ci.yml already has a dependency-review job, which I missed. The workflow this branch added ran the same review a second time on every pull request, so it is removed; the existing job stays as it is.
The owner decided against running OpenSSF Scorecard here. The workflow added by the commit before this one is removed; nothing else changes.
zizmor audits the workflows themselves for what makes a workflow unsafe, and uploads what it finds to code scanning. Its first run here found one thing, 4 times: a checkout that leaves the job's token in the checked-out repository, where any later step can read it. No workflow pushes or needs the token after the checkout, so every checkout now sets persist-credentials to false, and zizmor reports nothing. OpenSSF Scorecard grades how the repository is kept: branch protection, pinned dependencies, token permissions and the like. It runs on the default branch and weekly, publishes its score and uploads its findings to code scanning. Dependency Review fails a pull request that adds or changes a dependency with a known vulnerability of high severity or worse. Dependabot watches what is already there; this holds what comes in. Every new action is pinned to a commit, each job names the permissions it needs, and no new workflow has a default permission.
Language Hebrew (he-IL) joins English, German and Russian on the language site, in the page metadata and in the list the backend reports. A visitor who has not chosen a language now starts in the language of their browser: the first preferred language that is published, compared by primary language, with `iw` accepted as the former code for Hebrew. A browser that prefers no published language gets en-US. A choice made in the menu is kept under a new storage key and always wins. The earlier key was written on every visit, so it could not tell a choice from the former English default; it is no longer read, which resets an earlier explicit choice once. Hebrew does not mirror the page. The layout, the navigation and code keep their left-to-right arrangement; only text follows the language. The onward arrow points left in Hebrew, and a left-to-right mark keeps "Visual X#" intact inside right-to-left text. The forum placeholder no longer has a language menu. It shows its one notice in the language of the browser, with English as the fallback, and stores no language. Its assets get a new cache key. The single documentation column may now shrink below its widest code line. Before, a long command widened the page on narrow screens, which cut right-aligned text off. The Hebrew text was not reviewed by a native speaker. Documentation gate The backend applies Dokka 2.2.0 with reportUndocumented and failOnWarning, its public declarations have KDoc, and CI runs dokkaGenerate. The dependency lock file and the verification metadata include the new artifacts. Verified locally: frontend tests, type check, prettier and build; backend test, bootJar and dokkaGenerate, which was also shown to fail on an undocumented declaration; the Hebrew pages in a browser. The forum page was exercised by its tests only.
Move the Progmasoft mail operations baseline to its owning Progmaweb repository, remove the retired Astro account UI and duplicate identity backend, keep only the ViGet health boundary, add canonical sitemap signals, strengthen dependency CI, and adopt Patent Grant 1.1 across project-owned files.
Insert a dedicated username step after the password screen and require the same publisher identity after Google authorization. Enforce an uppercase ASCII first letter, ASCII alphanumeric content, 8-128 character bounds, and reserved Progmasoft and Leitwolf names in the backend rather than trusting browser validation. Preserve canonical case while enforcing case-insensitive ownership through a normalized unique PostgreSQL index. Claim the name only after email-code validation and commit code consumption plus ownership atomically so unverified accounts cannot squat publisher coordinates. Expose the canonical publisher name on the account model, add the EF migration and xUnit policy coverage, version the cached auth flow, document the contract, and run backend tests in CI.