v0.23.0

Docker

docker pull ghcr.io/lucaslra/montly:0.23.0
docker pull ghcr.io/lucaslra/montly-mcp:0.23.0

Fixed

• SQLite WAL mode — enabled journal_mode=WAL and synchronous=NORMAL on startup for better read concurrency and write throughput.
• Digest webhook goroutine storm — FireMonthDigest now caps concurrent HTTP deliveries at 20 across all users, preventing a goroutine burst on the 1st of every month.
• CSV import task visibility — imported tasks now set start_date from the import row's month so they appear correctly in GetTasks for historical months.
• Delete user with tasks — DELETE /api/users/:id now returns 409 Conflict with a readable message instead of a cryptic 500 when the target user still owns tasks.
• Optimistic toggle race — rapid double-clicks on a task no longer fire two concurrent toggle requests; subsequent clicks are ignored until the first request settles.
• Content-Security-Policy — added a strict CSP header to all responses via the security headers middleware.
• Digest webhook secret — X-Montly-Secret header on month.digest deliveries is now configurable via DIGEST_WEBHOOK_SECRET env var (falls back to the compiled default).

Changed

• CI — skip unchanged sub-project builds; fixed GHA cache scope collision between backend and frontend jobs.

v0.22.0

Docker

docker pull ghcr.io/lucaslra/montly:0.22.0
docker pull ghcr.io/lucaslra/montly-mcp:0.22.0

Added

• Click-anywhere task toggle — clicking anywhere on the task row now toggles completion; added aria-label attributes to icon buttons for screen readers.

Changed

• Lighter dark mode — dark theme backgrounds, surfaces, borders, badge colors, and hover-state overrides bumped ~4 shades lighter for improved readability.

Fixed

• MCP schema descriptions — removed spurious required, prefix from JSON Schema tool descriptions.

v0.21.0

Docker

docker pull ghcr.io/lucaslra/montly:0.21.0
docker pull ghcr.io/lucaslra/montly-mcp:0.21.0

Added

• MCP tools — 5 new tools: get_report (spending history + forecast), toggle_task (mark done/undo), skip_task, update_completion (set paid amount or note), create_task; the server now covers the full daily workflow.
• MCP client configs — setup instructions for Claude Desktop (stdio + HTTP), Claude Code, and Cursor.
• MCP user guide — README rewritten with quickstart, natural-language usage examples for all 6 tools, and a limitations section.

Fixed

• MCP report skip bug — get_report was including skipped tasks in total_due, inflating the amount vs what the web UI shows.
• MCP parseFloat — replaced fmt.Sscanf (silently swallowed errors) with strconv.ParseFloat.
• MCP shutdown — srv.Shutdown error is now logged instead of silently dropped.

Changed

• MCP client hardened — unified do() method with POST/PATCH support, month validation via regex, URL encoding on all params, 10 MB response body cap. Test count: 20 → 51.

v0.20.0

Docker

docker pull ghcr.io/lucaslra/montly:0.20.0
docker pull ghcr.io/lucaslra/montly-mcp:0.20.0

Fixed

• Webhook task.skipped event — subscribers now receive real deliveries when a task is skipped (was subscribed but never fired).
• AddTaskShare Content-Type — response now correctly sets Content-Type: application/json (was sniffed as text/plain due to WriteHeader ordering).
• Amount validation — NaN, Infinity, and negative values are now rejected in both task creation and completion patching; previously they passed validation and could corrupt spending totals.
• Skip error matching — replaced fragile string comparison with a sentinel ErrAlreadyCompleted error.
• Progress bar with skipped tasks — skipped tasks are now excluded from the denominator so 100% is reachable; the monetary summary also excludes skipped payments from the "due" total.
• Task checkbox tap target — expanded from 20×20px to 44×44px minimum, meeting mobile touch target guidelines.

Changed

• Static asset caching — Vite-built assets under /assets/ now return Cache-Control: public, max-age=31536000, immutable, eliminating redundant downloads on repeat visits.
• Documentation — 16 fixes across README, CLAUDE.md, SECURITY.md, deployment guide, CONTRIBUTING, MCP server README, PR template, and issue templates.

v0.19.0

Docker

docker pull ghcr.io/lucaslra/montly:0.19.0

Added

• MCP server — standalone MCP server (mcp-server/) exposes Montly tasks as tools for AI assistants (Claude Desktop, Cursor, etc.); runs as a separate Docker container with its own Dockerfile and test suite.
• Skip-to-content link — keyboard and screen-reader users can now bypass the header navigation (WCAG 2.4.1).

Security

• Session validation on deleted users — session cookies now verify the user still exists in the database on every request; deleted users are immediately locked out instead of retaining access until cookie expiry.

v0.18.0

Docker

docker pull ghcr.io/lucaslra/montly:0.18.0

Added

• Dependabot — automated weekly dependency updates for Go modules, npm packages, and GitHub Actions.
• GitHub issue and PR templates — bug report, feature request, and pull request templates added under .github/.

Changed

• README — website badge added; simplified Docker one-liner and persistent-install compose snippet in Quick Start.

Dependencies

• Vite v6 → v8, @vitejs/plugin-react v4 → v6 (combined — v6 requires Vite ≥ 8)
• modernc.org/sqlite v1.33.1 → v1.50.0; go-chi/chi v5.1.0 → v5.2.5
• jsdom v29.0.2 → v29.1.1
• GitHub Actions: actions/checkout v4 → v6, setup-go v5 → v6, setup-node v4 → v6, docker/setup-buildx-action v3 → v4, docker/login-action v3 → v4

v0.17.0

Docker

docker pull ghcr.io/lucaslra/montly:0.17.0

Security

• Request body size limits — parseTaskBody, CreateWebhook, and CreateUser now cap request bodies before decoding (16 KB / 4 KB respectively), preventing memory exhaustion via oversized payloads
• bcrypt password length cap — passwords are now rejected above 72 characters at all entry points (setup, create user, change password); bcrypt silently truncates at byte 72, which would allow any input sharing the first 72 bytes to authenticate as the same account
• SSRF protection for webhooks — webhook delivery resolves hostnames before connecting and rejects any IP in loopback, RFC 1918, link-local (covers cloud metadata endpoints like 169.254.169.254), carrier-grade NAT, and IPv6 unique-local ranges; redirects are re-validated at each hop and capped at 3

Added

• Migration step logging — startup now logs each schema change as it runs, or confirms "migration: schema up to date" when nothing needs applying

v0.16.0

Docker

docker pull ghcr.io/lucaslra/montly:0.16.0

v0.15.0

Docker

docker pull ghcr.io/lucaslra/montly:0.15.0

Added

• Shared task lists — task owners can share individual tasks with other users. Shared users see the task in their monthly view (with a "shared by X" badge), can toggle, skip, patch, and upload receipts. Sharing is managed from the Manage view via an inline Share panel with live user search. Completions and receipts on shared tasks are shared state — one completion is visible to all collaborators.
• GET/POST/DELETE /api/tasks/{id}/shares — manage per-task collaborators; only the task owner can add/remove; self-share returns 400.
• GET /api/users/lookup?q= — user search endpoint for the share autocomplete (returns up to 20 matches, excludes the requesting user).

Fixed

• Webhook actor — task.completed and task.uncompleted webhooks now fire against the task owner's webhook subscriptions, not the actor's (matters when a shared user toggles a task).

v0.14.0

Docker

docker pull ghcr.io/lucaslra/montly:0.14.0

Fixed

• EU decimal separator in task amount field — when the number format is set to EU (1.234,56), the Add/Edit Task dialog now accepts , as the decimal separator, shows 0,00 as placeholder, and normalises the value to a plain float before saving. Existing stored amounts are displayed with the correct separator when reopening the edit form.