The init and analyze steps were pinned to 7999b86c, a commit no release tag
points at, with a "# v4" comment that names another commit (zizmor
ref-version-mismatch, two code-scanning alerts). Both steps now use
2892aa5e, the commit of v4.38.2, with that exact version as the comment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The scripts in use become programs run with `bazelisk run //tools:<tool>`,
and arguments follow `--`:

  amalgamate     the single-file distribution; --check only compares it
  check          licenses, convenience headers, header guards, file names,
                 versions and whether the distribution is up to date
  third-party    compares third_party/ with its archives, or writes it
  version        prints the version, or moves every place that states it
  release-notes  prints a section of the release notes
  repo-info      reports the checkout and the tools on PATH; --json writes
                 it through yyjson, with the fields of Tala's repo-info

amalgamate writes what the Python script wrote, byte for byte, except for
the time of generation. That line is gone so that the output is
deterministic and --check can compare it.

MODULE.bazel now pins the archives of third_party/ by version and sha256,
so Bazel fetches and checks them instead of a tool of ours, and Renovate
reads the versions there.

Scripts nobody used are gone: fixWhitespace, updateDocumentSnippets,
buildAndTest, and updateDocumentToC, which rewrote unrelated documents.
CheckConvenienceHeaders leaves CTest, since //tools:check runs it in CI.
The Python of tests/TestScripts stays: those are tests, not tools.

cmake --install failed on extras/ParseAndAddCatchTests.cmake, which the
rename to Catch3 removed while CMakeLists.txt kept listing it. No job ran
an install, so nothing showed it. The Linux job now installs the library
and finds the installed package.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The move to C++17 left a trail of older claims. The Runner's own
.clang-format still said c++20; the result is byte for byte the same under
either value. Premake and Xmake still compiled the library as C++20 and
the main library as C++14, which meant their CI jobs were not testing the
language the project promises. Both now use C++17 for every target.

The rest is text: the Meson pkg-config description claimed C++14, comments
in the CMake and Meson files explained requirements that no longer exist,
.clang-tidy gave C++14 as the reason for two exclusions, issue templates
asked for C++20 samples, and the example headers named -std=c++14 and
catch2-with-main. The release notes and the migration guide state the
C++17 minimum. Doxygen's brief called the project "Catch2's test API",
which presents it as Catch2. Meson declared only BSL-1.0; it now names both
licenses of the tree. The amalgamated files are regenerated.

Version 1.1 left programs built with Progmasoft tools under MPL-2.0 duties
for the code the tools place in them, and left other cases unclear.
Version 2.0 adds a generated code permission, covers runtime and standard
libraries, compiler transformations, interfaces and examples, and settles
how a file is identified and how to tell recipients about source.

Every project SPDX expression moves to AdditionRef-Progmasoft-Exception-2.0.
The older texts stay, because released versions name them.

C++17 is still the widest common target, and a library built on it stays
usable from C++17 and every later standard, while C++20 would have left
out many users.

Concepts become enable_if on named traits in Detail/TypeTraits.hpp, which
also replaces std::remove_cvref_t and std::identity. std::span becomes
std::vector references, std::bit_cast becomes static_cast and memcpy,
template lambdas become helper templates, and std::erase_if, contains,
starts_with and ends_with have their C++17 forms. Random::Between no
longer uses a lambda over a constexpr local, which MSVC rejects outside
/permissive-, so the headers work under its default mode too.

Tests give up designated initializers, which MSVC refuses in C++17. CI
builds the matrix in C++17 and C++20, since the headers promise both.

macOS runners are the bottleneck of Progmasoft's CI: an organization
runs at most five macOS jobs at a time, shared by every repository, and a
pull request of Catch3 asked for about twenty of them. Every workflow
also listened to both push and pull_request, so each pull request ran
everything twice, once for its branch and once for the pull request.

macOS now has one job, as in the Tala compiler: macOS 26 on Apple
Silicon, Debug, C++17, with AddressSanitizer and UndefinedBehaviorSanitizer
over the most-tests preset, examples and extra tests. The C++14 and C++17,
Debug and Release matrix stays on Ubuntu and Fedora, where it already ran.
ThreadSanitizer, which ran only on macOS, moves to a new Ubuntu job.

The build systems that tested Windows and macOS (Bazel, Meson, Xmake,
Premake) test Windows and Ubuntu instead, with Clang, so their Unix side
is still covered and Linux is covered for the first time. The jobs that do
not depend on the platform leave macOS: CodeQL (build mode none), the
header and license checks, and native coverage, which now builds with
the Clang and LLVM tools of Ubuntu instead of those of Xcode.

Pushes build only devel; pull requests build their branches. The weekly
CodeQL schedule stays.

The required check "Bazel on macos-15" becomes "Bazel on ubuntu-26.04" in
the branch protection and the ruleset when this is merged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The runner's hand-written JSON parser and writer, and its XML escaping,
are replaced by two established MIT libraries, vendored in third_party/:
yyjson 0.13.0 and pugixml 1.16. JsonValue and the JUnit model stay as they
are.

Both are compiled into Catch3's own translation units, so a project that
links its own yyjson or pugixml is not affected:
- src/Progmasoft/Runner/Yyjson.inl includes yyjson.c into Json.cpp with
  yyjson_api defined as static, so no yyjson symbol leaves that file.
- src/Progmasoft/PugiXml.inl includes pugixml header-only into
  XmlWriter.cpp with its namespace renamed to Progmasoft_Catch3_Pugi.
- Both are read as system headers, outside the warnings Catch3 builds
  with; they are .inl files, which the header install rules leave out.

JSON keeps its behaviour: strings are bytes and come back as written
(invalid UTF-8 is allowed both ways), non-finite numbers are written as
null, documents nested deeper than 256 levels are refused while they are
converted, and whole numbers are written as integers. Fractions are now
written as the shortest text that reads back as the same double.

JUnit XML stays equivalent; pugixml writes ' and > in attributes as they
are, U+FFFD as the character itself and empty elements as <x />. The
tests follow.

third_party/{yyjson,pugixml} each have BUILD.bazel, CMakeLists.txt,
meson.build, xmake.lua and premake5.lua, which only provide the include
directory to the library; CMake links them through BUILD_INTERFACE.

tools/scripts/updateThirdParty.py pins the version and sha256 of each
archive; --check, now a step of the header and license workflow, fails
when a vendored file differs from its archive, and --update writes them.
Renovate proposes new versions through a regex manager on that table.

The amalgamation now has a third file, catch_amalgamated_third_party.hpp,
with both wrappers and the libraries inlined; catch_amalgamated.cpp
includes it once. The documents and the release notes say so.