v1.0.5

Highlights

• Recurring transactions: the transactions found every month (salary, rent, subscriptions, bills) get a "Monthly" badge. A new switch in the Transactions tab shows only them, and lists those not arrived yet this month with their usual day and amount ("≈" when it varies). Card payments must keep about the same amount to count, so subscriptions are found but not the restaurant.
• Identical transactions are kept: two genuine identical transactions on the same day (two coffees, two tolls) were merged into one by the synchronization or the import. Each one is now saved. The identifiers of existing transactions do not change: no duplicates after the upgrade.
• Simpler login: the portal finds the API by itself (/api next to /portal/), so the login screen no longer asks for the API URL. - Security badge: a new Security workflow scans the git history for secrets (gitleaks) and the dependencies for vulnerabilities (Trivy) on every change. Every Monday it also scans the image published on Docker Hub. Reports are in the Security tab of the repository. - Presentation video on the home page of the documentation. ## Fixes - PHP 8.5: the push notifications no longer use curl_close(), deprecated in PHP 8.5. With log_level=debug, its warning would have been printed in the API responses. ## Upgrade - Docker: nothing to do for Carbure, there is no database migration. The image is still based onPHP 8.3. - docker compose users: docker-compose.yml now uses MariaDB 13 (was 11). Back up the database before pulling. An existing data volume must be upgraded with mariadb-upgrade, or set MARIADB_AUTO_UPGRADE: "1" in the db service. To stay on MariaDB 11, keep image: mariadb:11. - Other installations: copy the new archive; no migration. PHP 8.2 to 8.5 are supported and tested. - Logged-in browsers: the API URL saved by the previous login screen is ignored and removed; thesession is kept. ## API Backward compatible, only additions:
• GET /transaction/recurring (month, year, months): the recurring transactions of a month, with their status (received or expected).
• POST /transaction/import/preview: identical rows of a file are now each new (they were known).

Development

• PHP 8.5 added to the test matrix; a deprecation now fails the tests.
• CI: GitHub Actions updated (#9); the flaky e2e test of the category list on scroll is fixed.
• Dependabot configuration for Docker and npm.

Before publishing, there's one risk to look at: the switch to MariaDB 13 (#7, Dependabot). It's a major version jump and docker-compose.yml doesn't set MARIADB_AUTO_UPGRADE. Someone who runs docker compose pull && up on an existing volume may end up with an unupgraded database, or one that won't start. Two options:

• The safer one: add MARIADB_AUTO_UPGRADE: "1" to the db service before the release. I can open a PR for it now.
• Otherwise: go back to mariadb:11 for this release.

v1.0.4

Highlights

• Getting started: on a new database, the installation wizard offers a starter pack — about 30 categories (sub-categories in the color of their parent), about 100 categorization rules for common shops, energy suppliers and telecom operators, and 13 insights: expenses, income, what is left this month, savings, uncategorized, unchecked, direct debits, over budget, largest expense, daily spending, vs last month, cash withdrawals, bank fees. Both options are checked by default, named in the chosen language, and everything can be changed afterwards.
• Bank of origin: the transaction detail shows the bank and account it comes from (synchronized account or imported statement). Older transactions get it at the next synchronization that receives them again.
• More room on screen: the month and year selectors move to the header and only offer the months that have transactions (plus the current one). On another year, the last month with transactions is selected.
• Professional logs: one JSON object per line (JSON Lines) with ISO 8601 time, request id (X-Request-Id kept), client IP (taken from X-Forwarded-For behind a trusted proxy such as the NAS reverse proxy, ignored otherwise), user, method and path. Each request ends with a line giving its status and duration. The Logs page shows the IP and the user of each entry. Older log files stay readable.
• Log retention: a new log_retention_days setting (Administration → Settings). Older files are deleted at the end of the bank synchronization, etention.
• Smaller touches: a compact Import button; rules that send a notification get a light red background; Logs and Settings come after AI agent in Categories page is titled "Transaction
  categorization".

Fixes

• A browser that kept the session of a previous installation at the same address now opens the installationwizard instead of showing "not installed
• The WARN filter of the Logs page now keeps the warnings, and their color is shown. - The category list of a transaction no ning when the page has just scrolled.
  ## Upgrade
  - Docker: nothing to do. The migratink(two optional columns onbank_transaction) is applied when the container starts. The HEALTHCHECK` now runs every 5 minutes (everys during the first 2 minutes with Docker
• Other installations: apply the migration from the banner of the portal (administrators) or with php tools/migrate.php.
• Log retention: existing configurations do not have log_retention_days, so their logs are kept forever. Set it in Administration → Settings (new
• Log format: new entries are JSON lines. If a tool parses data/logs/carbure_*.log, update it (for
  example, use jq).
• Behind a reverse proxy: check on the Logs page that the IP shown is the client's and not the proxy's;
  the proxy must send X-Forwarded-For.

API

Backward compatible, only additions:

• GET /transaction/periods: the months that have transactions.
• GET /system/logs/retention: the reteistrators).
• bank_name and account_number in the transactions.
• ip, user, method and path in t
• starter_categories and starter_insights (optional) for POST /setup/install.

Documentation

• Synology tutorial: the container is created straight from the image (no docker-compose project), plus a new
  "Secure the installation" section — firepermissions, HSTS, encrypted Hyper
  Backup, DSM 2-step verification, MariaDB user limited to the Docker network.
• The Settings page of the portal is hig guide, with the keys it can change
  marked.
• Log format, client IP and retention (p guide.

Development

• ./start.sh --fresh starts from an emn to go through the installation wizard.
  The following starts keep what the wizard created.

Quality

• Unit tests of the starter data: valid insights, parent colors, rules never hidden by an earlier one.
• Integration tests that run every start
• Unit tests of the client IP behind a proxy.
• Playwright tests of the wizard optionsod selector and the transaction origin.
• Two flaky end-to-end tests stabilized.

v1.0.3

Highlights

• Import your bank statements: the new Import button of the Transactions tab reads the files your bank lets you download — OFX/QFX, QIF, CSV (columns recognized from the header, French formats and Windows-1252 included) and CAMT.053. A preview shows which transactions are new, already there, or probable duplicates (same amount a few days apart, e.g. synchronized with another label) before anything is saved; your categorization rules then sort the imported transactions. Handy for a bank woob does not cover, or to bring in your history.
• A livelier money flow: key figures of the month (income, expenses, savings and savings rate, what is left), links in the color of their category, categ or its link — to list its transactions under the chart.
• Settings tab (Administration): the coance, section by section, secrets masked. The
  safe settings — log level, savings category, public URL, woob options, iOS notifications — can be changed from the
  portal, each value checked; the database, tand the label cleaning stay read-only. The
  previous file is kept as prod.ini.bak.
• Sync tab (Administration): the ready-ontab line that start the bank
  synchronization, for all accounts or one; the token stays masked until you show it, and can be created or renewed
  from there.
• Category picker: a modern search field, matches highlighted, arrow keys and Enter to choose.

Upgrade

No database migration in this release.

• Docker: nothing to do.
• Other installations: for the Settingsable to write data/conf/prod.ini (read-only
  otherwise). For the import, allow request bodies of at least 2 MB (client_max_body_size 2m; in nginx, as
  docker/nginx.conf).

Documentation

• Menu icons and a redesigned navigation, und configuration pages, comparison table with
  file import, new screenshots.
• Third-party components bundled in the Doc(woob is LGPL-3.0-or-later) listed in the
  README.

Quality

• Unit tests of the statement parser on sample OFX, QIF, CAMT.053 and CSV files; integration tests of the import and of the configuration (refused values, secre only); Playwright tests of the import, the
  flow click and the new tabs.

v1.0.2

Highlights

• Connect Claude without a token: the MCP server now supports OAuth 2.1, so Claude (web, Desktop, mobile) connects from the server URL alone (Settings → Connectors → Add custom connector) after your consent in the portal. Access appears in My access tokens and can be revoked there.
• Budgets per sub-category: a parent category's budget is the sum of its sub-categories, or an amount you set to override it. The budget edit dialog works again.
• Administration menu: users, logs and AI agent are grouped under Administration.
• Dev stack: ./start.sh runs the production image and MariaDB with the code mounted live and a year of demonstration data (--reset, --build, --fake-woob, --help).

Upgrade

The database gets a new migration, 2026-10-14_oauth (OAuth clients and codes, two columns on api_tokens):

• Docker: applied automatically when the container starts.
• Other installations: apply it from the Update banner shown to administrators (or php tools/migrate.php) before using the Claude connectors. Without it, everything else keeps working.
• Behind your own nginx, route /.well-known/oauth-* to src/api.php as docker/nginx.conf does, and set public_url in prod.ini if your HTTPS proxy does not send X-Forwarded-Proto.

Fixes

• Synchronizing one account no longer synchronizes every account.
• The icon chosen for an insight is saved.
• Escape closes the transaction dialog.
• Transaction icons and colors are those of their own category.
• Budget cards stay green up to 105 % of the budget.
• Category picker in the transaction list, checkboxes aligned with their labels, consistent page headers.

Quality

• Playwright end-to-end tests of every tab against the real API, in CI.
• Portal unit tests (node:test), in CI and pre-push.
• Less duplicated code (API calls, month ranges, badge styles) and dead code removed.

v1.0.1

Carbure 1.0.1

Une image Docker beaucoup plus légère, des icônes de transactions plus parlantes et une
correction pour la connexion des banques sur NAS.

Installation et mise à jour

docker pull ltoinel/carbure:1.0.1

Sur Synology : Container Manager → ImaMettre à jour.
Aucune migration de base dans cette version.

Nouveautés

• Image Docker sur Alpine : l'image repose sur php:8.3-fpm-alpine au lieu de Debian.
  woob est construit à part et l'image finalteur : elle est
  bien plus légère et ne présente plus aucune vulnérabilité connue corrigeable à sa
  publication (analyse Trivy).
• Transactions : l'icône et la couleur sont celles de la catégorie de la transaction
  (ou de sa catégorie parente). Une transactône du type
  d'opération.

Corrections

• woob sur NAS : l'erreur « Woob will not start as long as config file … is readable
  by group or other users » est corrigée. Cahier des banques
  à 600 au démarrage du conteneur et avant chaque appel à woob.
• Schéma : sql/carbure.sql est régénér vérifié
  identique. Il indique les migrations qu'il contient : un import manuel dans phpMyAdmin
  connaît donc la version du schéma.

Documentation

• Tutoriel Synology : l'image se télécharge Container
  Manager, et la mise à jour passe par Image → Mettre à jour. Il explique aussi que
  faire si l'erreur woob ci-dessus apparaît

v1.0.0

Carbure 1.0.0

Première version publique de Carbure : suivi du budget d'un foyer à partir des comptes
bancaires, synchronisés avec woob. Elle comprend un portail web,
une API (utilisée aussi par l'application iOS) et un serveur MCP pour les agents IA.

Installation

docker pull ltoinel/carbure:1.0.0

Au premier lancement, l'assistant web demande la base de données, installe ou migre le
schéma et crée le compte administrateur. Aucune commande n'est nécessaire.
Guides : installation ·
NAS Synology avec MariaDB

Sans Docker : carbure-1.0.0.tar.gz ou .zip ci-dessous (empreintes dans SHA256SUMS).

Fonctionnalités

• Transactions : recherche, pointage, détail d'une transaction et changement de catégorie.
• Budget : flux du mois (diagramme de Sankey des revenus vers les dépenses, l'épargne
  et le reste) et cartes de budget par catégorie.
• Insights et Tendances ; les administrateurs peuvent écrire leurs propres insights en SQL (lecture seule).
• Règles de catégorisation : appliquées à tout l'historique, avec une notification
  push en option quand une nouvelle transaction correspond.
• Comptes : ajout d'une banque depuis le portail (modules woob), synchronisation par
  compte avec la date et le statut de la dernière synchronisation.
• Agents IA : serveur MCP en lecture seule (Claude, ChatGPT…) avec des jetons
  révocables et une durée de vie au choix.
• Administration : profils administrateur et utilisateur, verrouillage du compte pendant
  24 h après 5 échecs de connexion, date de dernière connexion, onglet Logs.
• Accessibilité du portail (score Lighthouse de 100), français et anglais.

Exploitation

• Image Docker amd64/arm64 (nginx et PHP-FPM 8.3), avec SBOM et provenance.
• Un seul volume /data pour la configuration, les logs, le cache et woob.
• Migrations du schéma appliquées automatiquement au démarrage, et /api/health pour le healthcheck.
• En-têtes de sécurité (CSP, HSTS…) et image analysée par Trivy en CI.

⚠️ Le dossier data/ contient les secrets et les identifiants bancaires : il ne doit
jamais être servi par le serveur web (voir la page Sécurité de la documentation).