Syncmoney

Changelog (2026-09-20)

Security

- Frontend Dependency Remediation: Updated the Web Admin dependency graph to patched Axios, Vite 6, Vitest 4.1.11, Happy DOM, PostCSS, and Sharp releases. Targeted pnpm overrides keep vulnerable transitive packages on patched versions without taking unrelated Java/runtime major upgrades. - Audit Baseline: The resolved Web Admin dependency graph now reports zero known vulnerabilities with pnpm audit.

Changed

- Release Metadata: Unified root, PlaceholderAPI, Web Admin, documentation, configuration metadata, and acceptance version checks on 1.3.2. - Embedded Web Bundle: Rebuilt the embedded Web Admin assets and synchronized WebAdminServer.extractIndividualFiles with the generated bundle. - Release Automation: Added GitHub Actions workflows for CI artifacts, alpha/beta previews, protected stable releases, provenance attestations, and the synchronized Syncmoney-web release. - Web Release Contract: The Web repository now publishes v-prefixed deterministic source archives; the core downloader accepts both prefixed and unprefixed Web release tags.

Validation

- PlugDev acceptance passed on Paper 1.20.4, Paper 26.2, Folia 26.2.build.7-beta, Canvas 26.2, and a two-backend Paper 26.2 network. Folia coverage is specifically for the tested beta build.