* bump version
* fix formatting locale reset after embedded controller sub-requests (#5944)
* fix GHSA-c6w6-57jj-62vh
* fix GHSA-m492-gv72-xvxj
* fix GHSA-jr9p-4h4j-6c58
* make sure to only use JS logic to call API endpoints
* fixes GHSA-r8vr-m544-qh4h
* make sure to only use JS logic to call API endpoints
* fix GHSA-rw46-qg69-vg6h
* fix GHSA-pj8j-p4g4-4vw8 - prevent kimai from rendering images via markdown
* fix GHSA-pj8j-p4g4-4vw8 - use a safe network client to prevent SSRF via images
* fix GHSA-xv4r-4885-gwpg
* fix GHSA-pgcc-vfmc-7cw5 - move GET routes to API with POST method to prevent CSRF
* fix tooltip survives page reload
* updated wizard images
* split wizard and password reset subscriber into two classes
* relax upper php limit
* added zizmor workflow scans and apply findings
* user permissions <name>_other_profile now respect teams
* move all linting steps to new job
* updated docker image version names
* use .env.local for storing APP_SECRET
* improve build order and use given tag as ref for checkout, not default main branch
* improved APP_SECRET handling, see entrypoint.sh
* use local code for building the image for more flexibility, added dockerignore
* bring back deprecated methods
* bump packages
* fix SAML redirect
* config flag for break times
* use class constant instead of string in attributes
* throw if all tags were not found - fixes#4792
* added support for hourly rate column in detail table
* allow to register icon in extension
* allow to show QR code secret
* new translations
* bump theme and packages
* fix validation for invoice-document-filenames with uppercase character
* max upload size 1MB
* fix last month in daterange-picker in certain situations, more years in quick-select
* remove unused package-versions-deprecated
* link preferences from contract warning message
* added page_setup page layout
* prevent DROP TABLE in addSQL() and replace drop table with schema call
* added azuyalabs/yasumi
- show customer totals in single-user reports
- support custom fonts in export / invoice templates
- require daterange for export and invoice searches
- improve help label for user locale
- show decimal formats in help controller
- cache tag amount per request
- composer updates
- improved code styles
- added default label to date picker
- new macros & use own macro
* do not traverse into invoice template subdirectories (#3735)
* fix security open api definition
* fix currency can be null, removed fluent interface
* merged release 1.30.3
* allow to pre-fill timesheet metafields via URL
* fix api description
* added test accounts with simpler names and password
* upgrade to Symfony 6.2
* removed FrameworkExtraBundle (by Sensio) and replaced with new native SF annotations
* fixed symfony 6.2 deprecations
* fixed#3768
* unify extension check
* fix updating one config section redirects to all sections
* weekly times: configure number of weeks for recent activities
* weekly times: configure minimum number of rows
* added explicit formats for en_GB and pt
