tazel.net/package-lock.json, branch content/document-label The site of Tazel, tazel.net. Take minimatch and glob past their advisories 2026-11-06T08:28:18+00:00 Leitwolf11 2026-11-06T08:28:18+00:00 b581f547f5d1803660d2622b757eb6d97d937194 minimatch 10.2.6 (CVE-2026-118764, denial of service through globparts amplification) and glob 13.0.6 (CVE-2026-118773, traversal after an AbortSignal timeout) reach the site through @nuxt/content, nitropack and c8, whose ranges have not moved. Overrides take them to minimatch 11.0.5 and glob 14.0.4. Both run only while the site is generated, on the files of this repository, so no visitor could reach them; the override clears the alerts without waiting for the upstream ranges. zod 3.25.76 and deepmerge 4.3.1 keep their alerts. Nuxt Content checks the collections of this repository with zod, and rollup merges its own options with deepmerge, both at generation time on input from this repository; zod has no fixed 3.x and deepmerge no fixed release, and npm's way out is to go back to @nuxt/content 2 and nuxt 4.1. 
minimatch 10.2.6 (CVE-2026-118764, denial of service through globparts
amplification) and glob 13.0.6 (CVE-2026-118773, traversal after an
AbortSignal timeout) reach the site through @nuxt/content, nitropack and
c8, whose ranges have not moved. Overrides take them to minimatch 11.0.5
and glob 14.0.4. Both run only while the site is generated, on the files
of this repository, so no visitor could reach them; the override clears
the alerts without waiting for the upstream ranges.

zod 3.25.76 and deepmerge 4.3.1 keep their alerts. Nuxt Content checks
the collections of this repository with zod, and rollup merges its own
options with deepmerge, both at generation time on input from this
repository; zod has no fixed 3.x and deepmerge no fixed release, and
npm's way out is to go back to @nuxt/content 2 and nuxt 4.1.
Add CodeQL, Codecov, Codacy and actionlint 2026-11-05T03:59:06+00:00 Leitwolf11 2026-11-05T03:59:06+00:00 286256c6f9e8c1fa272ea1d7ea5631a41377f3f5 - CodeQL analyses the workflows and the TypeScript and Vue sources with the security-extended queries, on every push to main, every pull request and once a week. - The tests run under c8, and a job of its own uploads the lcov report to Codecov through OIDC, away from the job that installs packages. - .codacy.yml leaves out what is generated and what is copied from Progmasoft/tazel and Progmasoft/tala. - actionlint joins zizmor in Workflow Security. - CI Required gathers the site job and Dependency Review, so a ruleset can require one check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> 
- CodeQL analyses the workflows and the TypeScript and Vue sources with
  the security-extended queries, on every push to main, every pull
  request and once a week.
- The tests run under c8, and a job of its own uploads the lcov report
  to Codecov through OIDC, away from the job that installs packages.
- .codacy.yml leaves out what is generated and what is copied from
  Progmasoft/tazel and Progmasoft/tala.
- actionlint joins zizmor in Workflow Security.
- CI Required gathers the site job and Dependency Review, so a ruleset
  can require one check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Build the site of Tazel with Nuxt 2026-11-05T02:56:00+00:00 Leitwolf11 2026-11-05T02:56:00+00:00 6f114e3df68d0b20c7e58c5ffb8c46070317008a tazel.net is the site of Tazel itself: a Nuxt 4 site generated to static files, in en-US, de-DE, ru-RU and he-IL, light by default with a dark theme that is kept per browser. - Home: the release and its kind, what Tazel does, the steps from a project file to a program, and a sample. - Docs: Markdown through Nuxt Content, highlighted by Shiki (Kotlin, shell, PowerShell, and Tala through the grammar of the compiler repository), with a tree of the pages on the left, the headings of the page on the right, and the previous and next pages below. Installation, a first project, and releases and support are written in every language; the reference (commands, project file, lockfile, plugins, how Tazel works) is copied from the Documents of Tazel by scripts/sync-docs.mjs, and a language without a page shows the English one with a note. - Every page has its canonical address, hreflang alternates and a sitemap entry; generation fails on a link to a page that does not exist. CI checks the format, the types and the language helpers, generates the site and runs Dependency Review on pull requests. 
tazel.net is the site of Tazel itself: a Nuxt 4 site generated to static
files, in en-US, de-DE, ru-RU and he-IL, light by default with a dark
theme that is kept per browser.

- Home: the release and its kind, what Tazel does, the steps from a
  project file to a program, and a sample.
- Docs: Markdown through Nuxt Content, highlighted by Shiki (Kotlin,
  shell, PowerShell, and Tala through the grammar of the compiler
  repository), with a tree of the pages on the left, the headings of
  the page on the right, and the previous and next pages below.
  Installation, a first project, and releases and support are written
  in every language; the reference (commands, project file, lockfile,
  plugins, how Tazel works) is copied from the Documents of Tazel by
  scripts/sync-docs.mjs, and a language without a page shows the
  English one with a note.
- Every page has its canonical address, hreflang alternates and a
  sitemap entry; generation fails on a link to a page that does not
  exist.

CI checks the format, the types and the language helpers, generates
the site and runs Dependency Review on pull requests.