Yuvomi

Added

• A loan that is already running can say how many installments are behind it. Entering an existing loan meant starting from zero: every past installment had to be ticked off by hand, just to make the remaining balance and the progress read correctly. The form now asks for the number of installments already paid and suggests the figure derived from the first due month - a suggestion, not a rule, because a payment-free start or a deferral makes that number wrong, and it stops suggesting as soon as you touch the field. These installments are recorded against the loan but deliberately not booked to the budget: they were paid before Yuvomi existed and never went through the household, so booking them would fill past months with expenses that never happened and shift account balances along with them. Ticking off an installment the normal way books as it always did. (Discussion #813)

Security

• The document management connection now checks its target URL before contacting it. Four other outbound integrations (ICS subscriptions, recipe providers, WebDAV document storage, subscription logos) validate the address they are about to reach; the Paperless-ngx and Papra adapters were the ones that did not, and called an operator-supplied URL straight out. Only administrators can configure that URL, so this was consistency rather than an open door, but it was the one outbound path nobody was looking at. Every adapter method now runs through the check, including Papra’s connection test, which builds its own request and would otherwise have been the single hole.

  The new DMS_ALLOW_PRIVATE_NETWORK deliberately defaults to true, unlike the other three flags of its kind. A document management system is self-hosted by definition and in practice sits on the same LAN or Docker network as Yuvomi, so shipping this as an opt-in would have cut off essentially every existing connection on update. Nothing changes for existing installations. Set it to false to enforce the same protection the other integrations have; only an explicit false or 0 switches it on, so a typo leaves a working setup working.