tazel.net, branch fix/minimatch-glob-advisories The site of Tazel, tazel.net. Take minimatch and glob past their advisories 2026-11-06T08:28:18+00:00 Leitwolf11 2026-11-06T08:28:18+00:00 b581f547f5d1803660d2622b757eb6d97d937194 minimatch 10.2.6 (CVE-2026-118764, denial of service through globparts amplification) and glob 13.0.6 (CVE-2026-118773, traversal after an AbortSignal timeout) reach the site through @nuxt/content, nitropack and c8, whose ranges have not moved. Overrides take them to minimatch 11.0.5 and glob 14.0.4. Both run only while the site is generated, on the files of this repository, so no visitor could reach them; the override clears the alerts without waiting for the upstream ranges. zod 3.25.76 and deepmerge 4.3.1 keep their alerts. Nuxt Content checks the collections of this repository with zod, and rollup merges its own options with deepmerge, both at generation time on input from this repository; zod has no fixed 3.x and deepmerge no fixed release, and npm's way out is to go back to @nuxt/content 2 and nuxt 4.1. 
minimatch 10.2.6 (CVE-2026-118764, denial of service through globparts
amplification) and glob 13.0.6 (CVE-2026-118773, traversal after an
AbortSignal timeout) reach the site through @nuxt/content, nitropack and
c8, whose ranges have not moved. Overrides take them to minimatch 11.0.5
and glob 14.0.4. Both run only while the site is generated, on the files
of this repository, so no visitor could reach them; the override clears
the alerts without waiting for the upstream ranges.

zod 3.25.76 and deepmerge 4.3.1 keep their alerts. Nuxt Content checks
the collections of this repository with zod, and rollup merges its own
options with deepmerge, both at generation time on input from this
repository; zod has no fixed 3.x and deepmerge no fixed release, and
npm's way out is to go back to @nuxt/content 2 and nuxt 4.1.
Merge pull request #4 from Progmasoft/docs/gradle-plugin-repository 2026-11-06T06:36:27+00:00 Leitwolf 2026-11-06T06:36:27+00:00 1b6cf830302ee32b74a4665ec526a8296bb2a25b Show how a plugin build finds the Gradle plugin of Tazel 0.4.0.3 
Show how a plugin build finds the Gradle plugin of Tazel 0.4.0.3
 Look up Progmasoft's groups only in Progmasoft's repository 2026-11-06T06:28:12+00:00 Leitwolf11 2026-11-06T06:28:12+00:00 a8d5c015e13bcee918b3140442d7da5e82a71380 The settings of the plugin example listed the Gradle Plugin Portal first and filtered only the Progmasoft repository, so Gradle asked the Portal for com.progmasoft.tazel.plugin before Progmasoft's own repository. The example now makes https://maven.progmasoft.com/tazel exclusive for com.progmasoft.tazel and its subgroups: Gradle resolves those there and nowhere else, and every other plugin from the Portal. The example builds as written: the Gradle plugin and tazel-api resolve and jar writes the plugin JAR with its descriptor. 
The settings of the plugin example listed the Gradle Plugin Portal first
and filtered only the Progmasoft repository, so Gradle asked the Portal for
com.progmasoft.tazel.plugin before Progmasoft's own repository. The
example now makes https://maven.progmasoft.com/tazel exclusive for
com.progmasoft.tazel and its subgroups: Gradle resolves those there and
nowhere else, and every other plugin from the Portal.

The example builds as written: the Gradle plugin and tazel-api resolve
and jar writes the plugin JAR with its descriptor.
Show how a plugin build finds the Gradle plugin of Tazel 0.4.0.3 2026-11-06T05:23:12+00:00 Leitwolf11 2026-11-06T05:23:12+00:00 d17cee854076ddc3ea044e10be66b808af1f247c The Building a plugin section asked for com.progmasoft.tazel.plugin 0.4.0 from the Gradle Plugin Portal alone. The Portal does not serve it yet, and the released version is 0.4.0.3. The example now has the settings.gradle.kts that adds https://maven.progmasoft.com/tazel for the group com.progmasoft.tazel, uses version 0.4.0.3, and adds Maven Central, without which Kotlin's standard library does not resolve. The example was built as written: the Gradle plugin and tazel-api 0.4.0.3 resolve and gradlew jar writes the plugin JAR with its descriptor. Progmasoft/tazel carries the same change in Documents/PLUGINS.md for the next release, so the next sync keeps it. 
The Building a plugin section asked for com.progmasoft.tazel.plugin
0.4.0 from the Gradle Plugin Portal alone. The Portal does not serve it
yet, and the released version is 0.4.0.3. The example now has the
settings.gradle.kts that adds https://maven.progmasoft.com/tazel for the
group com.progmasoft.tazel, uses version 0.4.0.3, and adds Maven
Central, without which Kotlin's standard library does not resolve.

The example was built as written: the Gradle plugin and tazel-api
0.4.0.3 resolve and gradlew jar writes the plugin JAR with its
descriptor. Progmasoft/tazel carries the same change in
Documents/PLUGINS.md for the next release, so the next sync keeps it.
Merge pull request #2 from Progmasoft/seo/robots-txt 2026-11-05T13:35:01+00:00 Leitwolf 2026-11-05T13:35:01+00:00 3da7af66f343e532a9ea2aa7236152bf2225499b Name the crawlers robots.txt lets in 
Name the crawlers robots.txt lets in
 Merge branch 'main' into seo/robots-txt 2026-11-05T04:19:33+00:00 Leitwolf 2026-11-05T04:19:33+00:00 5c6d9ea719fc2871b58d10165def473fd9d194a4 






Merge pull request #3 from Progmasoft/ci/quality
2026-11-05T04:19:02+00:00

Leitwolf

2026-11-05T04:19:02+00:00

81359cfe2d60dfa4a18551d72ead860082598433

Add CodeQL, Codecov, Codacy and actionlint




Add CodeQL, Codecov, Codacy and actionlint






Pin the CodeQL action to v4.39.3 with its version
2026-11-05T04:09:35+00:00

Leitwolf11

2026-11-05T04:09:35+00:00

e8bb137bbae31105e1c753081a70c32daf835d18

zizmor found that the pinned commit was not the one the v4 comment
named; the pin is the commit of v4.39.3 and says so.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>





zizmor found that the pinned commit was not the one the v4 comment
named; the pin is the commit of v4.39.3 and says so.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>







Add CodeQL, Codecov, Codacy and actionlint
2026-11-05T03:59:06+00:00

Leitwolf11

2026-11-05T03:59:06+00:00

286256c6f9e8c1fa272ea1d7ea5631a41377f3f5

- CodeQL analyses the workflows and the TypeScript and Vue sources with
  the security-extended queries, on every push to main, every pull
  request and once a week.
- The tests run under c8, and a job of its own uploads the lcov report
  to Codecov through OIDC, away from the job that installs packages.
- .codacy.yml leaves out what is generated and what is copied from
  Progmasoft/tazel and Progmasoft/tala.
- actionlint joins zizmor in Workflow Security.
- CI Required gathers the site job and Dependency Review, so a ruleset
  can require one check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>





- CodeQL analyses the workflows and the TypeScript and Vue sources with
  the security-extended queries, on every push to main, every pull
  request and once a week.
- The tests run under c8, and a job of its own uploads the lcov report
  to Codecov through OIDC, away from the job that installs packages.
- .codacy.yml leaves out what is generated and what is copied from
  Progmasoft/tazel and Progmasoft/tala.
- actionlint joins zizmor in Workflow Security.
- CI Required gathers the site job and Dependency Review, so a ruleset
  can require one check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>







Name the crawlers robots.txt lets in
2026-11-05T03:48:34+00:00

Leitwolf11

2026-11-05T03:48:34+00:00

7a9b7891812611f9e45e64b2c585d006a414af97

Search crawlers and the crawlers that fetch a page for a person are
allowed: Googlebot, Google-Extended, OAI-SearchBot, ChatGPT-User,
Claude-SearchBot, Claude-User and ClaudeBot. GPTBot, CCBot and
Bytespider are turned away. Every other crawler is allowed, and the
sitemap stays named.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>





Search crawlers and the crawlers that fetch a page for a person are
allowed: Googlebot, Google-Extended, OAI-SearchBot, ChatGPT-User,
Claude-SearchBot, Claude-User and ClaudeBot. GPTBot, CCBot and
Bytespider are turned away. Every other crawler is allowed, and the
sitemap stays named.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>