build(deps): bump github/codeql-action/analyze from 4.37.7 to 4.37.9 by dependabot[bot] · Pull Request #518 · apache/fineract-backoffice-ui

dependabot · 2026-09-06T11:44:42Z

Bumps github/codeql-action/analyze from 4.37.7 to 4.37.9.

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.9

Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

4.37.9 - 26 Aug 2026

Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037

Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

Update default CodeQL bundle version to 2.26.0. #3995

... (truncated)

Commits

cdf488f Merge pull request #4107 from github/update-v4.37.9-920ba7cd1
7243f38 Update changelog for v4.37.9
920ba7c Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4
ecfa6e1 Add changelog note
adcdf4a Update default bundle to codeql-bundle-v2.26.4
486fec2 Merge pull request #4099 from github/update-supported-enterprise-server-versions
134624c Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...
ff43db8 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde
4605e03 Rebuild
099c869 Update changelog and version after v4.37.8
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.7 to 4.37.9. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@ff2f1c6...cdf488f) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-09-06T11:54:44Z

E2E — mocked backend

🎭 E2E Tests

✅ All green — 342 passed · 0 failed · 0 skipped, across 28 spec files in 6m 35s.

By spec file

Spec	✅	Time
accessibility.spec.ts	3	13.8s
all-functions-read-shortcut.spec.ts	5	9.4s
branded-deployment.spec.ts	9	16.9s
breadcrumb.spec.ts	2	4.8s
client-servicing-gaps.spec.ts	14	58.6s
client.spec.ts	1	3.5s
deployment-customization.spec.ts	18	32.8s
e2e-journey.spec.ts	81	2m 49s
feature-coverage.spec.ts	44	1m 30s
functional-coverage.spec.ts	42	1m 53s
global-search-nav-shortcuts.spec.ts	4	9.7s
global-search-navigation.spec.ts	8	20.2s
group-detail.spec.ts	6	23.9s
guidance-tour-dashboard.spec.ts	1	2.1s
keyboard-shortcuts.spec.ts	5	9.8s
list-pagination.spec.ts	9	32.6s
loan-portfolio-summary.spec.ts	4	14.0s
loan-product-down-payment.spec.ts	13	1m 6s
client-empty-account-cta.spec.ts	1	6.2s
loan-schedule-type-gating.spec.ts	5	16.2s
loan-servicing-gaps.spec.ts	14	53.5s
rbac-feature-flag.spec.ts	11	19.1s
rbac-route-protection.spec.ts	18	1m 39s
report-enhancements.spec.ts	2	5.9s
reporting.spec.ts	2	3.8s
scheduler-jobs.spec.ts	3	9.8s
two-factor-authentication.spec.ts	10	17.5s
working-capital-loan-actions.spec.ts	7	30.8s

All 342 tests — click to expand

accessibility.spec.ts

✅ Runtime accessibility › client list has no blocking violations — 3.7s
✅ Runtime accessibility › client form has no blocking violations — 4.4s
✅ Runtime accessibility › create office dialog has no blocking violations — 5.7s

all-functions-read-shortcut.spec.ts

✅ ALL_FUNCTIONS_READ shortcut › grants read access to the Clients list without any explicit READ_CLIENT permission — 1.8s
✅ ALL_FUNCTIONS_READ shortcut › does not grant the Create Client action — 1.8s
✅ ALL_FUNCTIONS_READ shortcut › does not grant Create Client even combined with an explicit READ_CLIENT permission — 1.8s
✅ ALL_FUNCTIONS_READ shortcut › a user with the real CREATE_CLIENT permission still sees the button — 1.6s
✅ ALL_FUNCTIONS_READ shortcut › ALL_FUNCTIONS (full superuser) still sees the Create Client button — 2.4s

branded-deployment.spec.ts

✅ a fully branded deployment › wears the institution’s name and mark, not Fineract’s — 1.6s
✅ a fully branded deployment › carries the institution’s palette into its own chrome and into Ionic — 1.6s
✅ a fully branded deployment › drops the sections the institution does not run — 1.6s
✅ a fully branded deployment › renames and reorders entries to the institution’s vocabulary — 1.6s
✅ a fully branded deployment › offers the institution’s own systems beside Fineract’s screens — 2.2s
✅ a fully branded deployment › restates the labels the institution words differently — 1.6s
✅ a fully branded deployment › keeps a readable palette in dark mode, with a label colour to match — 1.6s
✅ a fully branded deployment › does not leak a light colour into the dark palette — 1.6s
✅ a fully branded deployment › reports no configuration defects for the published example — 3.7s

breadcrumb.spec.ts

✅ a single-crumb page shows no breadcrumb trail — 1.7s
✅ a nested page shows a trail, and the ancestor crumb navigates back — 3.1s

client-servicing-gaps.spec.ts

✅ Client transfers › proposing a transfer sends the destination, the date and the format that parses it — 5.0s
✅ Client transfers › a one-step transfer omits the date the platform refuses — 4.3s
✅ Client transfers › the client’s own office is not offered as a destination — 3.9s
✅ Client transfers › accepting a transfer sends a note and nothing else — 4.4s
✅ Client transfers › accepting with no note sends an empty body — 4.1s
✅ Client transfers › rejecting a transfer is offered while one is pending — 4.0s
✅ Client transfers › withdrawing is offered from on hold, which is the only way back — 4.6s
✅ Client transfers › answers to a transfer are not offered when none is pending — 3.4s
✅ Client staff and default savings account › assigning a member of staff sends the staff id — 4.3s
✅ Client staff and default savings account › unassigning echoes the current holder back, which the platform requires — 4.5s
✅ Client staff and default savings account › unassigning is not offered when nobody is assigned — 3.4s
✅ Client staff and default savings account › the assigned officer is shown on the header — 3.3s
✅ Client staff and default savings account › setting the default savings account sends the account id — 5.4s
✅ Undoing a rejection › posts the command name the platform recognises, not the menu identifier — 4.2s

client.spec.ts

✅ Client Management › should create a new client — 3.5s

deployment-customization.spec.ts

✅ with no overlay mounted › boots, keeps the shipped branding, and shows the full menu — 1.6s
✅ with no overlay mounted › logs no federation parse error on load — 1.5s
✅ branding › applies colour and density tokens to the document — 2.2s
✅ branding › recolours Ionic through the same tokens — 1.5s
✅ branding › renames the product in the header and the tab title — 2.8s
✅ branding › serves the deployment logo and names it after the deployment — 1.6s
✅ branding › refuses a fill that cannot carry the white text baked into the stylesheet — 2.6s
✅ branding › accepts a light accent and derives a dark label for it — 1.6s
✅ branding › ignores a token outside the published allow-list, and says so — 1.6s
✅ navigation › hides an entry named by its id — 1.6s
✅ navigation › does not hide an entry named by its labelKey — 1.5s
✅ navigation › renames and reorders entries — 2.5s
✅ navigation › adds an external entry that opens in a new tab — 1.6s
✅ navigation › nests an added entry under an existing group — 1.6s
✅ navigation › gates an added entry on permissions like any built-in one — 1.5s
✅ navigation › drops an external entry with no usable url rather than rendering a dead link — 1.5s
✅ layering › merges over config.json instead of replacing it — 2.5s
✅ layering › a malformed overlay leaves the application usable — 1.6s

e2e-journey.spec.ts

✅ E2E: Login Flow › should display login page with all required fields — 1.4s
✅ E2E: Login Flow › should have Sign In button disabled when fields are empty — 1.3s
✅ E2E: Login Flow › should enable Sign In when credentials are entered — 1.2s
✅ E2E: Login Flow › should redirect to dashboard after successful login — 2.1s
✅ E2E: Login Flow › should display language selector on login page — 1.4s
✅ E2E: Login Flow › should display API endpoint selector with value — 1.3s
✅ E2E: Dashboard › should display dashboard summary cards — 1.6s
✅ E2E: Dashboard › should display system health as Online — 1.6s
✅ E2E: Dashboard › should display pending approvals section — 2.6s
✅ E2E: Dashboard › should display loan and savings status distribution charts — 1.6s
✅ E2E: Dashboard › should display system operational status — 1.6s
✅ E2E: Dashboard › should have header with business date, render time, and logout — 1.6s
✅ E2E: Dashboard › should have sidebar toggle button — 1.5s
✅ E2E: Dashboard › should have global search bar in header — 2.7s
✅ E2E: Dashboard › should have Guide button in header — 1.6s
✅ E2E: Dashboard › should have dark mode toggle button — 1.6s
✅ E2E: Sidebar Navigation › should have all main navigation links — 1.6s
✅ E2E: Sidebar Navigation › should have Products section with sub-links — 1.6s
✅ E2E: Sidebar Navigation › should have Transfers section with sub-links — 2.2s
✅ E2E: Sidebar Navigation › should have Accounting section with sub-links — 1.7s
✅ E2E: Sidebar Navigation › should have Security section — 1.6s
✅ E2E: Sidebar Navigation › should have Settings section — 1.6s
✅ E2E: Sidebar Navigation › should have Organization section — 1.6s
✅ E2E: Sidebar Navigation › should have System section — 1.7s
✅ E2E: Sidebar Navigation › should navigate to all major pages via sidebar — 3.8s
✅ E2E: Offices › should display offices list with table — 2.5s
✅ E2E: Offices › should have Create Office button — 1.8s
✅ E2E: Offices › should navigate to office create form — 1.9s
✅ E2E: Offices › should validate office create form - save disabled when empty — 2.0s
✅ E2E: Offices › should fill office create form and enable save — 2.4s
✅ E2E: Offices › should cancel office creation and return to list — 2.1s
✅ E2E: Offices › should have search input on offices page — 2.6s
✅ E2E: Offices › should show edit button for each office — 1.9s
✅ E2E: Offices › should have pagination controls — 1.8s
✅ E2E: Clients › should display clients list page — 2.0s
✅ E2E: Clients › should display client data in table — 2.1s
✅ E2E: Clients › should show ACTIVE status badge — 2.2s
✅ E2E: Clients › should have Create Client button — 2.2s
✅ E2E: Clients › should show empty state when no clients exist — 2.3s
✅ E2E: Clients › should have search input and status filter — 2.7s
✅ E2E: Clients › should have pagination controls — 1.9s
✅ E2E: Client Creation › should navigate to client create form — 2.1s
✅ E2E: Client Creation › should display all required client form fields, across the wizard steps — 2.8s
✅ E2E: Client Creation › should display optional client form fields, across the wizard steps — 2.8s
✅ E2E: Client Creation › should have Next disabled until the current step is valid — 2.6s
✅ E2E: Client Creation › should populate office dropdown from API — 3.3s
✅ E2E: Client Creation › should fill client form and enable save on the last step — 3.7s
✅ E2E: Client Creation › should submit client and redirect to clients list — 3.4s
✅ E2E: Client Creation › should cancel client creation and return to clients list — 2.3s
✅ E2E: Client Creation › should have add office quick-action button — 2.1s
✅ E2E: Client Creation › should have help icons for form fields — 1.9s
✅ E2E: Client Creation › should have calendar buttons for date fields — 2.7s
✅ E2E: Client Creation › should have pre-filled dates in Submitted On and Activation Date — 3.5s
✅ E2E: Client Creation › should have Active checkbox checked by default — 2.1s
✅ E2E: Client Creation › should handle Entity legal form showing fullname field — 3.2s
✅ E2E: Loan Products Page › should display loan products list page — 1.9s
✅ E2E: Loan Products Page › should have Create Loan Product button — 1.9s
✅ E2E: Loan Products Page › should display table with correct headers — 1.9s
✅ E2E: Loan Products Page › should show empty state when no products exist — 2.5s
✅ E2E: Loan Products Page › should have search input — 1.9s
✅ E2E: Loan Products Page › should navigate to loan product create form — 2.6s
✅ E2E: Savings Products Page › should display savings products list page — 1.9s
✅ E2E: Other Products Pages › Fixed Deposit Products page loads — 1.9s
✅ E2E: Other Products Pages › Recurring Deposit Products page loads — 1.9s
✅ E2E: Other Products Pages › Share Products page loads — 2.5s
✅ E2E: Other Products Pages › Tax Components page loads — 1.9s
✅ E2E: Other Products Pages › Tax Groups page loads — 1.9s
✅ E2E: Other Products Pages › Floating Rates page loads — 1.9s
✅ E2E: Loans Portfolio › should display loans portfolio page — 2.0s
✅ E2E: Loans Portfolio › should have Create Loan Account button — 1.8s
✅ E2E: Loans Portfolio › should display table with correct headers — 2.9s
✅ E2E: Loans Portfolio › should show empty state when no loans exist — 1.9s
✅ E2E: Loans Portfolio › should have search input — 1.8s
✅ E2E: Loans Portfolio › should have pagination controls — 1.9s
✅ E2E: Header & Global Elements › should display Fineract logo and title in header — 1.6s
✅ E2E: Header & Global Elements › should display logged-in username — 2.2s
✅ E2E: Header & Global Elements › should display office name for user — 1.6s
✅ E2E: Header & Global Elements › should have Logout button — 1.5s
✅ E2E: Header & Global Elements › should have language selector in header — 1.6s
✅ E2E: Header & Global Elements › should display render time — 1.6s
✅ E2E: Header & Global Elements › should display business date — 2.6s

feature-coverage.spec.ts

✅ Navigation & Sidebar › all main navigation links are visible in sidebar — 2.2s
✅ Navigation & Sidebar › sidebar navigation routes to correct pages — 3.0s
✅ Navigation & Sidebar › header shows logged-in user info — 1.6s
✅ Navigation & Sidebar › help tour button is visible and interactive — 1.5s
✅ Navigation & Sidebar › logout button is visible — 1.6s
✅ Navigation & Sidebar › language selector is present — 2.2s
✅ Dashboard › dashboard shows key metrics cards — 1.6s
✅ Dashboard › dashboard shows pending approvals section — 1.9s
✅ Dashboard › dashboard shows loan and savings status distribution — 1.6s
✅ Dashboard › dashboard shows system operational status — 1.6s
✅ Groups › groups page renders with title — 2.9s
✅ Groups › groups page has create button — 1.8s
✅ Centers › centers page renders with title — 1.9s
✅ Centers › centers page has create button — 1.8s
✅ Organization › offices page loads with list — 1.9s
✅ Organization › staff page loads — 2.8s
✅ Organization › funds page loads — 1.8s
✅ Organization › payment types page loads — 1.8s
✅ Accounting › chart of accounts loads — 1.9s
✅ Accounting › journal entries page loads — 2.0s
✅ Accounting › accounting closures loads — 2.2s
✅ Accounting › accounting rules loads — 2.9s
✅ Accounting › financial activity mappings loads — 1.9s
✅ Accounting › charges page loads — 1.8s
✅ Security › users page loads — 2.3s
✅ Security › roles page loads — 1.8s
✅ Security › audit logs page loads — 3.1s
✅ Products - Loan & Savings › loan products page loads — 1.9s
✅ Products - Loan & Savings › savings products page loads — 1.8s
✅ Products - Loan & Savings › tax components page loads — 1.8s
✅ Products - Loan & Savings › tax groups page loads — 1.8s
✅ Products - Loan & Savings › floating rates page loads — 2.8s
✅ Products - Loan & Savings › savings accounts page loads — 1.9s
✅ Settings › global configurations page loads — 1.9s
✅ Settings › holidays page loads — 1.9s
✅ Settings › working days page loads — 1.9s
✅ System › data tables page loads — 3.0s
✅ System › bulk import page loads — 1.9s
✅ System › delinquency page loads — 1.9s
✅ Tellers › tellers page loads with create button — 1.9s
✅ Transfers › account transfer page loads — 2.0s
✅ Transfers › standing instructions page loads — 2.0s
✅ Transfers › SI history page loads — 2.2s
✅ Embedded Fintech › asset owners page loads — 2.4s

functional-coverage.spec.ts

✅ Client CRUD Workflow › should complete full client creation flow — Person — 5.0s
✅ Client CRUD Workflow › should complete full client creation flow — Entity — 3.3s
✅ Client CRUD Workflow › should cancel client creation and return to list — 2.2s
✅ Client CRUD Workflow › should disable office and legal form in edit mode — 3.2s
✅ Client View & Status Transitions › should display client view with correct details — 3.8s
✅ Client View & Status Transitions › should show actions menu for pending client (status 100) — 3.5s
✅ Client View & Status Transitions › should show actions menu for active client (status 300) — 3.3s
✅ Client View & Status Transitions › should show actions menu for closed client (status 600) — 3.8s
✅ Client View & Status Transitions › should show New Account menu for active client — 3.4s
✅ Client View & Status Transitions › should navigate from client view to client list via breadcrumb — 3.1s
✅ Client View & Status Transitions › should navigate back from client view — 4.5s
✅ Client View Tabs › should display all expected tabs on client view — 3.6s
✅ Client View Tabs › should switch between client view tabs — 3.5s
✅ Search & Filter Interactions › should have search input on clients page and accept input — 1.8s
✅ Search & Filter Interactions › should have office filter on groups page — 2.6s
✅ Search & Filter Interactions › should have office filter on loans page — 1.9s
✅ Search & Filter Interactions › should have search input on charges page — 1.9s
✅ Navigation Flow Verification › should navigate full client lifecycle: list → create → back → list — 2.3s
✅ Navigation Flow Verification › should navigate from dashboard to all top-level pages via sidebar — 3.9s
✅ Navigation Flow Verification › should go from loan products → create → back — 2.8s
✅ Office CRUD › should validate office create form — save disabled when empty — 2.0s
✅ Office CRUD › should validate office create form — save enabled when filled — 2.4s
✅ Office CRUD › should cancel office creation — 2.1s
✅ Organization Create Flows › staff create form loads — 2.1s
✅ Organization Create Flows › funds create form loads — 2.0s
✅ Organization Create Flows › payment types create form loads — 3.0s
✅ Accounting CRUD › accounting closure create form loads — 2.0s
✅ Accounting CRUD › accounting rule create form loads — 2.0s
✅ Accounting CRUD › financial activity mapping create form loads — 2.0s
✅ Accounting CRUD › charge create form loads — 2.0s
✅ Accounting CRUD › chart of accounts create form loads — 2.4s
✅ Settings CRUD › global configurations page has editable toggle — 1.8s
✅ Settings CRUD › holiday create form loads — 2.1s
✅ Settings CRUD › working days page has save button — 2.2s
✅ System CRUD › data table create form loads — 2.0s
✅ System CRUD › delinquency page has create buttons for ranges and buckets — 2.9s
✅ Security CRUD › role create form loads — 1.9s
✅ Security CRUD › audit logs search form has date range — 2.5s
✅ Security CRUD › audit logs list exports the loaded page as CSV — 2.1s
✅ Reporting — Run Report Flow › should navigate to report and verify report parameters — 2.7s
✅ Teller CRUD › teller create form loads — 3.0s
✅ Create Office Dialog from Client Form › should open create office dialog from client create form — 2.4s

global-search-nav-shortcuts.spec.ts

✅ Global search navigation shortcuts › offers a settings page the entity search cannot return — 2.0s
✅ Global search navigation shortcuts › navigates to the page behind a shortcut — 2.1s
✅ Global search navigation shortcuts › keeps the results open across the mousedown that starts a click, so a slow render cannot race the dropdown closed — 2.3s
✅ Global search navigation shortcuts › withholds a shortcut the user has no permission to reach — 3.4s

global-search-navigation.spec.ts

✅ Global search navigation › does not query the backend for a single character — 2.5s
✅ Global search navigation › sends one request for a phrase typed straight through — 2.9s
✅ Global search navigation › opens the client behind a client result — 2.2s
✅ Global search navigation › opens the loan behind a loan result — 2.7s
✅ Global search navigation › opens the savings account behind a savings result — 2.3s
✅ Global search navigation › clears the query and closes the dropdown after a selection — 3.0s
✅ Global search navigation › closes the dropdown when focus leaves without a selection — 2.1s
✅ Global search navigation › shows nothing rather than an empty dropdown when there are no matches — 2.4s

group-detail.spec.ts

✅ Group detail › asks for the associations, and shows every member rather than only the active ones — 3.5s
✅ Group detail › closes a group with the reason id and a Fineract-formatted date — 5.4s
✅ Group detail › does not offer a client who is already a member, and associates the one it does — 3.6s
✅ Group detail › unassigns a committee role by the assignment id, not the role id — 3.5s
✅ Group detail › offers a retry when the group cannot be loaded — 4.0s
✅ Group detail › says so when no closure reason has been defined — 4.0s

guidance-tour-dashboard.spec.ts

✅ highlights the System Status card, not the sidebar, on the dashboard tour — 2.1s

keyboard-shortcuts.spec.ts

✅ Alt+C jumps straight to Create Client from anywhere — 2.0s
✅ Alt+G jumps to Create Group — 1.8s
✅ Alt+E jumps to Create Center — 2.8s
✅ Alt+H opens the guidance tour for the current page — 1.6s
✅ typing in the global search box does not trigger the Create Client shortcut — 1.6s

list-pagination.spec.ts

✅ List pagination › advances through pages and back again — 3.2s
✅ List pagination › jumps to the last page — 4.0s
✅ List pagination › returns to the first page when a filter changes — 3.9s
✅ List pagination › returns to the first page when searching — 4.2s
✅ Profile › renders the signed-in user rather than hanging on a spinner — 3.7s
✅ Profile › shows an error when the profile cannot be loaded — 2.9s
✅ List load failure › reports the failure and reloads when the user retries — 3.1s
✅ List load failure › calendars: reports the failure and reloads when the user retries — 4.1s
✅ List load failure › accounting rules: reports the failure and reloads when the user retries — 3.4s

loan-portfolio-summary.spec.ts

✅ Loan Portfolio Summary › searching sends entities: loans and shows the grouped results — 3.2s
✅ Loan Portfolio Summary › Edit Parameters returns from the results view to the filter form — 4.0s
✅ Loan Portfolio Summary › checking the outstanding-amount filter sends the between min/max values — 3.2s
✅ Loan Portfolio Summary › switching to a single-value comparison condition sends one value — 3.6s

loan-product-down-payment.spec.ts

✅ Loan product down payment and tranches › down payment is offered only for a progressive product — 4.4s
✅ Loan product down payment and tranches › the percentage and auto-repayment appear only once down payment is on — 5.3s
✅ Loan product down payment and tranches › multi-tranche disbursement reveals its tranche count, on either engine — 4.2s
✅ Loan product down payment and tranches › submits the down payment and tranche settings it was given — 4.3s
✅ Loan product down payment and tranches › does not send a down payment on a cumulative product — 5.0s
✅ Loan product down payment and tranches › income recognition is offered only for a progressive product — 4.6s
✅ Loan product down payment and tranches › the capitalisation details appear only once it is on — 4.0s
✅ Loan product down payment and tranches › submits the income recognition settings it was given — 4.1s
✅ Loan product down payment and tranches › does not send income recognition on a cumulative product — 5.7s
✅ Loan product down payment and tranches › interest recalculation reveals its mandatory settings only once it is on — 3.1s
✅ Loan product down payment and tranches › the rest interval appears only when the frequency is not the repayment period — 14.3s
✅ Loan product down payment and tranches › submits the interest recalculation settings it was given — 4.0s
✅ Loan product down payment and tranches › does not send recalculation settings once it is switched back off — 3.3s

client-empty-account-cta.spec.ts

✅ empty account tabs offer the matching creation action — 6.2s

loan-schedule-type-gating.spec.ts

✅ Loan schedule type gating › a cumulative loan offers neither progressive-only tab, and fetches neither — 2.9s
✅ Loan schedule type gating › a progressive loan shows only the capabilities it actually has — 3.7s
✅ Loan schedule type gating › a progressive loan with both capabilities shows both — 2.9s
✅ Loan schedule type gating › a charged-off loan says so and offers the reversal instead — 3.0s
✅ Loan schedule type gating › a healthy loan offers charge-off and no marker — 3.7s

loan-servicing-gaps.spec.ts

✅ Loan servicing gaps › edits an interest pause through PUT while preserving its existing dates — 4.1s
✅ Loan servicing gaps › undo approval sends an empty body, without the locale the platform refuses — 4.0s
✅ Loan servicing gaps › undo approval carries the reason when one was given — 4.9s
✅ Loan servicing gaps › undo approval is offered only while the loan is approved — 3.3s
✅ Loan servicing gaps › the delinquency tab shows the summary the loan carries and the tags it fetches — 3.4s
✅ Loan servicing gaps › the data-only tabs stay hidden when the loan carries nothing for them — 3.8s
✅ Loan servicing gaps › each data-only tab appears and renders once the loan carries its data — 3.6s
✅ Loan servicing gaps › disburse to savings sends the date and amount, with the platform date format — 4.1s
✅ Loan servicing gaps › disburse to savings is offered only on an approved loan — 3.8s
✅ Loan servicing gaps › unassign loan officer sends the date, and appears only when one is assigned — 4.2s
✅ Loan servicing gaps › unassign loan officer is hidden on a loan with no officer — 3.3s
✅ Loan servicing gaps › undo last disbursal appears only on a multi-disbursal loan, and sends an empty body — 4.4s
✅ Loan servicing gaps › undo last disbursal is hidden on a single-disbursal loan — 3.4s
✅ Loan servicing gaps › close as rescheduled is offered on an active loan — 3.3s

rbac-feature-flag.spec.ts

✅ RBAC permission gating (rbacEnabled = true) › a limited user does not see permission-gated nav groups — 1.6s
✅ RBAC permission gating (rbacEnabled = true) › a user with READ_USER sees only the Security entries that permission covers — 2.1s
✅ RBAC permission gating (rbacEnabled = true) › the Security group fills in as the user is granted each of its permissions — 1.4s
✅ RBAC permission gating (rbacEnabled = true) › a superuser (ALL_FUNCTIONS) sees all permission-gated groups — 1.6s
✅ RBAC institution-feature gating (rbacEnabled = true) › universal institution shows Groups, Centers and Collection Sheet — 1.6s
✅ RBAC institution-feature gating (rbacEnabled = true) › commercial bank (cb) hides all group-lending features — 1.6s
✅ RBAC institution-feature gating (rbacEnabled = true) › credit union (cu) shows Groups but hides Centers and Collection Sheet — 1.6s
✅ rbacEnabled = false › restores the pre-RBAC behaviour of showing everything — 2.7s
✅ deployment navigation overrides › removes the entries the deployment names by id, leaving the rest alone — 1.6s
✅ deployment navigation overrides › ignores a labelKey where an id is required — 1.6s
✅ deployment navigation overrides › removes them even where RBAC is off — 1.7s

rbac-route-protection.spec.ts

✅ route authorization › a superuser reaches every sampled route and sees the full navigation — 12.8s
✅ route authorization › a single-module user is confined to that module — 9.3s
✅ route authorization › a read-only user gets the lists and not the forms — 10.8s
✅ route authorization › a user with an empty permission list is refused everywhere and the app still works — 9.3s
✅ route authorization › a session carrying no permissions field is treated as carrying none — 4.8s
✅ route authorization › an unrecognised permission code grants nothing — 5.7s
✅ route authorization › an unauthenticated visitor is asked to sign in, not told they are forbidden — 5.2s
✅ route authorization › a deployment with RBAC turned off behaves as it did before the guard — 7.8s
✅ the Access Denied page › says what happened, under a single heading — 3.1s
✅ the Access Denied page › moves focus to the heading, since the user did not ask to come here — 3.0s
✅ the Access Denied page › announces itself politely — 4.0s
✅ the Access Denied page › names the permissions the screen wanted, so the user can ask for them — 3.1s
✅ the Access Denied page › offers a way back that the user is allowed to take — 3.2s
✅ the Access Denied page › is reachable by keyboard alone — 4.3s
✅ permission feedback › a visible nav entry says what the user can do in that module — 1.4s
✅ permission feedback › a nav entry carries no hint when there is nothing specific to say — 1.5s
✅ navigation and routes agree › a hidden menu entry is also refused by URL, and a shown one is not — 4.9s
✅ navigation and routes agree › the create button is withheld from a user whose create route would refuse them — 4.2s

report-enhancements.spec.ts

✅ Report Enhancements, Pagination, and Help Tour › should run report, show paginated data, and download CSV — 3.8s
✅ Report Enhancements, Pagination, and Help Tour › should trigger guidance help tour and navigate steps — 2.1s

reporting.spec.ts

✅ Reporting › should display list of reports — 1.8s
✅ Reporting › should navigate to run report page — 2.0s

scheduler-jobs.spec.ts

✅ Scheduler Jobs bulk run › Run Selected is disabled until a job is checked — 3.5s
✅ Scheduler Jobs bulk run › Select All checks every job, and running confirms then triggers each one — 3.4s
✅ Scheduler Jobs bulk run › declining the confirmation runs nothing — 2.9s

two-factor-authentication.spec.ts

✅ two-step verification › asks for a code and lets the user in once it is accepted — 1.6s
✅ two-step verification › sends the token on every later request — 1.6s
✅ two-step verification › keeps the user on the step when the code is wrong, and says why — 2.0s
✅ two-step verification › accepts a correct code after a wrong one — 1.7s
✅ two-step verification › offers the choice when there is more than one channel — 1.3s
✅ two-step verification › says so when the account has no channel configured — 1.3s
✅ two-step verification › returns to the choice when the code could not be sent — 1.3s
✅ two-step verification › does not let a half-finished session reach the application — 3.8s
✅ two-step verification › backing out returns to the password form — 1.3s
✅ two-step verification › a deployment without a second factor signs in exactly as before — 1.5s

working-capital-loan-actions.spec.ts

✅ Working Capital loan delinquency, breach and near-breach actions, and originators › shows delinquency action history and submits a new one — 4.0s
✅ Working Capital loan delinquency, breach and near-breach actions, and originators › shows breach action history and submits a new one — 5.4s
✅ Working Capital loan delinquency, breach and near-breach actions, and originators › shows near-breach action history and submits a new one — 4.4s
✅ Working Capital loan delinquency, breach and near-breach actions, and originators › attaches and detaches a loan originator — 3.6s
✅ Working Capital loan delinquency, breach and near-breach actions, and originators › adds a new charge and waives an existing one — 5.0s
✅ Working Capital loan delinquency, breach and near-breach actions, and originators › shows rate-change history, amortization schedule, and delinquency range tags — 3.3s
✅ Working Capital loan delinquency, breach and near-breach actions, and originators › marks the loan as fraud, applies a discount, and changes the payment rate — 5.0s

Slowest 10 — what the shard counts should be tuned against

Test	Spec	Time
Loan product down payment and tranches › the rest interval appears only when the frequency is not the repayment period	`loan-product-down-payment.spec.ts`	14.3s
route authorization › a superuser reaches every sampled route and sees the full navigation	`rbac-route-protection.spec.ts`	12.8s
route authorization › a read-only user gets the lists and not the forms	`rbac-route-protection.spec.ts`	10.8s
route authorization › a user with an empty permission list is refused everywhere and the app still works	`rbac-route-protection.spec.ts`	9.3s
route authorization › a single-module user is confined to that module	`rbac-route-protection.spec.ts`	9.3s
route authorization › a deployment with RBAC turned off behaves as it did before the guard	`rbac-route-protection.spec.ts`	7.8s
empty account tabs offer the matching creation action	`client-empty-account-cta.spec.ts`	6.2s
Runtime accessibility › create office dialog has no blocking violations	`accessibility.spec.ts`	5.7s
route authorization › an unrecognised permission code grants nothing	`rbac-route-protection.spec.ts`	5.7s
Loan product down payment and tranches › does not send income recognition on a cumulative product	`loan-product-down-payment.spec.ts`	5.7s

📼 Download the HTML report, videos and traces — see the playwright-report-mocked artifact.

_{Generated by run 34031120367 from c24f3a9.}

github-actions · 2026-09-06T11:54:45Z

E2E — real Fineract

🎭 E2E Tests

✅ All green — 77 passed · 0 failed · 0 skipped, across 23 spec files in 7m 1s.

By spec file

Spec	✅	Time
backend.setup.ts	3	5.0s
batch-api-operations.spec.ts	5	22.6s
center-servicing.spec.ts	2	15.8s
client-transfer.spec.ts	4	40.6s
deposit-account-servicing.spec.ts	3	22.1s
deposit-product-configuration.spec.ts	3	12.8s
group-membership.spec.ts	3	40.4s
loan-account-actions.spec.ts	3	19.9s
loan-charge-off.spec.ts	2	16.2s
loan-product-accounting.spec.ts	1	28.7s
loan-servicing.spec.ts	2	15.9s
login.spec.ts	4	5.5s
parity-screens.spec.ts	8	38.3s
rbac-backend-restricted-user.spec.ts	7	31.7s
rbac-multi-permission.spec.ts	9	50.5s
full-demo.spec.ts	1	1m 6s
loan-lifecycle.spec.ts	4	2m 7s
loan-schedule-type.spec.ts	3	36.2s
report-parameter-backend.spec.ts	4	23.3s
savings-transaction-correction.spec.ts	1	7.1s
share-account-servicing.spec.ts	2	18.0s
share-product-accounting.spec.ts	1	24.2s
teller-cash-management.spec.ts	2	36.7s

All 77 tests — click to expand

backend.setup.ts

✅ seed backend reference data — 1.4s
✅ seed backend reference data — 1.7s
✅ seed backend reference data — 2.0s

batch-api-operations.spec.ts

✅ Batch API Operations against Fineract › runs the sample batch scenario — create client, create loan, add and read back a charge — 4.7s
✅ Batch API Operations against Fineract › shows a parse error instead of submitting when the batch input is not valid JSON — 6.2s
✅ Batch API enclosingTransaction semantics against Fineract › rolls back the earlier steps when enclosingTransaction is true and a later step fails — 3.7s
✅ Batch API enclosingTransaction semantics against Fineract › does not roll back the earlier steps when enclosingTransaction is false and a later step fails — 4.1s
✅ Batch API Operations on a mobile viewport against Fineract › the sample batch scenario is reachable and works by touch at mobile width — 3.8s

center-servicing.spec.ts

✅ Center servicing › a center is activated, staffed and given a group — 11.8s
✅ Center servicing › notes are recorded against the center — 4.0s

client-transfer.spec.ts

✅ Client transfer between offices › a proposed transfer is held until the destination accepts, and then the client moves — 10.6s
✅ Client transfer between offices › a rejected transfer leaves the client on hold, and withdrawing is the way back — 10.4s
✅ Client transfer between offices › a client can be transferred in one step when the user may act for both offices — 9.4s
✅ Client staff assignment › an officer can be assigned and then removed — 10.2s

deposit-account-servicing.spec.ts

✅ Term deposit account servicing › an account is approved, activated and closed before maturity — 9.4s
✅ Term deposit account servicing › a deposit is recorded, listed, and reversed without leaving the list — 8.0s
✅ Term deposit account servicing › an application can be rejected instead of approved — 4.6s

deposit-product-configuration.spec.ts

✅ Deposit product configuration › a fixed deposit product survives being edited — 4.5s
✅ Deposit product configuration › a recurring deposit product can be created at all — 3.5s
✅ Deposit product configuration › a savings product carries its accounting configuration — 4.8s

group-membership.spec.ts

✅ Group membership and lifecycle › a group is activated, staffed, given members and a committee, then emptied — 17.5s
✅ Group membership and lifecycle › notes are recorded against the group and can be removed again — 6.6s
✅ Group membership and lifecycle › an empty group is closed with a reason, and a group with members is refused — 16.3s

loan-account-actions.spec.ts

✅ Loan account lifecycle actions › new action menu items appear only for active loans — 6.3s
✅ Loan account lifecycle actions › undo disbursal shows a confirm dialog and reverts the loan to Approved — 7.0s
✅ Loan account lifecycle actions › write off requires confirmation and moves the loan out of Active status — 6.6s

loan-charge-off.spec.ts

✅ Loan servicing commands › charges a loan off through the UI and reverses it — 8.7s
✅ Loan servicing commands › records a goodwill credit through the shared transaction form — 7.5s

loan-product-accounting.spec.ts

✅ Loan product accounting › a cash-accounting product is configured, round-trips on edit, and posts to the ledger — 28.7s

loan-servicing.spec.ts

✅ Loan servicing: notes and transaction adjustment › notes can be added and removed, with a confirm dialog on delete — 8.4s
✅ Loan servicing: notes and transaction adjustment › a repayment transaction can be viewed and adjusted with a corrected amount — 7.5s

login.spec.ts

✅ Login › login page displays correctly — 2.0s
✅ Login › login form has required fields — 1.1s
✅ Login › submit button is disabled when form is empty — 1.2s
✅ Login › submit button is enabled when form is filled — 1.2s

parity-screens.spec.ts

✅ Screens added for platform parity › a manual journal entry can be read whole and reversed — 4.9s
✅ Screens added for platform parity › an entry that is already reversed is not offered again — 3.8s
✅ Screens added for platform parity › a report definition can be created, edited and deleted; a core one cannot — 5.5s
✅ Screens added for platform parity › a core report opens read-only with only its in-use setting — 3.7s
✅ Screens added for platform parity › a pending loan is approved from the queue, in a batch — 6.3s
✅ Screens added for platform parity › a fixed deposit is listed as a deposit, not as a savings account — 3.9s
✅ Screens added for platform parity › an office has a screen, and it carries its custom fields — 4.7s
✅ Screens added for platform parity › a savings account carries notes, and the note survives a reload — 5.5s

rbac-backend-restricted-user.spec.ts

✅ a genuinely restricted Fineract user › holds exactly the permissions their role was granted — 202ms
✅ a genuinely restricted Fineract user › reaches the screen their permission covers — 4.6s
✅ a genuinely restricted Fineract user › is refused a screen their permission does not cover, by URL and by the backend — 4.1s
✅ a genuinely restricted Fineract user › is refused a write screen they can read the list for, and the write itself — 6.5s
✅ a genuinely restricted Fineract user › is not offered the actions it would be refused for — 3.3s
✅ a genuinely restricted Fineract user › is shown an action it cannot take, disabled and saying what it needs — 5.7s
✅ a genuinely restricted Fineract user › the superuser the rest of the suite uses is unaffected — 7.4s

rbac-multi-permission.spec.ts

✅ a route declaring more than one permission code (OR semantics) › is admitted by either declared code alone — 4.4s
✅ a route declaring more than one permission code (OR semantics) › is admitted by the other declared code alone — 3.9s
✅ a route declaring more than one permission code (OR semantics) › is refused when holding neither declared code, by the router and by the backend — 5.0s
✅ ALL_FUNCTIONS_READ, against the real Fineract permission catalogue › reaches read screens across modules it holds no specific code for — 7.3s
✅ ALL_FUNCTIONS_READ, against the real Fineract permission catalogue › is refused every write screen, and the writes themselves — 6.2s
✅ a restricted session across a real page reload › keeps the same permission boundary after reloading, not just after a fresh login — 8.7s
✅ a second real action-level gate, distinct from loan repayment › is shown the Approve action disabled and naming what it needs, refused by the backend too — 5.3s
✅ Security module writes (users, roles), against the real backend › reaches the list screens but is refused the write screens — 9.4s
✅ Security module writes (users, roles), against the real backend › is refused creating a user and modifying a role, by the backend itself — 276ms

full-demo.spec.ts

✅ Full feature demo recording › walk through loan schedule type, lifecycle, custom fields, collateral, and disbursement — 1m 6s

loan-lifecycle.spec.ts

✅ Loan lifecycle: creation, approval, disbursement › create, approve, and disburse a Cumulative loan — 33.3s
✅ Loan lifecycle: creation, approval, disbursement › create, approve, and disburse a Progressive loan — 34.1s
✅ Loan lifecycle: creation, approval, disbursement › an approved loan can be returned to pending approval — 30.4s
✅ Loan lifecycle: creation, approval, disbursement › the delinquency tab reads a real loan, and the empty data tabs stay hidden — 29.2s

loan-schedule-type.spec.ts

✅ Loan Schedule Type (Cumulative vs Progressive) › loan products list shows a schedule type chip per product — 9.5s
✅ Loan Schedule Type (Cumulative vs Progressive) › create a Progressive loan product end-to-end and verify it round-trips — 16.0s
✅ Loan Schedule Type (Cumulative vs Progressive) › loan creation shows the schedule type badge for a Progressive product — 10.8s

report-parameter-backend.spec.ts

✅ Dynamic report parameters against Fineract › keeps the parameter form available when a report has cascading lookups — 5.0s
✅ Dynamic report parameters against Fineract › changing Office changes the Client Listing row set — 6.4s
✅ Cascading report parameters against Fineract › sends the parent value to the child lookup and clears the child when it changes — 7.9s
✅ Chart reports against Fineract › renders a chart report as a chart rather than a table — 4.0s

savings-transaction-correction.spec.ts

✅ Savings transaction correction › a deposit is reversed and a hold is released — 7.1s

share-account-servicing.spec.ts

✅ Share account servicing › an account is approved, activated, traded and closed — 11.9s
✅ Share account servicing › an application can be rejected — 6.1s

share-product-accounting.spec.ts

✅ Share product accounting › a share product is mapped to equity and round-trips on edit — 24.2s

teller-cash-management.spec.ts

✅ Teller cash management › a cashier is listed, receives an allocation, and settles cash back — 25.0s
✅ Teller cash management › settling more than the cashier holds is refused and the form stays usable — 11.7s

Slowest 10 — what the shard counts should be tuned against

Test	Spec	Time
Full feature demo recording › walk through loan schedule type, lifecycle, custom fields, collateral, and disbursement	`full-demo.spec.ts`	1m 6s
Loan lifecycle: creation, approval, disbursement › create, approve, and disburse a Progressive loan	`loan-lifecycle.spec.ts`	34.1s
Loan lifecycle: creation, approval, disbursement › create, approve, and disburse a Cumulative loan	`loan-lifecycle.spec.ts`	33.3s
Loan lifecycle: creation, approval, disbursement › an approved loan can be returned to pending approval	`loan-lifecycle.spec.ts`	30.4s
Loan lifecycle: creation, approval, disbursement › the delinquency tab reads a real loan, and the empty data tabs stay hidden	`loan-lifecycle.spec.ts`	29.2s
Loan product accounting › a cash-accounting product is configured, round-trips on edit, and posts to the ledger	`loan-product-accounting.spec.ts`	28.7s
Teller cash management › a cashier is listed, receives an allocation, and settles cash back	`teller-cash-management.spec.ts`	25.0s
Share product accounting › a share product is mapped to equity and round-trips on edit	`share-product-accounting.spec.ts`	24.2s
Group membership and lifecycle › a group is activated, staffed, given members and a committee, then emptied	`group-membership.spec.ts`	17.5s
Group membership and lifecycle › an empty group is closed with a reason, and a group with members is refused	`group-membership.spec.ts`	16.3s

📼 Download the HTML report, videos and traces — see the playwright-report-backend artifact.

_{Generated by run 34031120367 from c24f3a9.}

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 6, 2026

dependabot Bot mentioned this pull request Sep 6, 2026

build(deps): bump github/codeql-action/analyze from 4.37.7 to 4.37.8 #470

Closed

Navigation Menu

Uh oh!

build(deps): bump github/codeql-action/analyze from 4.37.7 to 4.37.9 - #518

build(deps): bump github/codeql-action/analyze from 4.37.7 to 4.37.9#518
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github/codeql-action/analyze-4.37.9

dependabot Bot commented on behalf of github Sep 6, 2026

Uh oh!

github-actions Bot commented Sep 6, 2026

Uh oh!

github-actions Bot commented Sep 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 6, 2026

v4.37.9

v4.37.8

CodeQL Action Changelog

[UNRELEASED]

4.37.9 - 26 Aug 2026

4.37.8 - 21 Aug 2026

4.37.7 - 13 Aug 2026

4.37.6 - 04 Aug 2026

4.37.5 - 03 Aug 2026

4.37.4 - 29 Jul 2026

4.37.3 - 22 Jul 2026

4.37.2 - 21 Jul 2026

4.37.1 - 16 Jul 2026

4.37.0 - 08 Jul 2026

Uh oh!

github-actions Bot commented Sep 6, 2026

E2E — mocked backend

🎭 E2E Tests

By spec file

Uh oh!

github-actions Bot commented Sep 6, 2026

E2E — real Fineract

🎭 E2E Tests

By spec file

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants