Actual

A local-first personal finance app

Open Source

Actual Source Code

Author

actualbudget

Description

A local-first personal finance app

#budgeting#finance#money#personal-finance

Homepage

https://actualbudget.org

Repository

  • LicenseMIT
  • Created29 Apr 22
  • Primary languageTypeScript
  • Size577,368 KB
  • Stars28,029
  • Forks2,804
  • Watchers28,029

Language Usage

Language Usage

Project Health

  • Last commit6 days ago
  • Open issues222
  • Latest releasev26.8.1

Recent Commits

  • Benoît Viguier(08 Aug 26)

    [Enhancements] Add quarter date range presets (#8607) * [Enhancements] Add quarter date range presets * Revert unnecessary changes * Add back changes * do not need .yarn/release file * [AI] Update date range picker VRT snapshots for quarter presets The Current quarter/Previous quarter presets added to the date range picker grew the popover height, invalidating the committed VRT screenshots. * Add max height * VRT regenerated

  • Matiss Janis Aboltins(07 Aug 26)

    [AI] Omit empty WHERE clauses from AQL instead of emitting WHERE 1 (#8678) * [AI] Omit empty WHERE clauses from AQL instead of emitting WHERE 1 Empty or null top-level filters (including $or: []) no longer force a tautology placeholder, and executors append conditions safely when WHERE is absent. * Add AQL release notes for omitting empty WHERE clauses Document the change that omits empty WHERE clauses from AQL, preventing the emission of a tautology placeholder. This update enhances query efficiency and clarity in the upcoming release notes.

  • dependabot[bot](07 Aug 26)

    Bump mermaid in the npm_and_yarn group across 1 directory (#8679) Bumps the npm_and_yarn group with 1 update in the / directory: [mermaid](https://github.com/mermaid-js/mermaid). Updates `mermaid` from 11.15.0 to 11.16.1 - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Commits](https://github.com/mermaid-js/mermaid/compare/[email protected]@11.16.1) --- updated-dependencies: - dependency-name: mermaid dependency-version: 11.16.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  • Matt Fiddaman(07 Aug 26)

    upsize docker build runners (#8677) * upsize docker build runners * note

  • github-actions[bot](07 Aug 26)

    🔖 (26.8.1) (#8671) * 🔖 (26.8.1) * generate release notes * add header * add account context note * change date --------- Co-authored-by: matt-fidd <[email protected]> Co-authored-by: Matt Fiddaman <[email protected]>

  • youngcw(07 Aug 26)

    [AI] Fix transaction row context-menu listener rebinding on every render (#8606) * [AI] Fix transaction row context-menu listener rebinding on every render useContextMenu passed a fresh inline callback to useRefEventListener on every render, and the effect depended on that unstable callback, so the native contextmenu listener was torn down and re-added on every render of every visible transaction row. Since delete, reconcile-lock, and schedule-link all trigger a full re-render of the transaction list, this added unnecessary DOM listener churn to those actions. useRefEventListener now keeps the latest callback in a ref and only depends on [ref, event], so it binds once and stays current instead of rebinding on every render. Fixes all four call sites, not just the context menu. Co-Authored-By: Claude Sonnet 5 <[email protected]> * note --------- Co-authored-by: Claude Sonnet 5 <[email protected]> Co-authored-by: Matt Fiddaman <[email protected]>

  • dependabot[bot](07 Aug 26)

    Bump the npm_and_yarn group across 2 directories with 1 update (#8659) Bumps the npm_and_yarn group with 1 update in the / directory: [electron](https://github.com/electron/electron). Bumps the npm_and_yarn group with 1 update in the /packages/desktop-electron directory: [electron](https://github.com/electron/electron). Updates `electron` from 41.7.1 to 41.10.3 - [Release notes](https://github.com/electron/electron/releases) - [Commits](https://github.com/electron/electron/compare/v41.7.1...v41.10.3) Updates `electron` from 41.7.1 to 41.10.3 - [Release notes](https://github.com/electron/electron/releases) - [Commits](https://github.com/electron/electron/compare/v41.7.1...v41.10.3) --- updated-dependencies: - dependency-name: electron dependency-version: 41.10.3 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: electron dependency-version: 41.10.3 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Matt Fiddaman <[email protected]>

  • Kesley David(07 Aug 26)

    [AI] Fix payee placeholder for deposit transactions on mobile (#8658) When entering a deposit (inflow) on the mobile transaction entry form, the payee placeholder now reads 'Who paid you?' instead of the payment-style 'Who did you pay?'. Fixes #8605

  • DiegoC(07 Aug 26)

    [AI] Add UYU currency (#8638) Co-authored-by: Claude Opus 5 <[email protected]> Co-authored-by: youngcw <[email protected]> Co-authored-by: Matt Fiddaman <[email protected]>

  • Matt Fiddaman(07 Aug 26)

    fix hanging when switching accounts & reconciling (#8628) * fix infinite loop hang * [AI] add test * note * Update packages/desktop-client/src/queries/pagedQuery.test.ts Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

  • Matt Fiddaman(07 Aug 26)

    fix context menu showing on multi-account views (#8662) * fix context menu showing on multi-account views * note * [AI] Add regression test for sidebar account group context menu The All accounts / On budget / Off budget sidebar rows have no account, so 'account && needsTooltip' evaluated to undefined and useContextMenu's 'enabled = true' destructuring default silently enabled the menu. The test right-clicks the group rows and a real account row and asserts the menu only opens for the real account. Also correct the release note category to Bugfix. Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01RNjhpBsEGKx5CFtLBG9kqe --------- Co-authored-by: Claude Fable 5 <[email protected]>

  • youngcw(07 Aug 26)

    [AI] Stop scanning every transaction once per rendered register row (#8663) * [AI] Stop scanning every transaction once per rendered register row The context menu refactor (#8106) turned TransactionMenu, which only mounted inside an open Popover, into useTransactionRowContextActions — a hook that runs for every rendered row. That hook calls useSchedules, so every visible row opened live queries. For an ordinary transaction the selection holds no preview ids, so the schedule list came back empty and getHasTransactionsQuery built `filter({ $or: [] })`. compileConditions drops an empty $or entirely, leaving `WHERE 1` — a scan of every transaction in the budget, per row, re-run on every change to the transactions table. That covers adding, clearing, deleting and linking a schedule, plus reconciling, and it scales with both budget size and how many rows are on screen. Three fixes: - Skip the schedules query in useTransactionRowContextActions when the selection contains no previews, so ordinary rows open nothing. - Make getHasTransactionsQuery match nothing rather than everything for zero schedules. advanceSchedulesService passes a possibly-empty list on every sync, so a budget with no schedules hit the same scan. - Unsubscribe the previous status query in useSchedules before replacing it. onData fires on every schedules refresh and each orphaned query stayed subscribed to sync events, so the number of scans per mutation grew over a session. Co-Authored-By: Claude Opus 5 <[email protected]> * [AI] Type the useSchedules test against the real liveQuery signature The test cast the query fixture to `never` and the mock to `Mock`, which turned off the checks it should have been getting. The `as never` was not needed at all, and typing the mock with `vi.mocked` immediately surfaced that `Listener` takes `(data, previousData)` — the casts had hidden the arity mismatch. Co-Authored-By: Claude Opus 5 <[email protected]> * remove unneeded comment * poke tests --------- Co-authored-by: Claude Opus 5 <[email protected]>

  • youngcw(07 Aug 26)

    [AI] Fix Butterfly custom theme mode (#8668) Set the Butterfly custom theme's catalog mode to light instead of dark. Co-authored-by: Claude Sonnet 5 <[email protected]>

  • Matt Fiddaman(06 Aug 26)

    update vrt-update comment to reflect a more realistic time (#8657) * reduce vrt time * note

  • Matiss Janis Aboltins(06 Aug 26)

    [AI] Run React Compiler on js/ts files in addition to jsx/tsx (#8650) The React Compiler include regex only matched .jsx/.tsx, so hooks and components defined in plain .ts/.js files were never compiled. The babel plugin already selects the TypeScript parser for .ts files, and the compiler's code pre-filter keeps non-React files cheap to skip, so widening the include to .[jt]sx? is all that's needed. Claude-Session: https://claude.ai/code/session_013D6rbX4YueKKPZing9DRgm Co-authored-by: Claude <[email protected]>

  • Matiss Janis Aboltins(06 Aug 26)

    [AI] Fail agent hooks with an actionable error when jq is missing (#8651) * [AI] Fail agent hooks with an actionable error when jq is missing The shared agent-hook scripts all parse their payload with jq but never checked it exists. A missing jq made git-guard.sh block every Bash call with a misleading 'could not parse the hook payload' message, while other hooks silently failed open and skipped their checks (issue #8629). Add require_jq to common.sh — called by every hook before its first jq use — so a missing jq fails closed with a clear install message, distinct from a malformed-payload error. The script name in the message is derived from $0 rather than passed by each caller. The Cursor adapters emit a static JSON deny (their deny() helper itself needs jq to build JSON) or an advisory where blocking isn't possible, and AGENTS.md now documents the prerequisite. Co-Authored-By: Claude Fable 5 <[email protected]> * [AI] Address review: advisory wording for PostToolUse hooks, hook tests PostToolUse hooks (format-edited-file, prefer-one-component) run after the edit already happened, so a missing jq now reports 'Agent hook skipped' instead of claiming a block. Exit 2 stays: it is the only exit code that feeds stderr back to the agent. Add scripts/agent-hooks/test-hooks.sh, a standalone runnable check covering the missing-jq path for every hook plus malformed-JSON, missing-field, and guard-behavior cases, and soften the release-note verb. Co-Authored-By: Claude Fable 5 <[email protected]> * [AI] Remove standalone hook test script Not wired into CI, so it only served as a manual check; the hook behavior was verified by hand and the script isn't worth maintaining. Co-Authored-By: Claude Fable 5 <[email protected]> --------- Co-authored-by: Claude Fable 5 <[email protected]>

  • Matiss Janis Aboltins(05 Aug 26)

    [AI] Add blog post: sidenav design competition voting is open (#8644) * [AI] Add blog post: sidenav design competition voting is open Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_016q58nrYhWogyXH7jvEbXQQ * [AI] Add voting and discussion links to sidenav voting blog post Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_016q58nrYhWogyXH7jvEbXQQ * [AI] Remove em dashes from sidenav voting blog post Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_016q58nrYhWogyXH7jvEbXQQ * Revise voting announcement and community message Updated language for clarity and added a note about contacting finalists. --------- Co-authored-by: Claude <[email protected]>

  • Gaurav Yadav(04 Aug 26)

    fix(crossover-report): render empty state when no accounts exist (#8512) (#8523) * fix(crossover-report): render empty state when no accounts exist When no accounts exist in a fresh budget, two guards in Crossover.tsx prevent the component from ever leaving the loading state: - The init useEffect bails out on accounts.length === 0, never setting selectionsInitialized=true - The render guard returns <LoadingIndicator /> when accounts.length === 0 The spreadsheet already handles empty accounts gracefully (returns empty data with zeros). Remove both guards so the report renders its empty state instead of hanging indefinitely. Fixes #8512 * Add release note for crossover report empty state fix

  • dependabot[bot](04 Aug 26)

    Bump the npm_and_yarn group across 1 directory with 5 updates (#8630) Bumps the npm_and_yarn group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.16` | `1.1.18` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.4` | `3.1.5` | | [ip-address](https://github.com/beaugunderson/ip-address) | `10.2.0` | `10.4.0` | | [postcss](https://github.com/postcss/postcss) | `8.5.19` | `8.5.25` | | [undici](https://github.com/nodejs/undici) | `7.28.0` | `7.29.0` | Updates `brace-expansion` from 1.1.16 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.16...v1.1.18) Updates `fast-uri` from 3.1.4 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](https://github.com/fastify/fast-uri/compare/v3.1.4...v3.1.5) Updates `ip-address` from 10.2.0 to 10.4.0 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](https://github.com/beaugunderson/ip-address/compare/v10.2.0...v10.4.0) Updates `postcss` from 8.5.19 to 8.5.25 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/postcss/postcss/compare/8.5.19...8.5.25) Updates `undici` from 7.28.0 to 7.29.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](https://github.com/nodejs/undici/compare/v7.28.0...v7.29.0) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.4.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.25 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.29.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  • Michael Clark(03 Aug 26)

    :bar_chart: Monte Carlo Analysis report (#8551) * add a monte carlo sim * multiple pots with separate config * withdrawal rules * tabs for config, pension accessible age * improving the runs * docs for monte carlo * small ux niggles * add monte carlo to docs sidebar * update docs wording * inflation no longer static * small ui niggles, common market crashes in a year * minor ui styling tweaks * cleaning up * ui tweaks * update some screenshots * another screenshot * ui tweaks * adjusting the guardrails rule for phased spending and minor fix for ran out of money age * add withdrawn value from runs table and new withdrawal orders * allow linking accounts * new images * clamping extremely high values to prevent any parsing errors * feedback link * ignore locked pots when applying withdrawal rules * ui improvements * accounting for tax and updating screenshots * screenshots without your cursor ya daftie * add tax into simulation * ui improvements * taxable amount added to run * bit of code cleanup * adding more columns to run detail so tax/fees is easier to work out * images for docs * feedback * move docs to experimental

  • youngcw(03 Aug 26)

    [AI] Fix missing payee on schedule previews if the schedule has a split (#8624) * [AI] Fix missing payee on schedule previews with a split underneath useDisplayPayee determined a split parent's payee by querying the DB for its children, which works for persisted transactions but not for schedule preview rows, whose split children only ever exist in memory. Merge in-memory is_child rows into the subtransaction lookup so preview splits get the same computed payee real splits already do. Co-Authored-By: Claude Sonnet 5 <[email protected]> * fix note --------- Co-authored-by: Claude Sonnet 5 <[email protected]>

  • Stephen Brown II(03 Aug 26)

    [AI] Drag-and-drop reordering for upcoming scheduled transactions (#8385) * [AI] Add sort_order column to schedules table * [AI] Add db.moveSchedule for reordering schedules * [AI] Add schedule/move server method * [AI] Sort preview transactions by schedule sort_order * [AI] Allow dragging preview transactions against same-date previews * [AI] Route preview-to-preview drops to schedule/move * [AI] Add release note for schedule preview drag-and-drop * [AI] Guard schedule/move against missing schedule id Skip the schedule/move send in TransactionList's preview drag handler when draggedTrans.schedule is undefined, instead of issuing a backend request with id: undefined.

  • Moshe Brevda(03 Aug 26)

    feat: Add ILS currency (#8559)

  • Binny Zupnick(03 Aug 26)

    FIX-8612: add "delete" back to scheduled transactions (#8616) Co-authored-by: youngcw <[email protected]>

  • youngcw(03 Aug 26)

    [AI] :book: Clarify transfer docs (#8622) * [AI] Point to the sync-detail section from the transfers doc intro The intro said updating one side of a transfer "always" updates the other, but the Modifying a Transfer section below shows some fields are optional or independent. Link to that breakdown instead. * Update packages/docs/docs/transactions/transfers.md Co-authored-by: Stephen Brown II <[email protected]> --------- Co-authored-by: Stephen Brown II <[email protected]>

  • youngcw(02 Aug 26)

    [AI] Show schedule name in mobile notes in upcoming schedules (#8609) * [AI] Show schedule name in mobile notes when a preview schedule has no notes Mirrors the existing desktop fallback (schedule name shown in place of empty notes for upcoming scheduled transactions) which was missing on the mobile transaction list. Co-Authored-By: Claude Sonnet 5 <[email protected]> * Update VRT screenshots Auto-generated by VRT workflow PR: #8609 --------- Co-authored-by: Claude Sonnet 5 <[email protected]> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

  • Matiss Janis Aboltins(02 Aug 26)

    [AI] Add Discord notifications for new tags and published releases (#8611) * [AI] Add Discord notifications for new tags and drafted/published releases Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_018a3c6gvegH5cGjpMBfkV3N * [AI] Remove draft release notification step Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_018a3c6gvegH5cGjpMBfkV3N * [AI] Update release note to drop drafted release mention Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_018a3c6gvegH5cGjpMBfkV3N * [AI] Use nightly-alerts environment for Discord webhook secret Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_018a3c6gvegH5cGjpMBfkV3N * Update .github/workflows/discord-release-notifications.yml Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update .github/workflows/discord-release-notifications.yml Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> --------- Co-authored-by: Claude <[email protected]> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

  • github-actions[bot](02 Aug 26)

    🔖 (26.8.0) (#8563) * 🔖 (26.8.0) * Generate release notes for v26.8.0 * Add release notes for version 26.8.0, highlighting new stable features, mobile banking improvements, and day-level date range selection in reports. * Update authorship in release notes for version 26.8.0 to reflect MatissJanis as the author. * [AI] Apply review feedback to 26.8.0 release notes: clarify onboarding/mobile bank sync wording and note per-file credentials are Pluggy.ai only * [AI] Copy review-feedback wording fixes into releases.md for 26.8.0 Co-Authored-By: Claude Fable 5 <[email protected]> --------- Co-authored-by: github-merge-queue <[email protected]> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <[email protected]> Co-authored-by: Claude Fable 5 <[email protected]>

  • Stephen Brown II(02 Aug 26)

    [AI] Add opt-in checkbox to sync transfer date to other side (#8454) * [AI] Add opt-in checkbox to sync transfer date to other side PR #7722 removed forced date sync between transfer sides, breaking some workflows. Re-add it as opt-in: a checkbox under the calendar popup, only shown for transfer transactions, unchecked by default. When checked, committing a date change also updates the linked transaction's date via a direct transactions-batch-update (runTransfers: false), same pattern as onSetTransfer. - DateSelect.tsx: render the checkbox below the calendar, styled to match calendar theme colors; square off the calendar's bottom corners and move rounding/shadow to the checkbox row so the popup reads as one card when the checkbox is present. - TransactionsTable.tsx: track checkbox state per row, reset on each popover open. Read it via a ref (in addition to state) because Pikaday binds its onSelect handler once at mount, so a plain closure would always see the initial (false) value. - LabeledCheckbox.tsx: add onMouseDown passthrough so clicking the checkbox doesn't blur the date input and close the popover before the check registers. * [AI] Inline single-use calendar corner style, rename prop squareBottomCornersStyle was a top-level const used at exactly one call site. Inline it into the css([...]) array instead. Renamed squareBottomCorners to attached: the prop now also zeroes the box-shadow, so the old name no longer matched what it controls. * [AI] Address CodeRabbit: render transfer-sync checkbox on mobile DateSelectMobile silently dropped transferDateSyncChecked and onTransferDateSyncChange, so narrow-width users never saw the checkbox even though TransactionsTable always passes it for transfer transactions. Render the same LabeledCheckbox below the native date input when onTransferDateSyncChange is provided. * [AI] Address CodeRabbit: type guard + error handling for transfer-date send Replace the `as string` assertion with a `typeof value === 'string'` guard. Add a .catch to the fire-and-forget transactions-batch-update call so a failed sync doesn't fail silently. * [AI] Cascade transfer date sync to the split parent of the other side Restores the pre-#7722 behaviour for the opt-in transfer-date-sync checkbox: when the other side of the transfer is itself a split sub-transaction, also update that sub-transaction's parent date so the split stays consistent with its transfer leg. * [AI] Shrink transfer-date-sync checkbox label to fit narrower Calendar picker The react-aria Calendar picker is narrower than the old Pikaday one, so the full label wrapped/overflowed its margin. Shorten the text and swap the word "transfer" for the same direction-aware arrow icon already used on the transaction row (SvgLeftArrow2/SvgRightArrow2 by transaction.amount > 0). * [AI] Extract getFirstDayOfWeek to fix Vite Fast Refresh DateSelect.tsx exported both a component and getFirstDayOfWeek, which broke Fast Refresh (react-refresh flags files that export non-component values alongside a component). Moved the function into its own module so HMR works again. Also registered the new module in package.json's #components/* imports map: the wildcard entry only covers .tsx files, so a plain .ts file needs its own explicit mapping to resolve. * [AI] Use shared TransferDirectionIcon in TransactionListItem Mobile TransactionListItem duplicated the isDeposit-based left/right arrow logic that TransferDirectionIcon already encapsulates. Swapped it in. * [AI] Remove dead transfer-date-sync checkbox from DateSelectMobile DateSelectMobile renders a native <input type="date">, so the LabeledCheckbox for transfer-date-sync was unreachable dead code on mobile. * [AI] Remove stale Pikaday references from comments and code The syncTransferDateRef workaround and its comment dated back to Pikaday's date-click handler being bound once at mount (a stale-closure hazard). The react-aria Calendar receives onChange fresh on every render, and onUpdate here is a plain inline function redefined each render too, so the ref no longer serves a purpose. Dropped it back to plain useState and trimmed the matching Pikaday footnote in DateSelect.tsx's blur handler comment. * [AI] Simplify transfer-date-sync checkbox label Replace the icon-based "Also update other side of <arrow>" label with plain text: "Sync both transfer dates". Drops the now-unused transferIsDeposit prop, TransferDirectionIcon import, and transferIconStyle from DateSelect. * [AI] fix: keep transfer-date sync enabled through full date-edit session * [AI] Make transfer-date sync checkbox sticky per account Persist the transfer-date sync checkbox as a synced pref keyed by account id (sync-transfer-date-<accountId>) instead of local component state, so the choice sticks per account across date-edit sessions instead of resetting every time the date cell is opened. * [AI] Make transfer-date sync pref budget-level, not per-account Change sync-transfer-date-<accountId> to a single flat sync-transfer-date pref so the checkbox state is shared across the whole budget instead of being scoped to one account. * [AI] Fix race in transfer-date sync applying stale dates Concurrent date edits on the same transfer leg could interleave: each edit fires an independent async query+update, and a slower older edit could finish after a newer one, overwriting it with a stale date. Track the latest edit with a sequence ref and drop the batch-update call if a newer edit has started since. * [AI] Narrow aql query result with a type guard, drop unsafe casts Replace the Pick<...>[] blanket cast and parent_id as string assertion with a single typed aqlQuery result and a type-guard filter, so the compiler verifies is_child/parent_id narrowing instead of trusting an assertion. * [AI] Document the transfer date sync option

  • Julian Dominguez-Schatz(02 Aug 26)

    Update to Node 24 (#8604)

Actual Security

Security Advisories (13)

  • highPatchedCVSS 8.3

    CVE-2026-49229Disabled OpenID users keep access through existing session tokens

  • mediumPatchedCVSS 4.2

    CVE-2026-50179CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields

  • mediumPatchedCVSS 4.3

    CVE-2026-46700Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets

  • mediumPatchedCVSS 4.6

    CVE-2026-46672CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helper

  • mediumPatched

    CVE-2026-42890Electron Run As Node in actual

  • highPatched

    CVE-2026-42604OpenID `client_secret` Disclosure via Broken Authorization Guard in `/openid/config`

  • highPatched

    CVE-2026-50007Shared users can perform owner-only file management actions

  • mediumPatched

    CVE-2026-43872Path traversal vulnerability in actual-server

  • highPatchedCVSS 8.8

    CVE-2026-33318Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers

  • mediumPatched

    CVE-2026-3089Actual Sync Server 26.2.1 - Authenticated Path Traversal

  • criticalPatched

    CVE-2026-27584Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints

  • highPatched

    CVE-2026-27638Missing authorization in sync endpoints allows cross-user budget file access in multi-user mode

  • mediumPatchedCVSS 4.2

    GHSA-xvp7-8vm8-xfxxGocardless service is logging sensitive data including bearer tokens, account numbers, etc...

Actual Website

Website

Your Finances — made simple | Actual Budget

Actual Budget is a super fast and privacy-focused app for managing your finances. At its heart is the well proven and much loved Envelope Budgeting methodology.

Redirects

Does not redirect

Security Checks

All 65 security checks passed

Server Details

  • IP Address98.84.224.111
  • Hostnameec2-98-84-224-111.compute-1.amazonaws.com
  • LocationAshburn,Virginia,United States of America,NA
  • ISPAmazon Technologies Inc.
  • ASNAS14618

Associated Countries

  • USUS

Safety Score

Website marked as safe

100%

Blacklist Check

actualbudget.org was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview

Actual Docker

Container Info

actual

Actual is a super fast privacy-focused app for managing your finances.

#Finance

Run Command

docker run -d \
  

Compose File

version: 3.8

Actual Socials

Actual Reviews

More Secure Budgeting

About the Data: Actual

Change History

Edit Actual Data

You can edit Actual's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external sources, a list of these can be found data documentation.

Origin Data

Modify Data

API

You can access Actual's data programmatically via our API. Simply make a GET request to:

https://api.awesome-privacy.xyz/v1/services/actual

The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

Share Actual

Help your friends compare Secure Budgeting, and pick privacy-respecting software and services.
Share Actual and Awesome Privacy with your network!