Skip to content

build: Bump the dotnet group with 8 updates - #134

Closed
dependabot[bot] wants to merge 98 commits into
mainfrom
dependabot/nuget/backend/dotnet-31c49130b9
Closed

build: Bump the dotnet group with 8 updates#134
dependabot[bot] wants to merge 98 commits into
mainfrom
dependabot/nuget/backend/dotnet-31c49130b9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 22, 2026

Copy link
Copy Markdown
Contributor

Updated Anthropic from 12.58.0 to 13.1.0.

Updated ModelContextProtocol.AspNetCore from 2.2.0 to 2.3.0.

Release notes

Sourced from ModelContextProtocol.AspNetCore's releases.

2.3.0

This release improves HTTP discovery, OAuth, protocol interoperability, and shutdown reliability, preserves registration order for server primitives, and exposes a TimeProvider for deterministic client timeout tests. It also corrects optional server-identity handling; applications reading McpClient.ServerInfo should adopt nullable handling.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

  1. McpClient.ServerInfo is nullable — #​1903
    • Its return annotation changes from Implementation to Implementation?. Existing non-nullable assignments or dereferences can produce nullable warnings and fail warnings-as-errors builds.
    • On 2026-07-28 connections, ServerInfo is null when the server omits optional identity metadata from server/discover. Legacy initialize still requires serverInfo. Reading the property before connecting still throws InvalidOperationException.
    • Migrate with a null check or a fallback such as client.ServerInfo?.Name ?? "Unknown server". Self-reported identity must not be used for security decisions.
    • This corrective source-compatibility change is intentionally included in 2.3.0.

What's Changed

  • Correct protocol-version telemetry for stateless server spans #​1810 by @​luisangelrod
  • Preserve HTTP errors and correct discovery fallback handling #​1791 by @​PranavSenthilnathan (co-authored by @​Copilot)
  • Make modern Streamable HTTP status mapping deterministic #​1837 by @​jstar0
    • Modern responses wait for the first protocol message before sending headers; long-running silent handlers may need progress output or an appropriate HTTP timeout. Legacy eager-header behavior is preserved.
  • Accept opaque legacy metadata and correct request-scoped capabilities and discovery advertisement #​1852 by @​halter73 (co-authored by @​Copilot)
  • Avoid redundant SSE fallback after discovery is rejected with 400 or 404 #​1855 by @​scottt732
  • Close server stdin before waiting for graceful stdio process exit #​1838 by @​luisangelrod
  • Preserve insertion order when listing server tools, prompts, and resources #​1924 by @​PederHP (co-authored by Claude Opus 5.5)
  • Allow missing optional server identity in discovery and make ServerInfo nullable #​1903 by @​Coding-Professional
  • Include JSON parse details in Streamable HTTP 400 responses #​1844 by @​ump45nose
  • Exclude OAuth from DiscoverProbeTimeout, expose McpClientOptions.TimeProvider for deterministic timeout tests, and default SSE to legacy initialization #​1719 by @​halter73 (co-authored by @​Copilot)
    • OAuth remains subject to the overall InitializationTimeout and caller cancellation; it is excluded only from the short discovery-probe budget.
    • Modern discovery over SSE requires both explicit HttpTransportMode.Sse and ProtocolVersion = "2026-07-28"; pinning the version with AutoDetect is not equivalent.
  • Preserve numeric progress tokens in RequestOptions serialization #​1832 by @​dfedoryshchev
  • Dispose legacy SSE POST responses to release connections deterministically #​1841 by @​yalcinfu22 (co-authored by Claude Fable 5)

Documentation Updates

  • Document standing support for new MCP specification revisions #​1826 by @​halter73 (co-authored by @​Copilot)

Test Improvements

  • Stabilize discovery-capable test connections while retaining initialization deadlines #​1943 by @​tarekgh

Repository Infrastructure Updates

  • Add a source selector for manual documentation publishes #​1828 by @​jeffhandley (co-authored by @​Copilot)
  • Update SourceLink's private build dependency to resolve a vulnerable Git dependency #​1873 by @​halter73 (co-authored by @​Copilot)
  • Correct obsolete McpServerFactory references in Copilot instructions #​1892 by @​Zir0-93
  • Update Microsoft.Extensions.AI and AI.Abstractions to 10.11.0 and align shared System dependencies to 10.0.13 #​1940

Acknowledgements

  • @​scottt732 made their first contribution in #​1855
  • @​Zir0-93 made their first contribution in #​1892
  • @​Coding-Professional made their first contribution in #​1903
    ... (truncated)

Commits viewable in compare view.

Updated OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.20.0 to 1.20.1.

Release notes

Sourced from OpenTelemetry.Exporter.OpenTelemetryProtocol's releases.

1.20.1

For highlights and announcements pertaining to this release see: Release Notes > 1.20.1.

The following changes are from the previous release 1.20.0.

  • NuGet: OpenTelemetry v1.20.1

    • Fixed a possible race condition on ARM64 when multiple threads record the
      first measurement with no tags, or the first overflow measurement, that could
      cause the measurement to be recorded incorrectly.
      (#​7951)

    • Fixed self-diagnostics preamble redaction of quoted or encoded PEM material
      and prefixed JWTs.
      (#​7955)

    • Fixed default HTTP client log filtering when registering the OTLP log exporter
      through OpenTelemetryLoggerOptions.
      (#​7959)

    • Fixed legacy self-diagnostics logging terminating the process when the log
      file is truncated or the log volume runs out of space.
      (#​7956)

    • Experimental (pre-release builds only): Fixed Logger.EmitLog ignoring
      instrumentation suppression, which could cause recursive exports or deadlocks.
      (#​7961)

    • Fixed delta double counters losing subsequent measurements after a non-finite
      or large value and idle metric points with a NaN value failing to be reclaimed.
      (#​7963)

    • Improve the assignment of values to exponential histogram buckets when the
      value is near a bucket boundary by using a pre-computed lookup table.
      (#​7911)

    • Fixed LogRecords being returned to the shared pool while still queued for
      export when an exporter stops enumerating a single-item or array
      Batch<LogRecord> early which could cause a BatchLogRecordExportProcessor
      on the same provider to export missing or incorrect data.
      (#​7965)

    • Fixed a SuppressInstrumentationScope.Enter() reference count never being
      released when the Activity it was entered for is not recorded, which caused
      all subsequent telemetry in that execution context to be suppressed.
      (#​7966)

    • Self-diagnostics log files, whether configured through OTEL_DIAGNOSTICS.json
      or SelfDiagnosticsOptions, are now always created as new files.
      (#​7968)

... (truncated)

1.20.1-rc.1

The following changes are from the previous release 1.20.0.

  • NuGet: OpenTelemetry v1.20.1-rc.1

    • Fixed a possible race condition on ARM64 when multiple threads record the
      first measurement with no tags, or the first overflow measurement, that could
      cause the measurement to be recorded incorrectly.
      (#​7951)

    • Fixed self-diagnostics preamble redaction of quoted or encoded PEM material
      and prefixed JWTs.
      (#​7955)

    • Fixed default HTTP client log filtering when registering the OTLP log exporter
      through OpenTelemetryLoggerOptions.
      (#​7959)

    • Fixed legacy self-diagnostics logging terminating the process when the log
      file is truncated or the log volume runs out of space.
      (#​7956)

    • Experimental (pre-release builds only): Fixed Logger.EmitLog ignoring
      instrumentation suppression, which could cause recursive exports or deadlocks.
      (#​7961)

    • Fixed delta double counters losing subsequent measurements after a non-finite
      or large value and idle metric points with a NaN value failing to be reclaimed.
      (#​7963)

    • Improve the assignment of values to exponential histogram buckets when the
      value is near a bucket boundary by using a pre-computed lookup table.
      (#​7911)

    • Fixed LogRecords being returned to the shared pool while still queued for
      export when an exporter stops enumerating a single-item or array
      Batch<LogRecord> early which could cause a BatchLogRecordExportProcessor
      on the same provider to export missing or incorrect data.
      (#​7965)

    • Fixed a SuppressInstrumentationScope.Enter() reference count never being
      released when the Activity it was entered for is not recorded, which caused
      all subsequent telemetry in that execution context to be suppressed.
      (#​7966)

    • Self-diagnostics log files, whether configured through OTEL_DIAGNOSTICS.json
      or SelfDiagnosticsOptions, are now always created as new files.
      (#​7968)

    • Self-diagnostics messages written to the sinks configured by
      SelfDiagnosticsOptions are now truncated to 16,384 characters so that the
      ... (truncated)

1.20.1-beta.1

The following changes are from the previous release 1.20.0-beta.1.

  • NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.20.1-beta.1

    • Fixed scrape responses being handed to the server in a single write, which
      made the server buffer a full copy of the response for each client that did
      not read it until the request completed or timed out. Responses are now
      written in bounded slices so the server's back-pressure applies.
      (#​7957)

    • Fixed startup scrapes permanently omitting target_info and configured
      resource constant labels from subsequent scrape responses.
      (#​7984)

    • Updated OpenTelemetry core component version(s) to 1.20.1.
      (#​7990)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.20.1-beta.1

    • Fixed scrape responses being handed to the server in a single write, which
      on Linux and macOS made the listener allocate and hold a full copy of the
      response for each client that did not read it until the request completed or
      timed out. Responses are now written in bounded slices.
      (#​7957)

    • Fixed scrape requests that announce a request body holding a thread pool
      thread after their response had been sent on Linux and macOS for as long as
      the client kept trickling in the body. The connection is now closed after
      responding to a request with a body instead of being kept alive.
      (#​7962)

    • Fixed startup scrapes permanently omitting target_info and configured
      resource constant labels from subsequent scrape responses.
      (#​7984)

    • Updated OpenTelemetry core component version(s) to 1.20.1.
      (#​7990)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Shims.OpenTracing v1.20.1-beta.1

    • Updated OpenTelemetry core component version(s) to 1.20.1.
      (#​7990)

    See CHANGELOG for details.

Commits viewable in compare view.

Updated OpenTelemetry.Extensions.Hosting from 1.20.0 to 1.20.1.

Release notes

Sourced from OpenTelemetry.Extensions.Hosting's releases.

1.20.1

For highlights and announcements pertaining to this release see: Release Notes > 1.20.1.

The following changes are from the previous release 1.20.0.

  • NuGet: OpenTelemetry v1.20.1

    • Fixed a possible race condition on ARM64 when multiple threads record the
      first measurement with no tags, or the first overflow measurement, that could
      cause the measurement to be recorded incorrectly.
      (#​7951)

    • Fixed self-diagnostics preamble redaction of quoted or encoded PEM material
      and prefixed JWTs.
      (#​7955)

    • Fixed default HTTP client log filtering when registering the OTLP log exporter
      through OpenTelemetryLoggerOptions.
      (#​7959)

    • Fixed legacy self-diagnostics logging terminating the process when the log
      file is truncated or the log volume runs out of space.
      (#​7956)

    • Experimental (pre-release builds only): Fixed Logger.EmitLog ignoring
      instrumentation suppression, which could cause recursive exports or deadlocks.
      (#​7961)

    • Fixed delta double counters losing subsequent measurements after a non-finite
      or large value and idle metric points with a NaN value failing to be reclaimed.
      (#​7963)

    • Improve the assignment of values to exponential histogram buckets when the
      value is near a bucket boundary by using a pre-computed lookup table.
      (#​7911)

    • Fixed LogRecords being returned to the shared pool while still queued for
      export when an exporter stops enumerating a single-item or array
      Batch<LogRecord> early which could cause a BatchLogRecordExportProcessor
      on the same provider to export missing or incorrect data.
      (#​7965)

    • Fixed a SuppressInstrumentationScope.Enter() reference count never being
      released when the Activity it was entered for is not recorded, which caused
      all subsequent telemetry in that execution context to be suppressed.
      (#​7966)

    • Self-diagnostics log files, whether configured through OTEL_DIAGNOSTICS.json
      or SelfDiagnosticsOptions, are now always created as new files.
      (#​7968)

... (truncated)

1.20.1-rc.1

The following changes are from the previous release 1.20.0.

  • NuGet: OpenTelemetry v1.20.1-rc.1

    • Fixed a possible race condition on ARM64 when multiple threads record the
      first measurement with no tags, or the first overflow measurement, that could
      cause the measurement to be recorded incorrectly.
      (#​7951)

    • Fixed self-diagnostics preamble redaction of quoted or encoded PEM material
      and prefixed JWTs.
      (#​7955)

    • Fixed default HTTP client log filtering when registering the OTLP log exporter
      through OpenTelemetryLoggerOptions.
      (#​7959)

    • Fixed legacy self-diagnostics logging terminating the process when the log
      file is truncated or the log volume runs out of space.
      (#​7956)

    • Experimental (pre-release builds only): Fixed Logger.EmitLog ignoring
      instrumentation suppression, which could cause recursive exports or deadlocks.
      (#​7961)

    • Fixed delta double counters losing subsequent measurements after a non-finite
      or large value and idle metric points with a NaN value failing to be reclaimed.
      (#​7963)

    • Improve the assignment of values to exponential histogram buckets when the
      value is near a bucket boundary by using a pre-computed lookup table.
      (#​7911)

    • Fixed LogRecords being returned to the shared pool while still queued for
      export when an exporter stops enumerating a single-item or array
      Batch<LogRecord> early which could cause a BatchLogRecordExportProcessor
      on the same provider to export missing or incorrect data.
      (#​7965)

    • Fixed a SuppressInstrumentationScope.Enter() reference count never being
      released when the Activity it was entered for is not recorded, which caused
      all subsequent telemetry in that execution context to be suppressed.
      (#​7966)

    • Self-diagnostics log files, whether configured through OTEL_DIAGNOSTICS.json
      or SelfDiagnosticsOptions, are now always created as new files.
      (#​7968)

    • Self-diagnostics messages written to the sinks configured by
      SelfDiagnosticsOptions are now truncated to 16,384 characters so that the
      ... (truncated)

1.20.1-beta.1

The following changes are from the previous release 1.20.0-beta.1.

  • NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.20.1-beta.1

    • Fixed scrape responses being handed to the server in a single write, which
      made the server buffer a full copy of the response for each client that did
      not read it until the request completed or timed out. Responses are now
      written in bounded slices so the server's back-pressure applies.
      (#​7957)

    • Fixed startup scrapes permanently omitting target_info and configured
      resource constant labels from subsequent scrape responses.
      (#​7984)

    • Updated OpenTelemetry core component version(s) to 1.20.1.
      (#​7990)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.20.1-beta.1

    • Fixed scrape responses being handed to the server in a single write, which
      on Linux and macOS made the listener allocate and hold a full copy of the
      response for each client that did not read it until the request completed or
      timed out. Responses are now written in bounded slices.
      (#​7957)

    • Fixed scrape requests that announce a request body holding a thread pool
      thread after their response had been sent on Linux and macOS for as long as
      the client kept trickling in the body. The connection is now closed after
      responding to a request with a body instead of being kept alive.
      (#​7962)

    • Fixed startup scrapes permanently omitting target_info and configured
      resource constant labels from subsequent scrape responses.
      (#​7984)

    • Updated OpenTelemetry core component version(s) to 1.20.1.
      (#​7990)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Shims.OpenTracing v1.20.1-beta.1

    • Updated OpenTelemetry core component version(s) to 1.20.1.
      (#​7990)

    See CHANGELOG for details.

Commits viewable in compare view.

Updated OpenTelemetry.Instrumentation.AspNetCore from 1.20.0 to 1.20.1.

Release notes

Sourced from OpenTelemetry.Instrumentation.AspNetCore's releases.

1.20.1

1.20.1-rc.1

1.20.1-beta.1

1.20.1-alpha.1

Commits viewable in compare view.

Updated OpenTelemetry.Instrumentation.Http from 1.20.0 to 1.20.1.

Release notes

Sourced from OpenTelemetry.Instrumentation.Http's releases.

1.20.1

1.20.1-rc.1

1.20.1-beta.1

1.20.1-alpha.1

Commits viewable in compare view.

Updated OpenTelemetry.Instrumentation.Runtime from 1.20.0 to 1.20.1.

Release notes

Sourced from OpenTelemetry.Instrumentation.Runtime's releases.

1.20.1

1.20.1-rc.1

1.20.1-beta.1

1.20.1-alpha.1

Commits viewable in compare view.

Updated Scalar.AspNetCore from 2.18.0 to 2.18.2.

Release notes

Sourced from Scalar.AspNetCore's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

joaoguimaraespro and others added 30 commits October 4, 2026 12:40
@joaoguimaraespro @joguima596
Track crypto held on exchanges and wallets by hand (#32)
150403c 
Coins are entered on the portfolio page (coin, quantity, average buy price in
EUR, location, held since, notes) and priced from public Yahoo quotes: EUR pair,
else USD pair converted at the ECB rate. Each location is a read-only broker
account, so portfolio, accounts, net worth and dashboards include it. Prices
refresh at most every 15 minutes when the portfolio is opened and in the daily
snapshot job; today's change uses yesterday's close (24/7 market). History is
rebuilt from daily closes after each edit. Staking/Earn/airdrop rewards add coins
at zero cost and are reported as income next to dividends.

Co-authored-by: João Guimarães <joguima00@gmail.com>
@joaoguimaraespro
IBKR: later syncs no longer fail with 1003 (#35)
4743b79 
* fix(ibkr): incremental syncs use the query period; backfill steps the end date back on 1003

* test(e2e): click the header's add-broker button; the empty state repeats it
@joaoguimaraespro
feat(remote-control): finance commands as project skills for the phon…
ff70eb6 
…e session (#36)
@joaoguimaraespro
MCP: tools for accounts, savings interest, recurring, any transaction…
a94aa6a 
…, yearly/net-worth series, allocation and hand-entered crypto (#37)

* feat(ai): MCP tools for accounts, savings interest, recurring, any transaction, yearly and net-worth series, allocation and hand-entered crypto

New read-only gateway tools: get_accounts (accounts.balances.read), get_recurring
(recurring.read), get_transactions (transactions.read), get_year_breakdown (overview.read),
get_net_worth_history (networth.read) and get_allocation (portfolio.summary.read).
get_portfolio_summary and get_positions gain today's change; positions mark hand-entered
crypto with its location; get_dividend_summary splits dividends from crypto rewards.
Account names and IBANs stay behind accounts.identifiers.read; transaction search never
looks at notes. The tool-to-scope list is pinned by an architecture test.

* test(e2e): get_year_breakdown is listed for overview.read clients
@joaoguimaraespro
fix(sync): back off after failed syncs; handle IBKR 1025 lockout; cap…
3ecb31d 
… failed Flex probes (#38)
@joaoguimaraespro
Portfolio by wallet, with coin icons (#39)
ded164a 
A strip of wallet cards at the top of the portfolio replaces the scope dropdown:
one card per broker account and per hand-entered crypto wallet, plus All. Each
shows its logo, value, today's change and return; picking one scopes the whole
page. The summary now returns those figures per account (additive fields:
netContributions, totalReturn, totalReturnPercent, dayChange, dayChangePercent,
positions), so the strip needs no extra requests.

Wallets named after Binance, Coinbase, Kraken, Ledger or Trezor get the
official symbol (nominative use, noted in the README). In Add crypto the
location field becomes Wallet: pick an existing one or name a new one; the
wallet being viewed is preselected.

Coins show their icon in the search, the dialog, the positions table and the
income list, from cryptocurrency-icons (CC0) served as static files under
/coins; unknown coins fall back to their initials (real 404 in Caddy).
@joaoguimaraespro
fix: weekend day change shows Friday's move; labelled wallet card fig…
501d689 
…ures; one-column forms on phones; no sticky tooltips on touch (#40)
@joaoguimaraespro
feat(crypto): wallet is always picked from a list, with common exchan…
f03dd16 
…ges and hardware wallets suggested (#41)
@joaoguimaraespro
feat(portfolio): returns over 1M/YTD/1Y/All with their period stated;…
56e4f26 
… crypto change over 24h (#42)

- Summary: inception date per scope and account (`since`) and a `periodReturn`
  (`?period=1M|YTD|1Y|ALL`, default ALL). ALL keeps the total return (value minus
  net contributions) and states its start; a period is a time-weighted return from
  the last value on or before its start up to today's live value, with gain =
  end - start - net deposits; `partial` when history starts inside the period.
- Performance: `?period=` measured the same way, so the chart and the hero agree.
- Crypto day change is a rolling 24 hours: each price refresh also fetches the
  coin's 15-minute bars and stores the price 24 h before the latest quote on its
  listing; `dayChangeBasis` (PreviousClose / Rolling24Hours / Mixed) on positions,
  accounts and the summary. Falls back to the previous close if unavailable.
- Web: one period selector (1M · YTD · 1A · Tudo, remembered in the browser) drives
  the hero, the wallet cards and the value chart; labels "Retorno desde 03/2024",
  "Retorno 1A (TWR)"; crypto rows and wallets say "24h"; the hero's "Hoje"
  explains that coins count 24 h. Dashboard states the return's start.
- MCP/AI: dayChangeBasis and since in get_portfolio_summary/get_positions; docs.
@joaoguimaraespro
AI write access: opt-in write tools with a 30-day recycle bin (ADR-00…
b0da12e 
…08) (#43)

* feat(ai): opt-in write tools through the policy gateway (ADR-0008)

Four sensitive write scopes (transactions, recurring, planning, holdings) and
twelve typed single-record write tools that reuse the app's own commands and
validators. Separate hourly write budget, idempotency keys, ai:<client> audit
actor, before/after audit summaries, broker/investment/estimate/archived
refusals, and a 30-day recycle bin for AI deletes with a purge job.
Architecture tests replace 'no write tools' with an explicit allow-list.

* feat(web): AI access groups read and write scopes, confirms write grants, shows writes in the audit log and a recycle bin with one-click restore

EN and PT-PT strings; scope-selection helpers with specs; the E2E journey
grants a writer client, creates and deletes a transaction over MCP and
restores it from the recycle bin. The read-only client's tool list is unchanged.

* test: portfolio tests look only at the demo brokers; other tests share the database

* feat(remote-control): finance session asks before every write tool
@joaoguimaraespro
Recurring: every N days (daily frequency with interval) (#44)
02adafe 
Adds a Daily frequency: occurrences on start_on + k x interval days (1-365),
counted with DateOnly so DST never moves one. day_of_month is refused for
daily items and ignored if stored.

- Next due is the first occurrence on or after today (list and get_recurring).
- Editing the schedule drops pending proposals dated today or later and
  proposes again from the new anchor; confirmed, skipped and overdue ones stay.
- Monthly equivalent: amount x 365 / (days x 12) for daily; weekly aligned to
  the same 365-day basis (was x 52 / 12).
- upsert_recurring accepts frequency daily, interval 1-365 for daily.
- UI: 'Every N days' option with a days field; list shows 'Every 15 days'
  and, on narrow screens, schedule and next date under the name.
@joaoguimaraespro
feat(categories): rename any category (built-in too) and reset to the…
bf45cac 
… default name (#45)
@joaoguimaraespro
feat: notification centre — header bell for pending recurring items, …
c559a67 
…interest to reconcile, broker problems, budgets and AI writes (#46)
@joaoguimaraespro
Windows deployment: Docker Desktop install, app launcher, auto-start …
30be72e 
…and catch-up jobs/backups (#47)

* Background jobs follow the wall clock so a PC that sleeps or is off catches up

Periodic jobs (recurring proposals, interest accrual, daily snapshots, AI recycle bin
purge) now poll every minute and run when their interval has passed, a new UTC day has
begun or the clock moved back, instead of waiting on a PeriodicTimer that counts only
running time. Broker sync checks what is due 1 minute after start and every 5 minutes
(was 2 + 30), and a failed due-check no longer stops the schedule for good.

* Windows deployment: Docker Desktop install, app launcher, auto-start and catch-up backups

- deploy/compose.windows.yml + Caddyfile.windows: same images on Docker Desktop, served on
  http://localhost with the loopback hop marked HTTPS so Secure cookies keep working
- deploy/windows: Install/Update/Uninstall, Start-PersonalFinance launcher (Start Menu and
  Desktop shortcut, Edge/Chrome app window, starts Docker Desktop and the stack on demand),
  sign-in task, Backup/Restore ports of backup.sh/restore.sh with a daily task that runs
  late when missed and an overdue check in the launcher, optional Remote Control script
- CI: PowerShell parse + PSScriptAnalyzer + Pester on PowerShell 7 and 5.1 (windows-latest),
  Caddyfile.windows validated in the E2E job
- docs/windows.md and README section

* CI: analyze the Windows scripts and module only, not the Pester files or settings
@dependabot
Bump the dotnet group with 2 updates (#34)
1bb6ac3 
Bumps Anthropic from 12.50.0 to 12.53.0
Bumps Scalar.AspNetCore from 2.17.10 to 2.17.13

---
updated-dependencies:
- dependency-name: Anthropic
  dependency-version: 12.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Scalar.AspNetCore
  dependency-version: 2.17.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@joaoguimaraespro
feat: split transactions — one movement over several categories (#48)
eb74828 
A transaction (one bank line, one total) can now be split into category lines,
e.g. one energy bill for electricity and gas. Lines live in transaction_splits,
add up exactly to the amount (EUR amounts via the transaction's rate, remainder
on the last line) and take the explicit nature or their category's default.
A split transaction has no single category.

Every per-category figure reads the lines: reports, budgets, dashboard, the
list's category/nature filters, CSV/Excel (one row per line), the JSON archive
and the AI tools (rows show splits; create/update_transaction accept splits).
Recurring templates can be split and carry the lines into proposals and the
confirmed transaction (rescaled when the amount changes).
@joaoguimaraespro
Linux and macOS desktop install: app shortcut, sign-in item, catch-up… (
7e29842 
#49)

* Linux and macOS desktop install: app shortcut, sign-in item, catch-up backups (deploy/desktop)

One script, personal-finance.sh, mirrors the Windows install on an everyday Linux or macOS computer:
install/start/update/backup/restore/stop/status/uninstall, an applications-menu entry or
Personal Finance.app, XDG autostart or a LaunchAgent, and a systemd user timer (Persistent) or launchd
backup with a launcher fallback when the newest backup is older than 24 h.

backup.sh/restore.sh: honour PF_COMPOSE_OVERRIDE so a PC restore keeps the loopback-HTTP web config,
use shasum when sha256sum is missing (macOS), and never delete the newest archive.

CI: shellcheck plus smoke tests of the helpers on Ubuntu and on macOS (bash 3.2, BSD tools).
Docs: docs/desktop.md with the install matrix for Windows, macOS and Linux.

* test(desktop): build the fake age identity without a word-split substitution
@joaoguimaraespro
AI access: activity at a glance, tabs and client cards; full-height f… (
a87d0cf 
#50)

* AI access: activity at a glance, tabs and client cards; full-height flow tab in quick add

- AI access: 24 h totals on top (active clients, calls, denied, writes), then tabs for clients, recycle bin
  (with counts) and activity with All/Writes/Denied filters. Clients are cards with status, permissions,
  per-client 24 h figures and actions, readable on phones.
- Quick add: the selected flow (Everyday/Investments/Transfers) now fills the bar's height when labels wrap.
- E2E: open the Recycle bin and Activity tabs before asserting on them.

* fix(ai-access): one 'New AI client' button, also when there are no clients yet (E2E strict match)
@joaoguimaraespro
Monthly allocation like recurring items: automatic done/partial, reco…
a76b4ea 
…rd the rest, pending in notifications (#51)

- Each bucket's status follows what was set aside against its target (to do / partial / done); a status
  picked by hand still wins, and 'Automatic' (DELETE /api/allocation-checks/{period}/{bucket}) goes back.
- 'Record' opens the quick-add dialog prefilled: investment contribution or savings, the bucket, the amount
  left and the date.
- Notification centre: once the month's income is in, every bucket not fully set aside appears with the
  amount left and Record / Not this month (AllocationNotificationSource, read-only like the others).
- Tests: AllocationProgress theory, notification integration test, prefill and status helpers.
@joaoguimaraespro
Binance: spot and Simple Earn through a key verified as read-only; Ea…
6278a28 
…rn rewards as income (ADR-0009) (#52)

- BinanceProvider: one position per coin (spot + flexible + locked Earn) in EUR (EUR pair, else a dollar
  stablecoin pair over EURUSDT), EUR balances as cash, average cost from EUR/USDT/USDC/FDUSD fills, and every
  Earn reward (real-time, bonus, locked) as a dividend valued at that day's close with a stable external id.
- Read-only by construction: each sync first checks GET /sapi/v1/account/apiRestrictions and refuses a key that
  can trade, transfer or withdraw; the HttpClient is allow-listed to the read GETs only.
- A coin with no ISIN joins an existing coin of the same symbol, so Binance BTC and a hand-entered BTC are one
  position line; Binance coins get the crypto listing hint for public prices.
- Web: Binance kind, logo, credential checks and translated sync errors.
- Docs: broker-integrations Binance section, ADR-0009 (extends ADR-0005), README.
@joaoguimaraespro
Connections: step-by-step Binance guide, like Trading 212 and IBKR (#53)
f79bf1d 
Six steps (verified account with 2FA, create a system-generated key, only Enable Reading, trusted IP,
copy key + secret, paste), with the permissions to keep on and to leave off, in English and Portuguese.
@joaoguimaraespro
Connections: the step-by-step guide lives in the add/fix dialog only (#…
9d00e38 
…54)

- The page no longer repeats the guide: with no connections it shows one button per broker, and each opens
  the form with its guide expanded (first connection of that broker) and scrolled to step 1.
- 'How to fix it' on a failing connection opens its credentials form with the guide open.
- Field labels and hints can be broker-specific: Binance's API Key / Secret Key no longer show Trading 212 hints.
- Last guide step now says to paste below; Portuguese Binance guide uses 'tu' like the rest of the app.
@joaoguimaraespro
Monthly allocation counts deposits synced at a linked broker; Binance…
4dd68b2 
… fiat deposits; unique custom keys (#55)

- A broker account can be linked to an allocation bucket (PUT /api/accounts/{id}/allocation-bucket, Accounts page).
  Its synced deposits minus withdrawals in a month count towards that bucket (LedgerAggregates via the new
  IBrokerDeposits, implemented by the investments module). Ledger contributions recorded to that same broker are the
  same money: the bucket counts the larger of the two. Monthly shows the part that came from brokers.
- Binance: fiat deposits, crypto bought with fiat and fiat withdrawals are imported as the account's cash movements
  (read-only GET /sapi/v1/fiat/orders|payments, allow-listed).
- The JSON archive keeps the account-to-bucket link.
- Fix: custom bucket and category keys used the timestamp prefix of a v7 GUID, so two created in the same
  millisecond (a JSON import) collided on the unique key; they are random now.
@joaoguimaraespro
UI: bundled Inter font, one colour per meaning across charts, clearer…
c866946 
… theme button (#56)

- Inter (variable) ships with the app, so text looks the same on Linux, macOS and Windows instead of falling back
  to whatever the system has (DejaVu on Linux). Served from 'self': the CSP is unchanged. Charts use it too.
- One palette (shared/chart-options): income and net worth green, expenses rose, invested and portfolio value
  violet, saved teal, references grey. Asset classes come from the same family. The dashboard's net balance line is
  a quiet dashed grey over the bars instead of a competing amber.
- The theme button's label and tooltip name the current theme (System / Light / Dark).
@joaoguimaraespro
UI: transactions grouped by day, phone bottom navigation, foldable fi…
51a4279 
…lters (#57)

* UI: calmer transactions list grouped by day, phone bottom navigation, foldable filters

- Transactions are grouped by day with the day's net. Expenses use the normal text colour (only money in is green),
  each row has a badge in its category's colour, and the category no longer sits out of line. Actions appear on
  hover or keyboard focus on desktop (delete is grey until hovered); clicking a row edits it. On phones, tapping a
  row shows its actions.
- Phones get a bottom bar: Dashboard, Transactions, a raised Add button, Portfolio and More (the full menu).
  Messages appear at the top there so they never cover it.
- Phones: only the search box shows above the list; date, account, category and type filters fold behind a
  Filters button that counts the active ones.

* fix(shell): phone header logo on the left
@joaoguimaraespro
UI: balanced dashboard and portfolio cards, live budget split, shorte…
f2b11f6 
…r menu (#58)

- Net worth card shows what it is made of (cash, investments, other assets, debts) from day one.
- Dashboard monthly view: months still ahead are left out, the Status column is gone (the balance colour says
  it), and phones get one line per month instead of a wide table. Waiting/goals cards no longer stretch.
- Portfolio: performance and dividend charts fill their card; 'available from the second day' is a dash with the
  reason on hover (also on the dashboard).
- Budgets: a live bar shows how the edited version divides income (invest / save / expenses, fixed amounts apart,
  warning above 100%).
- Menu: Import, Export and AI access are tabs inside Settings, so the sidebar has 14 entries instead of 17.
@joaoguimaraespro
Goals can follow a savings account; recording a savings allocation as…
12e3e53 
…ks which goal (#62)

- A goal can follow a cash account (savings, bank, cash; EUR): its progress is that account's balance, so money
  moved there and interest count without linking anything (finance.goals.account_id, FK set null). Without an
  account it works as before (starting amount + linked savings, or an amount tracked by hand). Brokers and cards
  cannot be followed: investments never count towards goals.
- Quick add: recording a month's savings allocation highlights 'Is this for a goal?'; picking a goal that follows
  an account makes that account the destination.
- AI tools keep the link when updating a goal and refuse 'add to goal' for one that follows an account; the JSON
  archive round-trips it.
@joaoguimaraespro
Loans: terms, amortisation plan, rate revisions, early repayments and…
ae23086 
… a simulator (#63)

- A Loan account can have terms: amount, first instalment, term, fixed rate or index + spread revised every
  1/3/6/12 months (finance.loans, loan_rates, loan_prepayments).
- LoanSchedule: the French method of Portuguese banks — constant instalment, recalculated at each rate revision;
  early repayments shorten the term (same instalment) or lower the instalment (same end date).
- With terms, the account's balance (and net worth) is the plan's outstanding debt on that day, so instalments
  need not be booked to keep the debt right.
- /api/loans: summary (outstanding, next instalment with interest/capital, end date, interest paid/left, current
  rate, next revision), plan, rates, prepayments and a what-if simulator.
- Loan page: KPIs, debt chart, simulator ('record this repayment'), rates/revisions, early repayments and the
  plan by year; account cards link to it.
- Tests: schedule (textbook instalment, zero rate, revision, both prepayment modes, status) and API integration.
@joaoguimaraespro
Loans: instalments proposed for booking, rate-revision reminder, dash…
d08d335 
…board card (#64)

- A loan can say which bank account pays it: from then on each instalment due is proposed (notification centre
  and the loan page) and booking it records the interest as an expense (new built-in category Loan interest) and
  the capital as a transfer to the loan. Skip leaves it out; only the oldest pending one can be handled.
- Variable-rate loans: a revision date within 14 days (or past) without a rate entered is announced.
- Dashboard: Loans card with what is owed, the next instalment and the end date of each loan.
@joaoguimaraespro
Nav by purpose, Loans page, assistant only when configured, clearer s…
1fbacfe 
…avings interest (#65)

- Menu: Overview (dashboard, monthly, annual, assistant), Money (transactions, recurring, budgets, goals), Wealth
  (accounts, portfolio, loans, net worth), Setup (connections, categories, settings). The assistant entry only
  shows when the server has an Anthropic key (/api/assistant/status).
- Loans page: all loans with what is owed, monthly instalments and interest still to pay; 'New loan' creates the
  debt account and goes to its terms.
- Accounts are grouped: everyday money, savings, investments, debts (cards and loans).
- Savings interest on the account card reads like the bank: TANB, about how much per day gross and net, and
  'net this year (since …)' when the account or its rate is newer than 1 January (AccruingSince in the API),
  with a hint that earlier interest can be recorded as income.
joaoguimaraespro and others added 21 commits October 18, 2026 18:35
@joaoguimaraespro
feat(web): monthly allocation shows its status, with 'not this month'…
13ca9a7 
… and undo; category chart centred (#111)
@joaoguimaraespro
feat(desktop): MCP server inside the app; uninstall can delete the da…
cc8c54c 
…ta (#112)

* feat(desktop): MCP server for AI clients inside the app; uninstall can delete the data

- The launcher runs the MCP server in-process on 127.0.0.1:47821 (or the next free port) against the API's gateway
  (ADR-0012). AI access shows the claude mcp add command and a Claude Desktop config (mcp-remote) with that address.
- The smoke test checks the MCP server answers on every platform.
- The Windows uninstaller asks whether to delete the data too (kept by default).
- Desktop docs: where data lives, removing everything, when it syncs, AI clients.

* fix(desktop): publish keeps only the API's appsettings
@joaoguimaraespro
feat(portfolio): dividend calendar by month, positions without divide…
eb2286e 
…nds included (#113)

The last 12 months of net dividends by calendar month for every position (crypto only when it paid), with yield,
the monthly average and the thin months: where a payer would even out a monthly income.
@joaoguimaraespro
feat: delete accounts and people for good; docs for the latest featur…
74e3133 
…es (#114)

- DELETE /api/accounts/{id} after GET /api/accounts/{id}/deletion shows what goes with it: its movements (and
  transfers to or from it), recurring items, the shares of its expenses, loan terms and interest history. A deleted
  person stops sharing recurring items. Broker accounts are removed with their connection.
- Delete buttons on Accounts and Sharing, with that confirmation.
- README, docs/ai.md and the changelog describe sharing without an account, paid for me, the dividend calendar, the
  monthly status, the desktop MCP and deleting.
@joaoguimaraespro
feat: delete custom categories, buckets, goals and assets for good (#115
389509a 
)

- Categories (custom only): GET /deletion shows usage; in use, DELETE needs moveTo, a category of the same kind;
  movements and recurring items (and split lines) move there, sub-categories move up, budget limits go.
- Buckets (custom only): same with moveTo a bucket of the same group; linked broker accounts follow; budget
  targets and monthly checks go.
- Goals and manually valued assets: deleted with a confirmation.
- Built-in categories and buckets can still only be archived (or renamed).
@joaoguimaraespro
feat(web): account selects show the account's bank (#116)
2dac85d
@joaoguimaraespro
feat(sharing): what was owed before the app, when adding or editing a…
8d690ca 
… person; changelog for 1.2.0 (#118)
@joaoguimaraespro
fix(web): errors visible over dialogs; dialogs validate their fields (#…
d58736e 
…119)

- Overlays (dialogs, selects, tooltips) stay in the CDK overlay container instead of the browser's top layer, which
  drew them above everything, the toasts included.
- A shared FormState: required fields, numbers, amounts above zero, choices and limits are checked before saving and
  explained under each field; what the server refuses shows in the dialog (under the field it names, or above the
  buttons). Forms use novalidate so the messages are the app's, in its language.
- Applied to the account, sharing (person, received/paid, paid for me), goal, loan (new, terms, rate), asset,
  recurring and category dialogs.
@joaoguimaraespro
feat(monthly): clearer spending and allocation; the first month is ma…
7cbd8ee 
…rked partial (#120)

- Spending by category: a donut with the month's total in the middle and a ranked list with shares; the six
  biggest categories, the rest together as Other.
- Allocation: one row per bucket with a progress bar (set aside of target), its status and what is left; the expense
  budget as spent of budget, with what is left or over.
- The month tracking started in, after the 1st, is marked partial (with how to complete it) and left out of the
  12-month averages, overall and by category.
@joaoguimaraespro
docs: changelog for 1.3.0; step-by-step MCP setup for the desktop app (…
0e48a09 
…#121)
@joaoguimaraespro
feat(recurring): a recurring expense paid by someone else is owed to …
4d4a817 
…them (#122)
@joaoguimaraespro
docs: recurring paid by someone else goes in 1.3.0 (#123)
9f54261
@joaoguimaraespro
feat(portfolio): a card with the cash at the brokers (#125)
9eb7bfe 
The cash not invested yet was only part of the total value. A card now
shows it, its share of the portfolio and, with several brokers, how much
sits at each.
@joaoguimaraespro
feat(brokers): synced deposits ask which account the money came from (#…
a67c48d 
…124)

* feat(brokers): synced deposits ask which account the money came from

A deposit or withdrawal synced at a broker linked to an allocation bucket
no longer counts on its own: it waits for the owner to record it from one
of their accounts (from the notification or the new list in Portfolio),
so the source account's balance follows it too. Until then the month
shows it apart, as to record. History older than five weeks keeps
counting as it did.

* test: seed the reviewed broker directly so no other test sees its holdings

* test: remove the reviewed broker afterwards so the portfolio tests see only theirs
@joaoguimaraespro
feat(web): tables fit a phone without scrolling sideways (#126)
41409a6 
At phone width the annual summary and the dividend calendar become a list
of months (tap a month for every figure; who pays in each), and the other
wide tables keep their essential columns with the rest folded under the
main line: monthly categories, recurring items, recent dividends, the loan
plan and the AI recycle bin and audit.
@joaoguimaraespro
feat(portfolio): the income chart follows the chosen period, empty mo…
e5dab90 
…nths included (#127)

The dividends and rewards by month chart showed only the months that paid
(the last 24) whatever the period at the top. It now covers that period
(1M, YTD, 1Y, all since the first payment) with every month, and the
dividend calendar lists only the positions that pay unless asked.
@joaoguimaraespro
feat(brokers): a withdrawal can be a payment with the broker's card (#…
a696cf9 
…128)

Trading 212 reports card payments as WITHDRAW, like money sent to the
bank. A withdrawal can now be recorded as a card payment: a recurring item
still to confirm (shares kept), an expense already recorded elsewhere
(moved to the broker) or a new expense. It is paid from the broker
account, counts as the month's expense and comes off the broker's bucket.
Trading 212's reference is kept next to the type.
@joaoguimaraespro
feat(brokers): record a deposit as cash moved to the broker, invested…
6f31fdb 
… when its buys spend it (#129)

A broker deposit or withdrawal can be recorded as a transfer between one of your
accounts and the broker (now the default). The money waits there as cash and counts
towards the bucket when synced buys spend it, up to the cash transferred and not yet
spent. Undo puts a recorded or ignored movement back to be recorded.
@joaoguimaraespro
chore: spec-driven workflow with Spec Kit, agent subagents and loop g…
586f687 
…ate (#130)

* style(web): apply Prettier to three files that drifted

* chore: spec-driven workflow with Spec Kit, agent loop config and project subagents
@joaoguimaraespro
ci: check formatting and Conventional Commits PR titles (#131)
f554f27
@dependabot
build: Bump the dotnet group with 8 updates
3efb7a4 
Bumps Anthropic from 12.58.0 to 13.1.0
Bumps ModelContextProtocol.AspNetCore from 2.2.0 to 2.3.0
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.20.0 to 1.20.1
Bumps OpenTelemetry.Extensions.Hosting from 1.20.0 to 1.20.1
Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.20.0 to 1.20.1
Bumps OpenTelemetry.Instrumentation.Http from 1.20.0 to 1.20.1
Bumps OpenTelemetry.Instrumentation.Runtime from 1.20.0 to 1.20.1
Bumps Scalar.AspNetCore from 2.18.0 to 2.18.2

---
updated-dependencies:
- dependency-name: Anthropic
  dependency-version: 13.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dotnet
- dependency-name: ModelContextProtocol.AspNetCore
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: OpenTelemetry.Instrumentation.AspNetCore
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: OpenTelemetry.Instrumentation.Http
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: OpenTelemetry.Instrumentation.Runtime
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Scalar.AspNetCore
  dependency-version: 2.18.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Oct 22, 2026
@joaoguimaraespro joaoguimaraespro mentioned this pull request Oct 23, 2026
Merged
5 tasks done
@joaoguimaraespro

joaoguimaraespro commented Oct 23, 2026

Copy link
Copy Markdown
Owner

Superseded by #138, which includes all 8 updates and adapts the code to Anthropic SDK 13.

@joaoguimaraespro
joaoguimaraespro deleted the dependabot/nuget/backend/dotnet-31c49130b9 branch October 23, 2026 22:32
joaoguimaraespro added a commit that referenced this pull request Oct 23, 2026
@joaoguimaraespro
build(deps): bump .NET packages and adapt to Anthropic SDK 13 (#138)
706920c 
Supersedes Dependabot #134 (the dotnet group with 8 updates), which
conflicts with main and failed to build.

Anthropic 13 turns BetaMessageParam into a union of user, assistant
and system message types; Role and Content are no longer settable.
The assistant now builds BetaUserMessageParam and
BetaAssistantMessageParam directly. Same requests on the wire.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@joaoguimaraespro joaoguimaraespro Awaiting requested review from joaoguimaraespro joaoguimaraespro is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@joaoguimaraespro