Bump version from 2.13.0 to 2.13.1

Just an empty release to get the actions run correctly on tagging.
Fixes issue #1430

.docker/frankenphp/Caddyfile

@@ -51,6 +51,15 @@
 	# Disable Topics tracking if not enabled explicitly: https://github.com/jkarlin/topics
 	header ?Permissions-Policy "browsing-topics=()"
 
+	# Set a strict CSP and nosniff for all static assets not handled by PHP.
+	# ? means "set only if not already present", so PHP responses carrying a Nelmio CSP are left untouched.
+	header ?Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; sandbox;"
+	header ?X-Content-Type-Options "nosniff"
+
+	# SVG files get a slightly different CSP because they can embed resources and must not be framed.
+	@svg path *.svg *.svg.gz *.svg.br
+	header @svg Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'; sandbox;"
+
 	# Prevent PHP execution in the media upload directory
 	@php_in_media path_regexp (?i)^/media/.*\.(php[3-8]?|phar|phtml|pht|phps)$
 	respond @php_in_media 403

.env

@@ -149,6 +149,16 @@ DISABLE_YEAR2038_BUG_CHECK=0
 #TRUSTED_PROXIES=127.0.0.0/8,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
 #TRUSTED_HOSTS='^(localhost|example\.com)$'
 
+###################################################################################
+# Logging settings
+###################################################################################
+
+# The minimum level a deprecation notice must have to be written to the var/log/<env>_deprecations.log file.
+# Deprecation notices are logged with level "info", so this disables the deprecation log by default.
+# Set to debug to log all deprecation notices
+DEPRECATION_LOG_LEVEL=emergency
+
+
 
 ###> symfony/lock ###
 # Choose one of the stores below

.github/workflows/assets_artifact_build.yml

@@ -27,7 +27,7 @@ jobs:
       APP_ENV: prod
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Setup PHP
         uses: shivammathur/setup-php@v2

.github/workflows/docker_build.yml

@@ -32,7 +32,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       -
         name: Docker meta
         id: docker_meta

.github/workflows/docker_frankenphp.yml

@@ -32,7 +32,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       -
         name: Docker meta
         id: docker_meta

.github/workflows/static_analysis.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Setup PHP
       uses: shivammathur/setup-php@v2

.github/workflows/tests.yml

@@ -46,7 +46,7 @@ jobs:
         if: matrix.db-type == 'postgres'
 
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
@@ -129,7 +129,7 @@ jobs:
         run: ./bin/phpunit --coverage-clover=coverage.xml
 
       - name: Upload coverage
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@v7
         with:
           env_vars: PHP_VERSION,DB_TYPE
           token: ${{ secrets.CODECOV_TOKEN }}

Dockerfile

@@ -193,7 +193,7 @@ RUN a2dissite 000-default.conf && \
     a2enmod proxy_fcgi setenvif && \
     a2enconf php${PHP_VERSION}-fpm && \
     a2enconf docker-php && \
-    a2enmod rewrite
+    a2enmod rewrite headers
 
 # Install composer and yarn dependencies for Part-DB
 USER www-data

VERSION

@@ -1 +1 @@
-2.12.1
+2.13.1

assets/controllers/common/dirty_form_controller.js

@@ -19,8 +19,7 @@
 
 import {Controller} from "@hotwired/stimulus";
 import {visit} from "@hotwired/turbo";
-import * as bootbox from "bootbox";
-import "../../css/components/bootbox_extensions.css";
+import {ConfirmSwal} from "../../helpers/swal";
 import "../../css/components/dirty_form.css";
 
 /**
@@ -207,11 +206,10 @@ export default class extends Controller {
     }
 
     _confirmNavigation(onConfirm) {
-        bootbox.confirm({
-            title: this.confirmTitleValue,
-            message: this.confirmMessageValue,
-            callback: (result) => { if (result) onConfirm(); }
-        });
+        ConfirmSwal.fire({
+            titleText: this.confirmTitleValue,
+            text: this.confirmMessageValue,
+        }).then(({isConfirmed}) => { if (isConfirmed) onConfirm(); });
     }
 
     _handleLinkClick(event) {

assets/controllers/common/hide_sidebar_controller.js

@@ -51,7 +51,7 @@ export default class extends Controller {
 
         //Make the state persistent over reloads
         if(localStorage.getItem(STORAGE_KEY) === 'true') {
-            sidebarHide();
+            this.hideSidebar();
         }
     }
 

assets/controllers/elements/collection_type_controller.js

@@ -19,8 +19,7 @@
 
 import {Controller} from "@hotwired/stimulus";
 
-import * as bootbox from "bootbox";
-import "../../css/components/bootbox_extensions.css";
+import {AlertSwal, ConfirmSwal} from "../../helpers/swal";
 import accept from "attr-accept";
 
 export default class extends Controller {
@@ -62,7 +61,7 @@ export default class extends Controller {
 
         if(!prototype) {
             console.warn("Prototype is not set, we cannot create a new element. This is most likely due to missing permissions.");
-            bootbox.alert("You do not have the permissions to create a new element. (No protoype element is set)");
+            AlertSwal.fire({"text": "You do not have the permissions to create a new element. (No protoype element is set)"});
             return;
         }
 
@@ -226,8 +225,10 @@ export default class extends Controller {
         }
 
         if(this.deleteMessageValue) {
-            bootbox.confirm(this.deleteMessageValue, (result) => {
-                if (result) {
+            ConfirmSwal.fire({
+                text: this.deleteMessageValue,
+            }).then(({isConfirmed}) => {
+                if (isConfirmed) {
                     del();
                 }
             });

assets/controllers/elements/datatables/datatables_controller.js

@@ -38,9 +38,7 @@ import 'datatables.net-colreorder-bs5';
 import 'datatables.net-responsive-bs5';
 import '../../../js/lib/datatables';
 
-//import 'datatables.net-select-bs5';
-//Use the local version containing the fix for the select extension
-import '../../../js/lib/dataTables.select.mjs';
+import 'datatables.net-select-bs5';
 
 
 const EVENT_DT_LOADED = 'dt:loaded';

assets/controllers/elements/datatables/parts_controller.js

@@ -20,7 +20,7 @@
 import DatatablesController from "./datatables_controller.js";
 import TomSelect from "tom-select";
 
-import * as bootbox from "bootbox";
+import {ConfirmSwal} from "../../../helpers/swal";
 
 /**
  * This is the datatables controller for parts lists
@@ -146,16 +146,18 @@ export default class extends DatatablesController {
             bubbles: true, //This line is important, otherwise Turbo will not receive the event
         });
 
-        const confirm = bootbox.confirm({
-            message: message, title: title, callback: function (result) {
+        ConfirmSwal.fire({
+            titleText: title,
+            text: message,
+            icon: "warning"
+        }).then(({isConfirmed}) => {
             //If the dialog was confirmed, then submit the form.
-                if (result) {
+            if (isConfirmed) {
                 that._confirmed = true;
                 form.dispatchEvent(that._our_event);
             } else {
                 that._confirmed = false;
             }
-            }
         });
     }
 }

assets/controllers/elements/delete_btn_controller.js

@@ -19,8 +19,7 @@
 
 import {Controller} from "@hotwired/stimulus";
 
-import * as bootbox from "bootbox";
-import "../../css/components/bootbox_extensions.css";
+import {ConfirmSwal} from "../../helpers/swal";
 
 export default class extends Controller
 {
@@ -48,10 +47,12 @@ export default class extends Controller
         const submitter = event.submitter;
         const that = this;
 
-        const confirm = bootbox.confirm({
-            message: message, title: title, callback: function (result) {
+        ConfirmSwal.fire({
+            titleText: title,
+            html: message, //Message contains a <br> tag and no user injectable HTML
+        }).then(({isConfirmed}) => {
             //If the dialog was confirmed, then submit the form.
-                if (result) {
+            if (isConfirmed) {
                 //Set a flag to prevent the dialog from popping up again and allowing turbo to submit the form
                 that._confirmed = true;
 
@@ -73,7 +74,6 @@ export default class extends Controller
             } else {
                 that._confirmed = false;
             }
-            }
         });
     }
 }

assets/controllers/elements/link_confirm_controller.js

@@ -19,8 +19,7 @@
 
 import {Controller} from "@hotwired/stimulus";
 
-import * as bootbox from "bootbox";
-import "../../css/components/bootbox_extensions.css";
+import {ConfirmSwal} from "../../helpers/swal";
 
 export default class extends Controller
 {
@@ -53,11 +52,11 @@ export default class extends Controller
 
         const that = this;
 
-        bootbox.confirm({
-            title: this.titleValue,
-            message: this.messageValue,
-            callback: (result) => {
-                if (result) {
+        ConfirmSwal.fire({
+            titleText: this.titleValue,
+            text: this.messageValue,
+        }).then(({isConfirmed}) => {
+            if (isConfirmed) {
                 //Set a flag to prevent the dialog from popping up again and allowing turbo to submit the form
                 that._confirmed = true;
 
@@ -66,7 +65,6 @@ export default class extends Controller
             } else {
                 that._confirmed = false;
             }
-            }
         });
     }
 }

assets/controllers/elements/password_strength_estimate_controller.js

@@ -19,12 +19,14 @@
 
 
 import {Controller} from "@hotwired/stimulus";
-import { zxcvbn, zxcvbnOptions } from '@zxcvbn-ts/core';
+import { ZxcvbnFactory } from '@zxcvbn-ts/core';
 import * as zxcvbnCommonPackage from '@zxcvbn-ts/language-common';
 import * as zxcvbnEnPackage from '@zxcvbn-ts/language-en';
 import * as zxcvbnDePackage from '@zxcvbn-ts/language-de';
 import * as zxcvbnFrPackage from '@zxcvbn-ts/language-fr';
 import * as zxcvbnJaPackage from '@zxcvbn-ts/language-ja';
+import * as zxcvbnItPackage from '@zxcvbn-ts/language-it';
+import * as zxcvbnPlPackage from '@zxcvbn-ts/language-pl';
 import {trans} from '../../translator.js';
 
 /* stimulusFetch: 'lazy' */
@@ -34,6 +36,8 @@ export default class extends Controller {
 
     static targets = ["badge", "warning"]
 
+    _zxcvbnFactory;
+
     _getTranslations() {
         //Get the current locale
         const locale = document.documentElement.lang;
@@ -43,6 +47,10 @@ export default class extends Controller {
             return zxcvbnFrPackage.translations;
         } else if (locale.includes('ja')) {
             return zxcvbnJaPackage.translations;
+        } else if (locale.includes('it')) {
+            return zxcvbnItPackage.translations;
+        } else if (locale.includes('pl')) {
+            return zxcvbnPlPackage.translations;
         }
 
         //Fallback to english
@@ -56,34 +64,39 @@ export default class extends Controller {
         //Configure zxcvbn
         const options = {
             graphs: zxcvbnCommonPackage.adjacencyGraphs,
+            useLevenshtein: true,
             dictionary: {
                 ...zxcvbnCommonPackage.dictionary,
                 // We could use the english dictionary here too, but it is very big. So we just use the common words
-                //...zxcvbnEnPackage.dictionary,
+                ...zxcvbnEnPackage.dictionary,
+                ...zxcvbnDePackage.dictionary,
+
+                "partdb": ['part-db', 'partdb', 'part_db', 'part-db-symfony', 'partdb-symfony', 'part_db_symfony'],
             },
             translations: this._getTranslations(),
         };
-        zxcvbnOptions.setOptions(options);
+
+        this._zxcvbnFactory = new ZxcvbnFactory(options);
 
         //Add event listener to the password input field
         this._passwordInput.addEventListener('input', this._onPasswordInput.bind(this));
     }
 
-    _onPasswordInput() {
+    async _onPasswordInput() {
         //Retrieve the password
         const password = this._passwordInput.value;
 
         //Estimate the password strength
-        const result = zxcvbn(password);
+        const result = await this._zxcvbnFactory.checkAsync(password);
 
         //Update the badge
         this.badgeTarget.parentElement.classList.remove("d-none");
-        this._setBadgeToLevel(result.score);
+        this._setBadgeToLevel(result.score, result.crackTimes.onlineNoThrottlingXPerSecond.display);
 
         this.warningTarget.innerHTML = result.feedback.warning;
     }
 
-    _setBadgeToLevel(level) {
+    _setBadgeToLevel(level, time = null) {
         let text, classes;
 
         switch (level) {
@@ -118,5 +131,11 @@ export default class extends Controller {
         //Re-add the classes
         this.badgeTarget.classList.add("badge");
         this.badgeTarget.classList.add(...classes.split(" "));
+
+        if (time) {
+            this.badgeTarget.setAttribute("title", trans("user.password_strength.crack_time", {"%time%": time}));
+        } else {
+            this.badgeTarget.removeAttribute("title");
+        }
     }
 }

assets/controllers/pages/reelCalculator_controller.js

@@ -18,7 +18,7 @@
  */
 
 import {Controller} from "@hotwired/stimulus";
-import * as bootbox from "bootbox";
+import {AlertSwal} from "../../helpers/swal";
 
 export default class extends Controller {
 
@@ -35,12 +35,12 @@ export default class extends Controller {
         const part_distance = document.getElementById('reel_part_distance').value;
 
         if (dia_inner == "" || dia_outer == "" || tape_thickness == "") {
-            bootbox.alert(this.errorMissingValuesValue);
+            AlertSwal.fire({title: this.errorMissingValuesValue});
             return;
         }
 
         if (dia_outer**dia_outer < dia_inner**dia_inner) {
-            bootbox.alert(this.errorOuterGreaterInnerValue);
+            AlertSwal.fire({title: this.errorOuterGreaterInnerValue});
             return;
         }
 
@@ -61,12 +61,12 @@ export default class extends Controller {
             return;
         }
 
-        var parts_per_meter = 1 / (part_distance / 1000);
+        const parts_per_meter = 1 / (part_distance / 1000);
 
         document.getElementById('result_parts_per_meter').textContent = parts_per_meter.toFixed(2) + ' 1/m';
 
-        var parts_amount = (length/1000) * parts_per_meter;
+        const parts_amount = (length / 1000) * parts_per_meter;
 
-        document.getElementById('result_amount').textContent = Math.floor(parts_amount);
+        document.getElementById('result_amount').textContent = Math.floor(parts_amount).toString();
     }
 }

assets/css/components/swal.css

@@ -0,0 +1,50 @@
+/*
+ * This file is part of Part-DB (https://github.com/Part-DB/Part-DB-symfony).
+ *
+ *  Copyright (C) 2019 - 2026 Jan Böhmer (https://github.com/jbtronics)
+ *
+ *  This program is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU Affero General Public License as published
+ *  by the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU Affero General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Affero General Public License
+ *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/**
+ * Respect the dark mode of Bootstrap 5 set via data-bs-theme="dark" on the <html> element. This is done by overriding the CSS variables of the bootstrap-5 theme of SweetAlert2.
+ */
+
+html[data-bs-theme="dark"] [data-swal2-theme='bootstrap-5'] {
+    /* POPUP */
+    --swal2-background: #212529;
+    --swal2-color: #fff;
+    --swal2-border: 1px solid #495057;
+
+    /* INPUT */
+    --swal2-input-background: #2b3035;
+    --swal2-input-border: 1px solid #495057;
+    --swal2-input-focus-border: 1px solid #86b7fe;
+    --swal2-input-focus-box-shadow: inset 0 1px 2px rgba(0, 0, 0, 0.075), 0 0 0 0.25rem rgba(13, 110, 253, 0.25);
+
+    /* VALIDATION MESSAGE */
+    --swal2-validation-message-background: #2c0b0e;
+    --swal2-validation-message-color: #ea868f;
+
+    /* FOOTER */
+    --swal2-footer-border-color: #495057;
+    --swal2-footer-background: #343a40;
+    --swal2-footer-color: #adb5bd;
+
+    /* CLOSE BUTTON */
+    --swal2-close-button-color: #fff;
+
+    /* TOASTS */
+    --swal2-toast-border: 1px solid #495057;
+}

assets/helpers/swal.js

@@ -0,0 +1,44 @@
+/*
+ * This file is part of Part-DB (https://github.com/Part-DB/Part-DB-symfony).
+ *
+ *  Copyright (C) 2019 - 2022 Jan Böhmer (https://github.com/jbtronics)
+ *
+ *  This program is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU Affero General Public License as published
+ *  by the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU Affero General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Affero General Public License
+ *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import Swal from 'sweetalert2';
+import 'sweetalert2/themes/bootstrap-5.css';
+import '../css/components/swal.css'
+import { trans } from '../translator';
+
+const BaseSwal = Swal.mixin({
+    position: "top",
+    theme: "bootstrap-5",
+    confirmButtonText: trans('dialog.btn.ok'),
+    cancelButtonText: trans('dialog.btn.cancel'),
+    denyButtonText: trans('dialog.btn.deny'),
+});
+
+const ConfirmSwal = BaseSwal.mixin({
+    showCancelButton: true,
+    showCloseButton: true,
+    icon: "warning",
+});
+
+const AlertSwal = BaseSwal.mixin({
+    showCloseButton: true,
+    icon: "info",
+});
+
+export { ConfirmSwal, AlertSwal, BaseSwal, BaseSwal as default,};

assets/js/app.js

@@ -30,21 +30,21 @@ import '../css/app/images.css';
 // start the Stimulus application
 import '../stimulus_bootstrap';
 
-// Need jQuery? Install it with "yarn add jquery", then uncomment to require it.
-const $ = require('jquery');
+import $ from 'jquery';
 
 //Only include javascript
 import '@fortawesome/fontawesome-free/css/all.css'
 
-require('bootstrap');
+import 'bootstrap';
 
 import "./error_handler";
 import "./tab_remember";
 import "./register_events";
 import "./tristate_checkboxes";
 
-//Define jquery globally
-global.$ = global.jQuery = require("jquery");
+// Expose jQuery globally so legacy plugins and Bootstrap's jQuery integration
+// can find it on window at runtime.
+global.$ = global.jQuery = $;
 
 //Use the local WASM file for the ZXing library
 import {

assets/js/error_handler.js

@@ -17,7 +17,7 @@
  *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
-import * as bootbox from "bootbox";
+import Swal from "../helpers/swal";
 
 /**
  * If this class is imported the user is shown an error dialog if he calls an page via Turbo and an error is responded.
@@ -40,21 +40,6 @@ class ErrorHandlerHelper {
     _showAlert(statusText, statusCode, location, responseHTML)
     {
         const httpStatusToText = {
-            '200': 'OK',
-            '201': 'Created',
-            '202': 'Accepted',
-            '203': 'Non-Authoritative Information',
-            '204': 'No Content',
-            '205': 'Reset Content',
-            '206': 'Partial Content',
-            '300': 'Multiple Choices',
-            '301': 'Moved Permanently',
-            '302': 'Found',
-            '303': 'See Other',
-            '304': 'Not Modified',
-            '305': 'Use Proxy',
-            '306': 'Unused',
-            '307': 'Temporary Redirect',
             '400': 'Bad Request',
             '401': 'Unauthorized',
             '402': 'Payment Required',
@@ -83,49 +68,67 @@ class ErrorHandlerHelper {
             '505': 'HTTP Version Not Supported',
         };
 
-        //If the statusText is empty, we use the status code as text
-        if (!statusText) {
-            statusText = httpStatusToText[statusCode];
-        }
-
-        //Create error text
-        const title = statusText + ' (Status ' + statusCode + ')';
-
-        let trimString = function (string, length) {
-            return string.length > length ?
-                string.substring(0, length) + '...' :
-                string;
+        const userFriendlyMessages = {
+            '400': 'The request was invalid or malformed.',
+            '401': 'You need to log in to access this resource.',
+            '403': 'You don\'t have permission to access this resource.',
+            '404': 'The requested page or resource could not be found.',
+            '408': 'The request timed out. Please check your connection and try again.',
+            '409': 'There was a conflict with the current state of the resource.',
+            '429': 'Too many requests sent. Please wait a moment and try again.',
+            '500': 'An internal server error occurred. This is not your fault.',
+            '502': 'The server received an invalid response from an upstream service.',
+            '503': 'The service is temporarily unavailable. Please try again later.',
+            '504': 'The server did not respond in time. Please try again later.',
         };
 
-        const short_location = trimString(location, 50);
-
-        const alert = bootbox.alert(
-            {
-                size: 'large',
-                message: function() {
-                    let url = location;
-                    let msg = `Error calling <a href="${url}">${short_location}</a>.<br>`;
-                    msg += '<b>Try to reload the page or contact the administrator if this error persists.</b>';
-
-                    msg += '<br><br><a class=\"btn btn-outline-secondary mb-2\" data-bs-toggle=\"collapse\" href=\"#iframe_div\" >' + 'View details' + "</a>";
-                    msg += "<div class=\" collapse\" id='iframe_div'><iframe height='512' width='100%' id='error-iframe'></iframe></div>";
-
-                    return msg;
-                },
-                title: title,
-                callback: function () {
-                    //Remove blur
-                    $('#content').removeClass('loading-content');
+        if (!statusText) {
+            statusText = httpStatusToText[String(statusCode)] ?? 'Unknown Error';
         }
 
-            });
+        const title = `${statusText} <small class="text-muted fs-6">(HTTP ${statusCode})</small>`;
+        const friendlyMsg = userFriendlyMessages[String(statusCode)]
+            ?? 'An unexpected error occurred. Please try again or contact the administrator.';
 
-        alert.init(function (){
-            var dstFrame = document.getElementById('error-iframe');
+        const short_location = location.length > 80
+            ? location.substring(0, 80) + '…'
+            : location;
+
+        const msg = `
+            <p class="mb-3">${friendlyMsg}</p>
+            <p class="text-muted small mb-3">If this error keeps happening, please contact your administrator.</p>
+            <button class="btn btn-sm btn-outline-secondary" type="button" data-bs-toggle="collapse" data-bs-target="#swal-error-details" aria-expanded="false">
+                <i class="fas fa-code me-1"></i>Technical details
+            </button>
+            <div class="collapse mt-2" id="swal-error-details">
+                <iframe height="400" width="100%" id="error-iframe" style="border:1px solid var(--bs-border-color);border-radius:var(--bs-border-radius);"></iframe>
+            </div>`;
+
+        const footer = `<span class="text-muted small">Error while loading: <a href="${location}" class="text-muted text-decoration-none" style="opacity:0.7;">${short_location}</a></span>`;
+
+        Swal.fire({
+            icon: 'error',
+            title: title,
+            html: msg,
+            footer: footer,
+            width: '90%',
+            confirmButtonText: '<i class="fas fa-rotate-right me-1"></i>Reload page',
+            showCancelButton: true,
+            cancelButtonText: 'Close',
+            showCloseButton: true,
+            reverseButtons: true,
+            didOpen: () => {
+                const dstFrame = document.getElementById('error-iframe');
                 //@ts-ignore
-            var dstDoc = dstFrame.contentDocument || dstFrame.contentWindow.document;
-            dstDoc.write(responseHTML)
+                const dstDoc = dstFrame.contentDocument || dstFrame.contentWindow.document;
+                dstDoc.write(responseHTML);
                 dstDoc.close();
+            },
+        }).then((result) => {
+            document.getElementById('content').classList.remove('loading-content');
+            if (result.isConfirmed) {
+                window.location.reload();
+            }
         });
     }
 

assets/js/register_events.js

@@ -19,9 +19,8 @@
 
 'use strict';
 
-import {Dropdown} from "bootstrap";
+import {Dropdown, Modal, Tooltip} from "bootstrap";
 import ClipboardJS from "clipboard";
-import {Modal} from "bootstrap";
 
 class RegisterEventHelper {
     constructor() {
@@ -40,8 +39,6 @@ class RegisterEventHelper {
         });
 
         this.registerModalDropRemovalOnFormSubmit();
-
-
     }
 
     registerModalDropRemovalOnFormSubmit() {
@@ -83,11 +80,17 @@ class RegisterEventHelper {
 
     registerTooltips() {
         const handler = () => {
-            $(".tooltip").remove();
+            document.querySelectorAll('.tooltip').forEach(el => el.remove());
+
             //Exclude dropdown buttons from tooltips, otherwise we run into endless errors from bootstrap (bootstrap.esm.js:614 Bootstrap doesn't allow more than one instance per element. Bound instance: bs.dropdown.)
-            $('a[title], label[title], button[title]:not([data-bs-toggle="dropdown"]), p[title], span[title], h6[title], h3[title], i[title], small[title]')
-                //@ts-ignore
-                .tooltip("hide").tooltip({container: "body", placement: "auto", boundary: 'window'});
+            const tooltipSelector = 'a[title], label[title], button[title]:not([data-bs-toggle="dropdown"]), p[title], span[title], h6[title], h3[title], i[title], small[title]';
+            document.querySelectorAll(tooltipSelector).forEach(el => {
+                const existing = Tooltip.getInstance(el);
+                if (existing) {
+                    existing.dispose();
+                }
+                new Tooltip(el, {container: 'body', placement: 'auto', boundary: 'window'});
+            });
         };
 
         this.registerLoadHandler(handler);
@@ -95,9 +98,7 @@ class RegisterEventHelper {
     }
 
     registerSpecialCharInput() {
-        this.registerLoadHandler(() => {
-            //@ts-ignore
-            $("input[type=text], input[type=search]").unbind("keydown").keydown(function (event) {
+        const keydownHandler = function(event) {
             let use_special_char = event.altKey;
 
             let greek_char = "";
@@ -106,148 +107,148 @@ class RegisterEventHelper {
                 switch(event.key) {
                     //Greek letters
                     case "a": //Alpha (lowercase)
-                            greek_char = "\u03B1";
+                        greek_char = "α";
                         break;
                     case "A": //Alpha (uppercase)
-                            greek_char = "\u0391";
+                        greek_char = "Α";
                         break;
                     case "b": //Beta (lowercase)
-                            greek_char = "\u03B2";
+                        greek_char = "β";
                         break;
                     case "B": //Beta (uppercase)
-                            greek_char = "\u0392";
+                        greek_char = "Β";
                         break;
                     case "g": //Gamma (lowercase)
-                            greek_char = "\u03B3";
+                        greek_char = "γ";
                         break;
                     case "G": //Gamma (uppercase)
-                            greek_char = "\u0393";
+                        greek_char = "Γ";
                         break;
                     case "d": //Delta (lowercase)
-                            greek_char = "\u03B4";
+                        greek_char = "δ";
                         break;
                     case "D": //Delta (uppercase)
-                            greek_char = "\u0394";
+                        greek_char = "Δ";
                         break;
                     case "e": //Epsilon (lowercase)
-                            greek_char = "\u03B5";
+                        greek_char = "ε";
                         break;
                     case "E": //Epsilon (uppercase)
-                            greek_char = "\u0395";
+                        greek_char = "Ε";
                         break;
                     case "z": //Zeta (lowercase)
-                            greek_char = "\u03B6";
+                        greek_char = "ζ";
                         break;
                     case "Z": //Zeta (uppercase)
-                            greek_char = "\u0396";
+                        greek_char = "Ζ";
                         break;
                     case "h": //Eta (lowercase)
-                            greek_char = "\u03B7";
+                        greek_char = "η";
                         break;
                     case "H": //Eta (uppercase)
-                            greek_char = "\u0397";
+                        greek_char = "Η";
                         break;
                     case "q": //Theta (lowercase)
-                            greek_char = "\u03B8";
+                        greek_char = "θ";
                         break;
                     case "Q": //Theta (uppercase)
-                            greek_char = "\u0398";
+                        greek_char = "Θ";
                         break;
                     case "i": //Iota (lowercase)
-                            greek_char = "\u03B9";
+                        greek_char = "ι";
                         break;
                     case "I": //Iota (uppercase)
-                            greek_char = "\u0399";
+                        greek_char = "Ι";
                         break;
                     case "k": //Kappa (lowercase)
-                            greek_char = "\u03BA";
+                        greek_char = "κ";
                         break;
                     case "K": //Kappa (uppercase)
-                            greek_char = "\u039A";
+                        greek_char = "Κ";
                         break;
                     case "l": //Lambda (lowercase)
-                            greek_char = "\u03BB";
+                        greek_char = "λ";
                         break;
                     case "L": //Lambda (uppercase)
-                            greek_char = "\u039B";
+                        greek_char = "Λ";
                         break;
                     case "m": //Mu (lowercase)
-                            greek_char = "\u03BC";
+                        greek_char = "μ";
                         break;
                     case "M": //Mu (uppercase)
-                            greek_char = "\u039C";
+                        greek_char = "Μ";
                         break;
                     case "n": //Nu (lowercase)
-                            greek_char = "\u03BD";
+                        greek_char = "ν";
                         break;
                     case "N": //Nu (uppercase)
-                            greek_char = "\u039D";
+                        greek_char = "Ν";
                         break;
                     case "x": //Xi (lowercase)
-                            greek_char = "\u03BE";
+                        greek_char = "ξ";
                         break;
                     case "X": //Xi (uppercase)
-                            greek_char = "\u039E";
+                        greek_char = "Ξ";
                         break;
                     case "o": //Omicron (lowercase)
-                            greek_char = "\u03BF";
+                        greek_char = "ο";
                         break;
                     case "O": //Omicron (uppercase)
-                            greek_char = "\u039F";
+                        greek_char = "Ο";
                         break;
                     case "p": //Pi (lowercase)
-                            greek_char = "\u03C0";
+                        greek_char = "π";
                         break;
                     case "P": //Pi (uppercase)
-                            greek_char = "\u03A0";
+                        greek_char = "Π";
                         break;
                     case "r": //Rho (lowercase)
-                            greek_char = "\u03C1";
+                        greek_char = "ρ";
                         break;
                     case "R": //Rho (uppercase)
-                            greek_char = "\u03A1";
+                        greek_char = "Ρ";
                         break;
                     case "s": //Sigma (lowercase)
-                            greek_char = "\u03C3";
+                        greek_char = "σ";
                         break;
                     case "S": //Sigma (uppercase)
-                            greek_char = "\u03A3";
+                        greek_char = "Σ";
                         break;
                     case "t": //Tau (lowercase)
-                            greek_char = "\u03C4";
+                        greek_char = "τ";
                         break;
                     case "T": //Tau (uppercase)
-                            greek_char = "\u03A4";
+                        greek_char = "Τ";
                         break;
                     case "u": //Upsilon (lowercase)
-                            greek_char = "\u03C5";
+                        greek_char = "υ";
                         break;
                     case "U": //Upsilon (uppercase)
-                            greek_char = "\u03A5";
+                        greek_char = "Υ";
                         break;
                     case "f": //Phi (lowercase)
-                            greek_char = "\u03C6";
+                        greek_char = "φ";
                         break;
                     case "F": //Phi (uppercase)
-                            greek_char = "\u03A6";
+                        greek_char = "Φ";
                         break;
                     case "c": //Chi (lowercase)
-                            greek_char = "\u03C7";
+                        greek_char = "χ";
                         break;
                     case "C": //Chi (uppercase)
-                            greek_char = "\u03A7";
+                        greek_char = "Χ";
                         break;
                     case "y": //Psi (lowercase)
-                            greek_char = "\u03C8";
+                        greek_char = "ψ";
                         break;
                     case "Y": //Psi (uppercase)
-                            greek_char = "\u03A8";
+                        greek_char = "Ψ";
                         break;
                     case "w": //Omega (lowercase)
-                            greek_char = "\u03C9";
+                        greek_char = "ω";
                         break;
                     case "W": //Omega (uppercase)
-                            greek_char = "\u03A9";
+                        greek_char = "Ω";
                         break;
                 }
 
@@ -255,81 +256,81 @@ class RegisterEventHelper {
                 switch (event.keyCode) {
                     case 49: //1 key
                         //Product symbol on shift, sum on no shift
-                            greek_char = event.shiftKey ? "\u220F" : "\u2211";
+                        greek_char = event.shiftKey ? "∏" : "∑";
                         break;
                     case 50: //2 key
                         //Integral on no shift, partial derivative on shift
-                            greek_char = event.shiftKey ?  "\u2202" : "\u222B";
+                        greek_char = event.shiftKey ?  "∂" : "∫";
                         break;
                     case 51: //3 key
                         //Less than or equal on no shift, greater than or equal on shift
-                            greek_char = event.shiftKey ? "\u2265" : "\u2264";
+                        greek_char = event.shiftKey ? "≥" : "≤";
                         break;
                     case 52: //4 key
                         //Empty set on shift, infinity on no shift
-                            greek_char = event.shiftKey ? "\u2205" : "\u221E";
+                        greek_char = event.shiftKey ? "∅" : "∞";
                         break;
                     case 53: //5 key
                         //Not equal on shift, approx equal on no shift
-                            greek_char = event.shiftKey ? "\u2260" : "\u2248";
+                        greek_char = event.shiftKey ? "≠" : "≈";
                         break;
                     case 54: //6 key
                         //Element of on no shift, not element of on shift
-                            greek_char = event.shiftKey ? "\u2209" : "\u2208";
+                        greek_char = event.shiftKey ? "∉" : "∈";
                         break;
                     case 55: //7 key
                         //And on shift, or on no shift
-                            greek_char = event.shiftKey ? "\u2227" : "\u2228";
+                        greek_char = event.shiftKey ? "∧" : "∨";
                         break;
                     case 56: //8 key
                         //Proportional to on shift, angle on no shift
-                            greek_char = event.shiftKey ? "\u221D" : "\u2220";
+                        greek_char = event.shiftKey ? "∝" : "∠";
                         break;
                     case 57: //9 key
                         //Cube root on shift, square root on no shift
-                            greek_char = event.shiftKey ? "\u221B" : "\u221A";
+                        greek_char = event.shiftKey ? "∛" : "√";
                         break;
                     case 48: //0 key
                         //Minus-Plus on shift, plus-minus on no shift
-                            greek_char = event.shiftKey ? "\u2213" : "\u00B1";
+                        greek_char = event.shiftKey ? "∓" : "±";
                         break;
 
                     //Special characters
                     case 219: //hyphen (or ß on german layout)
                         //Copyright on no shift, TM on shift
-                            greek_char = event.shiftKey ? "\u2122" : "\u00A9";
+                        greek_char = event.shiftKey ? "™" : "©";
                         break;
                     case 191: //forward slash (or # on german layout)
                         //Generic currency on no shift, paragraph on shift
-                            greek_char = event.shiftKey ? "\u00B6" : "\u00A4";
+                        greek_char = event.shiftKey ? "¶" : "¤";
                         break;
 
                     //Currency symbols
                     case 192: //: or (ö on german layout)
                         //Euro on no shift, pound on shift
-                            greek_char = event.shiftKey ? "\u00A3" : "\u20AC";
+                        greek_char = event.shiftKey ? "£" : "€";
                         break;
                     case 221: //; or (ä on german layout)
                         //Yen on no shift,  dollar on shift
-                            greek_char = event.shiftKey ? "\u0024" : "\u00A5";
+                        greek_char = event.shiftKey ? "$" : "¥";
                         break;
-
-
                 }
 
                 if(greek_char=="") return;
 
-                    let $txt = $(this);
-                    //@ts-ignore
-                    let caretPos = $txt[0].selectionStart;
-                    let textAreaTxt = $txt.val().toString();
-                    $txt.val(textAreaTxt.substring(0, caretPos) + greek_char + textAreaTxt.substring(caretPos) );
-
+                const txt = event.currentTarget;
+                const caretPos = txt.selectionStart;
+                const textAreaTxt = txt.value;
+                txt.value = textAreaTxt.substring(0, caretPos) + greek_char + textAreaTxt.substring(caretPos);
             }
+        };
+
+        this.registerLoadHandler(() => {
+            document.querySelectorAll('input[type=text], input[type=search]').forEach(input => {
+                input.removeEventListener('keydown', keydownHandler);
+                input.addEventListener('keydown', keydownHandler);
+            });
         });
-            //@ts-ignore
-            this.greek_once = true;
-        })
     }
 }
 

assets/themes/brite.js

@@ -0,0 +1,20 @@
+/*
+ * This file is part of Part-DB (https://github.com/Part-DB/Part-DB-symfony).
+ *
+ *  Copyright (C) 2019 - 2026 Jan Böhmer (https://github.com/jbtronics)
+ *
+ *  This program is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU Affero General Public License as published
+ *  by the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU Affero General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Affero General Public License
+ *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import "bootswatch/dist/brite/bootstrap.css";

composer.json

@@ -57,9 +57,10 @@
         "scheb/2fa-trusted-device": "^v7.11.0",
         "shivas/versioning-bundle": "^4.0",
         "spatie/db-dumper": "^3.3.1",
-        "symfony/ai-bundle": "^0.9.0",
-        "symfony/ai-lm-studio-platform": "^0.9.0",
-        "symfony/ai-open-router-platform": "^0.9.0",
+        "symfony/ai-bundle": "^0.10.0",
+        "symfony/ai-lm-studio-platform": "^v0.10.0",
+        "symfony/ai-ollama-platform": "^0.10.0",
+        "symfony/ai-open-router-platform": "^0.10.0",
         "symfony/apache-pack": "^1.0",
         "symfony/asset": "7.4.*",
         "symfony/console": "7.4.*",
@@ -70,6 +71,7 @@
         "symfony/flex": "^v2.3.1",
         "symfony/form": "7.4.*",
         "symfony/framework-bundle": "7.4.*",
+        "symfony/html-sanitizer": "7.4.*",
         "symfony/http-client": "7.4.*",
         "symfony/http-kernel": "7.4.*",
         "symfony/mailer": "7.4.*",

config/packages/ai_lm_studio_platform.yaml

@@ -2,3 +2,4 @@ ai:
     platform:
         lmstudio:
             host_url: '%env(string:settings:ai_lmstudio:hostURL)%'
+            http_client: 'app.http_client.ai_lmstudio'

config/packages/ai_ollama_platform.yaml

@@ -0,0 +1,6 @@
+ai:
+    platform:
+        ollama:
+            endpoint: '%env(string:settings:ai_ollama:endpoint)%'
+            api_key: '%env(string:settings:ai_ollama:apiKey)%'
+            http_client: 'app.http_client.ai_ollama'

config/packages/ai_open_router_platform.yaml

@@ -2,3 +2,4 @@ ai:
     platform:
         openrouter:
             api_key: '%env(string:settings:ai_openrouter:apiKey)%'
+            http_client: 'app.http_client.ai_openrouter'

config/packages/dev/easy_log_handler.yaml

@@ -1,16 +0,0 @@
-services:
-    EasyCorp\EasyLog\EasyLogHandler:
-        public: false
-        arguments: ['%kernel.logs_dir%/%kernel.environment%.log']
-
-#// FIXME: How to add this configuration automatically without messing up with the monolog configuration?
-#monolog:
-#    handlers:
-#        buffered:
-#            type:     buffer
-#            handler:  easylog
-#            channels: ['!event']
-#            level:    debug
-#        easylog:
-#            type: service
-#            id:   EasyCorp\EasyLog\EasyLogHandler

config/packages/doctrine.php

@@ -20,16 +20,16 @@
 
 declare(strict_types=1);
 
-use Symfony\Config\DoctrineConfig;
-
 /**
- * This class extends the default doctrine ORM configuration to enable native lazy objects on PHP 8.4+.
+ * This file enables native lazy objects on PHP 8.4+.
  * We have to do this in a PHP file, because the yaml file does not support conditionals on PHP version.
+ *
+ * TODO: Remove this file when we drop support for PHP < 8.4
  */
 
-return static function(DoctrineConfig $doctrine) {
-    //On PHP 8.4+ we can use native lazy objects, which are much more efficient than proxies.
-    if (PHP_VERSION_ID >= 80400) {
-        $doctrine->orm()->enableNativeLazyObjects(true);
-    }
-};
+// On PHP 8.4+ we can use native lazy objects, which are much more efficient than proxies.
+if (PHP_VERSION_ID >= 80400) {
+    return ['doctrine' => ['orm' => ['enable_native_lazy_objects' => true]]];
+}
+
+return [];

config/packages/monolog.yaml

@@ -51,6 +51,7 @@ when@prod:
                 type: stream
                 channels: [deprecation]
                 path: "%kernel.logs_dir%/%kernel.environment%_deprecations.log"
+                level: "%env(DEPRECATION_LOG_LEVEL)%"
 
 when@docker:
     monolog:
@@ -75,3 +76,4 @@ when@docker:
                 type: stream
                 channels: [deprecation]
                 path: "%kernel.logs_dir%/%kernel.environment%_deprecations.log"
+                level: "%env(DEPRECATION_LOG_LEVEL)%"

config/parameters.yaml

@@ -53,6 +53,7 @@ parameters:
   # Themes commented here by default, are not really usable, because of display problems. Enable them at your own risk!
   partdb.available_themes:
     - bootstrap
+    - brite
     - cerulean
     - cosmo
     - cyborg

config/reference.php

@@ -121,7 +121,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  * }
  * @psalm-type ServicesConfig = array{
  *     _defaults?: DefaultsType,
- *     _instanceof?: InstanceofType,
+ *     _instanceof?: array<class-string, InstanceofType>,
  *     ...<string, DefinitionType|AliasType|PrototypeType|StackType|ArgumentsType|null>
  * }
  * @psalm-type ExtensionType = array<string, mixed>
@@ -653,7 +653,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *         time_based_uuid_node?: scalar|Param|null,
  *     },
  *     html_sanitizer?: bool|array{ // HtmlSanitizer configuration
- *         enabled?: bool|Param, // Default: false
+ *         enabled?: bool|Param, // Default: true
  *         sanitizers?: array<string, array{ // Default: []
  *             allow_safe_elements?: bool|Param, // Allows "safe" elements and attributes. // Default: false
  *             allow_static_elements?: bool|Param, // Allows all static elements and attributes from the W3C Sanitizer API standard. // Default: false
@@ -718,7 +718,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *             servicename?: scalar|Param|null, // Overrules dbname parameter if given and used as SERVICE_NAME or SID connection parameter for Oracle depending on the service parameter.
  *             sessionMode?: scalar|Param|null, // The session mode to use for the oci8 driver
  *             server?: scalar|Param|null, // The name of a running database server to connect to for SQL Anywhere.
- *             default_dbname?: scalar|Param|null, // Override the default database (postgres) to connect to for PostgreSQL connexion.
+ *             default_dbname?: scalar|Param|null, // Override the default database (postgres) to connect to for PostgreSQL connection.
  *             sslmode?: scalar|Param|null, // Determines whether or with what priority a SSL TCP/IP connection will be negotiated with the server for PostgreSQL.
  *             sslrootcert?: scalar|Param|null, // The name of a file containing SSL certificate authority (CA) certificate(s). If the file exists, the server's certificate will be verified to be signed by one of these authorities.
  *             sslcert?: scalar|Param|null, // The path to the SSL client certificate file for PostgreSQL.
@@ -769,7 +769,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *                 servicename?: scalar|Param|null, // Overrules dbname parameter if given and used as SERVICE_NAME or SID connection parameter for Oracle depending on the service parameter.
  *                 sessionMode?: scalar|Param|null, // The session mode to use for the oci8 driver
  *                 server?: scalar|Param|null, // The name of a running database server to connect to for SQL Anywhere.
- *                 default_dbname?: scalar|Param|null, // Override the default database (postgres) to connect to for PostgreSQL connexion.
+ *                 default_dbname?: scalar|Param|null, // Override the default database (postgres) to connect to for PostgreSQL connection.
  *                 sslmode?: scalar|Param|null, // Determines whether or with what priority a SSL TCP/IP connection will be negotiated with the server for PostgreSQL.
  *                 sslrootcert?: scalar|Param|null, // The name of a file containing SSL certificate authority (CA) certificate(s). If the file exists, the server's certificate will be verified to be signed by one of these authorities.
  *                 sslcert?: scalar|Param|null, // The path to the SSL client certificate file for PostgreSQL.
@@ -801,7 +801,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *                 servicename?: scalar|Param|null, // Overrules dbname parameter if given and used as SERVICE_NAME or SID connection parameter for Oracle depending on the service parameter.
  *                 sessionMode?: scalar|Param|null, // The session mode to use for the oci8 driver
  *                 server?: scalar|Param|null, // The name of a running database server to connect to for SQL Anywhere.
- *                 default_dbname?: scalar|Param|null, // Override the default database (postgres) to connect to for PostgreSQL connexion.
+ *                 default_dbname?: scalar|Param|null, // Override the default database (postgres) to connect to for PostgreSQL connection.
  *                 sslmode?: scalar|Param|null, // Determines whether or with what priority a SSL TCP/IP connection will be negotiated with the server for PostgreSQL.
  *                 sslrootcert?: scalar|Param|null, // The name of a file containing SSL certificate authority (CA) certificate(s). If the file exists, the server's certificate will be verified to be signed by one of these authorities.
  *                 sslcert?: scalar|Param|null, // The path to the SSL client certificate file for PostgreSQL.
@@ -2874,8 +2874,8 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *             enable_translation?: bool|Param, // Enable translation for the system prompt // Default: false
  *             translation_domain?: string|Param, // The translation domain for the system prompt // Default: null
  *         },
- *         tools?: bool|array{
- *             enabled?: bool|Param, // Default: true
+ *         tools?: bool|array{ // Tools are opt-in: set to true to inject all services tagged with "ai.tool", or configure an explicit list of tools. When the option is omitted (or set to null or false), no tools are registered.
+ *             enabled?: bool|Param, // Default: false
  *             services?: list<string|array{ // Default: []
  *                 service?: string|Param,
  *                 agent?: string|Param,
@@ -2886,6 +2886,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *         },
  *         keep_tool_messages?: bool|Param, // Keep tool messages in the conversation history // Default: false
  *         include_sources?: bool|Param, // Include sources exposed by tools as part of the tool result metadata // Default: false
+ *         max_tool_calls?: scalar|Param|null, // Maximum number of tool calls per agent call, null to disable // Default: 50
  *         fault_tolerant_toolbox?: bool|Param, // Continue the agent run even if a tool call fails // Default: true
  *         speech?: bool|array{ // Speech (TTS/STT) decorator configuration
  *             enabled?: bool|Param, // Default: true

config/services.yaml

@@ -52,6 +52,28 @@ services:
         alias: 'doctrine.migrations.dependency_factory'
 
 
+    ####################################################################################################################
+    # AI provider HTTP clients (with configurable timeouts)
+    ####################################################################################################################
+
+    app.http_client.ai_ollama:
+        class: Symfony\Contracts\HttpClient\HttpClientInterface
+        factory: ['@http_client', 'withOptions']
+        arguments:
+            - { timeout: '%env(int:settings:ai_ollama:timeout)%' }
+
+    app.http_client.ai_lmstudio:
+        class: Symfony\Contracts\HttpClient\HttpClientInterface
+        factory: ['@http_client', 'withOptions']
+        arguments:
+            - { timeout: '%env(int:settings:ai_lmstudio:timeout)%' }
+
+    app.http_client.ai_openrouter:
+        class: Symfony\Contracts\HttpClient\HttpClientInterface
+        factory: ['@http_client', 'withOptions']
+        arguments:
+            - { timeout: '%env(int:settings:ai_openrouter:timeout)%' }
+
     ####################################################################################################################
     # Email
     ####################################################################################################################

docs/configuration.md

@@ -279,9 +279,13 @@ See the [information providers]({% link usage/information_provider_system.md %})
 * `BANNER`: You can configure the text that should be shown as the banner on the homepage. Useful especially for docker
   containers. In all other applications you can just change the `config/banner.md` file.
 * `DISABLE_YEAR2038_BUG_CHECK` (env only): If set to `1`, the year 2038 bug check is disabled on 32-bit systems, and dates after
-2038 are no longer forbidden. However this will lead to 500 error messages when rendering dates after 2038 as all current
+2038 are no longer forbidden. However, this will lead to 500 error messages when rendering dates after 2038 as all current
 32-bit PHP versions can not format these dates correctly. This setting is for the case that future PHP versions will
 handle this correctly on 32-bit systems. 64-bit systems are not affected by this bug, and the check is always disabled.
+* `DEPRECATION_LOG_LEVEL` (default `emergency`) (env only): In the `prod` and `docker` environments, PHP/Symfony
+  deprecation notices are written to their own `var/log/<env>_deprecations.log` file. This option sets the minimum log 
+  level a deprecation notice must have to be written there. Since deprecation notices are logged with level `info`, 
+  the default value of `emergency` effectively disables this dedicated deprecation log. Set it to `debug` to enable it.
 
 ## Banner
 

docs/installation/installation_guide-debian.md

@@ -232,7 +232,7 @@ sudo ln -s /etc/apache2/sites-available/partdb.conf /etc/apache2/sites-enabled/p
 Configure apache to show pretty URL paths for Part-DB (`/label/dialog` instead of `/index.php/label/dialog`):
 
 ```bash
-sudo a2enmod rewrite
+sudo a2enmod rewrite headers
 ```
 
 If you want to access Part-DB via the IP-Address of the server, instead of the domain name, you have to remove the

docs/installation/nginx.md

@@ -36,6 +36,10 @@ server {
     root /var/www/partdb/public;
 
     location / {
+        # Headers are set here for static assets. PHP responses are served via the index.php location
+        # below and inherit neither of these headers, so Nelmio's PHP-side CSP is unaffected.
+        add_header Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; sandbox;" always;
+        add_header X-Content-Type-Options "nosniff" always;
         try_files $uri /index.php$is_args$args;
     }
 
@@ -58,9 +62,11 @@ server {
         return 403;
     }
 
-    # Set Content-Security-Policy for svg files, to block embedded javascript in there
+    # SVG files get a slightly different CSP because they can embed resources and must not be framed.
+    # This regex location takes precedence over location /, so headers must be repeated here.
     location ~* \.svg$ {
-        add_header Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none';";
+        add_header Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'; sandbox;" always;
+        add_header X-Content-Type-Options "nosniff" always;
     }
 
     error_log /var/log/nginx/parts.error.log;

docs/usage/ai.md

@@ -25,3 +25,10 @@ You need to supply an API key for OpenRouter to use it as an AI platform in Part
 
 [LMStudio](https://lmstudio.ai/) is a local LLM hosting solution that allows you to run LLMs on your own hardware. You can use LMStudio to host your own LLM and connect it to Part-DB for AI features.
 Currently only LMStudio without any authentication is supported. Supply your LMStudio instance URL (including the port) to use it as an AI platform in Part-DB.
+You have to set a model by hand, as suggestions currently do not work yet. Ensure the context length is suitable for your application.
+
+### Ollama
+
+[Ollama](https://ollama.com/) is another local LLM hosting solution that allows you to run LLMs on your own hardware. You can use Ollama to host your own LLM and connect it to Part-DB for AI features.
+Supply your Ollama instance URL (including the port) and an optional API key for authentication to use it as an AI platform in Part-DB. The model selector should give you suggestions about available models.
+Ensure the context length is suitable for your application.

package.json

@@ -13,7 +13,7 @@
         "bootstrap": "^5.1.3",
         "core-js": "^3.38.0",
         "intl-messageformat": "^10.5.11",
-        "jquery": "^3.5.1",
+        "jquery": "^4.0.0",
         "popper.js": "^1.14.7",
         "regenerator-runtime": "^0.14.1",
         "webpack": "^5.74.0",
@@ -38,20 +38,21 @@
         "@algolia/autocomplete-theme-classic": "^1.17.0",
         "@jbtronics/bs-treeview": "^1.0.1",
         "@part-db/html5-qrcode": "^4.0.0",
-        "@zxcvbn-ts/core": "^3.0.2",
-        "@zxcvbn-ts/language-common": "^3.0.3",
-        "@zxcvbn-ts/language-de": "^3.0.1",
-        "@zxcvbn-ts/language-en": "^3.0.1",
-        "@zxcvbn-ts/language-fr": "^3.0.1",
-        "@zxcvbn-ts/language-ja": "^3.0.1",
+        "@zxcvbn-ts/core": "^4.1.2",
+        "@zxcvbn-ts/language-common": "^4.1.2",
+        "@zxcvbn-ts/language-de": "^4.1.1",
+        "@zxcvbn-ts/language-en": "^4.1.1",
+        "@zxcvbn-ts/language-fr": "^4.1.1",
+        "@zxcvbn-ts/language-it": "^4.1.1",
+        "@zxcvbn-ts/language-ja": "^4.1.1",
+        "@zxcvbn-ts/language-pl": "^4.1.1",
         "attr-accept": "^2.2.5",
         "barcode-detector": "^3.0.5",
-        "bootbox": "^6.0.0",
         "bootswatch": "^5.1.3",
         "bs-custom-file-input": "^1.3.4",
         "ckeditor5": "^48.0.0",
         "clipboard": "^2.0.4",
-        "compression-webpack-plugin": "^11.1.0",
+        "compression-webpack-plugin": "^12.0.0",
         "datatables.net": "^2.0.0",
         "datatables.net-bs5": "^2.0.0",
         "datatables.net-buttons-bs5": "^3.0.0",
@@ -69,11 +70,12 @@
         "marked-mangle": "^1.0.1",
         "pdfmake": "^0.3.7",
         "stimulus-use": "^0.52.0",
+        "sweetalert2": "^11.26.25",
         "tom-select": "^2.1.0",
         "ts-loader": "^9.2.6",
         "typescript": "^6.0.2"
     },
     "resolutions": {
-        "jquery": "^3.5.1"
+        "jquery": "^4.0.0"
     }
 }

public/.htaccess

@@ -119,9 +119,14 @@ DirectoryIndex index.php
     </IfModule>
 </IfModule>
 
-# Set Content-Security-Policy for svg files (and compressed variants), to block embedded javascript in there
 <IfModule mod_headers.c>
+    # Set a strict CSP for all static assets not handled by PHP.
+    # PHP responses already carry their own CSP via NelmioSecurityBundle, so setifempty leaves those untouched.
+    Header always setifempty Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; sandbox;"
+    Header always setifempty X-Content-Type-Options "nosniff"
+
+    # SVG files get a slightly different CSP because they can embed resources and must not be framed.
     <FilesMatch "\.(svg|svg\.gz|svg\.br)$">
-        Header set Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none';"
+        Header always set Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'; sandbox;"
     </FilesMatch>
 </IfModule>

public/kicad/footprints.txt

@@ -1,4 +1,4 @@
-# Generated on Mon Jun  1 07:07:44 UTC 2026
+# Generated on Mon Jun 22 07:31:48 UTC 2026
 # This file contains all footprints available in the offical KiCAD library
 Audio_Module:Reverb_BTDR-1H
 Audio_Module:Reverb_BTDR-1V
@@ -8293,6 +8293,7 @@ Converter_DCDC:Converter_DCDC_Hamamatsu_C11204-1_THT
 Converter_DCDC:Converter_DCDC_MeanWell_NID30_THT
 Converter_DCDC:Converter_DCDC_MeanWell_NID60_THT
 Converter_DCDC:Converter_DCDC_MeanWell_NSD10_THT
+Converter_DCDC:Converter_DCDC_MeanWell_SMU02x-xxN_THT
 Converter_DCDC:Converter_DCDC_Murata_CRE1xxxxxx3C_THT
 Converter_DCDC:Converter_DCDC_Murata_CRE1xxxxxxDC_THT
 Converter_DCDC:Converter_DCDC_Murata_CRE1xxxxxxSC_THT
@@ -12012,7 +12013,6 @@ Package_DFN_QFN:WDFN-8-1EP_4x3mm_P0.65mm_EP2.4x1.8mm_ThermalVias
 Package_DFN_QFN:WDFN-8-1EP_6x5mm_P1.27mm_EP3.4x4mm
 Package_DFN_QFN:WDFN-8-1EP_8x6mm_P1.27mm_EP6x4.8mm
 Package_DFN_QFN:WDFN-8-1EP_8x6mm_P1.27mm_EP6x4.8mm_ThermalVias
-Package_DFN_QFN:WDFN-8_2x2mm_P0.5mm
 Package_DFN_QFN:WFDFPN-8-1EP_3x2mm_P0.5mm_EP1.25x1.35mm
 Package_DFN_QFN:WQFN-14-1EP_2.5x2.5mm_P0.5mm_EP1.45x1.45mm
 Package_DFN_QFN:WQFN-14-1EP_2.5x2.5mm_P0.5mm_EP1.45x1.45mm_ThermalVias
@@ -12358,7 +12358,6 @@ Package_DirectFET:DirectFET_SQ
 Package_DirectFET:DirectFET_ST
 Package_LCC:Analog_LCC-8_5x5mm_P1.27mm
 Package_LCC:MO047AD_PLCC-52_19.1x19.1mm_P1.27mm
-Package_LCC:PLCC-20
 Package_LCC:PLCC-20_9.0x9.0mm_P1.27mm
 Package_LCC:PLCC-20_SMD-Socket
 Package_LCC:PLCC-20_THT-Socket
@@ -13032,8 +13031,6 @@ Package_SON:WSON-6-1EP_2x2mm_P0.65mm_EP1x1.6mm
 Package_SON:WSON-6-1EP_2x2mm_P0.65mm_EP1x1.6mm_ThermalVias
 Package_SON:WSON-6-1EP_3x3mm_P0.95mm
 Package_SON:WSON-6_1.5x1.5mm_P0.5mm
-Package_SON:WSON-8-1EP_2x2mm_P0.5mm_EP0.9x1.6mm
-Package_SON:WSON-8-1EP_2x2mm_P0.5mm_EP0.9x1.6mm_ThermalVias
 Package_SON:WSON-8-1EP_3x2.5mm_P0.5mm_EP1.2x1.5mm_PullBack
 Package_SON:WSON-8-1EP_3x2.5mm_P0.5mm_EP1.2x1.5mm_PullBack_ThermalVias
 Package_SON:WSON-8-1EP_3x3mm_P0.5mm_EP1.2x2mm

public/kicad/symbols.txt

@@ -1,4 +1,4 @@
-# Generated on Mon Jun  1 07:08:24 UTC 2026
+# Generated on Mon Jun 22 07:32:26 UTC 2026
 # This file contains all symbols available in the offical KiCAD library
 4xxx:14528
 4xxx:14529
@@ -4954,6 +4954,7 @@ Converter_DCDC:RPMH15-1.5
 Converter_DCDC:RPMH24-1.5
 Converter_DCDC:RPMH3.3-1.5
 Converter_DCDC:RPMH5.0-1.5
+Converter_DCDC:SMU02L-24N
 Converter_DCDC:TBA1-0310
 Converter_DCDC:TBA1-0311
 Converter_DCDC:TBA1-0510
@@ -5300,21 +5301,39 @@ Converter_DCDC:TMR-4812
 Converter_DCDC:TMR-4821
 Converter_DCDC:TMR-4822
 Converter_DCDC:TMR-4823
+Converter_DCDC:TMR10-1211WI
+Converter_DCDC:TMR10-1212WI
+Converter_DCDC:TMR10-1213WI
+Converter_DCDC:TMR10-1215WI
+Converter_DCDC:TMR10-1222WI
+Converter_DCDC:TMR10-1223WI
 Converter_DCDC:TMR10-2410WIR
+Converter_DCDC:TMR10-2411WI
 Converter_DCDC:TMR10-2411WIR
+Converter_DCDC:TMR10-2412WI
 Converter_DCDC:TMR10-2412WIR
+Converter_DCDC:TMR10-2413WI
 Converter_DCDC:TMR10-2413WIR
+Converter_DCDC:TMR10-2415WI
 Converter_DCDC:TMR10-2415WIR
 Converter_DCDC:TMR10-2421WIR
+Converter_DCDC:TMR10-2422WI
 Converter_DCDC:TMR10-2422WIR
+Converter_DCDC:TMR10-2423WI
 Converter_DCDC:TMR10-2423WIR
 Converter_DCDC:TMR10-4810WIR
+Converter_DCDC:TMR10-4811WI
 Converter_DCDC:TMR10-4811WIR
+Converter_DCDC:TMR10-4812WI
 Converter_DCDC:TMR10-4812WIR
+Converter_DCDC:TMR10-4813WI
 Converter_DCDC:TMR10-4813WIR
+Converter_DCDC:TMR10-4815WI
 Converter_DCDC:TMR10-4815WIR
 Converter_DCDC:TMR10-4821WIR
+Converter_DCDC:TMR10-4822WI
 Converter_DCDC:TMR10-4822WIR
+Converter_DCDC:TMR10-4823WI
 Converter_DCDC:TMR10-4823WIR
 Converter_DCDC:TMR10-7210WIR
 Converter_DCDC:TMR10-7211WIR
@@ -6124,6 +6143,7 @@ Device:SparkGap
 Device:Speaker
 Device:Speaker_Crystal
 Device:Speaker_Ultrasound
+Device:Thermal_Jumper
 Device:Thermistor
 Device:Thermistor_NTC
 Device:Thermistor_NTC_3Wire
@@ -14593,6 +14613,8 @@ MCU_Texas:LM4F111C4QR
 MCU_Texas:LM4F111E5QR
 MCU_Texas:LM4F111H5QR
 MCU_Texas:MSP432E401Y
+MCU_Texas:MSPM0C110xSDDF
+MCU_Texas:MSPM0C110xSDSG
 MCU_Texas:TM4C1230C3PM
 MCU_Texas:TM4C1230D5PM
 MCU_Texas:TM4C1230E6PM
@@ -15115,6 +15137,7 @@ Memory_Flash:AM29F400Bx-xxEx
 Memory_Flash:AM29F400Bx-xxSx
 Memory_Flash:AM29PDL128G
 Memory_Flash:AT25DF041x-UxN-x
+Memory_Flash:AT25SF041B-SSHD-X
 Memory_Flash:AT25SF081-SSHD-X
 Memory_Flash:AT25SF081-SSHF-X
 Memory_Flash:AT25SF081-XMHD-X
@@ -15670,6 +15693,7 @@ Power_Management:LM5069MM-1
 Power_Management:LM5069MM-2
 Power_Management:LM66100DCK
 Power_Management:LM74700
+Power_Management:LM74701-Q1
 Power_Management:LMG3410
 Power_Management:LMG5200
 Power_Management:LT1641-1
@@ -15771,6 +15795,7 @@ Power_Management:TPS22810DBV
 Power_Management:TPS22810DRV
 Power_Management:TPS22917DBV
 Power_Management:TPS22917LDBV
+Power_Management:TPS22919DCK
 Power_Management:TPS22929D
 Power_Management:TPS22993
 Power_Management:TPS2412D
@@ -16480,6 +16505,7 @@ RF_Module:DWM3000
 RF_Module:E18-MS1-PCB
 RF_Module:E73-2G4M04S-52810
 RF_Module:E73-2G4M04S-52832
+RF_Module:ESP-01
 RF_Module:ESP-07
 RF_Module:ESP-12E
 RF_Module:ESP-12F
@@ -16681,6 +16707,19 @@ Reference_Voltage:LM4040LP-4.1
 Reference_Voltage:LM4040LP-5
 Reference_Voltage:LM4040LP-8.2
 Reference_Voltage:LM4041LP-ADJ
+Reference_Voltage:LM4050xEM3-2.1
+Reference_Voltage:LM4050xEM3-2.5
+Reference_Voltage:LM4050xEM3-3.0
+Reference_Voltage:LM4050xEM3-3.3
+Reference_Voltage:LM4050xEM3-4.1
+Reference_Voltage:LM4050xEM3-5.0
+Reference_Voltage:LM4050xEX3-2.1
+Reference_Voltage:LM4050xEX3-2.5
+Reference_Voltage:LM4050xEX3-3.3
+Reference_Voltage:LM4050xEX3-4.1
+Reference_Voltage:LM4050xEX3-5.0
+Reference_Voltage:LM4051xEM3-1.2
+Reference_Voltage:LM4051xEX3-1.2
 Reference_Voltage:LM4125AIM5-2.5
 Reference_Voltage:LM4125IM5-2.0
 Reference_Voltage:LM4125IM5-2.5
@@ -16828,7 +16867,6 @@ Reference_Voltage:MCP1501-25xCH
 Reference_Voltage:MCP1501-25xRW
 Reference_Voltage:MCP1501-25xSN
 Reference_Voltage:MCP1501-30xCH
-Reference_Voltage:MCP1501-30xRW
 Reference_Voltage:MCP1501-30xSN
 Reference_Voltage:MCP1501-33xCH
 Reference_Voltage:MCP1501-33xRW
@@ -19261,6 +19299,7 @@ Regulator_Switching:LT1373HVCN8
 Regulator_Switching:LT1373HVCS8
 Regulator_Switching:LT1377CN8
 Regulator_Switching:LT1377CS8
+Regulator_Switching:LT1931
 Regulator_Switching:LT1945
 Regulator_Switching:LT3430
 Regulator_Switching:LT3430-1
@@ -20989,6 +21028,7 @@ Sensor_Temperature:MCP9501
 Sensor_Temperature:MCP9502
 Sensor_Temperature:MCP9503
 Sensor_Temperature:MCP9504
+Sensor_Temperature:MCP96xx01x-x-MX
 Sensor_Temperature:MCP9700Ax-ELT
 Sensor_Temperature:MCP9700Ax-ETT
 Sensor_Temperature:MCP9700Ax-HLT
@@ -22479,6 +22519,7 @@ Transistor_FET_Other:Q_NMOS_Depletion_GDS
 Transistor_FET_Other:Q_NMOS_Depletion_GSD
 Transistor_FET_Other:Q_NMOS_Depletion_SDG
 Transistor_FET_Other:Q_NMOS_Depletion_SGD
+Transistor_FET_Other:SP010N70T8
 Transistor_FET_Other:VNB35N07xx-E
 Transistor_FET_Other:VNP10N07
 Transistor_FET_Other:VNP35N07xx-E

src/Controller/AttachmentFileController.php

@@ -93,6 +93,8 @@ class AttachmentFileController extends AbstractController
         //Set header content disposition, so that the file will be downloaded
         $response->setContentDisposition(ResponseHeaderBag::DISPOSITION_ATTACHMENT, $attachment->getFilename());
 
+        $this->setAttachmentCSPHeaders($response);
+
         return $response;
     }
 
@@ -112,6 +114,16 @@ class AttachmentFileController extends AbstractController
         //Set header content disposition, so that the file will be downloaded
         $response->setContentDisposition(ResponseHeaderBag::DISPOSITION_INLINE, $attachment->getFilename());
 
+        $this->setAttachmentCSPHeaders($response);
+
+        return $response;
+    }
+
+    private function setAttachmentCSPHeaders(Response $response): Response
+    {
+        //Set an CSP that disallow to run any scripts, styles or images from the attachment render page, as it is not used anywhere else for now and can be a security risk if used without proper precautions, so it should be opt-in
+        $response->headers->set('Content-Security-Policy', "default-src 'self'; script-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; sandbox;");
+
         return $response;
     }
 

src/Controller/TreeController.php

@@ -22,6 +22,7 @@ declare(strict_types=1);
 
 namespace App\Controller;
 
+use Symfony\Bridge\Doctrine\Attribute\MapEntity;
 use Symfony\Component\HttpFoundation\Response;
 use App\Entity\ProjectSystem\Project;
 use App\Entity\Parts\Category;
@@ -55,7 +56,7 @@ class TreeController extends AbstractController
 
     #[Route(path: '/category/{id}', name: 'tree_category')]
     #[Route(path: '/categories', name: 'tree_category_root')]
-    public function categoryTree(?Category $category = null): JsonResponse
+    public function categoryTree(#[MapEntity(id: 'id')] ?Category $category = null): JsonResponse
     {
         if ($this->isGranted('@parts.read') && $this->isGranted('@categories.read')) {
             $tree = $this->treeGenerator->getTreeView(Category::class, $category, 'list_parts_root');
@@ -68,7 +69,7 @@ class TreeController extends AbstractController
 
     #[Route(path: '/footprint/{id}', name: 'tree_footprint')]
     #[Route(path: '/footprints', name: 'tree_footprint_root')]
-    public function footprintTree(?Footprint $footprint = null): JsonResponse
+    public function footprintTree(#[MapEntity(id: 'id')] ?Footprint $footprint = null): JsonResponse
     {
         if ($this->isGranted('@parts.read') && $this->isGranted('@footprints.read')) {
             $tree = $this->treeGenerator->getTreeView(Footprint::class, $footprint, 'list_parts_root');
@@ -80,7 +81,7 @@ class TreeController extends AbstractController
 
     #[Route(path: '/location/{id}', name: 'tree_location')]
     #[Route(path: '/locations', name: 'tree_location_root')]
-    public function locationTree(?StorageLocation $location = null): JsonResponse
+    public function locationTree(#[MapEntity(id: 'id')] ?StorageLocation $location = null): JsonResponse
     {
         if ($this->isGranted('@parts.read') && $this->isGranted('@storelocations.read')) {
             $tree = $this->treeGenerator->getTreeView(StorageLocation::class, $location, 'list_parts_root');
@@ -93,7 +94,7 @@ class TreeController extends AbstractController
 
     #[Route(path: '/manufacturer/{id}', name: 'tree_manufacturer')]
     #[Route(path: '/manufacturers', name: 'tree_manufacturer_root')]
-    public function manufacturerTree(?Manufacturer $manufacturer = null): JsonResponse
+    public function manufacturerTree(#[MapEntity(id: 'id')] ?Manufacturer $manufacturer = null): JsonResponse
     {
         if ($this->isGranted('@parts.read') && $this->isGranted('@manufacturers.read')) {
             $tree = $this->treeGenerator->getTreeView(Manufacturer::class, $manufacturer, 'list_parts_root');
@@ -106,7 +107,7 @@ class TreeController extends AbstractController
 
     #[Route(path: '/supplier/{id}', name: 'tree_supplier')]
     #[Route(path: '/suppliers', name: 'tree_supplier_root')]
-    public function supplierTree(?Supplier $supplier = null): JsonResponse
+    public function supplierTree(#[MapEntity(id: 'id')] ?Supplier $supplier = null): JsonResponse
     {
         if ($this->isGranted('@parts.read') && $this->isGranted('@suppliers.read')) {
             $tree = $this->treeGenerator->getTreeView(Supplier::class, $supplier, 'list_parts_root');
@@ -119,7 +120,7 @@ class TreeController extends AbstractController
 
     #[Route(path: '/device/{id}', name: 'tree_device')]
     #[Route(path: '/devices', name: 'tree_device_root')]
-    public function deviceTree(?Project $device = null): JsonResponse
+    public function deviceTree(#[MapEntity(id: 'id')] ?Project $device = null): JsonResponse
     {
         if ($this->isGranted('@projects.read')) {
             $tree = $this->treeGenerator->getTreeView(Project::class, $device, 'devices');

src/DataTables/AttachmentDataTable.php

@@ -22,6 +22,7 @@ declare(strict_types=1);
 
 namespace App\DataTables;
 
+use App\DataTables\Column\HTMLColumn;
 use App\DataTables\Column\LocaleDateTimeColumn;
 use App\DataTables\Column\PrettyBoolColumn;
 use App\DataTables\Column\RowClassColumn;
@@ -40,14 +41,19 @@ use Omines\DataTablesBundle\DataTable;
 use Omines\DataTablesBundle\DataTableTypeInterface;
 use Symfony\Contracts\Translation\TranslatorInterface;
 
-final class AttachmentDataTable implements DataTableTypeInterface
+final readonly class AttachmentDataTable implements DataTableTypeInterface
 {
-    public function __construct(private readonly TranslatorInterface $translator, private readonly EntityURLGenerator $entityURLGenerator, private readonly AttachmentManager $attachmentHelper, private readonly AttachmentURLGenerator $attachmentURLGenerator, private readonly ElementTypeNameGenerator $elementTypeNameGenerator)
+    public function __construct(private TranslatorInterface $translator, private EntityURLGenerator $entityURLGenerator, private AttachmentManager $attachmentHelper, private AttachmentURLGenerator $attachmentURLGenerator, private ElementTypeNameGenerator $elementTypeNameGenerator)
     {
     }
 
     public function configure(DataTable $dataTable, array $options): void
     {
+        /*************************************************************************************************************
+         * Avoid using render, as it has no escaping, and is a potential security risk. Use data on TextColumn or the
+         * HTMLColumn, if necessary
+         ************************************************************************************************************/
+
         $dataTable->add('dont_matter', RowClassColumn::class, [
             'render' => function ($value, Attachment $context): string {
                 //Mark attachments yellow which have an internal file linked that doesn't exist
@@ -59,10 +65,10 @@ final class AttachmentDataTable implements DataTableTypeInterface
             },
         ]);
 
-        $dataTable->add('picture', TextColumn::class, [
+        $dataTable->add('picture', HTMLColumn::class, [
             'label' => '',
             'className' => 'no-colvis',
-            'render' => function ($value, Attachment $context): string {
+            'data' => function (Attachment $context): string {
                 if ($context->isPicture()
                     && $this->attachmentHelper->isInternalFileExisting($context)) {
 
@@ -95,65 +101,65 @@ final class AttachmentDataTable implements DataTableTypeInterface
             'orderField' => 'NATSORT(attachment.name)',
         ]);
 
-        $dataTable->add('attachment_type', TextColumn::class, [
+        $dataTable->add('attachment_type', HTMLColumn::class, [
             'label' => 'attachment.table.type',
             'field' => 'attachment_type.name',
             'orderField' => 'NATSORT(attachment_type.name)',
-            'render' => fn($value, Attachment $context): string => sprintf(
+            'data' => fn(Attachment $context, $value): string => sprintf(
                 '<a href="%s">%s</a>',
                 $this->entityURLGenerator->editURL($context->getAttachmentType()),
                 htmlspecialchars((string) $value)
             ),
         ]);
 
-        $dataTable->add('element', TextColumn::class, [
+        $dataTable->add('element', HTMLColumn::class, [
             'label' => 'attachment.table.element',
             //'propertyPath' => 'element.name',
-            'render' => fn($value, Attachment $context): string => sprintf(
+            'data' => fn(Attachment $context): string => sprintf(
                 '<a href="%s">%s</a>',
                 $this->entityURLGenerator->infoURL($context->getElement()),
                 $this->elementTypeNameGenerator->getTypeNameCombination($context->getElement(), true)
             ),
         ]);
 
-        $dataTable->add('internal_link', TextColumn::class, [
+        $dataTable->add('internal_link', HTMLColumn::class, [
             'label' => 'attachment.table.internal_file',
             'propertyPath' => 'filename',
             'orderField' => 'NATSORT(attachment.original_filename)',
-            'render' => function ($value, Attachment $context) {
+            'data' => function (Attachment $context, $value) {
                 if ($this->attachmentHelper->isInternalFileExisting($context)) {
                     return sprintf(
                         '<a href="%s" target="_blank" data-no-ajax>%s</a>',
                         $this->entityURLGenerator->viewURL($context),
-                        htmlspecialchars($value)
+                        htmlspecialchars((string) $value)
                     );
                 }
 
-                return $value;
-            }
+                return htmlspecialchars((string) $value);
+            },
         ]);
 
-        $dataTable->add('external_link', TextColumn::class, [
+        $dataTable->add('external_link', HTMLColumn::class, [
             'label' => 'attachment.table.external_link',
             'propertyPath' => 'host',
             'orderField' => 'attachment.external_path',
-            'render' => function ($value, Attachment $context) {
+            'data' => function (Attachment $context, $value) {
                 if ($context->hasExternal()) {
                     return sprintf(
                         '<a href="%s" class="link-external" title="%s" target="_blank" rel="noopener">%s</a>',
                         htmlspecialchars((string) $context->getExternalPath()),
                         htmlspecialchars((string) $context->getExternalPath()),
-                        htmlspecialchars($value),
+                        htmlspecialchars((string) $value),
                     );
                 }
 
-                return $value;
-            }
+                return htmlspecialchars((string) $value);
+            },
         ]);
 
-        $dataTable->add('filesize', TextColumn::class, [
+        $dataTable->add('filesize', HTMLColumn::class, [
             'label' => $this->translator->trans('attachment.table.filesize'),
-            'render' => function ($value, Attachment $context) {
+            'data' => function (Attachment $context) {
                 if (!$context->hasInternal()) {
                     return sprintf(
                         '<span class="badge bg-primary">
@@ -168,7 +174,7 @@ final class AttachmentDataTable implements DataTableTypeInterface
                         '<span class="badge bg-secondary">
                         <i class="fas fa-hdd fa-fw"></i> %s
                     </span>',
-                        $this->attachmentHelper->getHumanFileSize($context)
+                        htmlspecialchars($this->attachmentHelper->getHumanFileSize($context))
                     );
                 }
 

src/DataTables/Column/EntityColumn.php

@@ -78,7 +78,7 @@ class EntityColumn extends AbstractColumn
                     );
                 }
 
-                return sprintf('<i>%s</i>', $value);
+                return sprintf('<i>%s</i>', htmlspecialchars($value));
             }
 
             return '';

src/DataTables/Column/HTMLColumn.php

@@ -1,7 +1,11 @@
+<?php
+
+declare(strict_types=1);
+
 /*
  * This file is part of Part-DB (https://github.com/Part-DB/Part-DB-symfony).
  *
- *  Copyright (C) 2019 - 2022 Jan Böhmer (https://github.com/jbtronics)
+ *  Copyright (C) 2019 - 2026 Jan Böhmer (https://github.com/jbtronics)
  *
  *  This program is free software: you can redistribute it and/or modify
  *  it under the terms of the GNU Affero General Public License as published
@@ -16,31 +20,18 @@
  *  You should have received a copy of the GNU Affero General Public License
  *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
+namespace App\DataTables\Column;
 
-.modal-body > .bootbox-close-button {
-    position: absolute;
-    top: 0;
-    right: 0;
-    padding: 0.5rem 0.75rem;
-    z-index: 1;
-}
-.modal .bootbox-close-button {
-    font-weight: 100;
-}
+use Omines\DataTablesBundle\Column\TextColumn;
 
-button.bootbox-close-button {
-    padding: 0;
-    background-color: transparent;
-    border: 0;
-    -webkit-appearance: none;
-}
-
-.bootbox-close-button {
-    /* float: right; */
-    font-size: 1.40625rem;
-    font-weight: 600;
-    line-height: 1;
-    color: #000;
-    text-shadow: none;
-    opacity: .5;
+/**
+ * A TextColumn whose value is always treated as raw HTML and therefore never passed through htmlspecialchars().
+ * The value returned by the 'data' option must already contain properly escaped/sanitized HTML, as it is output as-is.
+ */
+class HTMLColumn extends TextColumn
+{
+    public function isRaw(): bool
+    {
+        return true;
+    }
 }

src/DataTables/Column/IconLinkColumn.php

@@ -87,9 +87,9 @@ class IconLinkColumn extends AbstractColumn
             return sprintf(
                 '<a class="btn btn-primary btn-sm %s" href="%s" title="%s"><i class="%s"></i></a>',
                 $disabled ? 'disabled' : '',
-                $href,
-                $title,
-                $icon
+                htmlspecialchars($href),
+                htmlspecialchars($title ?? ''),
+                htmlspecialchars($icon ?? '')
             );
         }
 

src/DataTables/ErrorDataTable.php

@@ -22,9 +22,9 @@ declare(strict_types=1);
  */
 namespace App\DataTables;
 
+use App\DataTables\Column\HTMLColumn;
 use App\DataTables\Column\RowClassColumn;
 use Omines\DataTablesBundle\Adapter\ArrayAdapter;
-use Omines\DataTablesBundle\Column\TextColumn;
 use Omines\DataTablesBundle\DataTable;
 use Omines\DataTablesBundle\DataTableFactory;
 use Omines\DataTablesBundle\DataTableTypeInterface;
@@ -32,7 +32,7 @@ use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\OptionsResolver\OptionsResolver;
 
-class ErrorDataTable implements DataTableTypeInterface
+final readonly class ErrorDataTable implements DataTableTypeInterface
 {
     public function configureOptions(OptionsResolver $optionsResolver): void
     {
@@ -49,6 +49,11 @@ class ErrorDataTable implements DataTableTypeInterface
 
     public function configure(DataTable $dataTable, array $options): void
     {
+        /*************************************************************************************************************
+         * Avoid using render, as it has no escaping, and is a potential security risk. Use data on TextColumn or the
+         * HTMLColumn, if necessary
+         ************************************************************************************************************/
+
         $optionsResolver = new OptionsResolver();
         $this->configureOptions($optionsResolver);
         $options = $optionsResolver->resolve($options);
@@ -58,9 +63,9 @@ class ErrorDataTable implements DataTableTypeInterface
                 'render' => fn($value, $context): string => 'table-warning',
             ])
 
-            ->add('error', TextColumn::class, [
+            ->add('error', HTMLColumn::class, [
                 'label' => 'error_table.error',
-                'render' => fn($value, $context): string => '<i class="fa-solid fa-triangle-exclamation fa-fw"></i> ' . $value,
+                'data' => fn($context, $value): string => '<i class="fa-solid fa-triangle-exclamation fa-fw"></i> ' . htmlspecialchars((string) $value),
             ])
         ;
 

src/DataTables/Helpers/PartDataTableHelper.php

@@ -62,7 +62,7 @@ class PartDataTableHelper
         }
         if ($context->getBuiltProject() instanceof Project) {
             $icon = sprintf('<i class="fa-solid fa-box-archive fa-fw me-1" title="%s"></i>',
-                $this->translator->trans('part.info.projectBuildPart.hint').': '.$context->getBuiltProject()->getName());
+                $this->translator->trans('part.info.projectBuildPart.hint').': '.htmlspecialchars($context->getBuiltProject()->getName()));
         }
 
 

src/DataTables/LogDataTable.php

@@ -25,6 +25,7 @@ namespace App\DataTables;
 use App\DataTables\Column\EnumColumn;
 use App\Entity\LogSystem\LogTargetType;
 use Symfony\Bundle\SecurityBundle\Security;
+use App\DataTables\Column\HTMLColumn;
 use App\DataTables\Column\IconLinkColumn;
 use App\DataTables\Column\LocaleDateTimeColumn;
 use App\DataTables\Column\LogEntryExtraColumn;
@@ -59,7 +60,7 @@ use Symfony\Component\OptionsResolver\OptionsResolver;
 use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
 use Symfony\Contracts\Translation\TranslatorInterface;
 
-class LogDataTable implements DataTableTypeInterface
+final readonly class LogDataTable implements DataTableTypeInterface
 {
     protected LogEntryRepository $logRepo;
 
@@ -95,6 +96,11 @@ class LogDataTable implements DataTableTypeInterface
 
     public function configure(DataTable $dataTable, array $options): void
     {
+        /*************************************************************************************************************
+         * Avoid using render, as it has no escaping, and is a potential security risk. Use data on TextColumn or the
+         * HTMLColumn, if necessary
+         ************************************************************************************************************/
+
         $resolver = new OptionsResolver();
         $this->configureOptions($resolver);
         $options = $resolver->resolve($options);
@@ -104,10 +110,10 @@ class LogDataTable implements DataTableTypeInterface
             'render' => fn($value, AbstractLogEntry $context) => $this->logLevelHelper->logLevelToTableColorClass($context->getLevelString()),
         ]);
 
-        $dataTable->add('symbol', TextColumn::class, [
+        $dataTable->add('symbol', HTMLColumn::class, [
             'label' => '',
             'className' => 'no-colvis',
-            'render' => fn($value, AbstractLogEntry $context): string => sprintf(
+            'data' => fn(AbstractLogEntry $context): string => sprintf(
                 '<i class="fas fa-fw %s" title="%s"></i>',
                 $this->logLevelHelper->logLevelToIconClass($context->getLevelString()),
                 $context->getLevelString()
@@ -128,10 +134,10 @@ class LogDataTable implements DataTableTypeInterface
             )
         ]);
 
-        $dataTable->add('type', TextColumn::class, [
+        $dataTable->add('type', HTMLColumn::class, [
             'label' => 'log.type',
             'propertyPath' => 'type',
-            'render' => function (string $value, AbstractLogEntry $context) {
+            'data' => function (AbstractLogEntry $context, string $value) {
                 $text = $this->translator->trans('log.type.'.$value);
 
                 if ($context instanceof PartStockChangedLogEntry) {
@@ -149,20 +155,20 @@ class LogDataTable implements DataTableTypeInterface
             'label' => 'log.level',
             'visible' => 'system_log' === $options['mode'],
             'propertyPath' => 'levelString',
-            'render' => fn(string $value, AbstractLogEntry $context) => $this->translator->trans('log.level.'.$value),
+            'data' => fn(AbstractLogEntry $context, string $value) => $this->translator->trans('log.level.'.$value),
         ]);
 
-        $dataTable->add('user', TextColumn::class, [
+        $dataTable->add('user', HTMLColumn::class, [
             'label' => 'log.user',
             'orderField' => 'NATSORT(user.name)',
-            'render' => function ($value, AbstractLogEntry $context): string {
+            'data' => function (AbstractLogEntry $context): string {
                 $user = $context->getUser();
 
                 //If user was deleted, show the info from the username field
                 if (!$user instanceof User) {
                     if ($context->isCLIEntry()) {
                         return sprintf('%s [%s]',
-                            htmlentities((string) $context->getCLIUsername()),
+                            htmlspecialchars((string) $context->getCLIUsername()),
                             $this->translator->trans('log.cli_user')
                         );
                     }
@@ -170,7 +176,7 @@ class LogDataTable implements DataTableTypeInterface
                     //Else we just deal with a deleted user
                     return sprintf(
                         '@%s [%s]',
-                        htmlentities($context->getUsername()),
+                        htmlspecialchars($context->getUsername()),
                         $this->translator->trans('log.target_deleted'),
                     );
                 }
@@ -182,7 +188,7 @@ class LogDataTable implements DataTableTypeInterface
                     $img_url,
                     $this->userAvatarHelper->getAvatarMdURL($user),
                     $this->urlGenerator->generate('user_info', ['id' => $user->getID()]),
-                    htmlentities($user->getFullName(true))
+                    htmlspecialchars($user->getFullName(true))
                 );
             },
         ]);
@@ -194,7 +200,7 @@ class LogDataTable implements DataTableTypeInterface
             'render' => function (LogTargetType $value, AbstractLogEntry $context) {
                 $class = $value->toClass();
                 if (null !== $class) {
-                    return $this->elementTypeNameGenerator->getLocalizedTypeLabel($class);
+                    return $this->elementTypeNameGenerator->typeLabel($class);
                 }
 
                 return '';
@@ -216,9 +222,9 @@ class LogDataTable implements DataTableTypeInterface
             'icon' => 'fas fa-fw fa-eye',
             'href' => function ($value, AbstractLogEntry $context) {
                 if (
+                    $context instanceof CollectionElementDeleted ||
                     ($context instanceof TimeTravelInterface
                         && $context->hasOldDataInformation())
-                    || $context instanceof CollectionElementDeleted
                 ) {
                     try {
                         $target = $this->logRepo->getTargetElement($context);

src/DataTables/PartsDataTable.php

@@ -25,6 +25,7 @@ namespace App\DataTables;
 use App\DataTables\Adapters\TwoStepORMAdapter;
 use App\DataTables\Column\EntityColumn;
 use App\DataTables\Column\EnumColumn;
+use App\DataTables\Column\HTMLColumn;
 use App\DataTables\Column\IconLinkColumn;
 use App\DataTables\Column\LocaleDateTimeColumn;
 use App\DataTables\Column\MarkdownColumn;
@@ -58,7 +59,7 @@ use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\OptionsResolver\OptionsResolver;
 use Symfony\Contracts\Translation\TranslatorInterface;
 
-final class PartsDataTable implements DataTableTypeInterface
+final readonly class PartsDataTable implements DataTableTypeInterface
 {
     public const LENGTH_MENU = [[10, 25, 50, 100, 250, 500, -1], [10, 25, 50, 100, 250, 500, "All"]];
 
@@ -94,6 +95,11 @@ final class PartsDataTable implements DataTableTypeInterface
          * When adding columns here, add them also to PartTableColumns enum, to make them configurable in the settings!
          *************************************************************************************************************/
 
+        /*************************************************************************************************************
+         * Avoid using render, as it has no escaping, and is a potential security risk. Use data on TextColumn or the
+         * HTMLColumn, if necessary
+         ************************************************************************************************************/
+
         $this->csh
             //Color the table rows depending on the review and favorite status
             ->add('row_color', RowClassColumn::class, [
@@ -109,23 +115,23 @@ final class PartsDataTable implements DataTableTypeInterface
                 },
             ], visibility_configurable: false)
             ->add('select', SelectColumn::class, visibility_configurable: false)
-            ->add('picture', TextColumn::class, [
+            ->add('picture', HTMLColumn::class, [
                 'label' => '',
                 'className' => 'no-colvis',
-                'render' => fn($value, Part $context) => $this->partDataTableHelper->renderPicture($context),
+                'data' => fn(Part $context) => $this->partDataTableHelper->renderPicture($context),
             ], visibility_configurable: false)
-            ->add('name', TextColumn::class, [
+            ->add('name', HTMLColumn::class, [
                 'label' => $this->translator->trans('part.table.name'),
-                'render' => fn($value, Part $context) => $this->partDataTableHelper->renderName($context),
+                'data' => fn(Part $context) => $this->partDataTableHelper->renderName($context),
                 'orderField' => 'NATSORT(part.name)'
             ])
             ->add('si_value', TextColumn::class, [
                 'label' => $this->translator->trans('part.table.si_value'),
-                'render' => function ($value, Part $context): string {
+                'data' => function (Part $context): string {
                     $siValue = SiValueSort::sqliteSiValue($context->getName());
                     if ($siValue !== null) {
                         //Output it as scientific number with a big E
-                        return htmlspecialchars(sprintf('%G', $siValue));
+                        return sprintf('%G', $siValue);
                     }
                     return '';
                 },
@@ -156,38 +162,38 @@ final class PartsDataTable implements DataTableTypeInterface
                 'label' => $this->translator->trans('part.table.manufacturer'),
                 'orderField' => 'NATSORT(_manufacturer.name)'
             ])
-            ->add('storelocation', TextColumn::class, [
+            ->add('storelocation', HTMLColumn::class, [
                 'label' => $this->translator->trans('part.table.storeLocations'),
                 //We need to use a aggregate function to get the first store location, as we have a one-to-many relation
                 'orderField' => 'NATSORT(MIN(_storelocations.name))',
-                'render' => fn($value, Part $context) => $this->partDataTableHelper->renderStorageLocations($context),
+                'data' => fn(Part $context) => $this->partDataTableHelper->renderStorageLocations($context),
             ], alias: 'storage_location')
 
-            ->add('amount', TextColumn::class, [
+            ->add('amount', HTMLColumn::class, [
                 'label' => $this->translator->trans('part.table.amount'),
-                'render' => fn($value, Part $context) => $this->partDataTableHelper->renderAmount($context),
+                'data' => fn(Part $context) => $this->partDataTableHelper->renderAmount($context),
                 'orderField' => 'amountSum'
             ])
             ->add('minamount', TextColumn::class, [
                 'label' => $this->translator->trans('part.table.minamount'),
-                'render' => fn($value, Part $context): string => htmlspecialchars($this->amountFormatter->format(
+                'data' => fn(Part $context, $value): string => $this->amountFormatter->format(
                     $value,
                     $context->getPartUnit()
-                )),
+                ),
             ])
             ->add('partUnit', TextColumn::class, [
                 'label' => $this->translator->trans('part.table.partUnit'),
                 'orderField' => 'NATSORT(_partUnit.name)',
-                'render' => function ($value, Part $context): string {
+                'data' => function (Part $context): string {
                     $partUnit = $context->getPartUnit();
                     if ($partUnit === null) {
                         return '';
                     }
 
-                    $tmp = htmlspecialchars($partUnit->getName());
+                    $tmp = $partUnit->getName();
 
                     if ($partUnit->getUnit()) {
-                        $tmp .= ' (' . htmlspecialchars($partUnit->getUnit()) . ')';
+                        $tmp .= ' (' . $partUnit->getUnit() . ')';
                     }
                     return $tmp;
                 }
@@ -195,14 +201,14 @@ final class PartsDataTable implements DataTableTypeInterface
             ->add('partCustomState', TextColumn::class, [
                 'label' => $this->translator->trans('part.table.partCustomState'),
                 'orderField' => 'NATSORT(_partCustomState.name)',
-                'render' => function($value, Part $context): string {
+                'data' => function(Part $context): string {
                     $partCustomState = $context->getPartCustomState();
 
                     if ($partCustomState === null) {
                         return '';
                     }
 
-                    return htmlspecialchars($partCustomState->getName());
+                    return $partCustomState->getName();
                 }
             ])
             ->add('addedDate', LocaleDateTimeColumn::class, [
@@ -248,25 +254,25 @@ final class PartsDataTable implements DataTableTypeInterface
             ])
             ->add('eda_reference', TextColumn::class, [
                 'label' => $this->translator->trans('part.table.eda_reference'),
-                'render' => static fn($value, Part $context) => htmlspecialchars($context->getEdaInfo()->getReferencePrefix() ?? ''),
+                'data' => static fn(Part $context) => $context->getEdaInfo()->getReferencePrefix() ?? '',
                 'orderField' => 'NATSORT(part.eda_info.reference_prefix)'
             ])
             ->add('eda_value', TextColumn::class, [
                 'label' => $this->translator->trans('part.table.eda_value'),
-                'render' => static fn($value, Part $context) => htmlspecialchars($context->getEdaInfo()->getValue() ?? ''),
+                'data' => static fn(Part $context) => $context->getEdaInfo()->getValue() ?? '',
                 'orderField' => 'NATSORT(part.eda_info.value)'
             ])
-            ->add('eda_status', TextColumn::class, [
+            ->add('eda_status', HTMLColumn::class, [
                 'label' => $this->translator->trans('part.table.eda_status'),
-                'render' => fn($value, Part $context) => $this->partDataTableHelper->renderEdaStatus($context),
+                'data' => fn(Part $context) => $this->partDataTableHelper->renderEdaStatus($context),
                 'className' => 'text-center',
             ]);
 
         //Add a column to list the projects where the part is used, when the user has the permission to see the projects
         if ($this->security->isGranted('read', Project::class)) {
-            $this->csh->add('projects', TextColumn::class, [
+            $this->csh->add('projects', HTMLColumn::class, [
                 'label' => $this->translator->trans('project.labelp'),
-                'render' => function ($value, Part $context): string {
+                'data' => function (Part $context): string {
                     //Only show the first 5 projects names
                     $projects = $context->getProjects();
                     $tmp = "";
@@ -286,7 +292,7 @@ final class PartsDataTable implements DataTableTypeInterface
                     }
 
                     return $tmp;
-                }
+                },
             ]);
         }
 

src/DataTables/ProjectBomEntriesDataTable.php

@@ -25,6 +25,7 @@ namespace App\DataTables;
 use App\DataTables\Adapters\TwoStepORMAdapter;
 use App\DataTables\Column\EntityColumn;
 use App\DataTables\Column\EnumColumn;
+use App\DataTables\Column\HTMLColumn;
 use App\DataTables\Column\LocaleDateTimeColumn;
 use App\DataTables\Column\MarkdownColumn;
 use App\DataTables\Helpers\PartDataTableHelper;
@@ -48,7 +49,7 @@ use Omines\DataTablesBundle\DataTable;
 use Omines\DataTablesBundle\DataTableTypeInterface;
 use Symfony\Contracts\Translation\TranslatorInterface;
 
-class ProjectBomEntriesDataTable implements DataTableTypeInterface
+final readonly class ProjectBomEntriesDataTable implements DataTableTypeInterface
 {
     public function __construct(
         protected EntityURLGenerator $entityURLGenerator,
@@ -63,17 +64,22 @@ class ProjectBomEntriesDataTable implements DataTableTypeInterface
 
     public function configure(DataTable $dataTable, array $options): void
     {
+        /*************************************************************************************************************
+         * Avoid using render, as it has no escaping, and is a potential security risk. Use data on TextColumn or the
+         * HTMLColumn, if necessary
+         ************************************************************************************************************/
+
         $dataTable
             //->add('select', SelectColumn::class)
-            ->add('picture', TextColumn::class, [
+            ->add('picture', HTMLColumn::class, [
                 'label' => '',
                 'className' => 'no-colvis',
-                'render' => function ($value, ProjectBOMEntry $context) {
+                'data' => function (ProjectBOMEntry $context) {
                     if(!$context->getPart() instanceof Part) {
                         return '';
                     }
                     return $this->partDataTableHelper->renderPicture($context->getPart());
-                }
+                },
             ])
 
             ->add('id', TextColumn::class, [
@@ -85,27 +91,27 @@ class ProjectBomEntriesDataTable implements DataTableTypeInterface
                 'label' => $this->translator->trans('project.bom.quantity'),
                 'className' => 'text-center',
                 'orderField' => 'bom_entry.quantity',
-                'render' => function ($value, ProjectBOMEntry $context): float|string {
+                'data' => function (ProjectBOMEntry $context): float|string {
                     //If we have a non-part entry, only show the rounded quantity
                     if (!$context->getPart() instanceof Part) {
                         return round($context->getQuantity());
                     }
                     //Otherwise use the unit of the part to format the quantity
-                    return htmlspecialchars($this->amountFormatter->format($context->getQuantity(), $context->getPart()->getPartUnit()));
+                    return $this->amountFormatter->format($context->getQuantity(), $context->getPart()->getPartUnit());
                 },
             ])
             ->add('partId', TextColumn::class, [
                 'label' => $this->translator->trans('project.bom.part_id'),
                 'visible' => true,
                 'orderField' => 'part.id',
-                'render' => function ($value, ProjectBOMEntry $context) {
+                'data' => function (ProjectBOMEntry $context) {
                     return $context->getPart() instanceof Part ? (string) $context->getPart()->getId() : '';
                 },
             ])
-            ->add('name', TextColumn::class, [
+            ->add('name', HTMLColumn::class, [
                 'label' => $this->translator->trans('part.table.name'),
                 'orderField' => 'NATSORT(part.name)',
-                'render' => function ($value, ProjectBOMEntry $context) {
+                'data' => function (ProjectBOMEntry $context) {
                     if(!$context->getPart() instanceof Part) {
                         return htmlspecialchars((string) $context->getName());
                     }
@@ -123,11 +129,7 @@ class ProjectBomEntriesDataTable implements DataTableTypeInterface
                 'label' => $this->translator->trans('part.table.ipn'),
                 'orderField' => 'NATSORT(part.ipn)',
                 'visible' => false,
-                'render' => function ($value, ProjectBOMEntry $context) {
-                    if($context->getPart() instanceof Part) {
-                        return $context->getPart()->getIpn();
-                    }
-                }
+                'data' => fn (ProjectBOMEntry $context) => $context->getPart()?->getIpn()
             ])
             ->add('description', MarkdownColumn::class, [
                 'label' => $this->translator->trans('part.table.description'),
@@ -172,9 +174,9 @@ class ProjectBomEntriesDataTable implements DataTableTypeInterface
                 },
             ])
 
-            ->add('mountnames', TextColumn::class, [
+            ->add('mountnames', HTMLColumn::class, [
                 'label' => 'project.bom.mountnames',
-                'render' => function ($value, ProjectBOMEntry $context) {
+                'data' => function (ProjectBOMEntry $context) {
                     $html = '';
 
                     foreach (explode(',', $context->getMountnames()) as $mountname) {
@@ -184,34 +186,34 @@ class ProjectBomEntriesDataTable implements DataTableTypeInterface
                 },
             ])
 
-            ->add('instockAmount', TextColumn::class, [
+            ->add('instockAmount', HTMLColumn::class, [
                 'label' => 'project.bom.instockAmount',
                 'visible' => false,
-                'render' => function ($value, ProjectBOMEntry $context) {
+                'data' => function (ProjectBOMEntry $context) {
                     if ($context->getPart() !== null) {
                         return $this->partDataTableHelper->renderAmount($context->getPart());
                     }
 
                     return '';
-                }
+                },
             ])
-            ->add('storelocation', TextColumn::class, [
+            ->add('storelocation', HTMLColumn::class, [
                 'label' => $this->translator->trans('part.table.storeLocations'),
                 //We need to use a aggregate function to get the first store location, as we have a one-to-many relation
                 'orderField' => 'NATSORT(MIN(_storelocations.name))',
                 'visible' => false,
-                'render' => function ($value, ProjectBOMEntry $context) {
+                'data' => function (ProjectBOMEntry $context) {
                     if ($context->getPart() !== null) {
                         return $this->partDataTableHelper->renderStorageLocations($context->getPart());
                     }
 
                     return '';
-                }
+                },
             ])
             ->add('price', TextColumn::class, [
                 'label' => 'project.bom.price',
                 'visible' => false,
-                'render' => function ($value, ProjectBOMEntry $context) {
+                'data' => function (ProjectBOMEntry $context) {
                     $price = $this->projectBuildHelper->getEntryUnitPrice($context);
                     return $this->moneyFormatter->format($price->toScale(2, RoundingMode::Up)->toFloat(), null, 2, true);
                 },
@@ -219,7 +221,7 @@ class ProjectBomEntriesDataTable implements DataTableTypeInterface
             ->add('ext_price', TextColumn::class, [
                 'label' => 'project.bom.ext_price',
                 'visible' => false,
-                'render' => function ($value, ProjectBOMEntry $context) {
+                'data' => function (ProjectBOMEntry $context) {
                     $price = $this->projectBuildHelper->getEntryUnitPrice($context);
                     return $this->moneyFormatter->format(
                         $price->multipliedBy(BigDecimal::fromFloatShortest($context->getQuantity()))

src/Doctrine/Middleware/SQLiteRegexExtensionMiddlewareDriver.php

@@ -27,6 +27,7 @@ use App\Doctrine\Functions\SiValueSort;
 use App\Exceptions\InvalidRegexException;
 use Doctrine\DBAL\Driver\Connection;
 use Doctrine\DBAL\Driver\Middleware\AbstractDriverMiddleware;
+use Pdo\Sqlite;
 
 /**
  * This middleware is used to add the regexp operator to the SQLite platform.
@@ -44,8 +45,20 @@ class SQLiteRegexExtensionMiddlewareDriver extends AbstractDriverMiddleware
         if ($params['driver'] === 'pdo_sqlite') {
             $native_connection = $connection->getNativeConnection();
 
-            //Ensure that the function really exists on the connection, as it is marked as experimental according to PHP documentation
             if($native_connection instanceof \PDO) {
+
+                //Use the new PDO::createFunction and PDO::createCollation methods if available (PHP 8.4+)
+                if (is_a($native_connection, Sqlite::class)) { #TODO: Remove this check when PHP 8.4 is the minimum requirement
+                    $native_connection->createFunction('REGEXP', self::regexp(...), 2, Sqlite::DETERMINISTIC);
+                    $native_connection->createFunction('FIELD', self::field(...), -1, Sqlite::DETERMINISTIC);
+                    $native_connection->createFunction('FIELD2', self::field2(...), 2, Sqlite::DETERMINISTIC);
+
+                    //Create a new collation for natural sorting
+                    $native_connection->createCollation('NATURAL_CMP', strnatcmp(...));
+
+                    //Create a function for SI prefix value sorting
+                    $native_connection->createFunction('SI_VALUE', SiValueSort::sqliteSiValue(...), 1, Sqlite::DETERMINISTIC);
+                } else {
                     $native_connection->sqliteCreateFunction('REGEXP', self::regexp(...), 2, \PDO::SQLITE_DETERMINISTIC);
                     $native_connection->sqliteCreateFunction('FIELD', self::field(...), -1, \PDO::SQLITE_DETERMINISTIC);
                     $native_connection->sqliteCreateFunction('FIELD2', self::field2(...), 2, \PDO::SQLITE_DETERMINISTIC);
@@ -57,6 +70,7 @@ class SQLiteRegexExtensionMiddlewareDriver extends AbstractDriverMiddleware
                     $native_connection->sqliteCreateFunction('SI_VALUE', SiValueSort::sqliteSiValue(...), 1, \PDO::SQLITE_DETERMINISTIC);
                 }
             }
+        }
 
 
         return $connection;

src/Doctrine/Middleware/SetSQLModeMiddlewareDriver.php

@@ -35,8 +35,10 @@ class SetSQLModeMiddlewareDriver extends AbstractDriverMiddleware
     {
         //Only set this on MySQL connections, as other databases don't support this parameter
         if($params['driver'] === 'pdo_mysql') {
-            //1002 is \PDO::MYSQL_ATTR_INIT_COMMAND constant value
-            $params['driverOptions'][\PDO::MYSQL_ATTR_INIT_COMMAND] = 'SET SESSION sql_mode=(SELECT REPLACE(@@sql_mode, \'ONLY_FULL_GROUP_BY\', \'\'))';
+            //PDO::MYSQL_ATTR_INIT_COMMAND is deprecated since PHP 8.5 in favor of Pdo\Mysql::ATTR_INIT_COMMAND,
+            //but the Pdo\Mysql class only exists since PHP 8.4. Both constants have the same value (1002).
+            $initCommandAttr = class_exists(\Pdo\Mysql::class) ? \Pdo\Mysql::ATTR_INIT_COMMAND : \PDO::MYSQL_ATTR_INIT_COMMAND;
+            $params['driverOptions'][$initCommandAttr] = 'SET SESSION sql_mode=(SELECT REPLACE(@@sql_mode, \'ONLY_FULL_GROUP_BY\', \'\'))';
         }
 
         return parent::connect($params);

src/Entity/Attachments/AttachmentType.php

@@ -65,21 +65,16 @@ use Symfony\Component\Validator\Constraints as Assert;
         new Post(securityPostDenormalize: 'is_granted("create", object)'),
         new Patch(security: 'is_granted("edit", object)'),
         new Delete(security: 'is_granted("delete", object)'),
+        new GetCollection(
+            uriTemplate: '/attachment_types/{id}/children.{_format}',
+            uriVariables: ['id' => new Link(fromProperty: 'children', fromClass: AttachmentType::class)],
+            openapi: new Operation(summary: 'Retrieves the children elements of an attachment type.'),
+            security: 'is_granted("@attachment_types.read")'
+        ),
     ],
     normalizationContext: ['groups' => ['attachment_type:read', 'api:basic:read'], 'openapi_definition_name' => 'Read'],
     denormalizationContext: ['groups' => ['attachment_type:write', 'api:basic:write', 'attachment:write', 'parameter:write'], 'openapi_definition_name' => 'Write'],
 )]
-#[ApiResource(
-    uriTemplate: '/attachment_types/{id}/children.{_format}',
-    operations: [
-        new GetCollection(openapi: new Operation(summary: 'Retrieves the children elements of an attachment type.'),
-            security: 'is_granted("@attachment_types.read")')
-    ],
-    uriVariables: [
-        'id' => new Link(fromProperty: 'children', fromClass: AttachmentType::class)
-    ],
-    normalizationContext: ['groups' => ['attachment_type:read', 'api:basic:read'], 'openapi_definition_name' => 'Read']
-)]
 #[ApiFilter(PropertyFilter::class)]
 #[ApiFilter(LikeFilter::class, properties: ["name", "comment"])]
 #[ApiFilter(DateFilter::class, strategy: DateFilterInterface::EXCLUDE_NULL)]

src/Entity/Parts/Category.php

@@ -68,23 +68,16 @@ use Symfony\Component\Validator\Constraints as Assert;
         new Post(securityPostDenormalize: 'is_granted("create", object)'),
         new Patch(security: 'is_granted("edit", object)'),
         new Delete(security: 'is_granted("delete", object)'),
+        new GetCollection(
+            uriTemplate: '/categories/{id}/children.{_format}',
+            uriVariables: ['id' => new Link(fromProperty: 'children', fromClass: Category::class)],
+            openapi: new Operation(summary: 'Retrieves the children elements of a category.'),
+            security: 'is_granted("@categories.read")'
+        ),
     ],
     normalizationContext: ['groups' => ['category:read', 'api:basic:read'], 'openapi_definition_name' => 'Read'],
     denormalizationContext: ['groups' => ['category:write', 'api:basic:write', 'attachment:write', 'parameter:write'], 'openapi_definition_name' => 'Write'],
 )]
-#[ApiResource(
-    uriTemplate: '/categories/{id}/children.{_format}',
-    operations: [
-        new GetCollection(
-            openapi: new Operation(summary: 'Retrieves the children elements of a category.'),
-            security: 'is_granted("@categories.read")'
-        )
-    ],
-    uriVariables: [
-        'id' => new Link(fromProperty: 'children', fromClass: Category::class)
-    ],
-    normalizationContext: ['groups' => ['category:read', 'api:basic:read'], 'openapi_definition_name' => 'Read']
-)]
 #[ApiFilter(PropertyFilter::class)]
 #[ApiFilter(LikeFilter::class, properties: ["name", "comment"])]
 #[ApiFilter(DateFilter::class, strategy: DateFilterInterface::EXCLUDE_NULL)]

src/Entity/Parts/Footprint.php

@@ -67,23 +67,16 @@ use Symfony\Component\Validator\Constraints as Assert;
         new Post(securityPostDenormalize: 'is_granted("create", object)'),
         new Patch(security: 'is_granted("edit", object)'),
         new Delete(security: 'is_granted("delete", object)'),
+        new GetCollection(
+            uriTemplate: '/footprints/{id}/children.{_format}',
+            uriVariables: ['id' => new Link(fromProperty: 'children', fromClass: Footprint::class)],
+            openapi: new Operation(summary: 'Retrieves the children elements of a footprint.'),
+            security: 'is_granted("@footprints.read")'
+        ),
     ],
     normalizationContext: ['groups' => ['footprint:read', 'api:basic:read'], 'openapi_definition_name' => 'Read'],
     denormalizationContext: ['groups' => ['footprint:write', 'api:basic:write', 'attachment:write', 'parameter:write'], 'openapi_definition_name' => 'Write'],
 )]
-#[ApiResource(
-    uriTemplate: '/footprints/{id}/children.{_format}',
-    operations: [
-        new GetCollection(
-            openapi: new Operation(summary: 'Retrieves the children elements of a footprint.'),
-            security: 'is_granted("@footprints.read")'
-        )
-    ],
-    uriVariables: [
-        'id' => new Link(fromProperty: 'children', fromClass: Footprint::class)
-    ],
-    normalizationContext: ['groups' => ['footprint:read', 'api:basic:read'], 'openapi_definition_name' => 'Read']
-)]
 #[ApiFilter(PropertyFilter::class)]
 #[ApiFilter(LikeFilter::class, properties: ["name", "comment"])]
 #[ApiFilter(DateFilter::class, strategy: DateFilterInterface::EXCLUDE_NULL)]

src/Entity/Parts/InfoProviderReference.php

@@ -28,9 +28,11 @@ use Doctrine\DBAL\Types\Types;
 use Doctrine\ORM\Mapping\Column;
 use Doctrine\ORM\Mapping\Embeddable;
 use Symfony\Component\Serializer\Annotation\Groups;
+use Symfony\Component\Validator\Constraints as Assert;
+use Symfony\Component\Validator\Context\ExecutionContextInterface;
 
 /**
- * This class represents a reference to a info provider inside a part.
+ * This class represents a reference to an info provider inside a part.
  * @see \App\Tests\Entity\Parts\InfoProviderReferenceTest
  */
 #[Embeddable]
@@ -157,4 +159,44 @@ class InfoProviderReference
         $ref->last_updated = new \DateTimeImmutable();
         return $ref;
     }
+
+    /**
+     * Creates a reference to an info provider based on the given parameters.
+     * @param  string|null  $provider_key
+     * @param  string|null  $provider_id
+     * @param  string|null  $provider_url
+     * @param  \DateTimeImmutable|null  $last_updated
+     * @return self
+     */
+    public static function create(?string $provider_key, ?string $provider_id, ?string $provider_url, ?\DateTimeImmutable $last_updated): self
+    {
+        $ref = new InfoProviderReference();
+        $ref->provider_key = $provider_key;
+        $ref->provider_id = $provider_id;
+        $ref->provider_url = $provider_url;
+        $ref->last_updated = $last_updated;
+        return $ref;
+    }
+
+    #[Assert\Callback()]
+    public function validate(ExecutionContextInterface $context, mixed $payload): void
+    {
+        if ($this->provider_key === null && $this->provider_id !== null) {
+            $context->buildViolation('info_providers.validation.provider_id_without_key')
+                ->atPath('provider_key')
+                ->addViolation();
+        }
+
+        if ($this->provider_key === null && $this->provider_url !== null) {
+            $context->buildViolation('info_providers.validation.provider_url_without_key')
+                ->atPath('provider_url')
+                ->addViolation();
+        }
+
+        if ($this->provider_key !== null && $this->provider_id === null) {
+            $context->buildViolation('info_providers.validation.provider_key_without_id')
+                ->atPath('provider_id')
+                ->addViolation();
+        }
+    }
 }

src/Entity/Parts/Manufacturer.php

@@ -66,23 +66,16 @@ use Symfony\Component\Validator\Constraints as Assert;
         new Post(securityPostDenormalize: 'is_granted("create", object)'),
         new Patch(security: 'is_granted("edit", object)'),
         new Delete(security: 'is_granted("delete", object)'),
+        new GetCollection(
+            uriTemplate: '/manufacturers/{id}/children.{_format}',
+            uriVariables: ['id' => new Link(fromProperty: 'children', fromClass: Manufacturer::class)],
+            openapi: new Operation(summary: 'Retrieves the children elements of a manufacturer.'),
+            security: 'is_granted("@manufacturers.read")'
+        ),
     ],
     normalizationContext: ['groups' => ['manufacturer:read', 'company:read', 'api:basic:read'], 'openapi_definition_name' => 'Read'],
     denormalizationContext: ['groups' => ['manufacturer:write', 'company:write', 'api:basic:write', 'attachment:write', 'parameter:write'], 'openapi_definition_name' => 'Write'],
 )]
-#[ApiResource(
-    uriTemplate: '/manufacturers/{id}/children.{_format}',
-    operations: [
-        new GetCollection(
-            openapi: new Operation(summary: 'Retrieves the children elements of a manufacturer.'),
-            security: 'is_granted("@manufacturers.read")'
-        )
-    ],
-    uriVariables: [
-        'id' => new Link(fromProperty: 'children', fromClass: Manufacturer::class)
-    ],
-    normalizationContext: ['groups' => ['manufacturer:read', 'company:read', 'api:basic:read'], 'openapi_definition_name' => 'Read']
-)]
 #[ApiFilter(PropertyFilter::class)]
 #[ApiFilter(LikeFilter::class, properties: ["name", "comment"])]
 #[ApiFilter(DateFilter::class, strategy: DateFilterInterface::EXCLUDE_NULL)]

src/Entity/Parts/MeasurementUnit.php

@@ -71,23 +71,16 @@ use Symfony\Component\Validator\Constraints\Length;
         new Post(securityPostDenormalize: 'is_granted("create", object)'),
         new Patch(security: 'is_granted("edit", object)'),
         new Delete(security: 'is_granted("delete", object)'),
+        new GetCollection(
+            uriTemplate: '/measurement_units/{id}/children.{_format}',
+            uriVariables: ['id' => new Link(fromProperty: 'children', fromClass: MeasurementUnit::class)],
+            openapi: new Operation(summary: 'Retrieves the children elements of a MeasurementUnit.'),
+            security: 'is_granted("@measurement_units.read")'
+        ),
     ],
     normalizationContext: ['groups' => ['measurement_unit:read', 'api:basic:read'], 'openapi_definition_name' => 'Read'],
     denormalizationContext: ['groups' => ['measurement_unit:write', 'api:basic:write', 'attachment:write', 'parameter:write'], 'openapi_definition_name' => 'Write'],
 )]
-#[ApiResource(
-    uriTemplate: '/measurement_units/{id}/children.{_format}',
-    operations: [
-        new GetCollection(
-            openapi: new Operation(summary: 'Retrieves the children elements of a MeasurementUnit.'),
-            security: 'is_granted("@measurement_units.read")'
-        )
-    ],
-    uriVariables: [
-        'id' => new Link(fromProperty: 'children', fromClass: MeasurementUnit::class)
-    ],
-    normalizationContext: ['groups' => ['measurement_unit:read', 'api:basic:read'], 'openapi_definition_name' => 'Read']
-)]
 #[ApiFilter(PropertyFilter::class)]
 #[ApiFilter(LikeFilter::class, properties: ["name", "comment", "unit"])]
 #[ApiFilter(DateFilter::class, strategy: DateFilterInterface::EXCLUDE_NULL)]

src/Entity/Parts/PartTraits/AdvancedPropertyTrait.php

@@ -75,6 +75,7 @@ trait AdvancedPropertyTrait
      */
     #[ORM\Embedded(class: InfoProviderReference::class, columnPrefix: 'provider_reference_')]
     #[Groups(['full', 'part:read'])]
+    #[Assert\Valid()]
     protected InfoProviderReference $providerReference;
 
     /**

src/Entity/Parts/StorageLocation.php

@@ -67,23 +67,16 @@ use Symfony\Component\Validator\Constraints as Assert;
         new Post(securityPostDenormalize: 'is_granted("create", object)'),
         new Patch(security: 'is_granted("edit", object)'),
         new Delete(security: 'is_granted("delete", object)'),
+        new GetCollection(
+            uriTemplate: '/storage_locations/{id}/children.{_format}',
+            uriVariables: ['id' => new Link(fromProperty: 'children', fromClass: StorageLocation::class)],
+            openapi: new Operation(summary: 'Retrieves the children elements of a storage location.'),
+            security: 'is_granted("@storelocations.read")'
+        ),
     ],
     normalizationContext: ['groups' => ['location:read', 'api:basic:read'], 'openapi_definition_name' => 'Read'],
     denormalizationContext: ['groups' => ['location:write', 'api:basic:write', 'attachment:write', 'parameter:write'], 'openapi_definition_name' => 'Write'],
 )]
-#[ApiResource(
-    uriTemplate: '/storage_locations/{id}/children.{_format}',
-    operations: [
-        new GetCollection(
-            openapi: new Operation(summary: 'Retrieves the children elements of a storage location.'),
-            security: 'is_granted("@storelocations.read")'
-        )
-    ],
-    uriVariables: [
-        'id' => new Link(fromProperty: 'children', fromClass: Manufacturer::class)
-    ],
-    normalizationContext: ['groups' => ['location:read', 'api:basic:read'], 'openapi_definition_name' => 'Read']
-)]
 #[ApiFilter(PropertyFilter::class)]
 #[ApiFilter(LikeFilter::class, properties: ["name", "comment"])]
 #[ApiFilter(DateFilter::class, strategy: DateFilterInterface::EXCLUDE_NULL)]

src/Entity/Parts/Supplier.php

@@ -71,21 +71,16 @@ use Symfony\Component\Validator\Constraints as Assert;
         new Post(securityPostDenormalize: 'is_granted("create", object)'),
         new Patch(security: 'is_granted("edit", object)'),
         new Delete(security: 'is_granted("delete", object)'),
+        new GetCollection(
+            uriTemplate: '/suppliers/{id}/children.{_format}',
+            uriVariables: ['id' => new Link(fromProperty: 'children', fromClass: Supplier::class)],
+            openapi: new Operation(summary: 'Retrieves the children elements of a supplier.'),
+            security: 'is_granted("@manufacturers.read")'
+        ),
     ],
     normalizationContext: ['groups' => ['supplier:read', 'company:read', 'api:basic:read'], 'openapi_definition_name' => 'Read'],
     denormalizationContext: ['groups' => ['supplier:write', 'company:write', 'api:basic:write', 'attachment:write', 'parameter:write'], 'openapi_definition_name' => 'Write'],
 )]
-#[ApiResource(
-    uriTemplate: '/suppliers/{id}/children.{_format}',
-    operations: [new GetCollection(
-        openapi: new Operation(summary: 'Retrieves the children elements of a supplier.'),
-        security: 'is_granted("@manufacturers.read")'
-    )],
-    uriVariables: [
-        'id' => new Link(fromProperty: 'children', fromClass: Supplier::class)
-    ],
-    normalizationContext: ['groups' => ['supplier:read', 'company:read', 'api:basic:read'], 'openapi_definition_name' => 'Read']
-)]
 #[ApiFilter(PropertyFilter::class)]
 #[ApiFilter(LikeFilter::class, properties: ["name", "comment"])]
 #[ApiFilter(DateFilter::class, strategy: DateFilterInterface::EXCLUDE_NULL)]

src/Entity/PriceInformations/Currency.php

@@ -71,23 +71,16 @@ use Symfony\Component\Validator\Constraints as Assert;
         new Post(securityPostDenormalize: 'is_granted("create", object)'),
         new Patch(security: 'is_granted("edit", object)'),
         new Delete(security: 'is_granted("delete", object)'),
+        new GetCollection(
+            uriTemplate: '/currencies/{id}/children.{_format}',
+            uriVariables: ['id' => new Link(fromProperty: 'children', fromClass: Currency::class)],
+            openapi: new Operation(summary: 'Retrieves the children elements of a currency.'),
+            security: 'is_granted("@currencies.read")'
+        ),
     ],
     normalizationContext: ['groups' => ['currency:read', 'api:basic:read'], 'openapi_definition_name' => 'Read'],
     denormalizationContext: ['groups' => ['currency:write', 'api:basic:write', 'attachment:write', 'parameter:write'], 'openapi_definition_name' => 'Write'],
 )]
-#[ApiResource(
-    uriTemplate: '/currencies/{id}/children.{_format}',
-    operations: [
-        new GetCollection(
-            openapi: new Operation(summary: 'Retrieves the children elements of a currency.'),
-            security: 'is_granted("@currencies.read")'
-        )
-    ],
-    uriVariables: [
-        'id' => new Link(fromProperty: 'children', fromClass: Currency::class)
-    ],
-    normalizationContext: ['groups' => ['currency:read', 'api:basic:read'], 'openapi_definition_name' => 'Read']
-)]
 #[ApiFilter(PropertyFilter::class)]
 #[ApiFilter(LikeFilter::class, properties: ["name", "comment", "iso_code"])]
 #[ApiFilter(DateFilter::class, strategy: DateFilterInterface::EXCLUDE_NULL)]

src/Entity/PriceInformations/Orderdetail.php

@@ -71,23 +71,17 @@ use Symfony\Component\Validator\Constraints\Length;
         new Post(securityPostDenormalize: 'is_granted("create", object)'),
         new Patch(security: 'is_granted("edit", object)'),
         new Delete(security: 'is_granted("delete", object)'),
+        new GetCollection(
+            uriTemplate: '/parts/{id}/orderdetails.{_format}',
+            uriVariables: ['id' => new Link(toProperty: 'part', fromClass: Part::class)],
+            normalizationContext: ['groups' => ['orderdetail:read', 'pricedetail:read', 'api:basic:read'], 'openapi_definition_name' => 'Read'],
+            openapi: new Operation(summary: 'Retrieves the orderdetails of a part.'),
+            security: 'is_granted("@parts.read")'
+        ),
     ],
     normalizationContext: ['groups' => ['orderdetail:read', 'orderdetail:read:standalone',  'api:basic:read', 'pricedetail:read'], 'openapi_definition_name' => 'Read'],
     denormalizationContext: ['groups' => ['orderdetail:write', 'api:basic:write'], 'openapi_definition_name' => 'Write'],
 )]
-#[ApiResource(
-    uriTemplate: '/parts/{id}/orderdetails.{_format}',
-    operations: [
-        new GetCollection(
-            openapi: new Operation(summary: 'Retrieves the orderdetails of a part.'),
-            security: 'is_granted("@parts.read")'
-        )
-    ],
-    uriVariables: [
-        'id' => new Link(toProperty: 'part', fromClass: Part::class)
-    ],
-    normalizationContext: ['groups' => ['orderdetail:read', 'pricedetail:read', 'api:basic:read'], 'openapi_definition_name' => 'Read']
-)]
 #[ApiFilter(PropertyFilter::class)]
 #[ApiFilter(PropertyFilter::class)]
 #[ApiFilter(LikeFilter::class, properties: ["supplierpartnr", "supplier_product_url"])]

src/Entity/ProjectSystem/Project.php

@@ -66,23 +66,16 @@ use Symfony\Component\Validator\Context\ExecutionContextInterface;
         new Post(securityPostDenormalize: 'is_granted("create", object)'),
         new Patch(security: 'is_granted("edit", object)'),
         new Delete(security: 'is_granted("delete", object)'),
+        new GetCollection(
+            uriTemplate: '/projects/{id}/children.{_format}',
+            uriVariables: ['id' => new Link(fromProperty: 'children', fromClass: Project::class)],
+            openapi: new Operation(summary: 'Retrieves the children elements of a project.'),
+            security: 'is_granted("@projects.read")'
+        ),
     ],
     normalizationContext: ['groups' => ['project:read', 'api:basic:read'], 'openapi_definition_name' => 'Read'],
     denormalizationContext: ['groups' => ['project:write', 'api:basic:write', 'attachment:write', 'parameter:write'], 'openapi_definition_name' => 'Write'],
 )]
-#[ApiResource(
-    uriTemplate: '/projects/{id}/children.{_format}',
-    operations: [
-        new GetCollection(
-            openapi: new Operation(summary: 'Retrieves the children elements of a project.'),
-            security: 'is_granted("@projects.read")'
-        )
-    ],
-    uriVariables: [
-        'id' => new Link(fromProperty: 'children', fromClass: Project::class)
-    ],
-    normalizationContext: ['groups' => ['project:read', 'api:basic:read'], 'openapi_definition_name' => 'Read']
-)]
 #[ApiFilter(PropertyFilter::class)]
 #[ApiFilter(LikeFilter::class, properties: ["name", "comment"])]
 #[ApiFilter(OrderFilter::class, properties: ['name', 'id', 'addedDate', 'lastModified'])]
@@ -117,7 +110,7 @@ class Project extends AbstractStructuralDBElement
     /**
      * @var string|null The current status of the project
      */
-    #[Assert\Choice(['draft', 'planning', 'in_production', 'finished', 'archived'])]
+    #[Assert\Choice(choices: ['draft', 'planning', 'in_production', 'finished', 'archived'])]
     #[Groups(['extended', 'full', 'project:read', 'project:write', 'import'])]
     #[ORM\Column(type: Types::STRING, length: 64, nullable: true)]
     protected ?string $status = null;

src/Entity/ProjectSystem/ProjectBOMEntry.php

@@ -63,23 +63,16 @@ use Symfony\Component\Validator\Context\ExecutionContextInterface;
         new Post(uriTemplate: '/project_bom_entries.{_format}', securityPostDenormalize: 'is_granted("create", object)',),
         new Patch(uriTemplate: '/project_bom_entries/{id}.{_format}', security: 'is_granted("edit", object)',),
         new Delete(uriTemplate: '/project_bom_entries/{id}.{_format}', security: 'is_granted("delete", object)',),
+        new GetCollection(
+            uriTemplate: '/projects/{id}/bom.{_format}',
+            uriVariables: ['id' => new Link(fromProperty: 'bom_entries', fromClass: Project::class)],
+            openapi: new Operation(summary: 'Retrieves the BOM entries of the given project.'),
+            security: 'is_granted("@projects.read")'
+        ),
     ],
     normalizationContext: ['groups' => ['bom_entry:read', 'api:basic:read'], 'openapi_definition_name' => 'Read'],
     denormalizationContext: ['groups' => ['bom_entry:write', 'api:basic:write'], 'openapi_definition_name' => 'Write'],
 )]
-#[ApiResource(
-    uriTemplate: '/projects/{id}/bom.{_format}',
-    operations: [
-        new GetCollection(
-            openapi: new Operation(summary: 'Retrieves the BOM entries of the given project.'),
-            security: 'is_granted("@projects.read")'
-        )
-    ],
-    uriVariables: [
-        'id' => new Link(fromProperty: 'bom_entries', fromClass: Project::class)
-    ],
-    normalizationContext: ['groups' => ['bom_entry:read', 'api:basic:read'], 'openapi_definition_name' => 'Read']
-)]
 #[ApiFilter(PropertyFilter::class)]
 #[ApiFilter(LikeFilter::class, properties: ["name", "comment", 'mountnames'])]
 #[ApiFilter(RangeFilter::class, properties: ['quantity'])]

src/Form/Extension/DateTimeModelTimezoneExtension.php

@@ -0,0 +1,79 @@
+<?php
+/*
+ * This file is part of Part-DB (https://github.com/Part-DB/Part-DB-symfony).
+ *
+ *  Copyright (C) 2019 - 2025 Jan Böhmer (https://github.com/jbtronics)
+ *
+ *  This program is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU Affero General Public License as published
+ *  by the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU Affero General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Affero General Public License
+ *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+declare(strict_types=1);
+
+namespace App\Form\Extension;
+
+use Symfony\Component\Form\AbstractTypeExtension;
+use Symfony\Component\Form\Extension\Core\Type\DateTimeType;
+use Symfony\Component\Form\Extension\Core\Type\DateType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\Form\FormEvent;
+use Symfony\Component\Form\FormEvents;
+
+/**
+ * Catches timezone mismatches between a DateTimeInterface model value and the effective
+ * model_timezone configured on the field.
+ *
+ * Doctrine's UTCDateTimeImmutableType always returns UTC DateTimeImmutable objects, so any
+ * date/datetime field that omits `model_timezone: 'UTC'` will silently corrupt stored values
+ * (the transformer treats the UTC instant as if it were in the user's local timezone).
+ * This extension throws a \LogicException early so the mistake is caught at development time.
+ */
+class DateTimeModelTimezoneExtension extends AbstractTypeExtension
+{
+    public static function getExtendedTypes(): iterable
+    {
+        return [DateTimeType::class, DateType::class];
+    }
+
+    public function buildForm(FormBuilderInterface $builder, array $options): void
+    {
+        $builder->addEventListener(FormEvents::POST_SET_DATA, static function (FormEvent $event) use ($options): void {
+            $data = $event->getData();
+
+            if (!$data instanceof \DateTimeInterface) {
+                return;
+            }
+
+            // Resolve the effective model timezone: explicit option or the PHP default set at build time.
+            // This mirrors what BaseDateTimeTransformer does in its constructor.
+            $modelTimezone = $options['model_timezone'] ?? date_default_timezone_get();
+
+            $dataOffset  = $data->getTimezone()->getOffset($data);
+            $modelOffset = (new \DateTimeZone($modelTimezone))->getOffset($data);
+
+            if ($dataOffset !== $modelOffset) {
+                throw new \LogicException(sprintf(
+                    'Form field "%s" received a %s with timezone "%s" (UTC offset %+d s), '
+                    . 'but the effective model_timezone is "%s" (UTC offset %+d s). '
+                    . 'Set the "model_timezone" option to match the timezone of your data source.',
+                    $event->getForm()->getName(),
+                    get_debug_type($data),
+                    $data->getTimezone()->getName(),
+                    $dataOffset,
+                    $modelTimezone,
+                    $modelOffset
+                ));
+            }
+        });
+    }
+}

src/Form/InfoProviderSystem/InfoProviderReferenceType.php

@@ -0,0 +1,113 @@
+<?php
+/*
+ * This file is part of Part-DB (https://github.com/Part-DB/Part-DB-symfony).
+ *
+ *  Copyright (C) 2019 - 2026 Jan Böhmer (https://github.com/jbtronics)
+ *
+ *  This program is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU Affero General Public License as published
+ *  by the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU Affero General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Affero General Public License
+ *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+declare(strict_types=1);
+
+
+namespace App\Form\InfoProviderSystem;
+
+use App\Entity\Parts\InfoProviderReference;
+use Symfony\Component\Form\AbstractType;
+use Symfony\Component\Form\DataMapperInterface;
+use Symfony\Component\Form\Extension\Core\Type\TextType;
+use Symfony\Component\Form\Extension\Core\Type\UrlType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\Form\FormInterface;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+
+class InfoProviderReferenceType extends AbstractType implements DataMapperInterface
+{
+    public function buildForm(FormBuilderInterface $builder, array $options): void
+    {
+        $builder
+            ->setDataMapper($this)
+            ->add('provider_key', ProviderSelectType::class, [
+                'label' =>  'info_providers.provider_key',
+                'input' => 'string',
+                'multiple' => false,
+                'required' => false,
+                'only_active' => false,
+            ])
+            ->add('provider_id', TextType::class, [
+                'label' =>  'info_providers.provider_id',
+                'required' => false,
+            ])
+            ->add('provider_url', UrlType::class, [
+                'label' =>  'info_providers.provider_url',
+                'required' => false,
+            ])
+        ;
+    }
+
+    public function configureOptions(OptionsResolver $resolver): void
+    {
+        $resolver->setDefaults([
+            'data_class' => InfoProviderReference::class,
+        ]);
+    }
+
+
+    public function mapDataToForms(mixed $viewData, \Traversable $forms): void
+    {
+        if ($viewData === null) {
+            return;
+        }
+
+        if (!$viewData instanceof InfoProviderReference) {
+            return;
+        }
+
+        /** @var FormInterface[] $forms */
+        $forms = iterator_to_array($forms);
+
+        $forms['provider_key']->setData($viewData->getProviderKey());
+        $forms['provider_id']->setData($viewData->getProviderId());
+        $forms['provider_url']->setData($viewData->getProviderUrl());
+    }
+
+    public function mapFormsToData(\Traversable $forms, mixed &$viewData): void
+    {
+        /** @var FormInterface[] $forms */
+        $forms = iterator_to_array($forms);
+
+        $providerKey = $forms['provider_key']->getData();
+        $providerId = $forms['provider_id']->getData();
+        $providerUrl = $forms['provider_url']->getData();
+
+        if ($viewData === null) {
+            $viewData = InfoProviderReference::noProvider();
+        }
+
+        if (!$viewData instanceof InfoProviderReference) {
+            return;
+        }
+
+        $oldDate = $viewData->getLastUpdated();
+
+        //If all fields are empty, we set the view data to a new instance without provider information
+        if ($providerKey === null && $providerId === null && $providerUrl === null) {
+            $viewData = InfoProviderReference::noProvider();
+            return;
+        }
+
+        $viewData = InfoProviderReference::create($providerKey, $providerId, $providerUrl, $oldDate);
+
+    }
+}

src/Form/InfoProviderSystem/ProviderSelectType.php

@@ -31,12 +31,12 @@ use Symfony\Component\Form\Extension\Core\Type\ChoiceType;
 use Symfony\Component\OptionsResolver\Options;
 use Symfony\Component\OptionsResolver\OptionsResolver;
 use Symfony\Component\Translation\StaticMessage;
+use Symfony\Component\Translation\TranslatableMessage;
 
 class ProviderSelectType extends AbstractType
 {
     public function __construct(private readonly ProviderRegistry $providerRegistry)
     {
-
     }
 
     public function getParent(): string
@@ -46,17 +46,22 @@ class ProviderSelectType extends AbstractType
 
     public function configureOptions(OptionsResolver $resolver): void
     {
-        $providers = $this->providerRegistry->getActiveProviders();
-
         $resolver->setDefault('input', 'object');
         $resolver->setAllowedTypes('input', 'string');
         //Either the form returns the provider objects or their keys
         $resolver->setAllowedValues('input', ['object', 'string']);
         $resolver->setDefault('multiple', true);
 
-        $resolver->setDefault('choices', function (Options $options) use ($providers) {
+        //Only show active providers in the list, or also inactive ones
+        $resolver->setDefault('only_active', true);
+        $resolver->setAllowedTypes('only_active', 'bool');
+
+
+        $resolver->setDefault('choices', function (Options $options) {
+            $providers = $options['only_active'] ? $this->providerRegistry->getActiveProviders() : $this->providerRegistry->getProviders();
+
             if ('object' === $options['input']) {
-                return $this->providerRegistry->getActiveProviders();
+                return $providers;
             }
 
             $tmp = [];
@@ -69,20 +74,35 @@ class ProviderSelectType extends AbstractType
         });
 
         //The choice_label and choice_value only needs to be set if we want the objects
-        $resolver->setDefault('choice_label', function (Options $options){
+        $resolver->setDefault('choice_label', function (Options $options) {
             if ('object' === $options['input']) {
-                return ChoiceList::label($this, static fn (?InfoProviderInterface $choice) => new StaticMessage($choice?->getProviderInfo()['name']));
+                return ChoiceList::label($this, static fn(?InfoProviderInterface $choice
+                ) => new StaticMessage($choice?->getProviderInfo()['name']));
             }
 
-            return static fn ($choice, $key, $value) => new StaticMessage($key);
+            return static fn($choice, $key, $value) => new StaticMessage($key);
         });
         $resolver->setDefault('choice_value', function (Options $options) {
             if ('object' === $options['input']) {
-                return ChoiceList::value($this, static fn(?InfoProviderInterface $choice) => $choice?->getProviderKey());
+                return ChoiceList::value($this,
+                    static fn(?InfoProviderInterface $choice) => $choice?->getProviderKey());
             }
 
             return null;
         });
+        $resolver->setDefault('group_by', function (Options $options) {
+            //Do not show groups when only active providers are shown, because then all providers are active and the group would be useless
+            if ($options['only_active']) {
+                return null;
+            }
+
+            return function ($choice, $key, string $value) {
+                if ($this->providerRegistry->getProviderByKey($value)->isActive()) {
+                    return new TranslatableMessage('info_providers.providers_list.active');
+                }
+                return new TranslatableMessage('info_providers.providers_list.disabled');
+            };
+        });
     }
 
 }

src/Form/Part/PartBaseType.php

@@ -33,6 +33,7 @@ use App\Entity\Parts\Part;
 use App\Entity\Parts\PartCustomState;
 use App\Entity\PriceInformations\Orderdetail;
 use App\Form\AttachmentFormType;
+use App\Form\InfoProviderSystem\InfoProviderReferenceType;
 use App\Form\ParameterType;
 use App\Form\Part\EDA\EDAPartInfoType;
 use App\Form\Type\MasterPictureAttachmentType;
@@ -225,6 +226,10 @@ class PartBaseType extends AbstractType
                 'empty_data' => null,
                 'label' => 'part.gtin',
             ])
+            ->add('providerReference', InfoProviderReferenceType::class, [
+                'label' => false,
+                'required' => false,
+            ])
             ;
 
         //Comment section

src/Form/Part/PartLotType.php

@@ -115,8 +115,10 @@ class PartLotType extends AbstractType
         $builder->add('last_stocktake_at', DateTimeType::class, [
             'label' => 'part_lot.edit.last_stocktake_at',
             'widget' => 'single_text',
+            'model_timezone' => 'UTC', // The database stores the datetime in UTC, so we need to set the model timezone to UTC
             'disabled' => !$this->security->isGranted('@parts_stock.stocktake'),
             'required' => false,
+            'with_seconds' => true,
         ]);
     }
 

src/Form/Type/AttachmentTypeType.php

@@ -38,7 +38,7 @@ class AttachmentTypeType extends AbstractType
         return StructuralEntityType::class;
     }
 
-    public function configureOptions(OptionsResolver $resolver)
+    public function configureOptions(OptionsResolver $resolver): void
     {
         $resolver->define('attachment_filter_class')->allowedTypes('null', 'string')->default(null);
 

src/Helpers/Projects/ProjectBuildRequest.php

@@ -84,8 +84,10 @@ final class ProjectBuildRequest
             $remaining_amount = $this->getNeededAmountForBOMEntry($bom_entry);
             foreach($this->getPartLotsForBOMEntry($bom_entry) as $lot) {
                 //If the lot has instock use it for the build
-                $this->withdraw_amounts[$lot->getID()] = min($remaining_amount, $lot->getAmount());
-                $remaining_amount -= max(0, $this->withdraw_amounts[$lot->getID()]);
+                $id = $lot->getID() ?? throw new \RuntimeException("Part lot needs to have an ID!");
+
+                $this->withdraw_amounts[$id] = min($remaining_amount, $lot->getAmount());
+                $remaining_amount -= max(0, $this->withdraw_amounts[$id]);
             }
         }
     }
@@ -176,6 +178,10 @@ final class ProjectBuildRequest
     {
         $lot_id = $lot instanceof PartLot ? $lot->getID() : $lot;
 
+        if ($lot_id === null) {
+            throw new \InvalidArgumentException('The given lot must have an ID!');
+        }
+
         if (! array_key_exists($lot_id, $this->withdraw_amounts)) {
             throw new \InvalidArgumentException('The given lot is not in the withdraw amounts array!');
         }
@@ -192,10 +198,12 @@ final class ProjectBuildRequest
     {
         if ($lot instanceof PartLot) {
             $lot_id = $lot->getID();
-        } elseif (is_int($lot)) {
-            $lot_id = $lot;
         } else {
-            throw new \InvalidArgumentException('The given lot must be an instance of PartLot or an ID of a PartLot!');
+            $lot_id = $lot;
+        }
+
+        if ($lot_id === null) {
+            throw new \InvalidArgumentException('The given lot must have an ID!');
         }
 
         $this->withdraw_amounts[$lot_id] = $amount;
@@ -296,7 +304,7 @@ final class ProjectBuildRequest
      * @param  bool  $dont_check_quantity
      * @return $this
      */
-    public function setDontCheckQuantity(bool $dont_check_quantity): ProjectBuildRequest
+    public function setDontCheckQuantity(bool $dont_check_quantity): self
     {
         $this->dont_check_quantity = $dont_check_quantity;
         return $this;

src/Repository/DBElementRepository.php

@@ -158,7 +158,6 @@ class DBElementRepository extends EntityRepository
     {
         $reflection = new ReflectionClass($element::class);
         $property = $reflection->getProperty($field);
-        $property->setAccessible(true);
         $property->setValue($element, $new_value);
     }
 }

src/Services/AI/AIPlatforms.php

@@ -24,6 +24,7 @@ declare(strict_types=1);
 namespace App\Services\AI;
 
 use App\Settings\AISettings\LMStudioSettings;
+use App\Settings\AISettings\OllamaSettings;
 use App\Settings\AISettings\OpenRouterSettings;
 use Symfony\Contracts\Translation\TranslatableInterface;
 use Symfony\Contracts\Translation\TranslatorInterface;
@@ -32,6 +33,7 @@ enum AIPlatforms: string implements TranslatableInterface
 {
     case OPENROUTER = 'openrouter';
     case LMSTUDIO = 'lmstudio';
+    case OLLAMA = 'ollama';
 
     /**
      * Returns the name attribute of the service tag for this platform, which is used to register the platform in the AIPlatformRegistry
@@ -52,6 +54,7 @@ enum AIPlatforms: string implements TranslatableInterface
         return match ($this) {
             self::LMSTUDIO => LMStudioSettings::class,
             self::OPENROUTER => OpenRouterSettings::class,
+            self::OLLAMA => OllamaSettings::class,
         };
     }
 

src/Services/Attachments/AttachmentSubmitHandler.php

@@ -543,8 +543,10 @@ class AttachmentSubmitHandler
             return $attachment;
         }
 
+        $guessed_mime_type = $this->mimeTypes->guessMimeType($path);
+
         //Check if the file is an SVG
-        if ($attachment->getExtension() === "svg") {
+        if ($guessed_mime_type === "image/svg+xml" || $attachment->getExtension() === "svg") {
             $this->SVGSanitizer->sanitizeFile($path);
         }
 

src/Services/ImportExportSystem/BOMValidationService.php

@@ -29,13 +29,13 @@ use Symfony\Contracts\Translation\TranslatorInterface;
 
 /**
  * Service for validating BOM import data with comprehensive validation rules
- * and user-friendly error messages.
+ * and user-friendly error messages. The results are not HTML safe, and must be escaped before display!
  */
-class BOMValidationService
+readonly class BOMValidationService
 {
     public function __construct(
-        private readonly EntityManagerInterface $entityManager,
-        private readonly TranslatorInterface $translator
+        private EntityManagerInterface $entityManager,
+        private TranslatorInterface $translator
     ) {
     }
 

src/Services/ImportExportSystem/PartKeeprImporter/PKImportHelperTrait.php

@@ -233,7 +233,6 @@ trait PKImportHelperTrait
 
         $reflectionClass = new \ReflectionClass($entity);
         $property = $reflectionClass->getProperty('addedDate');
-        $property->setAccessible(true);
         $property->setValue($entity, $date);
     }
 

src/Services/InfoProviderSystem/DTOJsonSchemaConverter.php

@@ -42,7 +42,7 @@ final class DTOJsonSchemaConverter
     public function getJSONSchema(): array
     {
         return [
-            'name' => 'clock',
+            'name' => 'part_detail',
             'strict' => true,
             'schema' => [
                 'type' => 'object',

src/Services/InfoProviderSystem/Providers/AIWebProvider.php

@@ -282,6 +282,10 @@ final class AIWebProvider implements InfoProviderInterface
         try {
             $aiPlatform = $this->AIPlatformRegistry->getPlatform($this->settings->platform ?? throw new \RuntimeException('No AI platform selected') );
 
+            // AI inference can take much longer than PHP's default max_execution_time (typically 30s).
+            // The HTTP client timeout already enforces the configured limit; disable PHP's constraint here.
+            set_time_limit(0);
+
             //'openai/gpt-5-mini'
             $result = $aiPlatform->invoke($this->settings->model ?? throw new \RuntimeException('No model selected'), $input, [
                 'response_format' => [

src/Settings/AISettings/AISettings.php

@@ -35,9 +35,14 @@ class AISettings
 {
     use SettingsTrait;
 
+    public const TIMEOUT_LIMIT = 600;
+
     #[EmbeddedSettings]
     public ?OpenRouterSettings $openRouter = null;
 
     #[EmbeddedSettings]
     public ?LMStudioSettings $lmstudio = null;
+
+    #[EmbeddedSettings]
+    public ?OllamaSettings $ollama = null;
 }

src/Settings/AISettings/LMStudioSettings.php

@@ -23,16 +23,17 @@ declare(strict_types=1);
 
 namespace App\Settings\AISettings;
 
-use App\Form\Type\APIKeyType;
 use App\Services\AI\AIPlatformSettingsInterface;
 use App\Settings\SettingsIcon;
 use Jbtronics\SettingsBundle\Metadata\EnvVarMode;
 use Jbtronics\SettingsBundle\Settings\Settings;
 use Jbtronics\SettingsBundle\Settings\SettingsParameter;
 use Jbtronics\SettingsBundle\Settings\SettingsTrait;
+use Symfony\Component\Form\Extension\Core\Type\NumberType;
 use Symfony\Component\Form\Extension\Core\Type\UrlType;
 use Symfony\Component\Translation\StaticMessage;
 use Symfony\Component\Translation\TranslatableMessage as TM;
+use Symfony\Component\Validator\Constraints as Assert;
 
 #[Settings(name: 'ai_lmstudio', label: new TM("settings.ai.lmstudio"))]
 #[SettingsIcon("fa-robot")]
@@ -46,6 +47,14 @@ class LMStudioSettings implements AIPlatformSettingsInterface
         envVar: "AI_LMSTUDIO_HOSTURL", envVarMode: EnvVarMode::OVERWRITE)]
     public ?string $hostURL = null;
 
+    #[SettingsParameter(label: new TM("settings.ai.timeout"),
+        description: new TM("settings.ai.timeout.help"),
+        formType: NumberType::class,
+        formOptions: ["scale" => 0, "attr" => ["min" => 1]],
+    )]
+    #[Assert\Range(min: 1, max: AISettings::TIMEOUT_LIMIT)]
+    public int $timeout = 180;
+
     public function isAIPlatformEnabled(): bool
     {
         return $this->hostURL !== null && $this->hostURL !== "";

src/Settings/AISettings/OllamaSettings.php

@@ -0,0 +1,68 @@
+<?php
+/*
+ * This file is part of Part-DB (https://github.com/Part-DB/Part-DB-symfony).
+ *
+ *  Copyright (C) 2019 - 2026 Jan Böhmer (https://github.com/jbtronics)
+ *
+ *  This program is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU Affero General Public License as published
+ *  by the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU Affero General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Affero General Public License
+ *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+declare(strict_types=1);
+
+
+namespace App\Settings\AISettings;
+
+use App\Form\Type\APIKeyType;
+use App\Services\AI\AIPlatformSettingsInterface;
+use App\Settings\SettingsIcon;
+use Jbtronics\SettingsBundle\Metadata\EnvVarMode;
+use Jbtronics\SettingsBundle\Settings\Settings;
+use Jbtronics\SettingsBundle\Settings\SettingsParameter;
+use Jbtronics\SettingsBundle\Settings\SettingsTrait;
+use Symfony\Component\Form\Extension\Core\Type\NumberType;
+use Symfony\Component\Form\Extension\Core\Type\UrlType;
+use Symfony\Component\Translation\StaticMessage;
+use Symfony\Component\Translation\TranslatableMessage as TM;
+use Symfony\Component\Validator\Constraints as Assert;
+
+#[Settings(name: 'ai_ollama', label: new TM("settings.ai.ollama"))]
+#[SettingsIcon("fa-robot")]
+class OllamaSettings implements AIPlatformSettingsInterface
+{
+    use SettingsTrait;
+
+    #[SettingsParameter(label: new TM("settings.ai.ollama.endpoint"),
+        formType: UrlType::class,
+        formOptions: ["attr" => ["placeholder" => new StaticMessage("http://localhost:11434")]],
+        envVar: "AI_OLLAMA_ENDPOINT", envVarMode: EnvVarMode::OVERWRITE)]
+    public ?string $endpoint = null;
+
+    #[SettingsParameter(label: new TM("settings.ai.ollama.apiKey"),
+        formType: APIKeyType::class,
+        envVar: "AI_OLLAMA_API_KEY", envVarMode: EnvVarMode::OVERWRITE)]
+    public ?string $apiKey = null;
+
+    #[SettingsParameter(label: new TM("settings.ai.timeout"),
+        description: new TM("settings.ai.timeout.help"),
+        formType: NumberType::class,
+        formOptions: ["scale" => 0, "attr" => ["min" => 1]]
+    )]
+    #[Assert\Range(min: 1, max: AISettings::TIMEOUT_LIMIT)]
+    public int $timeout = 180;
+
+    public function isAIPlatformEnabled(): bool
+    {
+        return $this->endpoint !== null && $this->endpoint !== "";
+    }
+}

src/Settings/AISettings/OpenRouterSettings.php

@@ -30,7 +30,9 @@ use Jbtronics\SettingsBundle\Metadata\EnvVarMode;
 use Jbtronics\SettingsBundle\Settings\Settings;
 use Jbtronics\SettingsBundle\Settings\SettingsParameter;
 use Jbtronics\SettingsBundle\Settings\SettingsTrait;
+use Symfony\Component\Form\Extension\Core\Type\NumberType;
 use Symfony\Component\Translation\TranslatableMessage as TM;
+use Symfony\Component\Validator\Constraints as Assert;
 
 #[Settings(name: 'ai_openrouter', label: new TM("settings.ai.openrouter"), description: "settings.ai.openrouter.help")]
 #[SettingsIcon("fa-robot")]
@@ -43,6 +45,14 @@ class OpenRouterSettings implements AIPlatformSettingsInterface
         formOptions: ["help_html" => true], envVar: "AI_OPENROUTER_KEY", envVarMode: EnvVarMode::OVERWRITE)]
     public ?string $apiKey = null;
 
+    #[SettingsParameter(label: new TM("settings.ai.timeout"),
+        description: new TM("settings.ai.timeout.help"),
+        formType: NumberType::class,
+        formOptions: ["scale" => 0, "attr" => ["min" => 1]],
+        envVar: "int:AI_OPENROUTER_TIMEOUT", envVarMode: EnvVarMode::OVERWRITE)]
+    #[Assert\Range(min: 1, max: AISettings::TIMEOUT_LIMIT)]
+    public int $timeout = 90;
+
     public function isAIPlatformEnabled(): bool
     {
         return $this->apiKey !== null && $this->apiKey !== "";

symfony.lock

@@ -411,6 +411,18 @@
             "config/packages/ai_lm_studio_platform.yaml"
         ]
     },
+    "symfony/ai-ollama-platform": {
+        "version": "0.10",
+        "recipe": {
+            "repo": "github.com/symfony/recipes",
+            "branch": "main",
+            "version": "0.1",
+            "ref": "2f0ac0a8bc59c4e46b47a962a3ad7fe8104457d6"
+        },
+        "files": [
+            "config/packages/ai_ollama_platform.yaml"
+        ]
+    },
     "symfony/ai-open-router-platform": {
         "version": "0.8",
         "recipe": {

templates/log_system/details/_extra_collection_element_deleted.html.twig

@@ -4,7 +4,7 @@
 
 <p class="m-0">
     <b>{% trans %}log.collection_deleted.deleted{% endtrans %}</b>:
-    {{ entity_type_label(entry.deletedElementClass) }} #{{ entry.deletedElementID }}
+    {{ type_label(entry.deletedElementClass) }} #{{ entry.deletedElementID }}
     {% if entry.oldName is not empty %}
         ({{ entry.oldName }})
     {% endif %}

templates/log_system/details/log_details.html.twig

@@ -58,7 +58,7 @@
         </tr>
         <tr>
             <td>{% trans %}log.target{% endtrans %}</td>
-            <td>{{ target_html|raw }}</td>
+            <td>{{ target_html|sanitize_html }}</td>
         </tr>
     </table>
 
@@ -111,7 +111,7 @@
         {%  elseif log_entry is instanceof('App\\Entity\\LogSystem\\CollectionElementDeleted') %}
                 {% include "log_system/details/_extra_collection_element_deleted.html.twig" %}
         {% else %}
-            {{ extra_html | raw }}
+            {{ extra_html | sanitize_html }}
         {% endif %}
     </div>
 {% endblock %}

templates/parts/edit/_advanced.html.twig

@@ -15,3 +15,24 @@
 {{ form_row(form.partUnit) }}
 {{ form_row(form.partCustomState) }}
 {{ form_row(form.gtin) }}
+
+<div class="{{ offset_label }} {{ col_input }} ps-1">
+    <div class="accordion" id="accordionProviderReference">
+        <div class="accordion-item">
+            <h2 class="accordion-header">
+                <button class="accordion-button collapsed py-2" type="button" data-bs-toggle="collapse" data-bs-target="#collapseProviderReference" aria-expanded="true" aria-controls="collapseProviderReference">
+                    <span>{% trans %}part.edit.provider_reference{% endtrans %}</span>
+                </button>
+            </h2>
+            <div id="collapseProviderReference" class="accordion-collapse collapse" data-bs-parent="#accordionProviderReference">
+                <div class="accordion-body">
+                    <div class="alert alert-warning">
+                        {% trans %}part.edit.provider_reference.warning{% endtrans %}
+                    </div>
+
+                    {{ form_widget(form.providerReference) }}
+                </div>
+            </div>
+        </div>
+    </div>
+</div>

templates/parts/info/_extended_infos.html.twig

@@ -76,7 +76,7 @@
                     <a href="{{ part.providerReference.providerUrl }}" rel="noopener">
                 {% endif %}
                 <span title="{{ part.providerReference.providerKey }}">{{ info_provider_label(part.providerReference.providerKey)|default(part.providerReference.providerKey) }}</span>: {{ part.providerReference.providerId }}
-                <span> ({{ part.providerReference.lastUpdated | format_datetime() }})</span>
+                <span> ({{ part.providerReference.lastUpdated ? (part.providerReference.lastUpdated  | format_datetime()) : ("part.info_provider_reference.updated_never"|trans) }})</span>
                 {% if part.providerReference.providerUrl %}
                     </a>
                 {% endif %}

templates/parts/info/_picture.html.twig

@@ -19,7 +19,7 @@
                             <div class="carousel-caption text-white">
                                 <div><b>{{ pic.name }}</b></div>
                                 <div>{% if pic.filename %}({{ pic.filename }}) {% endif %}</div>
-                                <div>{{ entity_type_label(pic.element) }}</div>
+                                <div>{{ type_label(pic.element) }}</div>
                             </div>
                         </div>
                         {% endif %}

templates/parts/info/show_part_info.html.twig

@@ -22,7 +22,7 @@
             <i>({{ timeTravel | format_datetime('short') }})</i>
         {% endif %}
         {% if part.projectBuildPart %}
-            (<i>{{ entity_type_label(part.builtProject) }}</i>: <a class="text-white" href="{{ entity_url(part.builtProject) }}">{{ part.builtProject.name }}</a>)
+            (<i>{{ type_label(part.builtProject) }}</i>: <a class="text-white" href="{{ entity_url(part.builtProject) }}">{{ part.builtProject.name }}</a>)
         {% endif %}
     </span>
     <span class="float-end">

templates/projects/_bom_validation_results.html.twig

@@ -68,7 +68,7 @@
             <p class="mb-2">{% trans %}project.bom_import.validation.errors.description{% endtrans %}</p>
             <ul class="mb-0">
                 {% for error in validation_result.errors %}
-                    <li>{{ error|raw }}</li>
+                    <li>{{ error }}</li>
                 {% endfor %}
             </ul>
         </div>
@@ -80,7 +80,7 @@
             <p class="mb-2">{% trans %}project.bom_import.validation.warnings.description{% endtrans %}</p>
             <ul class="mb-0">
                 {% for warning in validation_result.warnings %}
-                    <li>{{ warning|raw }}</li>
+                    <li>{{ warning }}</li>
                 {% endfor %}
             </ul>
         </div>
@@ -91,7 +91,7 @@
             <h4><i class="fa-solid fa-info-circle fa-fw"></i> {% trans %}project.bom_import.validation.info.title{% endtrans %}</h4>
             <ul class="mb-0">
                 {% for info in validation_result.info %}
-                    <li>{{ info|raw }}</li>
+                    <li>{{ info }}</li>
                 {% endfor %}
             </ul>
         </div>
@@ -139,21 +139,21 @@
                                         {% if line_result.errors is not empty %}
                                             <div class="text-danger">
                                                 {% for error in line_result.errors %}
-                                                    <div><i class="fa-solid fa-exclamation-triangle fa-fw"></i> {{ error|raw }}</div>
+                                                    <div><i class="fa-solid fa-exclamation-triangle fa-fw"></i> {{ error }}</div>
                                                 {% endfor %}
                                             </div>
                                         {% endif %}
                                         {% if line_result.warnings is not empty %}
                                             <div class="text-warning">
                                                 {% for warning in line_result.warnings %}
-                                                    <div><i class="fa-solid fa-exclamation-circle fa-fw"></i> {{ warning|raw }}</div>
+                                                    <div><i class="fa-solid fa-exclamation-circle fa-fw"></i> {{ warning }}</div>
                                                 {% endfor %}
                                             </div>
                                         {% endif %}
                                         {% if line_result.info is not empty %}
                                             <div class="text-info">
                                                 {% for info in line_result.info %}
-                                                    <div><i class="fa-solid fa-info-circle fa-fw"></i> {{ info|raw }}</div>
+                                                    <div><i class="fa-solid fa-info-circle fa-fw"></i> {{ info }}</div>
                                                 {% endfor %}
                                             </div>
                                         {% endif %}

templates/projects/import_bom_map_fields.html.twig

@@ -132,8 +132,8 @@
     <script nonce="{{ csp_nonce('script') }}">
         // Function to initialize the field mapping page
         function initializeFieldMapping() {
-            const suggestions = {{ suggested_mapping|json_encode|raw }};
-            const fieldNameMapping = {{ field_name_mapping|json_encode|raw }};
+            const suggestions = JSON.parse("{{ suggested_mapping|json_encode|escape('js')}}");
+            const fieldNameMapping = JSON.parse("{{ field_name_mapping|json_encode|escape('js') }}");
 
             Object.keys(suggestions).forEach(function(field) {
                 // Use the sanitized field name from the server-side mapping

tests/Doctrine/Functions/SiValueSortTest.php

@@ -26,6 +26,7 @@ use App\Doctrine\Functions\SiValueSort;
 use Doctrine\DBAL\Platforms\MySQLPlatform;
 use Doctrine\DBAL\Platforms\PostgreSQLPlatform;
 use Doctrine\DBAL\Platforms\SQLitePlatform;
+use PHPUnit\Framework\Attributes\DataProvider;
 
 final class SiValueSortTest extends AbstractDoctrineFunctionTestCase
 {
@@ -71,9 +72,7 @@ final class SiValueSortTest extends AbstractDoctrineFunctionTestCase
         $this->assertSame('SI_VALUE(part_name)', $sql);
     }
 
-    /**
-     * @dataProvider sqliteSiValueProvider
-     */
+    #[DataProvider('sqliteSiValueProvider')]
     public function testSqliteSiValue(?string $input, ?float $expected): void
     {
         $result = SiValueSort::sqliteSiValue($input);

tests/Entity/Attachments/AttachmentTest.php

@@ -276,7 +276,6 @@ final class AttachmentTest extends TestCase
     {
         $reflection = new ReflectionClass($object);
         $reflection_property = $reflection->getProperty($property);
-        $reflection_property->setAccessible(true);
         $reflection_property->setValue($object, $value);
     }
 

tests/Helpers/Projects/ProjectBuildRequestTest.php

@@ -82,7 +82,12 @@ final class ProjectBuildRequestTest extends TestCase
 
         $part2->setName('Part 2');
         $part2->setPartUnit($float_unit);
-        $this->lot2 = new PartLot();
+        $this->lot2 = new class extends PartLot {
+            public function getID(): ?int
+            {
+                return 3;
+            }
+        };;
         $part2->addPartLot($this->lot2);
         $this->lot2->setAmount(2.5);
         $this->lot2->setDescription('Lot 2');