progmaweb/apps, branch ci/audit-braces-exception The site and account service of Progmasoft: a Next.js frontend and an ASP.NET Core API. Update Next.js and override brace-expansion for security advisories 2026-10-02T22:50:07+00:00 Leitwolf11 2026-10-02T22:50:07+00:00 209da8ed364ae406e91c0d92db64b3a520c72ef9 The dependency audit reports a critical Next.js advisory for releases before 16.3.6 (remote code execution in next/og ImageResponse) and high-severity denial-of-service advisories for brace-expansion before 5.0.12. The site does not import next/og, but production runs the affected Next.js release. - next and eslint-config-next: 16.3.3 to 16.3.8. - brace-expansion: the lockfile resolves 1.1.21 within its range; the 5.x line, which minimatch pins to 5.0.9, is overridden to 5.0.12 in the workspace until minimatch depends on a fixed release. pnpm audit reports no known vulnerabilities. Prettier, eslint, the type check, the tests and the production build pass. 
The dependency audit reports a critical Next.js advisory for releases before
16.3.6 (remote code execution in next/og ImageResponse) and high-severity
denial-of-service advisories for brace-expansion before 5.0.12. The site does
not import next/og, but production runs the affected Next.js release.

- next and eslint-config-next: 16.3.3 to 16.3.8.
- brace-expansion: the lockfile resolves 1.1.21 within its range; the 5.x
  line, which minimatch pins to 5.0.9, is overridden to 5.0.12 in the
  workspace until minimatch depends on a fixed release.

pnpm audit reports no known vulnerabilities. Prettier, eslint, the type
check, the tests and the production build pass.
Switch language in place and add Russian 2026-10-02T21:20:50+00:00 Leitwolf11 2026-10-02T21:20:50+00:00 35158de28f4a0dfc300f2d3b5787d2064a06105c The language control no longer reloads the page. It calls a server action that stores the preference cookie; Next.js then renders the current route again and applies it in place, so scroll position, theme and client state stay. The lang query parameter remains for links and for browsers without script, and is the fallback when the action cannot reach the server. Both paths write the cookie with the same attributes from one function. The toggle button is now a language menu, a native select that lists each language by its own name, and Russian (ru-RU) is the third locale with a complete translation of every message. Tests require every locale to have exactly the message shape of the default locale with no empty text, and cover the cookie attributes and host normalization. Verified locally: prettier, eslint, type check, tests, the production build, and a browser run on the apex and ViGet hosts where the language changed with no navigation and the scroll position kept. 
The language control no longer reloads the page. It calls a server action
that stores the preference cookie; Next.js then renders the current route
again and applies it in place, so scroll position, theme and client state
stay. The lang query parameter remains for links and for browsers without
script, and is the fallback when the action cannot reach the server. Both
paths write the cookie with the same attributes from one function.

The toggle button is now a language menu, a native select that lists each
language by its own name, and Russian (ru-RU) is the third locale with a
complete translation of every message.

Tests require every locale to have exactly the message shape of the default
locale with no empty text, and cover the cookie attributes and host
normalization. Verified locally: prettier, eslint, type check, tests, the
production build, and a browser run on the apex and ViGet hosts where the
language changed with no navigation and the scroll position kept.
Harden Progmaweb account API and CI coverage credentials 2026-09-27T22:10:33+00:00 Leitwolf11 2026-09-27T22:10:33+00:00 bcf10c927358157bedf6ab09ff6bff0a8aa86a14 






Add Progmaweb frontend tests and full-stack security and coverage workflows
2026-09-26T13:57:36+00:00

Leitwolf11

2026-09-26T13:57:36+00:00

07b91c2966ffe5daa9501f41436b3a45b3a2d774












Prevent Google account pre-hijacking and unsafe email-based identity merging by persisting the provider subject, indexing it independently, rejecting unverified password-account collisions and email races, reconciling only identical Google identities, and covering both service-level concurrency and the protected external-auth callback path.
2026-09-10T09:02:26+00:00

Leitwolf11

2026-09-10T09:02:26+00:00

2e222079630adf07c0e14a1827283b0a26897149












Move the ViGet package and DSL-plugin catalogs into Progmaweb as host-aware Next.js routes, add complete en-US and German content, persistent light and dark themes, catalog-specific metadata, robots and sitemap responses, and an Nginx ownership contract for viget.progmasoft.com.
2026-09-09T17:28:06+00:00

Leitwolf11

2026-09-09T17:28:06+00:00

3f84eee09b08e354f3c61da11ac1a9e00ca5a8ea












Extend Progmaweb dark-theme and German localization coverage across account, authentication, recovery, and dashboard routes; localize page metadata and OAuth feedback; expose persistent preference controls in dashboard states; and apply saved themes before first paint.
2026-09-09T16:41:09+00:00

Leitwolf11

2026-09-09T16:41:09+00:00

fa3b1f249f390ecd2248e1c17e70ede1364ff034












Describe Progmasoft accurately as an open-source organization across public web surfaces
2026-09-08T19:12:43+00:00

Leitwolf11

2026-09-08T19:12:43+00:00

b7f2dceebdee7e9d13644a1f80c661cfcc265bd2












Make Progmaweb API activation SELinux-stable
2026-09-07T22:29:57+00:00

Leitwolf11

2026-09-07T22:29:57+00:00

41b6d47bd69e0545420612e1eebe9d01fb77be9e

Invoke the framework-dependent API through the installed dotnet runtime instead of relying on a copied apphost inode retaining executable SELinux metadata. Document the production service contract so immutable releases activate consistently on the AlmaLinux host.





Invoke the framework-dependent API through the installed dotnet runtime instead of relying on a copied apphost inode retaining executable SELinux metadata. Document the production service contract so immutable releases activate consistently on the AlmaLinux host.







Harden Progmaweb identity, localization, and operations
2026-09-07T18:31:05+00:00

Leitwolf11

2026-09-07T18:31:05+00:00

171b443addac11e07559b6c4127e622341fe1961

Adopt Patent Grant 1.1, make the apex host canonical while excluding account surfaces from indexing, move the Progmasoft mail boundary into its owning repository, migrate the .NET 10 tests to native MTP, and add persistent light/dark and en-US/de-DE preferences across corporate and account experiences.





Adopt Patent Grant 1.1, make the apex host canonical while excluding account surfaces from indexing, move the Progmasoft mail boundary into its owning repository, migrate the .NET 10 tests to native MTP, and add persistent light/dark and en-US/de-DE preferences across corporate and account experiences.