allocate it, and removed allocations are not
  re-added by automatic matching.
• Pillar 3a: late payments capped per year, refunds subtracted, portfolios not counted twice.
• Imports: confirm re-checks the preview under the ledger lock; inbox imports match bills again;
  expired uploads are cleaned up reliably.
• Outgoing requests: private-address checks cannot be bypassed through DNS, and saved tokens are
  not sent to a changed host.
• Login throttling per username and per client (IPv6 by /64), without hard-locking a username.
• Many concurrency fixes around bills, transfers, categories and notification settings.

New environment variables

DATABASE_URL, KEPT_DB_POOL_MAX, KEPT_DB_PREPARE, KEPT_DB_STATEMENT_TIMEOUT_MS,
KEPT_DB_TRANSACTION_TIMEOUT_MS, KEPT_DB_APPLICATION_NAME, KEPT_STORAGE, KEPT_STORAGE_DIR,
KEPT_S3_*, KEPT_ALLOW_PRIVATE_NETWORK, KEPT_ALLOW_INSECURE_KEY.
See the README for details.

What's Changed

• fix: decode jbig2 and ccitt images when scanning bill pdfs by @OrellBuehler in #41
• feat: preview institution logo as soon as a file is picked by @OrellBuehler in #42
• feat: investment holdings with daily prices by @OrellBuehler in #43
• feat: pillar 3a accounts, portfolios and contributions by @OrellBuehler in #44
• fix: address review findings by @OrellBuehler in #45
• feat: liquid cash, notice periods and invested totals by @OrellBuehler in #46
• feat: link transfers and mirror them into accounts without statements by @OrellBuehler in #47
• fix: address remaining review findings and harden setup by @OrellBuehler in #48
• refactor: blob storage abstraction for documents and pending imports by @OrellBuehler in #49
• feat: s3 blob storage by @OrellBuehler in #50
• fix: security hardening by @OrellBuehler in #51
• chore: groundwork for the async data layer by @OrellBuehler in #52
• refactor: await auth queries by @OrellBuehler in #53
• refactor: await ledger, category and tax queries by @OrellBuehler in #54
• refactor: await import and inbox queries by @OrellBuehler in #55
• refactor: await bill and paperless queries by @OrellBuehler in #56
• refactor: await the remaining queries by @OrellBuehler in #57
• refactor: async database facade with a serialising gate by @OrellBuehler in #58
• refactor: dialect-aware schema and sqlite migrations folder by @OrellBuehler in #59
• feat: postgresql backend by @OrellBuehler in #60
• test: run the suite on postgresql by @OrellBuehler in #61
• docs: postgresql and s3 backends, backups on postgresql by @OrellBuehler in #62
• fix: bill allocation consistency by @OrellBuehler in #69
• fix: recheck import preview under the ledger lock and harden pending uploads by @OrellBuehler in #68
• fix: enforce pillar 3a buy-in and detection rules by @OrellBuehler in #67
• fix: multi-instance job coordination and graceful shutdown by @OrellBuehler in #66
• ci: gate releases on the full quality workflow by @OrellBuehler in #65
• fix: transfer sign flip and trades-move-cash guard by @OrellBuehler in #63
• fix: reclaim orphaned document blobs by @OrellBuehler in #64
• fix: harden outbound requests, secrets and email notifications by @OrellBuehler in #70
• fix: database layer hardening, consistent read snapshots, 3a valuation by @OrellBuehler in #71
• chore: post-merge cleanup of inbox scheduler and document sweep by @OrellBuehler in #72
• feat: external token api for companion apps by @OrellBuehler in #74
• docs: add 0.4.0 changelog with upgrade notes by @OrellBuehler in #73

Full Changelog: v0.3.0...v0.4.0

v0.3.0

What's Changed

• fix: keep deleted paperless bills from returning after reconnecting by @OrellBuehler in #27
• feat: search, filter and paginate bills by @OrellBuehler in #28
• feat: add year in review page with sankey, headline stats and yoy changes by @OrellBuehler in #31
• feat: import statements from a watch folder by @OrellBuehler in #30
• feat: detect and project recurring payments by @OrellBuehler in #32
• feat: add cash-flow forecast by @OrellBuehler in #33
• feat: institution logos with sanitized uploads and initials fallback by @OrellBuehler in #35
• feat: add notifications with ntfy, webhook and email channels by @OrellBuehler in #34
• docs: add product page on github pages by @OrellBuehler in #39
• feat: add two-factor authentication with totp and passkeys by @OrellBuehler in #36
• feat: tax deductions summary per tax year by @OrellBuehler in #37
• feat: add preferences tab for iban display, amount blur, locale, currency and page size by @OrellBuehler in #29
• feat: ownership share for shared accounts by @OrellBuehler in #38
• ci: publish docker image only on release by @OrellBuehler in #40

Full Changelog: v0.2.0...v0.3.0

v0.2.0

What's Changed

• feat: database backup and restore by @OrellBuehler in #23
• feat: transaction categories and monthly budgets by @OrellBuehler in #26
• feat: tax payment reconciliation by @OrellBuehler in #25
• feat: polish ui by @OrellBuehler in #24

Full Changelog: v0.1.0...v0.2.0

v0.1.0

First release of Kept, a self-hosted personal finance app.

Features

• Accounts grouped by institution (current, savings, credit card, investment, pension, cash), with manual balance snapshots for accounts you don't import
• Statement import from ISO 20022 camt.053, CSV and Excel (per-account column mapping with live preview); re-imports never duplicate transactions, and every import can be undone
• Bills from PDF with Swiss QR-bill extraction, or entered by hand
• Bill-to-payment matching by structured reference, by IBAN and amount as a suggestion, or manually; partial payments, overpayments and credit notes
• Dashboard: net worth per currency, monthly income and expenses, overdue and upcoming bills, stale imports
• PDF reports: account statement, open bills, net worth
• Optional Paperless-ngx integration for pulling bills and writing status back
• Multiple local users; each user only sees their own data

Run it

docker run -d --name kept -p 3000:3000 -v kept-data:/data \
  -e KEPT_SECRET_KEY="$(openssl rand -base64 32)" \
  -e ORIGIN=https://kept.example.org \
  ghcr.io/orellbuehler/kept:0.1.0