firefly-iii/firefly-iii
Firefly III: a personal finances manager
How firefly-iii is put together
Firefly III is a self-hosted personal finance manager built as a PHP/Laravel server-rendered monolith with a REST JSON API covering nearly all functionality. The repository contains two JavaScript frontends maintained as npm workspaces: 'v1' (jQuery/Vue 2 assets bundled by Laravel Mix into public/v1) and 'v2' (Alpine.js-based SPA-style pages bundled by Vite with laravel-vite-plugin). Backend structure follows classic Laravel layering: Eloquent models under app/Models, object factories under app/Factory, queued jobs under app/Jobs, mail notifications under app/Mail, and configuration-driven behavior under config/. Client code consumes internal JSON endpoints such as api/v1/summary/basic and api/v1/accounts/{id}, authenticating browser calls with CSRF tokens.
Languages
Frameworks
Datastores
Infrastructure
Major components
REST API (routes/api.php + api/v1 endpoints)
Exposes the JSON API consumed by both frontends and third-party tools, including summary, account ordering, and chart endpoints.
Web routes (routes/web.php)
Defines the server-side web UI routes including registration/login flows whose forms are enhanced by client-side JS.
Domain models (app/Models)
Eloquent entities for the double-entry bookkeeping domain: Account, Transaction journals, Budget, Bill, PiggyBank, Category, Attachment, AuditLogEntry, GroupMembership, etc.
Factories (app/Factory)
Centralized creation logic for accounts, transactions, transaction groups/journals, budgets, bills, piggy banks, recurrences, tags, webhooks, and user groups.
Queued jobs (app/Jobs)
Background processing for recurring transactions, auto-budget limits, exchange rate downloads, webhook message delivery, bill warnings, and error mail.
Notifications/Mail (app/Mail)
Emails for security-relevant events: new IP address warnings, access/OAuth token creation, password resets, email change confirmation, invitations.
Enums and casts (app/Enums, app/Casts)
Typed enumerations for account/transaction types, webhook triggers/delivery, user roles, and timezone-separating attribute casts.
Frontend v1 (resources/assets/v1 -> public/v1)
Legacy jQuery/Vue 2 dashboard pages that fetch JSON from api/v1 and render charts, boxes, sortable account tables, and client-side registration validation.
Frontend v2 (resources/assets/v2)
Newer Alpine.js/Bootstrap5 page bundle built with Vite, organized by feature pages (dashboard, accounts, administrations, transactions) with i18next localization.
A small week with just one change clarifying how security issues should be reported.
5 weeksWeek of 2026-08-17
Week of 2026-08-17latest
A small week with just one change clarifying how security issues should be reported.
Week of 2026-08-10
The team stopped building version 1 of the app and removed some leftover old code.
Week of 2026-08-03
A busy week of pipeline cleanup and automated dependency updates, including renaming the release workflow to 'Run CI'.
Week of 2026-07-27
Routine maintenance with four changes, mostly JavaScript dependency updates plus a timezone fix in the release process.
Week of 2026-07-20
A quiet week limited to two automated dependency updates.
Over the past month, most activity on the Firefly III repository focused on housekeeping rather than new features: the team streamlined its automated testing and release pipelines, refreshed a range of underlying software dependencies to keep things secure and up to date, and tidied old code. A notable milestone was retiring version 1 of the software's build process. The quietest weeks involved just routine dependency updates and documentation tweaks.
Week by week
2026-08-17A small week with just one change clarifying how security issues should be reported.latest1 change
Docs
Clearer security reporting guidelines
Updated instructions so people know exactly how to responsibly report security problems in the software.
2026-08-10The team stopped building version 1 of the app and removed some leftover old code.1 change
Refactor
Retire v1 builds
Version 1 of Firefly III is no longer being built or maintained, and related outdated code was cleaned out.
2026-08-03A busy week of pipeline cleanup and automated dependency updates, including renaming the release workflow to 'Run CI'.6 changes
Fix
Sponsorship fix
Corrected an issue related to how project sponsorships are displayed or handled.
Chore
Workflow renamed and reorganized
The 'Create new release' workflow was renamed to 'Run CI' and consolidated into a new file, while older analysis workflows were deleted or updated.
Chore
Code-quality tooling updates
The Psalm security scanner and SonarCloud analysis tools were updated to newer versions so automatic code checks keep working.
Chore
PHP library updates
Two building-block libraries (commonmark for text formatting and guzzle for web requests) were bumped to newer versions automatically.
Chore
JavaScript dependency update
An internal library called brace-expansion was updated to a newer version.
Chore
Automation tool update
The bot that flags stale issues was upgraded from version 10 to 11.
2026-07-27Routine maintenance with four changes, mostly JavaScript dependency updates plus a timezone fix in the release process.2 changes
Fix
Release workflow timezone set
The automated release process now uses the Amsterdam timezone so timestamps come out consistently.
Chore
SVG tooling update
The svgo library, which compresses icons and graphics, was updated to a newer version.
2026-07-20A quiet week limited to two automated dependency updates.2 changes
Chore
JavaScript group update
Two JavaScript packages were refreshed to newer versions in one go.
Chore
Web request library update
The guzzle library used for making web requests was bumped to a newer version.
Dependencies and code review
Dependency advisories
Security Watch
2 vulnerable packages (2 advisories) across 829 scanned dependencies.
fast-uri 3.1.4
1 advisory. Fixed in 2.4.4.
How it can be abusedThis library parses web addresses and can be tricked by a backslash into treating a malicious hostname as if it were part of a trusted one. In Firefly III this package is only pulled in as a build-time helper for the JavaScript tooling, so there is no realistic way an attacker reaches it through the app itself.
- highGHSA-7p8r-x3mc-p8w7fast-uri vulnerable to host confusion via backslash authority introducer
nanoid 3.3.16
1 advisory. Fixed in 3.3.18.
How it can be abusedThis bug only matters when code asks nanoid to generate an empty string with a custom alphabet, which makes it hang forever. Firefly III uses this package only as a build-time helper for its front-end assets, so no attacker can reach it and only a developer running the build tools could ever hit it.
- highGHSA-2v37-7h3g-55p8nanoid: custom generators can loop indefinitely when size is zero
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required