pnpm audit reports a critical advisory for next >=16.0.0 <=16.4.0:
unauthenticated remote code execution through the Image Optimization
API when SVG files are used. progmasoft.com runs 16.3.8. The site sets
no images option and the optimizer refused an SVG request in a check
from outside, but the version is in the affected range, so it moves to
16.4.2, the latest patch release; eslint-config-next follows.

Verified: pnpm check, pnpm test:coverage, pnpm lint and pnpm build
pass; pnpm audit --audit-level high reports nothing beyond the one
advisory already ignored.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

BIMI lets mail clients show a sender's logo next to messages from a
domain whose DMARC policy is enforced; progmasoft.com already publishes
p=quarantine with pct=100. The BIMI record points at an SVG on the
domain, so the site now serves one at /bimi/logo.svg.

The file is SVG Tiny Portable/Secure, as BIMI requires: version 1.2,
baseProfile tiny-ps, a title, no scripts, no external references and
no x or y on the root. It draws the same four tiles as the Brand
component, in the same colours (#3b4658, #1e7188, #7655fa, #dc7644)
and the same tile-to-gap ratio (11:2, here 132 and 24 on a 512 grid),
on a white square. The mark stays inside the circle that clients crop
the logo to.

Next.js serves files from apps/web/public before the dynamic routes;
the deployment already copies public/ next to the standalone server.

A Tazel project file may be called BUILD.kts, BUILD.tzl, BUILD.tazel,
BUILD or Tazel.build, so ViGet no longer names one of them. The plugin
texts in all four locales speak of the project file of Tazel.

viget.progmasoft.com now shows, from the top:

1. The state of the registry: what it holds today, the package format,
   the publisher identity and that publishing is not open yet.
2. LANGUAGES: Tala links to viget.progmasoft.com/langs/tala; C++ is a
   gray, disabled button that leads nowhere.
3. BUILD SYSTEM DSL PLUGINS: Tazel links to
   viget.progmasoft.com/dslplugins/tazel; Gradle is a gray, disabled
   button that leads nowhere.

/langs/tala is the catalog of Tala packages and /dslplugins/tazel the
catalog of Kotlin DSL plugins for Tazel, both honestly empty. /langs and
/dslplugins redirect to them. The header, the footer and the sitemap
link the two catalogs, and the coordinates they show begin with the
catalog: /langs/tala/<Publisher>/<Name>/ and
/dslplugins/tazel/<Publisher>/<Name>/.

The text of the catalogs lives in lib/viget-catalogs.ts in all four
locales; localization.ts is close to the size limit of a file. The
two section headings are the registry's names and stay in English.

The language links of the ViGet and Progmasoft pages point at tala.run.

The language Visual X# is now Tala. The Progmasoft home page, the ViGet
pages, the dashboard and the two footers name it so in the four languages of
the site; the project file is BUILD.kts, and the source link leads to
Progmasoft/tala. The README, the operations and localization documents and
the issue templates follow.

The localization document said that a left-to-right mark follows the name of
the language in Hebrew text. That was for the `#` of the old name; the
sentence now speaks of names that end in a symbol.

The links to xsharp-lang.xyz stay: the language site is still served there.

- Google-Extended, Google's token for model training, is now allowed.
- GPTBot, OpenAI's training crawler, is now disallowed. OAI-SearchBot and
  ChatGPT-User, which index and fetch pages for answers, stay allowed.
- ClaudeBot, Anthropic's training crawler, is now allowed, next to
  Claude-SearchBot and Claude-User, which already were.

Every other rule is unchanged.

A second pass over the Hebrew text replaced words a Hebrew reader would
misread or that are not used for the concept:

- "native" was rendered with the word for "local"; it is now machine code
  for output and the Latin term for the native parts of the toolchain.
- Typed boundaries, the ecosystem, the dedicated account area and the
  first-party infrastructure use the usual terms instead of literal ones.
- The greetings and the new-visitor prompt no longer address one gender.

The text is still not reviewed by a native speaker.

Hebrew (he-IL) joins English, German and Russian with a complete message
tree and its own entry in the language menu.

A visitor who has not chosen a language now gets the language their browser
prefers. The Accept-Language header is negotiated by quality, only the
primary language is compared, and `iw` is accepted as the former code for
Hebrew. A browser that prefers no published language gets en-US, as before.
A language chosen in the menu is still stored in the cookie and always wins.

Hebrew does not mirror the page. The layout, the navigation and code keep
their left-to-right arrangement; only text follows the language. Blocks of
prose run right to left, short pieces such as links and buttons take the
direction of their own first letter, and inputs and code stay left to right.
The onward arrow points left in Hebrew, and a left-to-right mark keeps
"Visual X#" intact inside right-to-left text.

The Hebrew text was not reviewed by a native speaker.

Verified locally: node tests, type check, lint, prettier and a production
build; language selection per Accept-Language header against the dev server;
the Hebrew home and registration pages in a browser.

The dependency audit reports a critical Next.js advisory for releases before
16.3.6 (remote code execution in next/og ImageResponse) and high-severity
denial-of-service advisories for brace-expansion before 5.0.12. The site does
not import next/og, but production runs the affected Next.js release.

- next and eslint-config-next: 16.3.3 to 16.3.8.
- brace-expansion: the lockfile resolves 1.1.21 within its range; the 5.x
  line, which minimatch pins to 5.0.9, is overridden to 5.0.12 in the
  workspace until minimatch depends on a fixed release.

pnpm audit reports no known vulnerabilities. Prettier, eslint, the type
check, the tests and the production build pass.

The language control no longer reloads the page. It calls a server action
that stores the preference cookie; Next.js then renders the current route
again and applies it in place, so scroll position, theme and client state
stay. The lang query parameter remains for links and for browsers without
script, and is the fallback when the action cannot reach the server. Both
paths write the cookie with the same attributes from one function.

The toggle button is now a language menu, a native select that lists each
language by its own name, and Russian (ru-RU) is the third locale with a
complete translation of every message.

Tests require every locale to have exactly the message shape of the default
locale with no empty text, and cover the cookie attributes and host
normalization. Verified locally: prettier, eslint, type check, tests, the
production build, and a browser run on the apex and ViGet hosts where the
language changed with no navigation and the scroll position kept.