progmaweb/pnpm-workspace.yaml, branch content/no-programming-languages

Rate-limit sign-in by visitor behind Cloudflare and stop forwarding h2c

2026-11-08T21:38:47+00:00

Cloudflare proxies the Progmasoft hosts, so Nginx saw a Cloudflare edge as
its peer and appended that edge to X-Forwarded-For. The API takes the last
hop as the client, so the account-auth limit (12 attempts in 3 minutes) was
counted per edge: 38 failed sign-ins from one address in a row were all
answered with 401, none with 429, and unrelated visitors behind one edge
shared a bucket.

- ops/nginx/cloudflare-real-ip.conf trusts CF-Connecting-IP only from the
  published Cloudflare ranges; a direct peer keeps its own address, so the
  header cannot be forged around Cloudflare. With it installed the 13th
  failed sign-in gets 429, a forged X-Forwarded-For changes nothing, and
  another address is not affected.
- Every proxied location forwarded the client's Upgrade header with
  "Connection: upgrade" on each request. Only a WebSocket upgrade is now
  forwarded; other requests carry no Upgrade and an empty Connection.
- c8 reached glob 13 (GHSA-3g3m-2fjr-6pw4) and minimatch 10
  (GHSA-g3hv-75wg-m249) through test-exclude; both are overridden to the
  fixed majors. pnpm audit reports nothing, coverage, lint and check pass.
- The CodeQL action pins carry their exact version comment (v4.38.2).
- ops/README.md describes the address handling and no longer names a
  script that left the repository with AI Support.

Co-Authored-By: Claude Opus 5.5

Document the ViGet API in full and take zod 4.6.7 for eslint

2026-10-29T09:42:13+00:00

The documentation check of the backend found the private members of
ViGet/ without a summary and no page for its namespace:
- Summaries for every field and helper method of the catalog, the
  descriptor, the properties reader, publishing and the endpoints.
- docs/api/namespaces/Progmasoft.Progmaweb.Api.ViGet.md describes the
  namespace.
- The two regular expressions of TazelPluginDescriptor are excluded from the
  reference like AccountNamePolicy.CanonicalPattern: the generator replaces
  their comment with its own.

The dependency audit found GHSA for zod < 4.6.6, which can exhaust memory
while validating oversized constrained collections. Only
eslint-plugin-react-hooks reaches it, and it accepts any zod 4, so an
override takes 4.6.7 until the plugin resolves a fixed release itself.
pnpm audit --audit-level high finds nothing.

Accept the unfixable braces advisory in the dependency audit

2026-10-03T10:45:34+00:00

The dependency audit fails on every branch since GHSA-vfj7-8cjw-p6xm was
published: braces <= 3.0.3 can exhaust the stack on deeply nested brace
patterns. There is no fixed release; 3.0.3 is the latest version, and the
latest fast-glob and micromatch still depend on it.

braces is reached only through the lint toolchain (eslint-config-next >
@next/eslint-plugin-next > fast-glob > micromatch). It is not part of the
built or deployed application, and it only receives the glob patterns of
this repository.

The audit now ignores this one advisory by its identifier. Every other
advisory of high severity still fails the check, and the entry carries the
reason and the condition for removing it.

Co-Authored-By: Claude Opus 5.5

Update Next.js and override brace-expansion for security advisories

2026-10-02T22:50:07+00:00

The dependency audit reports a critical Next.js advisory for releases before
16.3.6 (remote code execution in next/og ImageResponse) and high-severity
denial-of-service advisories for brace-expansion before 5.0.12. The site does
not import next/og, but production runs the affected Next.js release.

- next and eslint-config-next: 16.3.3 to 16.3.8.
- brace-expansion: the lockfile resolves 1.1.21 within its range; the 5.x
  line, which minimatch pins to 5.0.9, is overridden to 5.0.12 in the
  workspace until minimatch depends on a fixed release.

pnpm audit reports no known vulnerabilities. Prettier, eslint, the type
check, the tests and the production build pass.

Harden Progmaweb identity, localization, and operations

2026-09-07T18:31:05+00:00

Adopt Patent Grant 1.1, make the apex host canonical while excluding account surfaces from indexing, move the Progmasoft mail boundary into its owning repository, migrate the .NET 10 tests to native MTP, and add persistent light/dark and en-US/de-DE preferences across corporate and account experiences.

Establish Progmasoft copyright ownership across the corporate website and account service, license all project-owned sources under AGPL-3.0-or-later, add the shared defensive Progmasoft patent grant with SPDX and REUSE coverage, preserve source-availability obligations, and align notices, npm and .NET package metadata, frontend, API, tests, deployment configuration, and repository documentation

2026-08-29T08:01:02+00:00

Initialize Progmaweb 1.0.0 corporate and account platform: add a responsive Next.js corporate site without Visual X# compiler-pipeline content, host-aware account routes, registration and dashboard UX, an ASP.NET Core authentication API with account policies, password hashing, secure sessions, rate limiting and security headers, integration tests on Microsoft Testing Platform, locked dependency graphs, reproducible local orchestration, and separate frontend, backend and security workflows.

2026-08-28T20:03:57+00:00