Econumo

Econumo v1.1.0 brings multi-language support, a redesigned account-sharing flow, exact decimal money handling, new-release notifications, and a substantial security-hardening pass — plus a batch of budget and UI fixes.

What's new

• Multi-language support (#94) — the app now speaks English and Russian. A globe selector on the sign-in/registration pages and in Settings switches the UI language; validation errors and the password-reset email are localized too. Your choice is remembered per browser and stored in your profile. More languages are easy to add — contributions welcome.
• Standardized account sharing (#90) — sharing an account now uses the same invite → accept/decline handshake budgets already had: the recipient sees a pending invite and explicitly accepts (choosing a folder for the account) or declines, instead of the account silently appearing. Existing shares are grandfathered as accepted, and leaving a share you received is now a "Decline/Leave" action rather than a scary "Delete" (#103).
• Exact money amounts (#60, #113) — amounts (balances, transactions, budget limits/spent) now travel as decimal strings end-to-end and the web app does all money math in exact decimal arithmetic instead of JavaScript floats, so large amounts like 12345678901234567.89 survive byte-exactly. Amount inputs now reject non-numeric text outright, and -0 can no longer be produced.
• New-release notifications (#98) — the server checks econumo.com once a day for a new release (a single server-side request, nothing about your instance is sent) and the app shows a subtle badge plus a dismissible notice when one is available. Opt out with ECONUMO_CHECK_UPDATES=false.
• Anonymous product analytics (#99, #100) — the web app now reports anonymous, cookieless usage events (feature usage only — never amounts, names, or any personal data) to help prioritize development. Self-hosters can disable it instance-wide with ECONUMO_ANALYTICS=false.

Security hardening

An authorization audit of every write endpoint, plus fixes for the findings of an external security review (#106, #108, #109, #110):

• Fixed IDOR bugs where a valid foreign UUID was enough to mutate another user's data (transaction updates/transfers, budget folders and envelopes), and closed several secondary authorization gaps.
• Budget sharing now fails closed: only an accepted owner/admin can grant or revoke access, and the owner can no longer be revoked (previously anyone knowing a budget UUID could remove members).
• Read-only budget guests really are read-only now — budget metadata edits are rejected server-side and the Edit dialog is read-only for guests (#112); tag/payee reordering is owner-only (#108, #109).
• Request bodies are capped (1 MiB; CSV import bounded as a whole), and the server got proper read/write/idle timeouts.

Fixes & improvements

• Budget: archived categories with history stay visible, folder visibility corrected, and Spent is no longer shown negated (#104); the Spent column aligns across rows in edit mode (#107); a revoked or deleted default budget no longer strands you on an endless loader (#102).
• A failed update check is silent instead of showing an amber sync icon (#101).
• The SPA sends explicit Cache-Control headers, so browsers pick up new versions reliably after an upgrade (#96).
• Category/payee pickers in the transaction form are keyboard-reachable in Safari (#89).
• Copy button placement fixed in the created-token dialog.

Upgrading

Drop-in for self-hosters: pull the new image and restart — migrations run on boot, and the bundled web app always matches the API.

Two notes for third-party API clients (the bundled SPA is unaffected):

• Money amounts in JSON are now decimal strings (e.g. "10.50"), in both requests and responses.
• Account sharing moved to POST /api/v1/account/{grant,accept,decline,revoke}-access; the old connection/set-account-access and connection/revoke-account-access endpoints are gone.

The ghcr.io/econumo/econumo:latest image tag points to this build; to pin the exact version use ghcr.io/econumo/econumo:v1.1.0.

Contributors

@dmtrkzntsv — with Claude (Fable 5 and Opus 4.8) co-authoring throughout.

Full changelog: v1.0.2...v1.1.0