v3.4.0

Ka-Ching! started with comics, and plenty of it still assumed you collect comics. This release makes it fit whatever you collect: cards, figures, vinyl, films, games or a mix. New installs get a short setup guide, and a round of fixes from a full audit makes the everyday jobs quicker.

What you collect

• A setup guide on new installs. What you collect, whether you pre-order, which pages to show, currency and budget, theme and layout, and an optional password. Every step can be skipped, and you can run it again from Settings → Help. Existing installs never see it unless they open it.
• What you track (Settings → Appearance) replaces the three layout presets. Tick what you collect and whether you pre-order, and the pages that don't fit are switched off for you: Price creep only shows for numbered things like comics and manga, Top titles is hidden if nothing you collect comes in sets or series, and the pre-order cards go if you don't pre-order. You can still switch any card back on, and Reset cards to preset puts things back.
• Price creep and Top titles get their own on/off switch ("Show this page") in Customise and in Settings → Appearance. A hidden page also leaves the sidebar.
• A type for every category: Comics, Manga and books, Trading cards, Figures and toys, Vinyl and music, Films and TV, Video games or Something else, set in Settings → General → Categories. The type decides the words used: a Set for trading cards, a Line for figures, an Artist for vinyl, and so on. Existing categories get a type from their name (you can change it). On upgrading, unused Comics and Manga type categories get Numbered issues switched on.
• A Series / Set box on Log orders, the import review screen and Edit item, worded to match the category. For comics and manga it's worked out from the title, so you can leave it empty. It suggests names you've used before, and is included in both CSV exports.
• Top titles groups by Series / Set, with its wording following what you collect ("Top sets by total spend" for cards, and so on).
• Gold / silver is no longer a starter category on new installs. If you already have it, it stays.

Orders, Calendar and Alerts

• A floating bar for bulk select: Mark paid, Delay (+30, +60 or +90 days), Cancel and Remove. Esc or ✕ clears the selection.
• Calendar: a Day / Whole month switch replaces "Show whole month".
• Alerts: "Fine as it is". Items with no order number or no release date can be marked as fine, so they stop showing up. You can bring any of them back from "Marked as fine".
• "Ghost items" are now called items with no order number.

Smaller changes

• Typing a new category: the "Add ..." row comes first, and + New category... stays at the top of the list.
• Overview: the 10 releases card just has Recent, Most expensive and Lowest tabs; figures say "item" rather than "issue".
• Where each series sits (Price creep) shows the same hover box as the charts.
• Log orders tabs are now Paste an order and Add by hand.
• The sidebar budget box sits at the very bottom, below Collapse.
• Clearer text box borders and focus rings in every theme.

Fixes

• Shipping was counted too many times for orders with several release dates. An order's real postage was added to every parcel in it. It's now shared across the order's parcels, so still due, budgets and shipping figures come out lower and correct.
• Insights left out items with no release date. Older orders that only have an order date are now included, so Overview, Spend by shop and the Dashboard all give the same total.
• The Dashboard's year so far and all time figures now include shipping.
• Notifications that keep failing are now flagged on the Dashboard and in Alerts, with the reason in plain words.
• Price creep only uses categories with Numbered issues on, counts manga in volumes, and ignores issues bought only as a variant, so one pricey variant no longer fakes a big rise or drop.
• Series typed in capitals (common on eBay) group with the same series written normally.
• Free (£0) items no longer show as unpaid.
• The Alerts page shows open alerts first, and dates read "15 Sep" everywhere.
• Chart labels stay readable at any width, and the 12-month trend no longer dips below zero.
• Various things running off the edge on narrow screens, and wording tidied throughout.

v3.3.0 - a calmer, premium look

A restyle release. Every page has been redesigned to be quieter and easier to read, and nothing about how your data is tracked or added has changed.

• Four themes: Sand (new default), Grey, Blue and Noir, each with contrast-checked accent colours
• New "K!" logo and app icons; fonts bundled, so nothing loads from outside your server
• Dashboard: a "This month" summary and key figures, and a Spending chart that splits paid from still due (bars or line)
• Insights: stacked bars on Spend by shop, and "Where each series sits" on Price creep
• Collapsible sidebar, Settings as tabs, and a Compact layout replacing Three columns
• Redesigned sign-in page with Caps Lock warning, tries left and a lock countdown

Upgrading: git pull && docker compose up -d --build. You start on Sand, Three columns becomes Compact, and a saved Dashboard card order resets once. See CHANGELOG.md and the README's "Upgrading from v3.2".

v3.2.0

v3.2.0 — safe, sound and checked

A tidy-up and security release: everything was audited - the code, the
pages on real data, and security against OWASP ASVS Level 1 - and every
problem found was fixed. No new features to learn; things just work
better and more safely.

Security

• Fixed: names could run script code (stored XSS). An item, shop or
  category name containing script code ran on the Insights and Spend by
  shop pages. Every name is now escaped everywhere, including inside charts,
  tooltips and legends.
• Forms can't be submitted from other websites (cross-site request
  forgery protection), with or without the login.
• Every "go back to" address stays on Ka-Ching! - crafted links could
  previously redirect to another site (including via old /v2/ and
  /classic/ addresses).
• Crafted pastes can't tie the app up: the import reader's patterns were
  rewritten so they can't slow down on malicious text (one took over 25
  seconds; now 0.02s), and pastes are capped at 1 MB.
• Size limits: backups up to 100 MB, settings files 1 MB, any request
  110 MB.
• Security headers on every response: a content security policy, no
  framing, no sniffing, no caching of personal data, a referrer policy, and
  HSTS when reached over HTTPS. The server no longer announces its software.
• Stronger login: passwords of 12+ characters (existing ones keep
  working), the most common passwords refused, a strength bar and Show
  button, sessions recorded on the server so signing out ends a session
  for good, every other session ended on a password change, a
  notification when login details change, and the cookie marked secure
  over HTTPS.
• Framework upgrade: FastAPI 0.142 / Starlette 1.7 / Uvicorn 0.54,
  clearing 7 known vulnerabilities in the old Starlette.

Fixes

• Importing the same order twice no longer crashes; items already tracked
  are marked on the review screen and skipped.
• The word "None" no longer appears as a note (50 existing ones are
  cleared automatically).
• The general paste reader no longer puts lines like "Order Number: ..." or
  "Qty: 1" into item names.
• Prices must be between £0 and £100,000; an unreadable date no longer
  quietly becomes today's.
• A form missing something shows a normal page with a way back, not
  technical text.
• Money shows thousands separators everywhere (£1,274.86).
• Chart tooltips sit beside the cursor in every layout (they drifted on
  wide screens).
• The Price creep tooltip shows the right year; Insights' figures and shop
  toggles no longer run off a phone screen.
• The budget alert now follows your budget cycle and rollover, like the
  sidebar.

Under the hood

• Faster pages: one database connection per page (was 14 to 21) and
  60 to 80% fewer queries.
• The code is split into clear parts, old leftovers from the v2 interface
  removed, and shared calculations used everywhere so figures always agree.
• An automated test suite (120 tests) runs on every change, alongside
  CodeQL code scanning, dependency vulnerability and licence checks, and a
  sign-off check.

Project

• Signed releases: each release comes with a software bill of materials
  and a checksums file, signed by GitHub - see
  [Verifying a release](SECURITY.md#verifying-a-release).
• New documents: [ARCHITECTURE.md](ARCHITECTURE.md),
  [SECURITY-ASSESSMENT.md](SECURITY-ASSESSMENT.md),
  [INTERFACES.md](INTERFACES.md), [MAINTAINERS.md](MAINTAINERS.md), and
  fuller [SECURITY.md](SECURITY.md) and [CONTRIBUTING.md](CONTRIBUTING.md).
• OpenSSF Best Practices: Baseline Level 1 and Level 2.

Upgrading

• If you use the login, you'll be asked to sign in once more.

v3.1.0

v3.1.0 — make it yours

Customise every page

• ⚙ Customise on Dashboard, Calendar and the four Insights pages: show or
  hide any card from a strip across its top (nothing on the card is
  covered), and drag cards into your own order with the ⠿ handle (mouse
  or touch; holding near the screen edge scrolls). Half-width cards pair up;
  a lone one widens to fill the row. Reset order per page.
• Settings → Layout: every card on every page in one place, with
  Everything, I don't pre-order and Just the essentials presets.
• Layout and order are saved on the server, so every device matches.

Wide landscape monitors

• Settings → Layout → On wide screens (1,900px+ only; phones, tablets,
  laptops and portrait screens are unaffected): Standard (centred),
  Three columns (three cards to a row, full width) or Side panel (a
  sticky "At a glance" column on every page: this week, alerts, biggest
  still to come).

Budget by category

• Optional category limits per budget cycle (Settings → General).
• New Budget by category Dashboard card: one bar split into category
  colours, limits in the legend, pink when a category's over.
• Insights → Cumulative spend's budget bar splits by category too.
• Over-limit categories show in Alerts, with a push (once per category per
  cycle) if budget alerts are on. Shipping is shared across a parcel's
  categories by price, so categories always add up to the budget figure.

Optional login

• Settings → Security: turn a login on, change the password, or turn it
  off. Stored hashed; "keep me signed in for 30 days"; Sign out in the
  sidebar; five wrong tries lock sign-in for a minute.
• Optional KACHING_PASSWORD in docker-compose: a master password that keeps
  the login on and is the recovery route if you forget yours.
• Calendar subscriptions keep working through a private link while the login
  is on.

Smaller things

• / jumps to search from anywhere (desktop).
• Alerts now flags items with no release date (with a Set date
  button) and categories over their limit.
• Before-restore copies are listed in Settings → Data backup (newest 3
  kept, older ones tidied up automatically).
• Dashboard: "Year so far" and "Year in review" merged into one Your
  spending card; This week says "Nothing due" instead of £0.00 of
  £0.00; the Backup card offers to turn daily backups on when they're off.
• Calendar: each day in the releases list shows items + shipping, matching
  the calendar's figure.
• Price creep: Typical increase is now the median, and each series has a
  category-coloured dot.
• "Has series" is now Numbered issues, with a hint saying what it does.
• Every pill-shaped button and tab is the same size everywhere, and every
  expand/collapse arrow is now a clear round chevron button.
• Pages no longer shift slightly between short and long pages (room for the
  scrollbar is always kept).
• Better "Install app" support on phones (the app's worker now covers every
  page).

Removed

• The old interface at /classic/, as announced in v3.0. Old /classic/
  links open the same page in the current interface.

v3.0

v3.0.0 — new interface

A complete redesign of the web interface, plus categories and a lot of
fixes. Your data upgrades itself on first start; nothing needs doing by hand.

The Android app is dormant

The [Android app](https://github.com/callum87-Lab/Ka-Ching-App) is on hold
until it can be reworked to match this release and fully re-tested. Phone
sync is off and hidden by default — set KACHING_PHONE_SYNC=1 to bring it
back (unsupported until the app update ships). Your sync key is kept.

New interface

• Dark neon redesign with a sidebar layout, now at the normal addresses
  (/, /orders, /calendar, /search, /items/new, /insights/…,
  /alerts, /settings)
• The old interface is kept at /classic/ for this release only, and
  will be removed in the next one
• New pages: Orders (by shipment, All / Unpaid & cancelled), Alerts
  (awaiting charge, duplicates, ghost items, history, notification setup)
• Insights split into Overview, Spend by shop, Price creep and
  Top titles
• A full phone layout: slide-out menu, section pills under the page
  title, shop dropdowns, readable chart labels, tables as one block per row
• The sidebar budget box stays in view while scrolling, with a choice of
  what it shows (spent of budget, left/over, percentage, daily allowance,
  spent + still due, or hidden) and turns pink when you're over
• Toggles, tabs and ranges are remembered between visits
• Consistent buttons and pills throughout (same hover, selected and disabled
  behaviour everywhere)
• Installable to a phone home screen, as before

Categories

• Every item has a category, with a starter list and your own on top; each
  gets its own colour, and "has series" is set per category in Settings
• Pick a category when logging orders (per paste or per item)
• Spend by category on Insights; category chips on Price creep and Top
  titles
• Existing items become Comics; category is in backups and both CSV exports

Insights

• Price creep now uses cover price (the cheapest copy of each issue), so
  variants no longer look like huge price rises; a new Variants cost
  extra column shows the average variant mark-up. Replaces the old
  sparklines
• Cumulative spend redesigned: spent so far vs budget, what's still due
  this month, and a bar per release day
• Calendar: tap a day to show only its releases

Fixes

• Backups (download, daily automatic, and the pre-restore safety copy) could
  miss the most recent changes; they now always include everything
• Restoring a backup now can't be affected by leftover database files, and
  restoring an older backup upgrades it immediately
• Items with no release date or placed date no longer break the Orders page
• Items synced from the app no longer arrive without a category
• Orders: the selected shop filter now shows as selected
• Dashboard: the budget ring shows how much you're over, not a capped 100%
• "Alert-free streak" replaced with honest open / resolved / last-resolved
  counts
• The default landing page setting applies to the new interface

v2.0.0

v2.0.0

A major milestone release — the webui and app now share data properly
instead of drifting apart, and a real security gap found during a full
code review is closed.

New

• Shop colours now genuinely match the app instead of two independent
  hashes disagreeing - the webui sends its own colour mapping via sync,
  the app uses it directly.
• The configured shipping-estimate default is now shared with the app
  the same way, instead of being hardcoded separately on each side.
• Total/Comics/Shipping toggles, previously Dashboard-only, now also on
  Insights' 12-month trend chart.
• Cumulative spend curve and price distribution chart on Insights.
• Calendar heatmap - days shade by how much is actually due.
• "Biggest still to come" card on the dashboard.
• Delay this item - one tap (+30/+60/+90 days) for a manufacturer delay.
• Whatnot order confirmation email support.
• Close buttons on the item edit and import review screens.

Fixed

• A critical data-loss bug where syncing an item from the app could
  silently wipe that item's note on the webui.
• CSV exports had no protection against formula/CSV injection.
• Webui and app sometimes disagreeing on which items show in "coming
  up" or "10 most recent" when several release the same day.
• The Insights cumulative-spend chart showing all three lines at once
  instead of just Total.
• Budget circle showing a capped "100%" instead of the true percentage
  over budget.
• A database-locked error during a large first-time app sync.

Full changelog in commit history.

v1.7.1

What's new since v1.6.1

• New: Total/Comics/Shipping toggles on Insights' 12-month spend trend chart too — previously this was only on the Dashboard's own chart.
• Fixed a critical data-loss bug: syncing an item from the app could silently wipe that item's note on the webui.
• Fixed the Insights cumulative-spend chart showing all three lines at once instead of just Total.
• Added close buttons to the item edit and import review screens.

Full changelog in commit history.

v1.6.1

What's new since v1.3.1

• New: Whatnot order confirmation email support, matching the app.
• New: chart Total/Comics/Shipping toggles — switch each line on or off independently and overlay them on the Spend Trend chart.
• New: Insights additions — cumulative spend curve for the current month, and a price distribution chart showing how many items fall into each price bracket.
• New: Calendar heatmap — days now shade by how much is actually due, not just which days have something releasing.
• New: "Biggest still to come" card on the dashboard — the single highest-value item not yet released, plus the total size of everything still on order.
• New: Delay this item — one tap (+30/+60/+90 days) on an item's edit screen to push its release date back for a manufacturer delay, logged the same way a manual edit is.
• Redesigned the item actions menu (⋮) into a proper dropdown.
• Fixed several genuine bugs found while testing: the actions menu wasn't showing most of your real "marked as paid" history (the quick paid-toggle button never logged it), a database-locked error during a large first-time app sync, and a few UI polish issues.
• Documentation: README now covers Whatnot, the chart toggles, and the budget alert notification (previously undocumented).

Full changelog in commit history.

v1.3.1

What's new since v1.2.0

• New: toggleable spend-trend chart. Total, Comics, and Shipping can each be switched on or off independently and overlaid on the same chart — gradient glowing line for the combined total, distinct colors for each metric, permanent dots at every data point.
• New: Whatnot order confirmation email support, matching the app.
• Fixed a database-locked error that could happen during a large first-time app sync.
• Fixed the item actions menu (⋮) not being properly styled — it's a proper dropdown now instead of a cramped row of buttons.
• Fixed several genuine bugs found while testing today: header text colliding with numbers on narrow screens, vertical misalignment from mixing fonts, a broken CSS rule causing missing spacing on some screens, and Whatnot shipping not being captured when pasted from certain email clients.
• Simplified the version numbering scheme to match the app (no more date-based versions).

Full changelog in commit history.

v1.2.0

What's new in v1.2.0

Full UI redesign — Dashboard, Calendar, Search, Insights, Settings, and Log Orders all reworked with icon headers, real toggle switches instead of plain checkboxes, and consistent rounded pill buttons throughout. The top navigation is centered, and the item actions menu (⋮) is now a proper dropdown instead of a cramped row of buttons.

New: budget alert notifications. Get notified once you cross 80% of your monthly budget, with a test button to check it works.

Forbidden Planet parser improvements:

• Fixed items with a product image being misread as "Awaiting product image"
• Added support for pasting the checkout confirmation page, not just order history
• Added support for pasting the order confirmation email, including tolerance for email clients that collapse line breaks on copy

Bug fixes:

• Fixed a real layout bug causing text and numbers to run together with no spacing on narrow screens
• Fixed accidental navigation to the edit screen when tapping a comic's name in a list — the explicit Edit option in the (⋮) menu is now the only way in
• Fixed vertical misalignment between header text and figures caused by mixing a display font with a monospace font
• Styled the previously-unstyled native file input to match the rest of the UI
• Sync key now shows a copy icon and confirms with "Copied!" when clicked

Full changelog in commit history.