Bump versions for v12.76

Prepare v12.76 release
CHANGELOG: open issues #6834-#6840 - Today in the date picker, the card title and movable popups, Change Settings, the d shortcut, minicard dates.
2026-11-08 19:35:19 -05:00 · 2026-10-31 19:44:06 +00:00 · 2026-10-31 21:43:03 +02:00 · 2026-10-31 21:32:28 +02:00 · 2026-10-31 21:31:36 +02:00 · 2026-10-31 21:29:31 +02:00
482 changed files with 21860 additions and 6135 deletions
@@ -38,7 +38,7 @@ run-name: Release v${{ inputs.new_version }}
 #              only the ferretdb-<arch> binary it needs from the newest wekan/FerretDB
 #              release (FerretDB is built + released separately by its own build.sh —
 #              not compiled here) and embeds it
-#   - release: writes the newest CHANGELOG.md notes to the GitHub Release and
+#   - release: writes the newest CHANGELOG-big.md notes to the GitHub Release and
 #              checks the core wekan-<version>-{amd64,arm64}.zip bundles are on
 #              it. It uploads nothing: EVERY job that builds a release file
 #              attaches it itself, as its last step, the moment it is built and
@@ -281,8 +281,8 @@ jobs:
      # No `changelog:` output. The notes are 170 KB and more, which is past the
      # 128 KiB MAX_ARG_STRLEN a single environment variable may hold, so any job
      # consuming them through `env:` fails to start its shell. Jobs read
-      # CHANGELOG.md from their own checkout instead - see
-      # "Check the release notes exist in CHANGELOG.md" below.
+      # CHANGELOG-big.md from their own checkout instead - see
+      # "Check the release notes exist in CHANGELOG-big.md" below.
    steps:
      # Shallow: the only thing history was fetched for was finding out whether
      # the release tag already exists, which the tag step now asks GitHub.
@@ -310,8 +310,8 @@ jobs:
      # string at MAX_ARG_STRLEN - 128 KiB - so execve refused to start bash at
      # all ("Argument list too long") before a line of the step ran. Each job
      # that needs the notes now extracts them from its own checkout of
-      # CHANGELOG.md with the same script, straight into a file.
-      - name: Check the release notes exist in CHANGELOG.md
+      # CHANGELOG-big.md with the same script, straight into a file.
+      - name: Check the release notes exist in CHANGELOG-big.md
        env:
          STEP_VERSION_VERSION: ${{ steps.version.outputs.version }}
        run: |
@@ -1170,7 +1170,7 @@ jobs:
    env:
      VERSION: ${{ needs.prepare.outputs.version }}
    steps:
-      # ref: main, the same ref `prepare` read CHANGELOG.md from, so the notes
+      # ref: main, the same ref `prepare` read CHANGELOG-big.md from, so the notes
      # composed below are the ones prepare validated. (bump pushes to main and
      # prepare tags it; nothing else pushes during a release.)
      #
@@ -1203,7 +1203,7 @@ jobs:
        # published nothing, "Incorrect: command not found"); and `env:` put a
        # 172 KB string in envp, past the 128 KiB MAX_ARG_STRLEN, so execve
        # refused to start bash at all (v10.92, "Argument list too long"). Read
-        # from CHANGELOG.md, appended with cat, the text is data all the way.
+        # from CHANGELOG-big.md, appended with cat, the text is data all the way.
        run: |
          set -euo pipefail
          bash releases/release-notes.sh "$VERSION" > release-notes.md
@@ -5694,7 +5694,7 @@ jobs:
    # rewrites the notes of a release that is already published.
    timeout-minutes: 15
    steps:
-      # ref: main, so this job reads the same CHANGELOG.md the release job did.
+      # ref: main, so this job reads the same CHANGELOG-big.md the release job did.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: main
@@ -140,4 +140,7 @@ jobs:
          fi
          echo "Publishing $SPK with $SPK_BIN ..."
          # Same command as releases/release-sandstorm.sh: spk publish wekan-<VERSION>.spk
-          "$SPK_BIN" publish "$SPK"
+          # Publish to apps.sandstorm.org
+          "$SPK_BIN" publish --webkey=https://api-b72c46193b266fd6c33e1299dccc9bfa.oasis.sandstorm.org#iCDu7VYl4qZxVbDLXLIE2XSU0bEadaBgApEMqgCkLmP "$SPK"
+          # Publish to apps.sandstorm.io
+          "$SPK_BIN" publish --webkey=https://alpha-api.sandstorm.io/#Rs-0TT13YrNSbv7Fiz5K9bBkLaJn3E5TB0PU1GSn1HE "$SPK"
@@ -35,7 +35,7 @@ contributor — that offer is the mistake, not the rule.
 The maintainer's half is the release flow, not taste. Releases here are frequent —
 several a day when a fault is being chased — and `releases/release-all.sh` cuts one
 from whatever is on `main`, taking the version from the `# Upcoming WeKan ® release`
-section of `CHANGELOG.md`. Work parked on a branch is work that is not in the next
+section of `CHANGELOG-big.md`. Work parked on a branch is work that is not in the next
 release, and `tests/changelogEntriesBelongToTheirRelease.test.cjs` fails when a
 released section links a commit that release does not contain.

@@ -340,7 +340,7 @@ directly after the merge.
  the two patch repositories under `.tools/` — node-patches and mongo-tools-patches.
 - Directory structure:
  - `wekan` — this repo (https://github.com/wekan/wekan); see
-    `docs/DeveloperDocs/Directory-Structure.md`; `CHANGELOG.md` at root. It is at
+    `docs/DeveloperDocs/Directory-Structure.md`; `CHANGELOG-big.md` and `CHANGELOG.md` at root. It is at
    `~/repos/wekan` on Linux, `~/Documents/repos/wekan` on macOS and
    `Downloads\repos\wekan` on Windows. The maintainer commits on `main`; a
    contributor works on a branch and opens a pull request — see "Where this
@@ -414,7 +414,7 @@ directly after the merge.

  | Repository | File | Format |
  | --- | --- | --- |
-  | `wekan/wekan` | `CHANGELOG.md` | the WeKan format this section describes: `# Status` (Platforms/Version/TODO Later nested as `<details>`), then `# v<MAJOR>.<MINOR> YYYY-MM-DD WeKan ® release` sections of `<details>` entries whose `<summary>` links the commit |
+  | `wekan/wekan` | `CHANGELOG-big.md` (and the generated `CHANGELOG.md`, below) | the WeKan format this section describes: `# Status` (Platforms/Version/TODO Later nested as `<details>`), then `# v<MAJOR>.<MINOR> YYYY-MM-DD WeKan ® release` sections of `<details>` entries whose `<summary>` links the commit |
  | `wekan/node-patches` | `CHANGELOG.md` | the same WeKan format, with `# Upcoming node-patches release` |
  | `wekan/mongo-tools-patches` | `CHANGELOG.md` | the same WeKan format, with `# Upcoming mongo-tools-patches release` |
  | `wekan/FerretDB` | `CHANGELOG.md` | **upstream FerretDB's** format, not WeKan's: `## [v1.48.0](tag URL) (YYYY-MM-DD)` and `### New Features 🎉` / `### Fixed 🐛` / `### Other Changes 🤖` bullets ending `by @xet7. Thanks to xet7.` |
@@ -426,6 +426,52 @@ directly after the merge.
  out and would break the tooling that parses them. When this file and the file being
  edited disagree, **the file being edited wins** — and everything below in this
  section is about the WeKan format specifically.
+- **WeKan has TWO changelogs, and only one is written.** `CHANGELOG-big.md` is
+  the changelog: `# Status`, `# Upcoming WeKan ® release` and every release in
+  full, in the `<details>` format below - every rule in the rest of this section
+  is about it, and every entry, fix and release goes into it. `CHANGELOG.md` is
+  the SHORT changelog, generated from it by `node releases/changelog-short.mjs`
+  and never edited by hand:
+
+  | | `CHANGELOG.md` |
+  | --- | --- |
+  | Status, TODO Later | none |
+  | First | the unreleased `# Upcoming WeKan ® release`, when there is one: its **In short** paragraph only, then `[All changes so far](CHANGELOG-big.md#upcoming-wekan--release)` |
+  | Below it | the five newest `# v<MAJOR>.<MINOR> YYYY-MM-DD WeKan ® release` |
+  | Per release | its **In short** paragraph only, then `[All changes in v…](CHANGELOG-big.md#anchor)` |
+  | Markup | plain Markdown: no `<details>`, `<summary>`, `</summary>` or `</details>`, and every HTML link a Markdown link |
+
+  It exists because the big file is for whoever writes and audits a release,
+  and most readers - GitHub's front page, the Sandstorm App Market
+  (`sandstorm-pkgdef.capnp` embeds it), the Helm chart's changelog link - want
+  what changed lately, at a glance. `releases/release-all.sh` regenerates it
+  right after naming the new release, so it is in the same release commit, and
+  `releases/changelog.sh` does the same; `tests/changelogShort.test.cjs` fails
+  when it is not exactly what the generator writes. So: write
+  `CHANGELOG-big.md`, run the generator, commit both - and never edit
+  `CHANGELOG.md` to fix something, because the next run overwrites it.
+- **"Update wekan changelog" means both files, in this order:**
+  1. Find what is not in the changelog yet: `git log` since the newest commit
+     `CHANGELOG-big.md`'s Upcoming section (or, when it has none, the newest
+     release's `Prepare v… release` commit) already covers, by anybody - a
+     merged pull request and the maintainer's own commits alike.
+  2. Check whether a release was cut since the last update (`release-all.sh`
+     renames Upcoming to `# v<NEW> …` and opens no new one). If there is no
+     `# Upcoming WeKan ® release` heading, add it from
+     [docs/DeveloperDocs/Changelog-Upcoming-Template.md](docs/DeveloperDocs/Changelog-Upcoming-Template.md)
+     above the newest release - never add an entry to a released section.
+  3. Write the entries into that Upcoming section of `CHANGELOG-big.md`, in the
+     format described below (subsections, topic groups, `<details>` entries
+     linking each commit), and update its **In short** paragraph so it still
+     names the release's main outcomes.
+  4. Run `node releases/changelog-short.mjs`: `CHANGELOG.md` then shows that
+     Upcoming **In short** first and the five newest releases below it, with the
+     longer details only in `CHANGELOG-big.md`.
+  5. Run the changelog tests - `tests/changelogShort.test.cjs`,
+     `tests/changelogFormat.test.cjs`,
+     `tests/changelogEntriesBelongToTheirRelease.test.cjs` (or
+     `node tests/run-node-suites.cjs changelog`) - and commit
+     `CHANGELOG-big.md` and `CHANGELOG.md` together.
 - During development, add entries under a new `# Upcoming WeKan ® release` section above
  the newest release (FerretDB uses `## Upcoming FerretDB release`; the patch repos use
  `# Upcoming <repo> release`). Do **not** hand-edit
@@ -438,10 +484,10 @@ directly after the merge.
  add and syntax-check/register the test and state clearly what could not be run.
  Do not duplicate an existing test merely to satisfy the audit — extend it when
  that keeps one behavior in one suite.
- **CHANGELOG.md stays small enough for GitHub to show it.** GitHub renders
+- **CHANGELOG-big.md stays small enough for GitHub to show it.** GitHub renders
  Markdown up to 500 KiB; above that it shows only plain source text, and above
  about 2 MB nothing at all ("we can't show files that are this big right
-  now"). CHANGELOG.md reached 2.6 MB over 1,100 releases back to 2015 (#6580),
+  now"). The changelog reached 2.6 MB over 1,100 releases back to 2015 (#6580),
  and keeping only the current month still came to 2.1 MB, because releases
  here are frequent and large. So the cut is by SIZE: 450,000 bytes
  (`BUDGET` in `releases/changelog-archive.mjs`), under GitHub's limit with
@@ -449,7 +495,7 @@ directly after the merge.

  | | |
  | --- | --- |
-  | `CHANGELOG.md` | `# Status` (Platforms/TODO Later inside it), `# Upcoming`, and the newest releases that fit the budget |
+  | `CHANGELOG-big.md` | `# Status` (Platforms/TODO Later inside it), `# Upcoming`, and the newest releases that fit the budget |
  | `old-CHANGELOG/<year>/<MM>.md` | a month's releases, newest first; a month over the budget continues in `<MM>-part2.md`, `<MM>-part3.md`, ... |
  | `old-CHANGELOG/<year>.md` | 2015–2025, whole |

@@ -464,11 +510,11 @@ directly after the merge.
  still in git (`gitk`, `git-gui`, `git log --follow`), and being small enough
  to open is worth more.

-  Run `node releases/changelog-archive.mjs` whenever CHANGELOG.md has grown -
+  Run `node releases/changelog-archive.mjs` whenever CHANGELOG-big.md has grown -
  after a release is the natural moment. It is idempotent — a run with nothing
  to move only refreshes the tables and parts — and it decides from the FILE
  rather than the clock, so two people running it agree.
-  `tests/changelogArchive.test.cjs` fails when CHANGELOG.md is over the budget.
+  `tests/changelogArchive.test.cjs` fails when CHANGELOG-big.md is over the budget.
  An archived section is never edited, for the same reason a released one is
  not.
 - **The file's shape, top to bottom** — keep it exactly as it is now. There is
@@ -564,7 +610,7 @@ directly after the merge.
  `<details>` blocks below carry that information. Keep the paragraph current as
  topics change, and shorten it when added commits make it grow. A finished release
  keeps the paragraph it was written with.
- **Neither CHANGELOG.md nor release notes may contain a binaries provenance
+- **Neither changelog nor the release notes may contain a binaries provenance
  section or a Platform/Bundle/Binary/From/Version/Checked/SHA256 table.**
  Do not add "Binaries in these bundles" at the top or bottom of either.
  Release notes summarize each Translations group as only a list of updated
@@ -577,7 +623,7 @@ directly after the merge.
  no security fixes - is left out rather than added empty.
  Release notes have only In short, Security, Translations (language list),
  the standard thanks line and More details at ChangeLog with the release
-  anchor link. Other details stay in CHANGELOG.md. Keep download
+  anchor link into CHANGELOG-big.md. Other details stay in CHANGELOG-big.md. Keep download
  verification and `provenance.tsv` build artifacts for diagnostics; do not
  append their contents or `releases/provenance-table.sh` output to notes.
 - **Inside a subsection, entries are GROUPED BY TOPIC/AREA.** A release touches a handful
@@ -636,7 +682,7 @@ directly after the merge.
  Because CRITICAL comes first, it keeps the `This release ` prefix; a following non-security
  subsection becomes `and …` per the rule above.
 - **TODO Later** — a `<details>` nested inside `# Status` near the TOP of
-  `CHANGELOG.md` (above the version sections), a triage backlog for open
+  `CHANGELOG-big.md` (above the version sections), a triage backlog for open
  issues that were **investigated but not fixed here**, each
  recorded with a concrete REASON so whoever picks it up next knows why. Use it when working
  through open issues (the "Fix open issues" process): for each issue, either **fix it** (commit
@@ -717,7 +763,7 @@ have cost a released section its accuracy:
 - **Work continues immediately after a release**, so an entry written right
  after one has to go somewhere. `release-all.sh` renames `# Upcoming WeKan ®
  release` to `# v<NEW> …` and stops there — it does **not** create a new,
-  empty `# Upcoming` section. CHANGELOG.md never carries an
+  empty `# Upcoming` section. CHANGELOG-big.md never carries an
  `**In short:** nothing here yet.` placeholder sitting between releases; it
  used to (via a now-deleted `releases/changelog-open-next.mjs`), and that
  meant the file always had a section saying nothing, from the moment a
@@ -35,7 +35,7 @@ contributor — that offer is the mistake, not the rule.
 The maintainer's half is the release flow, not taste. Releases here are frequent —
 several a day when a fault is being chased — and `releases/release-all.sh` cuts one
 from whatever is on `main`, taking the version from the `# Upcoming WeKan ® release`
-section of `CHANGELOG.md`. Work parked on a branch is work that is not in the next
+section of `CHANGELOG-big.md`. Work parked on a branch is work that is not in the next
 release, and `tests/changelogEntriesBelongToTheirRelease.test.cjs` fails when a
 released section links a commit that release does not contain.

@@ -340,7 +340,7 @@ directly after the merge.
  the two patch repositories under `.tools/` — node-patches and mongo-tools-patches.
 - Directory structure:
  - `wekan` — this repo (https://github.com/wekan/wekan); see
-    `docs/DeveloperDocs/Directory-Structure.md`; `CHANGELOG.md` at root. It is at
+    `docs/DeveloperDocs/Directory-Structure.md`; `CHANGELOG-big.md` and `CHANGELOG.md` at root. It is at
    `~/repos/wekan` on Linux, `~/Documents/repos/wekan` on macOS and
    `Downloads\repos\wekan` on Windows. The maintainer commits on `main`; a
    contributor works on a branch and opens a pull request — see "Where this
@@ -414,7 +414,7 @@ directly after the merge.

  | Repository | File | Format |
  | --- | --- | --- |
-  | `wekan/wekan` | `CHANGELOG.md` | the WeKan format this section describes: `# Status` (Platforms/Version/TODO Later nested as `<details>`), then `# v<MAJOR>.<MINOR> YYYY-MM-DD WeKan ® release` sections of `<details>` entries whose `<summary>` links the commit |
+  | `wekan/wekan` | `CHANGELOG-big.md` (and the generated `CHANGELOG.md`, below) | the WeKan format this section describes: `# Status` (Platforms/Version/TODO Later nested as `<details>`), then `# v<MAJOR>.<MINOR> YYYY-MM-DD WeKan ® release` sections of `<details>` entries whose `<summary>` links the commit |
  | `wekan/node-patches` | `CHANGELOG.md` | the same WeKan format, with `# Upcoming node-patches release` |
  | `wekan/mongo-tools-patches` | `CHANGELOG.md` | the same WeKan format, with `# Upcoming mongo-tools-patches release` |
  | `wekan/FerretDB` | `CHANGELOG.md` | **upstream FerretDB's** format, not WeKan's: `## [v1.48.0](tag URL) (YYYY-MM-DD)` and `### New Features 🎉` / `### Fixed 🐛` / `### Other Changes 🤖` bullets ending `by @xet7. Thanks to xet7.` |
@@ -426,6 +426,52 @@ directly after the merge.
  out and would break the tooling that parses them. When this file and the file being
  edited disagree, **the file being edited wins** — and everything below in this
  section is about the WeKan format specifically.
+- **WeKan has TWO changelogs, and only one is written.** `CHANGELOG-big.md` is
+  the changelog: `# Status`, `# Upcoming WeKan ® release` and every release in
+  full, in the `<details>` format below - every rule in the rest of this section
+  is about it, and every entry, fix and release goes into it. `CHANGELOG.md` is
+  the SHORT changelog, generated from it by `node releases/changelog-short.mjs`
+  and never edited by hand:
+
+  | | `CHANGELOG.md` |
+  | --- | --- |
+  | Status, TODO Later | none |
+  | First | the unreleased `# Upcoming WeKan ® release`, when there is one: its **In short** paragraph only, then `[All changes so far](CHANGELOG-big.md#upcoming-wekan--release)` |
+  | Below it | the five newest `# v<MAJOR>.<MINOR> YYYY-MM-DD WeKan ® release` |
+  | Per release | its **In short** paragraph only, then `[All changes in v…](CHANGELOG-big.md#anchor)` |
+  | Markup | plain Markdown: no `<details>`, `<summary>`, `</summary>` or `</details>`, and every HTML link a Markdown link |
+
+  It exists because the big file is for whoever writes and audits a release,
+  and most readers - GitHub's front page, the Sandstorm App Market
+  (`sandstorm-pkgdef.capnp` embeds it), the Helm chart's changelog link - want
+  what changed lately, at a glance. `releases/release-all.sh` regenerates it
+  right after naming the new release, so it is in the same release commit, and
+  `releases/changelog.sh` does the same; `tests/changelogShort.test.cjs` fails
+  when it is not exactly what the generator writes. So: write
+  `CHANGELOG-big.md`, run the generator, commit both - and never edit
+  `CHANGELOG.md` to fix something, because the next run overwrites it.
+- **"Update wekan changelog" means both files, in this order:**
+  1. Find what is not in the changelog yet: `git log` since the newest commit
+     `CHANGELOG-big.md`'s Upcoming section (or, when it has none, the newest
+     release's `Prepare v… release` commit) already covers, by anybody - a
+     merged pull request and the maintainer's own commits alike.
+  2. Check whether a release was cut since the last update (`release-all.sh`
+     renames Upcoming to `# v<NEW> …` and opens no new one). If there is no
+     `# Upcoming WeKan ® release` heading, add it from
+     [docs/DeveloperDocs/Changelog-Upcoming-Template.md](docs/DeveloperDocs/Changelog-Upcoming-Template.md)
+     above the newest release - never add an entry to a released section.
+  3. Write the entries into that Upcoming section of `CHANGELOG-big.md`, in the
+     format described below (subsections, topic groups, `<details>` entries
+     linking each commit), and update its **In short** paragraph so it still
+     names the release's main outcomes.
+  4. Run `node releases/changelog-short.mjs`: `CHANGELOG.md` then shows that
+     Upcoming **In short** first and the five newest releases below it, with the
+     longer details only in `CHANGELOG-big.md`.
+  5. Run the changelog tests - `tests/changelogShort.test.cjs`,
+     `tests/changelogFormat.test.cjs`,
+     `tests/changelogEntriesBelongToTheirRelease.test.cjs` (or
+     `node tests/run-node-suites.cjs changelog`) - and commit
+     `CHANGELOG-big.md` and `CHANGELOG.md` together.
 - During development, add entries under a new `# Upcoming WeKan ® release` section above
  the newest release (FerretDB uses `## Upcoming FerretDB release`; the patch repos use
  `# Upcoming <repo> release`). Do **not** hand-edit
@@ -438,10 +484,10 @@ directly after the merge.
  add and syntax-check/register the test and state clearly what could not be run.
  Do not duplicate an existing test merely to satisfy the audit — extend it when
  that keeps one behavior in one suite.
- **CHANGELOG.md stays small enough for GitHub to show it.** GitHub renders
+- **CHANGELOG-big.md stays small enough for GitHub to show it.** GitHub renders
  Markdown up to 500 KiB; above that it shows only plain source text, and above
  about 2 MB nothing at all ("we can't show files that are this big right
-  now"). CHANGELOG.md reached 2.6 MB over 1,100 releases back to 2015 (#6580),
+  now"). The changelog reached 2.6 MB over 1,100 releases back to 2015 (#6580),
  and keeping only the current month still came to 2.1 MB, because releases
  here are frequent and large. So the cut is by SIZE: 450,000 bytes
  (`BUDGET` in `releases/changelog-archive.mjs`), under GitHub's limit with
@@ -449,7 +495,7 @@ directly after the merge.

  | | |
  | --- | --- |
-  | `CHANGELOG.md` | `# Status` (Platforms/TODO Later inside it), `# Upcoming`, and the newest releases that fit the budget |
+  | `CHANGELOG-big.md` | `# Status` (Platforms/TODO Later inside it), `# Upcoming`, and the newest releases that fit the budget |
  | `old-CHANGELOG/<year>/<MM>.md` | a month's releases, newest first; a month over the budget continues in `<MM>-part2.md`, `<MM>-part3.md`, ... |
  | `old-CHANGELOG/<year>.md` | 2015–2025, whole |

@@ -464,11 +510,11 @@ directly after the merge.
  still in git (`gitk`, `git-gui`, `git log --follow`), and being small enough
  to open is worth more.

-  Run `node releases/changelog-archive.mjs` whenever CHANGELOG.md has grown -
+  Run `node releases/changelog-archive.mjs` whenever CHANGELOG-big.md has grown -
  after a release is the natural moment. It is idempotent — a run with nothing
  to move only refreshes the tables and parts — and it decides from the FILE
  rather than the clock, so two people running it agree.
-  `tests/changelogArchive.test.cjs` fails when CHANGELOG.md is over the budget.
+  `tests/changelogArchive.test.cjs` fails when CHANGELOG-big.md is over the budget.
  An archived section is never edited, for the same reason a released one is
  not.
 - **The file's shape, top to bottom** — keep it exactly as it is now. There is
@@ -564,7 +610,7 @@ directly after the merge.
  `<details>` blocks below carry that information. Keep the paragraph current as
  topics change, and shorten it when added commits make it grow. A finished release
  keeps the paragraph it was written with.
- **Neither CHANGELOG.md nor release notes may contain a binaries provenance
+- **Neither changelog nor the release notes may contain a binaries provenance
  section or a Platform/Bundle/Binary/From/Version/Checked/SHA256 table.**
  Do not add "Binaries in these bundles" at the top or bottom of either.
  Release notes summarize each Translations group as only a list of updated
@@ -577,7 +623,7 @@ directly after the merge.
  no security fixes - is left out rather than added empty.
  Release notes have only In short, Security, Translations (language list),
  the standard thanks line and More details at ChangeLog with the release
-  anchor link. Other details stay in CHANGELOG.md. Keep download
+  anchor link into CHANGELOG-big.md. Other details stay in CHANGELOG-big.md. Keep download
  verification and `provenance.tsv` build artifacts for diagnostics; do not
  append their contents or `releases/provenance-table.sh` output to notes.
 - **Inside a subsection, entries are GROUPED BY TOPIC/AREA.** A release touches a handful
@@ -636,7 +682,7 @@ directly after the merge.
  Because CRITICAL comes first, it keeps the `This release ` prefix; a following non-security
  subsection becomes `and …` per the rule above.
 - **TODO Later** — a `<details>` nested inside `# Status` near the TOP of
-  `CHANGELOG.md` (above the version sections), a triage backlog for open
+  `CHANGELOG-big.md` (above the version sections), a triage backlog for open
  issues that were **investigated but not fixed here**, each
  recorded with a concrete REASON so whoever picks it up next knows why. Use it when working
  through open issues (the "Fix open issues" process): for each issue, either **fix it** (commit
@@ -717,7 +763,7 @@ have cost a released section its accuracy:
 - **Work continues immediately after a release**, so an entry written right
  after one has to go somewhere. `release-all.sh` renames `# Upcoming WeKan ®
  release` to `# v<NEW> …` and stops there — it does **not** create a new,
-  empty `# Upcoming` section. CHANGELOG.md never carries an
+  empty `# Upcoming` section. CHANGELOG-big.md never carries an
  `**In short:** nothing here yet.` placeholder sitting between releases; it
  used to (via a now-deleted `releases/changelog-open-next.mjs`), and that
  meant the file always had a section saying nothing, from the moment a
@@ -38,7 +38,7 @@ FROM --platform=$BUILDPLATFORM debian:trixie AS bundle

 ARG TARGETARCH
 ARG TARGETVARIANT
-ARG VERSION=12.71
+ARG VERSION=12.76
 ARG DEBIAN_FRONTEND=noninteractive

 COPY --chmod=755 releases/check-telemetry.py /tmp/check-telemetry.py
@@ -292,6 +292,14 @@ ENV \
    LOGOUT_ON_HOURS="" \
    LOGOUT_ON_MINUTES="" \
    USERS_DISABLE_INACTIVE_AFTER_DAYS="" \
+    LOGOUT_IDLE_MINUTES="" \
+    REQUIRE_2FA="" \
+    PASSWORD_MIN_LENGTH="" \
+    PASSWORD_MIN_LENGTH_ENFORCE="" \
+    PASSWORD_CHECK_PWNED="" \
+    HSTS_MAX_AGE="" \
+    HSTS_INCLUDE_SUBDOMAINS="" \
+    HSTS_PRELOAD="" \
    ATTACHMENTS_RETENTION_DAYS="" \
    ATTACHMENTS_RETENTION_MODE="" \
    ATTACHMENTS_PURGE_DELETED_AFTER_DAYS="" \
@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v12.71.0"
+appVersion: "v12.76.0"
 files:
  userUploads:
    - README.md
@@ -1282,7 +1282,7 @@ if arguments >= 1:

 # ------- BOARD MEMBER / CARD FIELD API ENDPOINTS START -----------
 # These commands wrap REST endpoints that already exist in Wekan.
-# See CHANGELOG.md "Upcoming" section for related issues and design notes.
+# See CHANGELOG-big.md "Upcoming" section for related issues and design notes.

    # Map a human readable ROLE to the board member permission boolean flags
    # used by /api/boards/:boardId/members/:userId/add and .../members/:memberId
@@ -1472,7 +1472,7 @@ if arguments >= 1:
        edcard = wekanurl + apiboards + boardid + s + l + s + listid + s + cs + s + cardid
        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey), 'Content-Type': 'application/json'}
        # NOTE: this REPLACES the card's labels. Bulk add/remove (merge) is not yet
-        # implemented server-side, see Issue #5819 in CHANGELOG.md "Upcoming".
+        # implemented server-side, see Issue #5819 in CHANGELOG-big.md "Upcoming".
        put_data = {'labelIds': labelids if labelids else []}
        body = requests.put(edcard, json=put_data, headers=headers)
        print("=== SET CARD LABELS ===\n")
@@ -989,15 +989,18 @@ exit /b %errorlevel%

 :buildcommon
 REM The same diagnostics as build.sh build_wekan: npm verbose output and
-REM foreground install scripts, METEOR_PROFILE, Node module resolution and the
-REM resolver command/output tracer, so a failed Windows build leaves the same
-REM evidence in its log. WEKAN_BUILD_HEAP_SNAPSHOT=1 caps the heap at
+REM foreground install scripts, METEOR_PROFILE and the resolver command/output
+REM tracer, so a failed Windows build leaves the same evidence in its log. Node
+REM module resolution (one line per require, gigabytes a minute) only with
+REM WEKAN_BUILD_TRACE_MODULES=1. WEKAN_BUILD_HEAP_SNAPSHOT=1 caps the heap at
 REM WEKAN_BUILD_HEAP_SNAPSHOT_MB (4096) and writes a heap snapshot near the limit.
 setlocal
 set "npm_config_loglevel=verbose"
 set "npm_config_foreground_scripts=true"
 if not defined METEOR_PROFILE set "METEOR_PROFILE=100"
-if defined NODE_DEBUG (set "NODE_DEBUG=%NODE_DEBUG%,module") else (set "NODE_DEBUG=module")
+if "%WEKAN_BUILD_TRACE_MODULES%"=="1" (
+  if defined NODE_DEBUG (set "NODE_DEBUG=!NODE_DEBUG!,module") else (set "NODE_DEBUG=module")
+)
 if "%WEKAN_BUILD_HEAP_SNAPSHOT%"=="1" (
  if not defined WEKAN_BUILD_HEAP_SNAPSHOT_MB set "WEKAN_BUILD_HEAP_SNAPSHOT_MB=4096"
  set "TOOL_NODE_FLAGS=--max-old-space-size=!WEKAN_BUILD_HEAP_SNAPSHOT_MB! --heapsnapshot-near-heap-limit=1"
@@ -1005,7 +1008,7 @@ if "%WEKAN_BUILD_HEAP_SNAPSHOT%"=="1" (
  echo Heap snapshot: ON, heap capped at !WEKAN_BUILD_HEAP_SNAPSHOT_MB! MB; the build will fail sooner and write Heap.*.heapsnapshot.
 )
 set "NODE_OPTIONS=%NODE_OPTIONS% --require="%REPO%\tools\build-command-output.cjs""
-echo Build diagnostics: resolver command/output tracing, Node module resolution, npm verbose output, foreground install scripts, METEOR_PROFILE=%METEOR_PROFILE% ^(milliseconds^).
+echo Build diagnostics: resolver command/output tracing, npm verbose output, foreground install scripts, METEOR_PROFILE=%METEOR_PROFILE% ^(milliseconds^).
 call :buildcommon_steps
 set "BUILD_RC=%errorlevel%"
 if not "%BUILD_RC%"=="0" if defined WEKAN_BUILD_LOG (
@@ -468,10 +468,17 @@ function build_wekan(){
 		echo "===== wekan build started $(date '+%F %T') ====="
 		export npm_config_loglevel=verbose npm_config_foreground_scripts=true
 		export METEOR_PROFILE="${METEOR_PROFILE:-100}"
-		export NODE_DEBUG="${NODE_DEBUG:+$NODE_DEBUG,}module"
+		# Node module resolution, one line per require. OFF unless
+		# WEKAN_BUILD_TRACE_MODULES=1: a Meteor build writes it at gigabytes a
+		# minute - 1.1 GB in the first three minutes of a menu dev build, over
+		# 12 GB in the first half hour of EVERYTHING on macOS, written twice
+		# through tee - and slows the build it is tracing.
+		if [ "${WEKAN_BUILD_TRACE_MODULES:-0}" = 1 ]; then
+			export NODE_DEBUG="${NODE_DEBUG:+$NODE_DEBUG,}module"
+		fi
 		# NODE_OPTIONS parses quoted paths, including checkouts with spaces.
 		export NODE_OPTIONS="${NODE_OPTIONS:-} --require=\"$(pwd)/tools/build-command-output.cjs\""
-		echo "Build diagnostics: resolver command/output tracing, Node module resolution, npm verbose output, foreground install scripts, METEOR_PROFILE=$METEOR_PROFILE (milliseconds)."
+		echo "Build diagnostics: resolver command/output tracing, npm verbose output, foreground install scripts, METEOR_PROFILE=$METEOR_PROFILE (milliseconds), Node module resolution $([ "${WEKAN_BUILD_TRACE_MODULES:-0}" = 1 ] && echo on || echo 'off (WEKAN_BUILD_TRACE_MODULES=1 turns it on)')."
 		build_stage "1/4 Remove dependencies and build caches" rm -rf node_modules node_modules/.cache .meteor/local .build _build || return $?
 		# Updating npm metadata has historically been best effort; installation is required.
 		build_stage "2/4 Compile app to resolve Meteor plugin npm dependencies" meteor update --npm || echo "WARNING: Meteor plugin npm dependency compilation failed; trying dependency installation."
@@ -2393,8 +2400,8 @@ function git_fix_changelog_links(){
 	local script="$WEKAN_DIR/releases/fix-changelog-hashes.sh"
 	[ -f "$script" ] || return 1
 	bash "$script" || return 1
-	if [ -n "$(git status --porcelain -- CHANGELOG.md 2>/dev/null)" ]; then
-		git add CHANGELOG.md
+	if [ -n "$(git status --porcelain -- CHANGELOG-big.md CHANGELOG.md 2>/dev/null)" ]; then
+		git add CHANGELOG-big.md CHANGELOG.md
 		git commit -q -m "CHANGELOG: repoint commit links after history moved.

 A rebase rewrote the commits these entries link to, so the links named commits
@@ -2605,7 +2612,7 @@ choose() {
 # snap/bundle, not on a maintainer's machine) and the superseded old-*.sh and
 # translations/fill_translations.py.
 # Release notes summarize translations as affected languages; other changelog
-# details stay in CHANGELOG.md. Notes include only In short, Security,
+# details stay in CHANGELOG-big.md. Notes include only In short, Security,
 # Translations language list, thanks and the changelog link. Binary provenance remains
 # a build artifact and must not be appended by any release entry point.
 RELEASE_SCRIPTS=(	"Release|Release All: audit, commit, push and build with Actions|releases/release-all.sh|||"
@@ -111,6 +111,28 @@ Meteor.startup(() => {
    }
  });

+  // LOGOUT_IDLE_MINUTES: report the user's activity while signed in, if the
+  // limit is set (models/lib/idleLogout.js).
+  const { createIdleActivityReporter } = require('/client/lib/idleActivity');
+  const idleReporter = createIdleActivityReporter({
+    target: document,
+    touch: () => Meteor.call('touchActivity', () => {}),
+  });
+  let idleCheckedFor = null;
+  Tracker.autorun(() => {
+    const userId = Meteor.userId();
+    if (!userId) {
+      idleCheckedFor = null;
+      idleReporter.stop();
+      return;
+    }
+    if (idleCheckedFor === userId) return;
+    idleCheckedFor = userId;
+    Meteor.call('getIdleLogout', (error, result) => {
+      if (!error && result && result.enabled && Meteor.userId() === userId) idleReporter.start();
+    });
+  });
+
  // Initialize mobile mode on startup for iOS devices
  // This ensures mobile mode is applied correctly on page load
  Tracker.afterFlush(() => {
@@ -366,43 +366,43 @@ body.desktop-mode .card-details.card-details-collapsed {
  position: relative;
 }

-/* The title is two things at once, split like a minicard's: the LEADING half
-   opens the editor, the trailing half drags the window. With drag handles OFF
-   there is no handle, so the title bar is what the window is moved by - and a
-   heading that is entirely an edit target leaves nothing to take hold of.
+/* #6839: the whole title edits - every word of it and the space beside a
+   short last line, which is what anybody clicks to change the title. The window
+   is moved from the empty space ABOVE the title, in the row of the collapse
+   caret and the menu (cardDetails.js), or by the drag handle when drag handles
+   are on. It was split like a minicard's - the trailing half dragged - and a
+   click on the right of the title did nothing anybody expected.

-   An overlay rather than a split of the text, because the text is a `.viewer`
-   and cutting it in two would cut the sentence in two. `inset-inline-start`, so
-   the edit half is the left in English and the right in Arabic from one rule.
-   The drag handler steps aside for this zone (cardDetails.js). */
+   An overlay rather than a link around the text, because the text is a
+   `.viewer` with its own links. */
 .card-details .card-details-header .card-details-title .card-details-title-edit-zone {
  position: absolute;
  top: 0;
  bottom: 0;
  inset-inline-start: 0;
-  /* Half of the heading - and the heading is stretched to the row below, so
-     this is half of the BAR however long the title happens to be. */
-  width: 50%;
+  width: 100%;
  cursor: text;
  z-index: 1;
 }

-/* The heading fills the row rather than shrinking to its text, so "half the
-   title" and "half the bar" are the same half however long the title is. A
-   heading only as wide as its words leaves the empty space beside it belonging
-   to nothing - and that space is where anybody would grab to move the window.
-   It stays inline-block so the complete-toggle beside it keeps its place; the
-   buttons floating at the trailing edge take their room out of this width. */
+/* The heading fills the row rather than shrinking to its text, so the edit
+   zone covers the space beside a short title too. It stays inline-block so
+   the complete-toggle beside it keeps its place. */
 .card-details .card-details-header .card-details-title {
  min-width: 60%;
 }

-/* With drag handles ON the handle is the only drag source, so the whole title
-   is the edit target - the same rule the minicard follows, from the same
-   question: `card-details-with-handle` is set by the template from
-   isTouchScreenOrShowDesktopDragHandles, which is Utils.showDragHandles(). */
-.card-details.card-details-with-handle .card-details-header .card-details-title .card-details-title-edit-zone {
-  width: 100%;
+/* The empty part of the header row is what moves the window when there is no
+   drag handle; with one, the handle alone does. */
+.card-details:not(.card-details-with-handle) .card-details-header {
+  cursor: move;
+}
+.card-details .card-details-header .card-details-title,
+.card-details .card-details-header a {
+  cursor: auto;
+}
+.card-details .card-details-header a {
+  cursor: pointer;
 }
 .card-details .card-details-header .linked-card-location {
  font-style: italic;
@@ -49,10 +49,9 @@ template(name="cardDetails")
          a.card-details-menu.js-open-card-details-menu(title="{{_ 'cardDetailsActionsPopup-title'}}")
            i.fa.fa-bars
          //- The handle appears only when drag handles are ON, like the
-            minicard's. With them off the window is dragged by its own title bar
-            - the trailing half of the title - so a handle would be a second way
-            to do what the bar already does; with them on it is the ONLY way, and
-            the title is all edit target.
+            minicard's. With them off the window is dragged by the empty space
+            of its header row, so a handle would be a second way to do what the
+            bar already does; with them on it is the ONLY way.
            client/components/cards/minicard.jade
          if canModifyCard
            if isTouchScreenOrShowDesktopDragHandles
@@ -80,12 +79,12 @@ template(name="cardDetails")
          if currentBoard.allowsDueComplete
            a.card-details-complete-toggle.js-toggle-due-complete(title="{{#if getDueComplete}}{{_ 'card-mark-incomplete'}}{{else}}{{_ 'card-mark-complete'}}{{/if}}")
              .materialCheckBox(class="{{#if getDueComplete}}is-checked{{/if}}")
-        //- The title is BOTH: the leading half opens the editor and the
-          trailing half drags the window, exactly as a minicard's title splits
-          between editing and dragging the card. `js-card-title-drag-handle`
-          stays on the whole heading - the drag handler is what steps aside for
-          the edit zone - so a reader who may not write can still drag the
-          window by any part of it, which is what that class was for.
+        //- #6839: the whole title opens the editor. The window is moved from
+          the empty space of the header row above it, or by the drag handle
+          when drag handles are on. `js-card-title-drag-handle` stays on the
+          whole header - the drag handler is what steps aside for the edit zone
+          - so a reader who may not write, who has no edit zone, can still drag
+          the window by the title.
        if showLabelsAboveTitleOnCard
          .card-details-labels-above-title
            +minicardLabels(show=labelsShownAboveTitle labels=labels hideText=hiddenCardLabelText)
@@ -701,9 +701,12 @@ Template.cardDetails.onDestroyed(function () {

  // #6686: see the comment in onCreated above. Only close a popup that is
  // still showing THIS card's data at the base of its stack - a popup opened
-  // for an unrelated card/context must not be touched.
+  // for an unrelated card/context must not be touched. #6840: and only when
+  // this card is no longer the open one - closed, or another card opened. A
+  // card whose details are merely rendered again is still open, and its popup
+  // (the Due date one `d` just opened) must not flash shut.
  const openedCardId = this.openedCardId;
-  if (openedCardId && Popup.isOpen()) {
+  if (openedCardId && Popup.isOpen() && Utils.getCurrentCardId() !== openedCardId) {
    const baseStackEntry = Popup._stack?.[0];
    if (baseStackEntry?.dataContext?._id === openedCardId) {
      Popup.close();
@@ -1287,17 +1290,18 @@ Template.cardDetails.events({
      // selects text instead of moving the card window.
      return;
    }
-    // ...and don't drag from the half that EDITS. The title is split like a
-    // minicard's: the leading half opens the editor, the trailing half is what
-    // you take hold of. With drag handles ON the zone covers the whole title
-    // (cardDetails.css), so the window is dragged by its handle alone - which is
-    // what turning handles on means.
+    // #6839: ...and never from the title, which edits - all of it
+    // (cardDetails.css). The window is moved from the empty space of the
+    // header row above it, beside the collapse caret and the menu.
    if ($(event.target).closest('.card-details-title-edit-zone').length > 0) {
      return;
    }
    // The drag handle has its own handler; without this both would run and the
-    // window would be moved twice by one press.
-    if ($(event.target).closest('.js-card-drag-handle').length > 0) {
+    // window would be moved twice by one press. And when there IS a handle -
+    // drag handles on - it is the only thing that moves the window, which is
+    // what turning handles on means.
+    if ($(event.target).closest('.js-card-drag-handle').length > 0
+      || $(event.target).closest('.card-details').find('.js-card-drag-handle').length > 0) {
      return;
    }

@@ -374,7 +374,12 @@
  flex-wrap: wrap;
  position: relative;
  z-index: 5;
-  margin-inline-end: 84px;
+  /* #6834: room for the drag handle beside it (20px, 1px from the edge), and
+     no more. It reserved 84px - a third of a 250px minicard - for nothing:
+     the avatars float AFTER this row and `clear: both` starts it below the
+     menu, so a due date "1405-08-10 12:00 (1 day left)" was broken over three
+     lines beside an empty strip. */
+  margin-inline-end: 24px;
  clear: both;
 }
 .minicard .date {
@@ -102,6 +102,11 @@
  padding-inline: 4px;
 }

+/* #6838: a word, not an arrow - it may be wider than the arrows beside it. */
+.selected-calendar-heading .js-calendar-today {
+  white-space: nowrap;
+  padding-inline: 6px;
+}
 .selected-calendar-heading .selected-calendar-date {
  margin-inline-start: 4px;
 }
@@ -22,6 +22,9 @@ template(name="calendarDateInput")
              | {{monthLabel}}
              if inline
                span.selected-calendar-date {{headingDateText}}
+            //- #6838: back to today's month from wherever the arrows went. It only
+            //- shows the month; the date stays as it is until a day is clicked.
+            button.primary.js-calendar-today(type="button" aria-label="{{_ 'today'}}") {{_ 'today'}}
            button.primary.js-calendar-next(type="button" aria-label="{{_ 'next'}} {{_ 'month'}}") ›
            button.primary.js-calendar-year-next(type="button" aria-label="{{_ 'next'}} {{_ 'predicate-year'}}") »
          table
@@ -34,5 +37,5 @@ template(name="calendarDateInput")
                tr
                  each days
                    td(class="{{#if this.today}}is-today-cell{{/if}}")
-                      if this
+                      unless this.empty
                        button.primary.js-calendar-day(type="button" class="{{#if today}}is-today{{/if}}" data-date=iso title=title aria-label=title aria-pressed=selected aria-current=ariaCurrent tabindex=tabIndex) {{label}}
@@ -86,9 +86,17 @@ Template.calendarDateInput.helpers({
    // the browser's local day, the same local calendar day formatDate() gives
    // every other cell, so it is the cell the user means by "today".
    const todayIso = formatDate(new Date());
+    // #6838: every row and every cell - an empty one too - has its own _id.
+    // Blaze matches list items by _id; without one, going from one month to
+    // another reused cells by position and the empty cells, all alike, were
+    // moved around: October came back as "29, empty, 30, empty", without the
+    // 31st. The month is part of each id, so a new month is new cells.
+    const month = days.find(Boolean);
+    const monthId = month ? formatDate(month) : 'empty';
    const rows = [];
    for (let index = 0; index < days.length; index += 7) {
-      rows.push({ days: days.slice(index, index + 7).map(date => date && ({
+      rows.push({ _id: `${monthId}-week-${index / 7}`, days: days.slice(index, index + 7).map((date, cell) => (date ? {
+        _id: formatDate(date),
        iso: formatDate(date),
        today: formatDate(date) === todayIso,
        // null omits the attribute: only today's button carries aria-current.
@@ -97,7 +105,7 @@ Template.calendarDateInput.helpers({
        title: formatDateForDisplay(date, false),
        selected: tpl.selectedDate.get() && formatDate(tpl.selectedDate.get()) === formatDate(date),
        tabIndex: focusDate && formatDate(focusDate) === formatDate(date) ? 0 : -1,
-      })) });
+      } : { _id: `${monthId}-empty-${index + cell}`, empty: true })) });
    }
    return rows;
  },
@@ -121,6 +129,11 @@ Template.calendarDateInput.events({
    event.preventDefault();
    tpl.shownDate.set(calendarMonthRange(tpl.shownDate.get(), selectedSystem().intl).end);
  },
+  'click .js-calendar-today'(event, tpl) {
+    event.preventDefault();
+    tpl.shownDate.set(new Date());
+    Tracker.afterFlush(() => tpl.find('.js-calendar-day.is-today')?.focus());
+  },
  'click .js-calendar-year-previous'(event, tpl) { event.preventDefault(); tpl.shownDate.set(shiftCalendarYear(tpl.shownDate.get(), -1, selectedSystem().intl)); },
  'click .js-calendar-year-next'(event, tpl) { event.preventDefault(); tpl.shownDate.set(shiftCalendarYear(tpl.shownDate.get(), 1, selectedSystem().intl)); },
  'click .js-calendar-day'(event, tpl) {
@@ -6,7 +6,7 @@ import { Markdown } from 'meteor/wekan-markdown';
 import { Utils } from '/client/lib/utils';
 import { memberMatchesTerm } from '/models/lib/memberAutocomplete';
 import { internalCardPath } from '/models/lib/internalCardLink';
-import { parseAllowedUrlSchemes, hrefScheme, BUILT_IN } from '/models/lib/urlSchemeAllowlist';
+import { parseAllowedUrlSchemes, hrefScheme, BUILT_IN, NEVER_LINKED } from '/models/lib/urlSchemeAllowlist';
 import autosize from 'autosize';
 var converter = require('@wekanteam/html-to-markdown');

@@ -348,6 +348,10 @@ Template.viewer.events({
        const scheme = hrefScheme(href);
        if (cardPath) {
          FlowRouter.go(cardPath);
+        } else if (NEVER_LINKED.has(scheme)) {
+          // The sanitizer never lets one of these be a link; should one reach
+          // the page some other way, a click still does not launch its
+          // handler (ms-msdt:, search-ms:, telnet: ...).
        } else if (scheme && !BUILT_IN.includes(scheme)) {
          // #3218: an allowed custom scheme (thunderlink:, onenote:, ...) is
          // handed to the application registered for it by following the
@@ -1446,9 +1446,18 @@ body.mobile-mode .pop-over .content-wrapper {
  cursor: move;
  color: #888;
 }
-.pop-over .header:has(.popup-drag-handle) {
+/* #6839: the title bar moves every popup while drag handles are off; with
+   them on, the handle does, and the bar is an ordinary title. */
+.pop-over .header {
  cursor: move;
 }
+.pop-over .header:has(.popup-drag-handle) {
+  cursor: auto;
+}
+.pop-over .header a,
+.pop-over .header button {
+  cursor: pointer;
+}
 .pop-over .header .popup-maximize-btn {
  position: absolute;
  top: 0;
@@ -29,8 +29,11 @@ function resizeDatePopup(element, width, height) {
  Object.entries(styles).forEach(([key, value]) => element.style.setProperty(key, value, 'important'));
 }

-// Popups dragged by their title bar (or the drag handle beside it), as the
-// opened card is. A date popup is movable too, found by its .edit-date.
+// #6839: EVERY popup is moved like the opened card: by its title bar when drag
+// handles are off, by the drag handle before its title when they are on - the
+// handle alone, then, as the card's. These are the popups that may also GROW
+// past the window while open (Drawing replacing a menu), so they are kept
+// inside it as they grow; so is any popup the user has dragged.
 const MOVABLE_POPUPS = new Set(['boardViewSettingsPopup', 'cardDrawingPopup', 'boardCardSettingsPopup']);
 // Popups with the opened card's maximize / minimize button.
 const MAXIMIZABLE_POPUPS = new Set(['cardDrawingPopup', 'boardCardSettingsPopup']);
@@ -66,7 +69,7 @@ Popup.template.onCreated(function () {

 Popup.template.helpers({
  popupMovable() {
-    return MOVABLE_POPUPS.has(this.popupName);
+    return true;
  },
  popupMaximizable() {
    return MAXIMIZABLE_POPUPS.has(this.popupName);
@@ -87,21 +90,43 @@ Popup.template.events({
  'pointerdown .header'(evt, tpl) {
    const element = evt.currentTarget.closest('.pop-over');
    // A maximized popup has no place to be dragged to.
+    // With drag handles on, the handle is the only thing that moves it.
+    const handle = element.querySelector('.js-popup-drag-handle');
    if (evt.button !== 0 || element.classList.contains('pop-over--maximized') ||
-        (!element.querySelector('.edit-date') && !MOVABLE_POPUPS.has(element.dataset.popup)) ||
+        (handle && !evt.target.closest('.js-popup-drag-handle')) ||
        evt.target.closest('a, button, input, select')) return;
    evt.preventDefault(); evt.stopPropagation();
    const bounds = element.getBoundingClientRect();
+    // Pin it where it is before it moves. A popup is placed by its margins, by
+    // inset-inline-end (the member menu, at the right edge) or by left/top, so
+    // `left: bounds.left` alone put some of them elsewhere - one jumped across
+    // the window as the drag began. Set it, see where it went, and correct.
+    const place = (left, top) => {
+      element.style.setProperty('inset-inline-start', 'auto', 'important');
+      element.style.setProperty('inset-inline-end', 'auto', 'important');
+      element.style.setProperty('left', `${left}px`, 'important');
+      element.style.setProperty('top', `${top}px`, 'important');
+    };
+    place(bounds.left, bounds.top);
+    const placed = element.getBoundingClientRect();
+    const left = bounds.left + (bounds.left - placed.left);
+    const top = bounds.top + (bounds.top - placed.top);
+    place(left, top);
+    element.dataset.userMoved = 'true';
    tpl._dateMove = { element, pointerId: evt.pointerId, x: evt.clientX, y: evt.clientY,
-      left: bounds.left, top: bounds.top, width: bounds.width, height: bounds.height };
+      left, top, width: bounds.width, height: bounds.height,
+      // The clamp keeps the popup's VISIBLE box 12px inside the window.
+      dx: bounds.left - left, dy: bounds.top - top };
    evt.currentTarget.setPointerCapture(evt.pointerId);
  },
  'pointermove .header'(evt, tpl) {
    const drag = tpl._dateMove;
    if (!drag || drag.pointerId !== evt.pointerId) return;
    evt.preventDefault(); evt.stopPropagation();
-    const left = Math.max(12, Math.min(window.innerWidth - drag.width - 12, drag.left + evt.clientX - drag.x));
-    const top = Math.max(12, Math.min(window.innerHeight - drag.height - 12, drag.top + evt.clientY - drag.y));
+    const boxLeft = Math.max(12, Math.min(window.innerWidth - drag.width - 12, drag.left + drag.dx + evt.clientX - drag.x));
+    const boxTop = Math.max(12, Math.min(window.innerHeight - drag.height - 12, drag.top + drag.dy + evt.clientY - drag.y));
+    const left = boxLeft - drag.dx;
+    const top = boxTop - drag.dy;
    // Dragging uses physical pointer coordinates in either text direction.
    drag.element.style.setProperty('inset-inline-start', 'auto', 'important');
    drag.element.style.setProperty('inset-inline-end', 'auto', 'important');
@@ -221,7 +246,8 @@ Popup.template.onRendered(function () {
    if (typeof ResizeObserver !== 'undefined') {
      const element = this._popupElement;
      this._boundsObserver = new ResizeObserver(() => {
-        if (!MOVABLE_POPUPS.has(element.dataset.popup) || element.classList.contains('pop-over--maximized')) return;
+        if (!(MOVABLE_POPUPS.has(element.dataset.popup) || element.dataset.userMoved)
+          || element.classList.contains('pop-over--maximized')) return;
        const box = element.getBoundingClientRect();
        const moved = keptInside(box, window.innerWidth, window.innerHeight);
        if (!moved) return;
@@ -14,10 +14,10 @@
  .header
    a.back-btn.js-back-view(class="{{#unless hasPopupParent}}is-hidden{{/unless}}" aria-label="{{_ 'go-back'}}")
      i.fa.fa-caret-left(aria-hidden="true")
-    //- A movable popup (popup.js MOVABLE_POPUPS) is dragged by its title bar
-      or this handle, like the opened card - and, like the card's, the handle
-      is there only while drag handles are on; a maximizable one has the
-      card's maximize / minimize button beside its close button.
+    //- #6839: every popup is moved like the opened card - by its title bar
+      while drag handles are off, by this handle alone while they are on
+      (popup.js); a maximizable one has the card's maximize / minimize button
+      beside its close button.
    if popupMovable
      if isTouchScreenOrShowDesktopDragHandles
        span.popup-drag-handle.js-popup-drag-handle(title="{{_ 'drag-to-move'}}")
@@ -0,0 +1,11 @@
+.admin-audit-log-search { margin: 0.5rem 0; max-width: 24rem; }
+.admin-audit-log-table { width: 100%; border-collapse: collapse; }
+.admin-audit-log-table th, .admin-audit-log-table td {
+  padding: 0.3rem 0.5rem;
+  border-bottom: 1px solid rgba(128, 128, 128, 0.3);
+  text-align: start;
+  vertical-align: top;
+}
+.admin-audit-args { white-space: pre-wrap; word-break: break-all; font-size: 0.85em; }
+.admin-audit-failed .admin-audit-error { color: #c0392b; }
+.admin-audit-log-pager { margin-top: 0.5rem; display: flex; gap: 0.5rem; align-items: center; }
@@ -0,0 +1,39 @@
+template(name="adminAuditLog")
+  //- Admin Panel / People / Audit log (models/lib/adminAudit.js): every
+  //- administrative action of a site administrator, newest first. The
+  //- arguments are shown as stored - passwords and secrets never are.
+  .admin-audit-log
+    p {{_ 'admin-audit-log-info'}}
+    .admin-audit-log-search
+      input.wekan-form-control.js-admin-audit-search(type="search" placeholder="{{_ 'search'}}" value=search)
+    if loading
+      +spinner
+    else
+      table.admin-audit-log-table
+        thead
+          tr
+            th {{_ 'admin-audit-log-when'}}
+            th {{_ 'admin-audit-log-who'}}
+            th {{_ 'admin-audit-log-action'}}
+            th {{_ 'admin-audit-log-details'}}
+            th IP
+        tbody
+          each rows
+            tr(class="{{#unless ok}}admin-audit-failed{{/unless}}")
+              td {{when at}}
+              td {{actorUsername}}
+              td
+                code {{method}}
+                unless ok
+                  |  
+                  span.admin-audit-error {{error}}
+              td
+                code.admin-audit-args {{args}}
+              td {{ip}}
+          else
+            tr
+              td(colspan="5") {{_ 'admin-audit-log-empty'}}
+      .admin-audit-log-pager
+        button.js-admin-audit-prev(type="button" disabled=noPrev) ‹
+        span {{page}} / {{pages}} ({{total}})
+        button.js-admin-audit-next(type="button" disabled=noNext) ›
@@ -0,0 +1,47 @@
+import { ReactiveVar } from 'meteor/reactive-var';
+import { Template } from 'meteor/templating';
+
+// Admin Panel / People / Audit log: pages of server/adminAudit.js's trail.
+Template.adminAuditLog.onCreated(function () {
+  this.page = new ReactiveVar(1);
+  this.search = new ReactiveVar('');
+  this.result = new ReactiveVar({ rows: [], total: 0, page: 1, perPage: 50 });
+  this.loading = new ReactiveVar(true);
+  this.autorun(() => {
+    const options = { page: this.page.get(), search: this.search.get() };
+    this.loading.set(true);
+    Meteor.call('adminAuditLogPage', options, (error, result) => {
+      this.loading.set(false);
+      if (!error && result) this.result.set(result);
+    });
+  });
+});
+
+Template.adminAuditLog.helpers({
+  loading() { return Template.instance().loading.get(); },
+  rows() { return Template.instance().result.get().rows; },
+  total() { return Template.instance().result.get().total; },
+  page() { return Template.instance().page.get(); },
+  search() { return Template.instance().search.get(); },
+  pages() {
+    const { total, perPage } = Template.instance().result.get();
+    return Math.max(1, Math.ceil(total / perPage));
+  },
+  noPrev() { return Template.instance().page.get() <= 1; },
+  noNext() {
+    const { total, perPage } = Template.instance().result.get();
+    return Template.instance().page.get() >= Math.ceil(total / perPage);
+  },
+  when(at) { return at ? new Date(at).toLocaleString() : ''; },
+});
+
+let searchTimer = null;
+Template.adminAuditLog.events({
+  'input .js-admin-audit-search'(event, tpl) {
+    const value = event.currentTarget.value;
+    clearTimeout(searchTimer);
+    searchTimer = setTimeout(() => { tpl.page.set(1); tpl.search.set(value); }, 300);
+  },
+  'click .js-admin-audit-prev'(event, tpl) { tpl.page.set(Math.max(1, tpl.page.get() - 1)); },
+  'click .js-admin-audit-next'(event, tpl) { tpl.page.set(tpl.page.get() + 1); },
+});
@@ -58,6 +58,8 @@ template(name="adminProblems")
            +eventStreamReport(stream="api")
          else if isPane 'report-office'
            +officeReport
+          else if isPane 'report-password-length'
+            +passwordLengthReport
          else if tablePageData
            +tablePage(tablePageData)

@@ -321,6 +321,9 @@ const PROBLEMS_MENU = [
  // Security, and the two sit in the same menu.
  { id: 'report-security', icon: 'fa-shield', labelKey: 'securityReportTitle' },
  { id: 'report-impersonation', icon: 'fa-user-secret', labelKey: 'impersonationReportTitle' },
+  // Who signs in with a password shorter than PASSWORD_MIN_LENGTH, and the two
+  // settings that decide it (passwordLengthReport.js).
+  { id: 'report-password-length', icon: 'fa-key', labelKey: 'password-length-report-title' },
  { id: 'features-performance', icon: 'fa-tachometer', labelKey: 'features-performance', emoji: true },
  { id: 'report-speed', icon: 'fa-tachometer', labelKey: 'speedReportTitle' },
  { id: 'report-tests', icon: 'fa-flask', labelKey: 'testsReportTitle' },
@@ -538,6 +541,8 @@ const SELF_LOADING_PANES = [
  'report-security', 'report-speed', 'report-tests', 'report-cpu', 'report-ram', 'report-disk',
  'report-instrumentation',
  'report-database', 'report-integrity', 'report-office', 'report-api', 'report-mail',
+  // passwordLengthReport.js loads its own rows and settings through methods.
+  'report-password-length',
 ];

 function openReportPane(tmpl, targetID) {
@@ -281,6 +281,17 @@ template(name="attachments")
                      .materialCheckBox#s3-force-path-style(class="{{#if cloudValue.s3.forcePathStyle}}is-checked{{/if}}")
                      span {{_ 's3-force-path-style'}}
                  small.form-text.text-muted {{_ 's3-force-path-style-description'}}
+                //- Encryption at rest (models/lib/s3Encryption.js).
+                .form-group
+                  label(for="s3-sse") {{_ 's3-sse'}}
+                  select.wekan-form-control#s3-sse
+                    option(value="" selected="{{s3SseSelected ''}}") {{_ 's3-sse-none'}}
+                    option(value="AES256" selected="{{s3SseSelected 'AES256'}}") SSE-S3 (AES256)
+                    option(value="aws:kms" selected="{{s3SseSelected 'aws:kms'}}") SSE-KMS (aws:kms)
+                  small.form-text.text-muted {{_ 's3-sse-description'}}
+                .form-group
+                  label(for="s3-sse-kms-key-id") {{_ 's3-sse-kms-key-id'}}
+                  input.wekan-form-control#s3-sse-kms-key-id(type="text" value="{{cloudValue.s3.sseKmsKeyId}}" placeholder="arn:aws:kms:eu-north-1:111122223333:key/…")

                .form-group
                  button.js-test-cloud-connection.btn.btn-secondary(data-provider="s3") {{_ 'test-cloud-connection'}}
@@ -32,6 +32,8 @@ const CLOUD_FIELD_IDS = {
    accessKeyId: '#s3-access-key',
    secretAccessKey: '#s3-secret-key',
    forcePathStyle: '#s3-force-path-style',
+    serverSideEncryption: '#s3-sse',
+    sseKmsKeyId: '#s3-sse-kms-key-id',
  },
  azure: {
    enabled: '#azure-enabled',
@@ -858,6 +860,11 @@ Template.attachments.helpers({
    CLOUD_PROVIDERS.forEach(p => { out[p] = cloudConfigFromSettings(tpl, p).read !== false; });
    return out;
  },
+  // The S3 server-side encryption option that is stored (models/lib/s3Encryption.js).
+  s3SseSelected(mode) {
+    const stored = cloudConfigFromSettings(Template.instance(), 's3').serverSideEncryption || '';
+    return stored === mode ? 'selected' : null;
+  },
  cloudValue() {
    const tpl = Template.instance();
    const s3 = cloudConfigFromSettings(tpl, 's3');
@@ -872,6 +879,8 @@ Template.attachments.helpers({
        bucket: s3.bucket || '',
        accessKeyId: s3.accessKeyId || '',
        forcePathStyle: s3.forcePathStyle !== false,
+        serverSideEncryption: s3.serverSideEncryption || '',
+        sseKmsKeyId: s3.sseKmsKeyId || '',
      },
      azure: {
        accountName: azure.accountName || '',
@@ -0,0 +1,23 @@
+//- Admin Panel / Problems / Password length (docs/Features/Admin-Panel/Problems/Password-length.md):
+//- the minimum, whether it is enforced, and who signs in with a shorter
+//- password - through the shared table page (docs/Features/General/Table.md).
+template(name="passwordLengthReport")
+  ul.setting-detail.password-length-settings
+    li
+      label(for="password-min-length-input") {{_ 'password-min-length'}}
+      input#password-min-length-input.js-password-min-length(type="number" min="1" max="256" value="{{minLength}}")
+      p.description {{_ 'password-min-length-description'}}
+    li
+      a.flex.js-toggle-password-min-length-enforce
+        .materialCheckBox(class="{{#if enforce}}is-checked{{/if}}")
+        span {{_ 'password-min-length-enforce'}}
+      p.description {{_ 'password-min-length-enforce-description'}}
+    li
+      button.primary.js-save-password-length(type="button") {{_ 'save'}}
+      if saved
+        span.password-length-saved {{_ 'password-length-saved'}}
+      if saveError
+        p.error.password-length-error= saveError
+      if fromEnvironment
+        p.description {{_ 'password-length-from-environment'}}
+  +tablePage(tablePageData)
@@ -0,0 +1,157 @@
+import { ReactiveVar } from 'meteor/reactive-var';
+import { Template } from 'meteor/templating';
+import { formatDateForDisplay } from '/client/lib/dateDisplay';
+import { buildFilters, buildHeader, buildRows, pageInfo } from '/models/lib/tablePage';
+import { errorMessage } from '/client/lib/errorMessage';
+
+// Admin Panel / Problems / Password length: the two settings and the table of
+// accounts that sign in with a password shorter than the minimum
+// (server/lib/shortPasswordLogins.js; docs/Features/Admin-Panel/Problems/Password-length.md).
+const { addressValue, locationText, locationFlag } = require('/models/lib/addressReportColumns');
+const { DEFAULT_FILTER } = require('/models/lib/shortPasswordLogins');
+
+const PER_PAGE = 25;
+const formatDate = date => (date ? formatDateForDisplay(date) : '');
+
+// One cell per family: the address, then the city when a CDN in front of
+// WeKan said where it is, and the country's flag before both.
+const addressColumn = (labelKey, family) => ({
+  labelKey,
+  nowrap: true,
+  value: row => [addressValue(row, family), locationText(row, family)].filter(Boolean).join(' '),
+  flag: row => locationFlag(row, family),
+});
+
+const COLUMNS = [
+  { labelKey: 'username', value: row => row.username || row.userId },
+  { labelKey: 'password-length-first-login', nowrap: true, value: row => formatDate(row.firstAt) },
+  addressColumn('event-ipv4', 'ipv4'),
+  addressColumn('event-ipv6', 'ipv6'),
+  { labelKey: 'password-length-last-login', nowrap: true, value: row => formatDate(row.at) },
+  { labelKey: 'password-length-login-count', align: 'end', value: row => row.count || 0 },
+  { labelKey: 'password-length-fixed', nowrap: true, value: row => formatDate(row.fixedAt) },
+];
+
+const FILTER_OPTIONS = [
+  { value: 'short', labelKey: 'password-length-filter-short' },
+  { value: 'fixed', labelKey: 'password-length-filter-fixed' },
+  { value: 'all', labelKey: 'password-length-filter-all' },
+];
+
+Template.passwordLengthReport.onCreated(function () {
+  this.rows = new ReactiveVar([]);
+  this.total = new ReactiveVar(0);
+  this.page = new ReactiveVar(1);
+  this.search = new ReactiveVar('');
+  this.filter = new ReactiveVar(DEFAULT_FILTER);
+  this.sources = new ReactiveVar(null);
+  // The working copy of the two settings, until Save.
+  this.minLength = new ReactiveVar(8);
+  this.enforce = new ReactiveVar(false);
+  this.saved = new ReactiveVar(false);
+  this.error = new ReactiveVar('');
+
+  this.load = () => {
+    Meteor.call('shortPasswordLoginsPage', {
+      filter: this.filter.get(),
+      search: this.search.get() || undefined,
+      limit: PER_PAGE,
+      skip: (this.page.get() - 1) * PER_PAGE,
+    }, (error, result) => {
+      if (error) return;
+      this.rows.set((result && result.rows) || []);
+      this.total.set((result && result.total) || 0);
+    });
+  };
+  this.loadSettings = () => {
+    Meteor.call('getAuthConfigSources', 'login', (error, result) => {
+      if (error || !result) return;
+      this.sources.set(result.sources || {});
+      this.minLength.set(result.sources?.passwordMinLength?.value || 8);
+      this.enforce.set(result.sources?.passwordMinLengthEnforce?.value === true);
+    });
+  };
+  this.load();
+  this.loadSettings();
+});
+
+Template.passwordLengthReport.helpers({
+  minLength() { return Template.instance().minLength.get(); },
+  enforce() { return Template.instance().enforce.get(); },
+  saved() { return Template.instance().saved.get(); },
+  saveError() { return Template.instance().error.get(); },
+  // An environment variable set on the host is overridden by a save here; say
+  // so, rather than let the admin wonder which one is in effect.
+  fromEnvironment() {
+    const sources = Template.instance().sources.get() || {};
+    return ['passwordMinLength', 'passwordMinLengthEnforce'].some(key => sources[key]?.source === 'env');
+  },
+  tablePageData() {
+    const t = Template.instance();
+    const rows = t.rows.get() || [];
+    const info = pageInfo(t.total.get(), t.page.get(), PER_PAGE);
+    return {
+      descKey: 'password-length-report-desc',
+      emptyKey: 'password-length-no-results',
+      searchTerm: t.search.get(),
+      filters: buildFilters([{
+        id: 'password-length-status', labelKey: 'status', current: t.filter.get(), options: FILTER_OPTIONS,
+      }]),
+      header: buildHeader(COLUMNS),
+      rows: buildRows(rows, COLUMNS),
+      rowCount: rows.length,
+      totalCount: t.total.get(),
+      page: info.page,
+      totalPages: info.totalPages,
+      hasPrev: info.hasPrev,
+      hasNext: info.hasNext,
+    };
+  },
+});
+
+Template.passwordLengthReport.events({
+  'input .js-password-min-length'(event, tmpl) {
+    tmpl.minLength.set(parseInt(event.currentTarget.value, 10) || '');
+    tmpl.saved.set(false);
+  },
+  'click .js-toggle-password-min-length-enforce'(event, tmpl) {
+    event.preventDefault();
+    tmpl.enforce.set(!tmpl.enforce.get());
+    tmpl.saved.set(false);
+  },
+  'click .js-save-password-length'(event, tmpl) {
+    event.preventDefault();
+    Meteor.call('saveAuthConfigSettings', 'login', {
+      passwordMinLength: tmpl.minLength.get() || null,
+      passwordMinLengthEnforce: tmpl.enforce.get(),
+    }, error => {
+      tmpl.error.set(error ? errorMessage(error) : '');
+      if (error) return;
+      tmpl.saved.set(true);
+      tmpl.loadSettings();
+    });
+  },
+  'change .js-table-page-filter'(event, tmpl) {
+    tmpl.filter.set(event.currentTarget.value || DEFAULT_FILTER);
+    tmpl.page.set(1);
+    tmpl.load();
+  },
+  'click .js-table-page-prev'(event, tmpl) {
+    event.preventDefault();
+    if (tmpl.page.get() > 1) { tmpl.page.set(tmpl.page.get() - 1); tmpl.load(); }
+  },
+  'click .js-table-page-next'(event, tmpl) {
+    event.preventDefault();
+    const info = pageInfo(tmpl.total.get(), tmpl.page.get(), PER_PAGE);
+    if (info.hasNext) { tmpl.page.set(tmpl.page.get() + 1); tmpl.load(); }
+  },
+  'keydown .js-table-page-search'(event, tmpl) {
+    if (event.keyCode === 13 && !event.shiftKey) {
+      event.preventDefault();
+      event.stopPropagation();
+      tmpl.search.set(event.currentTarget.value || '');
+      tmpl.page.set(1);
+      tmpl.load();
+    }
+  },
+});
@@ -36,6 +36,8 @@ template(name="people")
              +authProviderSettings(loginOptionsData)
              //- Windows SSO, which works only on a Windows server.
              +authProviderSettings(windowsSsoData)
+              //- Strict-Transport-Security, sent when ROOT_URL is https.
+              +authProviderSettings(httpSecurityData)
            else if samlSetting
              +authProviderSettings(samlSettingsData)
            else if authConfigSection
@@ -56,6 +58,8 @@ template(name="people")
              +peopleGeneral(peopleTablePageData)
            else if lockedUsersSetting.get
              +lockedUsersGeneral
+            else if auditLogSetting.get
+              +adminAuditLog
            else if rolesSetting.get
              +rolesGeneral
            else if templatesSetting.get
@@ -142,6 +142,7 @@ Template.people.onCreated(function () {
  this.teamSetting = new ReactiveVar(false);
  this.peopleSetting = new ReactiveVar(false);
  this.lockedUsersSetting = new ReactiveVar(false);
+  this.auditLogSetting = new ReactiveVar(false);
  this.rolesSetting = new ReactiveVar(false);
  this.templatesSetting = new ReactiveVar(false);
  // #5850: Admin Panel > People > Domains tab. The domains table itself
@@ -434,6 +435,7 @@ Template.people.onCreated(function () {
      this.teamSetting.set('team-setting' === targetID);
      this.peopleSetting.set('people-setting' === targetID);
      this.lockedUsersSetting.set('locked-users-setting' === targetID);
+      this.auditLogSetting.set('audit-log-setting' === targetID);
      this.rolesSetting.set('roles-setting' === targetID);
      this.templatesSetting.set('templates-setting' === targetID);
      this.domainSetting.set('domains-setting' === targetID);
@@ -551,6 +553,9 @@ function peopleMenu(user) {
    { id: 'team-setting', icon: 'fa-users', labelKey: 'teams' },
    { id: 'people-setting', icon: 'fa-user', labelKey: 'people' },
    { id: 'locked-users-setting', icon: 'fa-lock', labelKey: 'accounts-lockout-locked-users', iconWrapCls: 'text-red' },
+    // What site administrators did (models/lib/adminAudit.js). Site admins only:
+    // tenantAdminPeopleMenu keeps a per-tenant admin's menu to its own panes.
+    { id: 'audit-log-setting', icon: 'fa-list-alt', labelKey: 'admin-audit-log' },
    { id: 'roles-setting', icon: 'fa-key', labelKey: 'roles' },
    { id: 'templates-setting', icon: 'fa-clone', labelKey: 'shared-templates' },
    { id: 'registration-setting', icon: 'fa-key', labelKey: 'login', emoji: true },
@@ -581,6 +586,15 @@ function peopleMenu(user) {
  return items;
 }

+// A password the server refused (server/lib/passwordPolicy.js), in the
+// reader's language; the popup that sent it has already closed.
+function passwordErrorMessage(error) {
+  const key = error && error.error;
+  if (key === 'password-too-short') return TAPi18n.__('password-too-short', { min: error.details?.min });
+  if (['password-pwned', 'password-same-as-username'].includes(key)) return TAPi18n.__(key);
+  return error.reason || error.message;
+}
+
 // People panes drawn from models/lib/authConfigCatalog.js, and the data the
 // catalog form (authProviderSettings) needs for one section.
 const AUTH_CONFIG_PANES = {
@@ -899,6 +913,8 @@ Template.people.helpers({
  // The Login pane's own login settings (PASSWORD_LOGIN_ENABLED, ...).
  loginOptionsData() { return authConfigData('login'); },
  windowsSsoData() { return authConfigData('windowsSso'); },
+  // HSTS (HSTS_MAX_AGE, ...), below the login settings.
+  httpSecurityData() { return authConfigData('httpSecurity'); },
  ldapPane() { return Template.instance().activeMenuId.get() === 'ldap-setting'; },
  authenticationSection() {
    return {
@@ -927,6 +943,9 @@ Template.people.helpers({
  lockedUsersSetting() {
    return Template.instance().lockedUsersSetting;
  },
+  auditLogSetting() {
+    return Template.instance().auditLogSetting;
+  },
  rolesSetting() {
    return Template.instance().rolesSetting;
  },
@@ -2352,7 +2371,9 @@ Template.editUserPopup.events({
    });

    if (isChangePassword) {
-      Meteor.call('setPassword', password, this.userId);
+      Meteor.call('setPassword', password, this.userId, error => {
+        if (error) alert(passwordErrorMessage(error));
+      });
    }

    if (isChangeEmailVerified) {
@@ -2651,6 +2672,8 @@ Template.newUserPopup.events({
          } else if (errorElement === 'email-already-taken') {
            usernameMessageElement.hide();
            emailMessageElement.show();
+          } else if (String(errorElement).startsWith('password-')) {
+            alert(passwordErrorMessage(error));
          }
        } else {
          usernameMessageElement.hide();
@@ -0,0 +1,27 @@
+/* PASSWORD_MIN_LENGTH: the Change Password form over everything, until done. */
+.password-change-required {
+  position: fixed;
+  inset: 0;
+  z-index: 100000;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  overflow: auto;
+  background: rgba(0, 0, 0, 0.6);
+}
+.password-change-required-box {
+  max-width: 32rem;
+  width: calc(100% - 2rem);
+  margin: 1rem;
+  padding: 1.5rem;
+  border-radius: 6px;
+  background: #fff;
+  color: #222;
+}
+.password-change-required-box h2 {
+  margin-top: 0;
+}
+/* layouts.css hides the password form until a page shows it (#6380). */
+.password-change-required .at-pwd-form {
+  display: block;
+}
@@ -0,0 +1,12 @@
+template(name="passwordChangeRequired")
+  //- PASSWORD_MIN_LENGTH (server/passwordChangeRequired.js): an account whose
+  //- password is shorter than the minimum signed in, and sees only this until
+  //- it has a longer one. The form is the same Change Password Member
+  //- Settings opens; changing it signs every session out, this one too.
+  .password-change-required(role="dialog" aria-modal="true" aria-labelledby="password-change-required-title")
+    .password-change-required-box
+      h2#password-change-required-title {{_ 'password-change-required-title'}}
+      p {{_ 'password-change-required-text' min=min}}
+      +atForm(state='changePwd')
+      .buttonsContainer
+        button.js-password-change-required-logout(type="button") {{_ 'log-out'}}
@@ -0,0 +1,77 @@
+import { Blaze } from 'meteor/blaze';
+import { Template } from 'meteor/templating';
+import { Tracker } from 'meteor/tracker';
+import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
+
+// PASSWORD_MIN_LENGTH: after signing in, ask whether this account must change
+// a password shorter than the minimum, and if so show nothing but the Change
+// Password form (passwordChangeRequired.jade). The server asks the question
+// (server/passwordChangeRequired.js); config/accounts.js tells it when the
+// password just typed was too short. Changing a password signs every session
+// out, so the account then signs in again, with the new password.
+let overlay = null;
+
+function closeOverlay() {
+  if (!overlay) return;
+  Blaze.remove(overlay.view);
+  overlay.node.remove();
+  overlay = null;
+}
+
+function openOverlay(min) {
+  if (overlay) return;
+  const node = document.createElement('div');
+  document.body.appendChild(node);
+  overlay = { node, view: Blaze.renderWithData(Template.passwordChangeRequired, { min }, node) };
+}
+
+Template.passwordChangeRequired.events({
+  'click .js-password-change-required-logout'() {
+    Meteor.logout(() => closeOverlay());
+  },
+});
+
+export function checkPasswordChangeRequirement() {
+  const userId = Meteor.userId();
+  if (!userId) return;
+  Meteor.call('getPasswordChangeRequirement', (error, result) => {
+    if (error || !result || Meteor.userId() !== userId) return;
+    if (result.required) openOverlay(result.minLength);
+  });
+}
+
+// A changed password signs this session out too (server/passwordChangeRequired.js).
+// The server closes the connection as it removes the token, so the answer to
+// the change - and useraccounts' onSubmitHook - may never arrive; being signed
+// out soon after submitting a change is the answer, and the next stop is the
+// sign-in page, from Member Settings and from this overlay alike.
+const SIGN_OUT_WAIT_MS = 2 * 60 * 1000;
+let changeSubmittedAt = 0;
+document.addEventListener('submit', event => {
+  const form = event.target;
+  if (form && form.id === 'at-pwd-form' && form.querySelector('#at-field-current_password')) {
+    changeSubmittedAt = Date.now();
+  }
+}, true);
+
+Meteor.startup(() => {
+  let askedFor = null;
+  Tracker.autorun(() => {
+    const userId = Meteor.userId();
+    if (!userId) {
+      askedFor = null;
+      const changed = Date.now() - changeSubmittedAt < SIGN_OUT_WAIT_MS;
+      if (overlay || changed) {
+        // The change signed every session out: sign in with the new password.
+        changeSubmittedAt = 0;
+        closeOverlay();
+        Popup.close?.();
+        FlowRouter.go('atSignIn');
+      }
+      return;
+    }
+    if (askedFor === userId) return;
+    askedFor = userId;
+    Tracker.nonreactive(checkPasswordChangeRequirement);
+  });
+});
@@ -0,0 +1,23 @@
+/* REQUIRE_2FA: the set-up over everything, until it is done. */
+.two-factor-required {
+  position: fixed;
+  inset: 0;
+  z-index: 100000;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  overflow: auto;
+  background: rgba(0, 0, 0, 0.6);
+}
+.two-factor-required-box {
+  max-width: 32rem;
+  width: calc(100% - 2rem);
+  margin: 1rem;
+  padding: 1.5rem;
+  border-radius: 6px;
+  background: #fff;
+  color: #222;
+}
+.two-factor-required-box h2 {
+  margin-top: 0;
+}
@@ -0,0 +1,13 @@
+template(name="twoFactorRequired")
+  //- REQUIRE_2FA (models/lib/twoFactorRequirement.js): an account that must
+  //- have two-factor authentication sees only this until it has set it up.
+  //- The server refuses everything else meanwhile (server/requireTwoFactor.js);
+  //- this is what the account can do about it. The set-up is the same
+  //- twoFactorAuthPopup Member Settings opens.
+  .two-factor-required(role="dialog" aria-modal="true" aria-labelledby="two-factor-required-title")
+    .two-factor-required-box
+      h2#two-factor-required-title {{_ 'two-factor-required-title'}}
+      p {{_ 'two-factor-required-text'}}
+      +twoFactorAuthPopup
+      .buttonsContainer
+        button.js-two-factor-required-logout(type="button") {{_ 'log-out'}}
@@ -0,0 +1,55 @@
+import { Blaze } from 'meteor/blaze';
+import { Template } from 'meteor/templating';
+import { Tracker } from 'meteor/tracker';
+
+// REQUIRE_2FA: after signing in, ask whether this account must still set up
+// two-factor authentication, and if so show nothing but the set-up
+// (twoFactorRequired.jade). accounts-2fa publishes the account's own
+// services.twoFactorAuthentication.type, so finishing the set-up is seen at
+// once; the page then reloads, because every subscription the server left
+// empty meanwhile has to be made again.
+let overlay = null;
+
+function closeOverlay() {
+  if (!overlay) return;
+  Blaze.remove(overlay.view);
+  overlay.node.remove();
+  overlay = null;
+}
+
+function openOverlay() {
+  if (overlay) return;
+  const node = document.createElement('div');
+  document.body.appendChild(node);
+  overlay = { node, view: Blaze.render(Template.twoFactorRequired, node) };
+}
+
+Template.twoFactorRequired.events({
+  'click .js-two-factor-required-logout'() {
+    Meteor.logout(() => closeOverlay());
+  },
+});
+
+Meteor.startup(() => {
+  let askedFor = null;
+  Tracker.autorun(() => {
+    const userId = Meteor.userId();
+    const user = Meteor.user({ fields: { 'services.twoFactorAuthentication.type': 1 } });
+    if (!userId) {
+      askedFor = null;
+      closeOverlay();
+      return;
+    }
+    const enabled = user?.services?.twoFactorAuthentication?.type === 'otp';
+    if (overlay && enabled) {
+      window.location.reload();
+      return;
+    }
+    if (askedFor === userId) return;
+    askedFor = userId;
+    Meteor.call('getTwoFactorRequirement', (error, result) => {
+      if (error || !result || Meteor.userId() !== userId) return;
+      if (result.required && !result.enabled) openOverlay();
+    });
+  });
+});
@@ -204,3 +204,57 @@ body.mobile-mode.userform-layout {
  #at-meteor-developer, #at-weibo, #at-meetup) {
  display: none;
 }
+
+/* #6835: Member Settings / Change Settings. Its rows are the shared popup list
+   (popup.css: a flex row, every line 33px high, the icon centred), which reads
+   well for one-line items and badly for these: a setting whose words wrap -
+   most of them, in Persian and German - became two 33px lines with its icon
+   floating between them and the next setting right below, with nothing to
+   tell one from the other. Here a row is an icon column, the words, and the
+   check mark at the end; the icon sits on the first line of the words, a
+   wrapped line is an ordinary line high, and a rule divides the rows. Scoped
+   to the list's own class: the member menu before it shares its .pop-over. */
+.pop-over-list.change-settings-list li + li {
+  border-top: 1px solid rgba(0, 0, 0, 0.12);
+}
+.pop-over-list.change-settings-list li > a {
+  align-items: flex-start;
+  gap: 0;
+  line-height: 1.35;
+  padding: 8px 10px;
+}
+.pop-over-list.change-settings-list li > a > i.fa:first-child {
+  flex: 0 0 1.4em;
+  margin-inline-end: 0.6em;
+  line-height: inherit;
+  text-align: center;
+}
+.pop-over-list.change-settings-list li > a > i.fa-check {
+  flex: 0 0 auto;
+  margin-inline-start: auto;
+  padding-inline-start: 0.6em;
+  line-height: inherit;
+}
+.pop-over-list.change-settings-list li > label.bold {
+  display: flex;
+  align-items: flex-start;
+  line-height: 1.35;
+  padding: 8px 10px 4px;
+}
+.pop-over-list.change-settings-list li > label.bold > i.fa {
+  flex: 0 0 1.4em;
+  margin-inline-end: 0.6em;
+  text-align: center;
+  line-height: inherit;
+}
+/* The Card settings checkbox row: the box on the first line of its words,
+   with the same space between them as an icon has. */
+.pop-over-list.change-settings-list .js-rescue-card-description {
+  align-items: flex-start;
+  gap: 0.6em;
+  line-height: 1.35;
+}
+.pop-over-list.change-settings-list .js-rescue-card-description .materialCheckBox {
+  flex: 0 0 auto;
+  margin-top: 0.15em;
+}
@@ -410,7 +410,10 @@ template(name="changeFontPopup")
      a.js-reset-text-color(class="{{#unless hasTextColor}}disabled{{/unless}}") {{_ 'remove-btn'}}

 template(name="changeSettingsPopup")
-  ul.pop-over-list
+  //- #6835: its own class - a popup keeps the screens before it (the member
+    menu) side by side in the same .pop-over, so the popup's data-popup would
+    restyle those too. userForm.css
+  ul.pop-over-list.change-settings-list
    li
      a.js-toggle-desktop-drag-handles
        i.fa.fa-arrows
@@ -1,4 +1,5 @@
 import '/client/components/settings/adminProblems.jade';
+import '/client/components/settings/adminAuditLog.jade';
 import '/client/components/settings/attachments.jade';
 // Backup status and history, shared by Attachments / Backup and Problems / Backup.
 import '/client/components/settings/backupRunsStatus.jade';
@@ -33,6 +34,7 @@ import '/client/components/settings/invitationCode.js';
 // the `collapsed` class either. docs/Features/All-Boards/Left-Menu.md
 import '/client/components/settings/leftMenu.js';
 import '/client/components/settings/lockedUsersBody.js';
+import '/client/components/settings/adminAuditLog.js';
 import '/client/components/settings/migrationProgress.js';
 import '/client/components/settings/notificationSettingsPopup.js';
 // #3695: notification delivery (content, grouping, schedule) per channel, in
@@ -48,6 +50,8 @@ import '/client/components/settings/sharedLabelsSettings.js';
 import '/client/components/settings/settingHeader.js';
 import '/client/components/settings/problemsSummary.jade';
 import '/client/components/settings/problemsSummary.js';
+import '/client/components/settings/passwordLengthReport.jade';
+import '/client/components/settings/passwordLengthReport.js';
 import '/client/components/settings/translationBody.js';

 // adminProblems.css was missing here, so NONE of the Admin Panel report styling
@@ -59,6 +63,7 @@ import '/client/components/settings/adminProblems.css';
 import '/client/components/settings/attachments.css';
 import '/client/components/settings/informationBody.css';
 import '/client/components/settings/lockedUsersBody.css';
+import '/client/components/settings/adminAuditLog.css';
 import '/client/components/settings/migrationProgress.css';
 import '/client/components/settings/peopleBody.css';
 import '/client/components/settings/settingBody.css';
@@ -2,13 +2,19 @@ import '/client/components/users/passwordInput.jade';
 import '/client/components/users/userAvatar.jade';
 import '/client/components/users/userHeader.jade';
 import '/client/components/users/dependencyMenu.jade';
+import '/client/components/users/twoFactorRequired.jade';
+import '/client/components/users/passwordChangeRequired.jade';

 import '/client/components/users/passwordInput.js';
 import '/client/components/users/userAvatar.js';
 import '/client/components/users/userHeader.js';
 import '/client/components/users/dependencyMenu.js';
+import '/client/components/users/twoFactorRequired.js';
+import '/client/components/users/passwordChangeRequired.js';

 import '/client/components/users/userAvatar.css';
 import '/client/components/users/userForm.css';
 import '/client/components/users/dependencyMenu.css';
+import '/client/components/users/twoFactorRequired.css';
+import '/client/components/users/passwordChangeRequired.css';

@@ -0,0 +1,36 @@
+// LOGOUT_IDLE_MINUTES: tell the server, at most once a minute, that the user
+// did something here - a key press, a click, a touch, a scroll - so a session
+// in use is not signed out as idle (models/lib/idleLogout.js). Nothing is sent
+// while the page only sits open, and nothing at all when the limit is off.
+
+const { TOUCH_INTERVAL_MS } = require('../../models/lib/idleLogout');
+
+const EVENTS = ['keydown', 'mousedown', 'touchstart', 'wheel', 'scroll'];
+
+// target: where to listen (document); touch(): report; now(): clock.
+function createIdleActivityReporter({ target, touch, now = () => Date.now(), interval = TOUCH_INTERVAL_MS }) {
+  let last = 0;
+  let listening = false;
+  function onActivity() {
+    const t = now();
+    if (t - last < interval) return;
+    last = t;
+    touch();
+  }
+  return {
+    start() {
+      if (listening) return;
+      listening = true;
+      last = now(); // signing in was the activity that started this
+      for (const name of EVENTS) target.addEventListener(name, onActivity, { capture: true, passive: true });
+    },
+    stop() {
+      if (!listening) return;
+      listening = false;
+      for (const name of EVENTS) target.removeEventListener(name, onActivity, { capture: true });
+    },
+    onActivity,
+  };
+}
+
+module.exports = { createIdleActivityReporter, EVENTS };
@@ -404,10 +404,30 @@ function clickDueDateControl(cardId) {
  control.click();
  return true;
 }
+// #6840: the card's details render a moment AFTER the route names it - a few
+// hundred milliseconds on a slow server. Pressing `d` right after opening a
+// card found no control yet and did nothing, while the previous card's details
+// were still on screen. So the click waits until THIS card's control is there,
+// both for an opened card and for one `d` opens itself (#6755), and clicks it
+// once; it gives up quietly after 3 seconds (no due dates on this board).
+function clickDueDateControlWhenRendered(cardId) {
+  const started = Date.now();
+  const tryClick = () => {
+    if (Utils.getCurrentCardId() !== cardId) return;
+    if (clickDueDateControl(cardId)) return;
+    if (Date.now() - started < 3000) setTimeout(tryClick, 50);
+  };
+  tryClick();
+}
 export function openDueDateEditorOfOpenedCard() {
  if (Meteor.userId() === null) return false;
  const cardId = Utils.getCurrentCardId();
-  if (cardId) return clickDueDateControl(cardId);
+  if (cardId) {
+    const card = ReactiveCache.getCard(cardId);
+    if (!card || !Utils.canModifyCard(card)) return false;
+    clickDueDateControlWhenRendered(cardId);
+    return true;
+  }
  // #6755: with no card opened, `d` on a hovered or selected minicard - the
  // card every other card shortcut here acts on - opens that card and then
  // its Due date editor, rather than doing nothing until the card is opened.
@@ -415,14 +435,7 @@ export function openDueDateEditorOfOpenedCard() {
  const minicard = minicardId && ReactiveCache.getCard(minicardId);
  if (!minicard || !Utils.canModifyCard(minicard)) return false;
  Utils.goCardId(minicardId);
-  // The card details render after the route changes; wait for its control,
-  // and give up quietly if it never comes (no due dates on this board).
-  const started = Date.now();
-  const tryClick = () => {
-    if (Utils.getCurrentCardId() === minicardId && clickDueDateControl(minicardId)) return;
-    if (Date.now() - started < 3000) setTimeout(tryClick, 50);
-  };
-  setTimeout(tryClick, 0);
+  setTimeout(() => clickDueDateControlWhenRendered(minicardId), 0);
  return true;
 }
 hotkeys('d, shift+d', (event) => {
@@ -0,0 +1,55 @@
+// Breached-password check for the forms that set a NEW password - sign-up,
+// Change Password, reset and enrolment (models/lib/passwordPolicy.js says why
+// it is done in the browser). It captures the submit before useraccounts sees
+// it, asks the server for the SHA-1 range of the password - five hex digits,
+// never the password - and replays the submit when the password is not in it.
+//
+// A form that sets a new password is the one with a "password again" or a
+// "current password" field; the sign-in form has neither and is left alone.
+
+const { isPwned, breachLookupDigest } = require('../../models/lib/passwordPolicy');
+
+function isNewPasswordForm(form) {
+  return !!(form && form.id === 'at-pwd-form' && form.querySelector('#at-field-password')
+    && (form.querySelector('#at-field-password_again') || form.querySelector('#at-field-current_password')));
+}
+
+// policy() -> { checkPwned } (cached by the caller); range(prefix) -> Promise
+// of suffixes or null; subtle is crypto.subtle (absent outside a secure
+// context, where the check is skipped); showError(message); replay(form).
+function createNewPasswordSubmitHandler({ policy, range, subtle, showError, replay, pwnedMessage }) {
+  let replaying = false;
+  let pending = false;
+  return async function submit(event) {
+    const form = event.target;
+    if (replaying || !isNewPasswordForm(form) || !policy().checkPwned || !subtle) return;
+    const password = form.querySelector('#at-field-password').value;
+    if (!password) return;
+    event.preventDefault();
+    event.stopImmediatePropagation();
+    if (pending) return;
+    pending = true;
+    try {
+      let breached = false;
+      try {
+        const hex = await breachLookupDigest(password, subtle);
+        const suffixes = await range(hex.slice(0, 5));
+        breached = Array.isArray(suffixes) && isPwned(hex, suffixes);
+      } catch (e) {
+        // An unreachable service must not stop anybody from setting a password.
+        breached = false;
+      }
+      if (breached) {
+        showError(pwnedMessage());
+        return;
+      }
+      await new Promise(resolve => setTimeout(resolve, 0));
+      replaying = true;
+      try { replay(form); } finally { replaying = false; }
+    } finally {
+      pending = false;
+    }
+  };
+}
+
+module.exports = { createNewPasswordSubmitHandler, isNewPasswordForm };
@@ -115,6 +115,63 @@ AccountsTemplates.addFields([
  },
 ]);

+// PASSWORD_MIN_LENGTH and PASSWORD_CHECK_PWNED (models/lib/passwordPolicy.js).
+// useraccounts checks a NEW password's minLength in the browser - sign-up,
+// Change Password, reset, enrolment; never sign-in - and reads it from the
+// field at submit time, so the server's value applies once it has arrived.
+// Unless the minimum is enforced (PASSWORD_MIN_LENGTH_ENFORCE, off by
+// default) the fields keep their own 6.
+// The breached-password check runs before useraccounts sees the submit.
+if (Meteor.isClient) {
+  const passwordPolicy = { minLength: 8, enforce: false, checkPwned: false };
+  Meteor.call('getPasswordPolicy', (error, result) => {
+    if (error || !result) return;
+    Object.assign(passwordPolicy, result);
+    if (!passwordPolicy.enforce) return;
+    for (const id of ['password', 'password_again']) {
+      const field = AccountsTemplates.getField(id);
+      if (field) field.minLength = passwordPolicy.minLength;
+    }
+  });
+  // Signing in is never refused for a short password: it is reported to
+  // Admin Panel / Problems / Password length, and with the minimum enforced the
+  // account is asked to change it (server/passwordChangeRequired.js). Only this
+  // browser knows the length, so it is noted on the sign-in form - the length,
+  // never the password - and compared with the minimum once the login worked.
+  const { isNewPasswordForm } = require('/client/lib/newPasswordCheck');
+  let signInPasswordLength = null;
+  document.addEventListener('submit', event => {
+    const form = event.target;
+    const field = form && form.id === 'at-pwd-form' && form.querySelector('#at-field-password');
+    if (field && !isNewPasswordForm(form)) signInPasswordLength = [...field.value].length;
+  }, true);
+  Accounts.onLogin(() => {
+    const length = signInPasswordLength;
+    signInPasswordLength = null;
+    if (length === null) return;
+    // Asked again: the minimum may have changed since the page loaded.
+    Meteor.call('getPasswordPolicy', (error, result) => {
+      if (error || !result || !(result.minLength > 0) || length >= result.minLength) return;
+      Meteor.call('reportShortPasswordLogin', () => {
+        const { checkPasswordChangeRequirement } = require('/client/components/users/passwordChangeRequired');
+        checkPasswordChangeRequirement();
+      });
+    });
+  });
+  const { createNewPasswordSubmitHandler } = require('/client/lib/newPasswordCheck');
+  document.addEventListener('submit', createNewPasswordSubmitHandler({
+    policy: () => passwordPolicy,
+    range: prefix => Meteor.callAsync('passwordPwnedRange', prefix),
+    subtle: globalThis.crypto && globalThis.crypto.subtle,
+    pwnedMessage: () => tr('password-pwned'),
+    showError(message) {
+      AccountsTemplates.setDisabled(false);
+      AccountsTemplates.state.form.set('error', [message]);
+    },
+    replay: form => form.dispatchEvent(new Event('submit', { bubbles: true, cancelable: true })),
+  }), true);
+}
+
 // The sign-in / register form field labels and placeholders were rendered through
 // accounts-t9n (`T9n.get`), whose per-language coverage is incomplete, and
 // useraccounts' `getPlaceholder()` never invokes a function placeholder (unlike
@@ -333,6 +390,12 @@ AccountsTemplates.configure({
  forbidClientAccountCreation: disableRegistration,
  homeRoutePath: '/',
  onSubmitHook(error, state) {
+    if (!error && state === 'changePwd') {
+      // The server has signed every session of the account out, this one too
+      // (server/passwordChangeRequired.js): sign in with the new password.
+      Meteor.logout(() => FlowRouter.go('atSignIn'));
+      return;
+    }
    if (!error && (state === 'signUp' || state === 'signIn')) {
      hideTwoFactorPrompt();
      goHomeWhenSignedIn();
@@ -76,6 +76,8 @@ services:
    environment:
      DO_NOT_TRACK: "1"
      FERRETDB_TELEMETRY: disable
+      # CVE-2026-98432: no MPTCP listener (Go's default since 1.24).
+      GODEBUG: multipathtcp=0
      # Pin a specific release instead of the newest by setting e.g.
      #   FERRETDB_RELEASE=download/v1.24.2
      FERRETDB_RELEASE: ${FERRETDB_RELEASE:-latest/download}
@@ -906,6 +908,35 @@ services:
      # it too, and its value there wins.
      #- USERS_DISABLE_INACTIVE_AFTER_DAYS=180
      #---------------------------------------------------------------
+      # LOGOUT_IDLE_MINUTES : Sign a browser session out after this many minutes without a key press, click,
+      # touch or scroll. Empty or 0 = off (default). REST API tokens are not affected.
+      #- LOGOUT_IDLE_MINUTES=30
+      #---------------------------------------------------------------
+      # REQUIRE_2FA : Compulsory two-factor authentication for accounts that sign in with a WeKan password:
+      # off (default), admins or all. They must set it up right after signing in.
+      #- REQUIRE_2FA=admins
+      #---------------------------------------------------------------
+      # PASSWORD_MIN_LENGTH : Minimum password length, in characters. Default 8. A sign-in with a shorter
+      # password is listed in Admin Panel / Problems / Password length; nothing is refused unless enforced:
+      #- PASSWORD_MIN_LENGTH=12
+      # PASSWORD_MIN_LENGTH_ENFORCE : true = refuse a shorter new password, and make an account that
+      # signs in with a shorter one change it; the change signs every session out. Off by default.
+      #- PASSWORD_MIN_LENGTH_ENFORCE=true
+      #---------------------------------------------------------------
+      # PASSWORD_CHECK_PWNED : true = refuse a new password found in a known data breach. Off by default.
+      # Only 5 hex digits of its SHA-1 are sent to api.pwnedpasswords.com.
+      #- PASSWORD_CHECK_PWNED=true
+      #---------------------------------------------------------------
+      # HSTS_MAX_AGE : Strict-Transport-Security max-age in seconds, sent only when ROOT_URL is https.
+      # Default 15552000 (180 days). 0 = do not send it.
+      #- HSTS_MAX_AGE=31536000
+      #---------------------------------------------------------------
+      # HSTS_INCLUDE_SUBDOMAINS : true = HSTS covers every subdomain too. Only when ALL of them have HTTPS.
+      #- HSTS_INCLUDE_SUBDOMAINS=false
+      #---------------------------------------------------------------
+      # HSTS_PRELOAD : true = add the preload token (needs includeSubDomains and max-age >= 31536000).
+      #- HSTS_PRELOAD=false
+      #---------------------------------------------------------------
      # BACKUP_KEEP_DAYS : after each successful Admin Panel backup, delete
      # local (filesystem) backups older than this many days; the newest is
      # always kept. Unset or 0 = keep all (default). Admin Panel / Attachments
@@ -78,6 +78,8 @@ services:
    environment:
      DO_NOT_TRACK: "1"
      FERRETDB_TELEMETRY: disable
+      # CVE-2026-98432: no MPTCP listener (Go's default since 1.24).
+      GODEBUG: multipathtcp=0
      # Pin a specific release instead of the newest by setting e.g.
      #   FERRETDB_RELEASE=download/v1.24.2
      FERRETDB_RELEASE: ${FERRETDB_RELEASE:-latest/download}
@@ -908,6 +910,35 @@ services:
      # it too, and its value there wins.
      #- USERS_DISABLE_INACTIVE_AFTER_DAYS=180
      #---------------------------------------------------------------
+      # LOGOUT_IDLE_MINUTES : Sign a browser session out after this many minutes without a key press, click,
+      # touch or scroll. Empty or 0 = off (default). REST API tokens are not affected.
+      #- LOGOUT_IDLE_MINUTES=30
+      #---------------------------------------------------------------
+      # REQUIRE_2FA : Compulsory two-factor authentication for accounts that sign in with a WeKan password:
+      # off (default), admins or all. They must set it up right after signing in.
+      #- REQUIRE_2FA=admins
+      #---------------------------------------------------------------
+      # PASSWORD_MIN_LENGTH : Minimum password length, in characters. Default 8. A sign-in with a shorter
+      # password is listed in Admin Panel / Problems / Password length; nothing is refused unless enforced:
+      #- PASSWORD_MIN_LENGTH=12
+      # PASSWORD_MIN_LENGTH_ENFORCE : true = refuse a shorter new password, and make an account that
+      # signs in with a shorter one change it; the change signs every session out. Off by default.
+      #- PASSWORD_MIN_LENGTH_ENFORCE=true
+      #---------------------------------------------------------------
+      # PASSWORD_CHECK_PWNED : true = refuse a new password found in a known data breach. Off by default.
+      # Only 5 hex digits of its SHA-1 are sent to api.pwnedpasswords.com.
+      #- PASSWORD_CHECK_PWNED=true
+      #---------------------------------------------------------------
+      # HSTS_MAX_AGE : Strict-Transport-Security max-age in seconds, sent only when ROOT_URL is https.
+      # Default 15552000 (180 days). 0 = do not send it.
+      #- HSTS_MAX_AGE=31536000
+      #---------------------------------------------------------------
+      # HSTS_INCLUDE_SUBDOMAINS : true = HSTS covers every subdomain too. Only when ALL of them have HTTPS.
+      #- HSTS_INCLUDE_SUBDOMAINS=false
+      #---------------------------------------------------------------
+      # HSTS_PRELOAD : true = add the preload token (needs includeSubDomains and max-age >= 31536000).
+      #- HSTS_PRELOAD=false
+      #---------------------------------------------------------------
      # BACKUP_KEEP_DAYS : after each successful Admin Panel backup, delete
      # local (filesystem) backups older than this many days; the newest is
      # always kept. Unset or 0 = keep all (default). Admin Panel / Attachments
@@ -71,6 +71,8 @@ services:
    environment:
      DO_NOT_TRACK: "1"
      FERRETDB_TELEMETRY: disable
+      # CVE-2026-98432: no MPTCP listener (Go's default since 1.24).
+      GODEBUG: multipathtcp=0
      # Pin a specific release instead of the newest by setting e.g.
      #   FERRETDB_RELEASE=download/v1.24.2
      FERRETDB_RELEASE: ${FERRETDB_RELEASE:-latest/download}
@@ -895,6 +897,35 @@ services:
      # it too, and its value there wins.
      #- USERS_DISABLE_INACTIVE_AFTER_DAYS=180
      #---------------------------------------------------------------
+      # LOGOUT_IDLE_MINUTES : Sign a browser session out after this many minutes without a key press, click,
+      # touch or scroll. Empty or 0 = off (default). REST API tokens are not affected.
+      #- LOGOUT_IDLE_MINUTES=30
+      #---------------------------------------------------------------
+      # REQUIRE_2FA : Compulsory two-factor authentication for accounts that sign in with a WeKan password:
+      # off (default), admins or all. They must set it up right after signing in.
+      #- REQUIRE_2FA=admins
+      #---------------------------------------------------------------
+      # PASSWORD_MIN_LENGTH : Minimum password length, in characters. Default 8. A sign-in with a shorter
+      # password is listed in Admin Panel / Problems / Password length; nothing is refused unless enforced:
+      #- PASSWORD_MIN_LENGTH=12
+      # PASSWORD_MIN_LENGTH_ENFORCE : true = refuse a shorter new password, and make an account that
+      # signs in with a shorter one change it; the change signs every session out. Off by default.
+      #- PASSWORD_MIN_LENGTH_ENFORCE=true
+      #---------------------------------------------------------------
+      # PASSWORD_CHECK_PWNED : true = refuse a new password found in a known data breach. Off by default.
+      # Only 5 hex digits of its SHA-1 are sent to api.pwnedpasswords.com.
+      #- PASSWORD_CHECK_PWNED=true
+      #---------------------------------------------------------------
+      # HSTS_MAX_AGE : Strict-Transport-Security max-age in seconds, sent only when ROOT_URL is https.
+      # Default 15552000 (180 days). 0 = do not send it.
+      #- HSTS_MAX_AGE=31536000
+      #---------------------------------------------------------------
+      # HSTS_INCLUDE_SUBDOMAINS : true = HSTS covers every subdomain too. Only when ALL of them have HTTPS.
+      #- HSTS_INCLUDE_SUBDOMAINS=false
+      #---------------------------------------------------------------
+      # HSTS_PRELOAD : true = add the preload token (needs includeSubDomains and max-age >= 31536000).
+      #- HSTS_PRELOAD=false
+      #---------------------------------------------------------------
      # BACKUP_KEEP_DAYS : after each successful Admin Panel backup, delete
      # local (filesystem) backups older than this many days; the newest is
      # always kept. Unset or 0 = keep all (default). Admin Panel / Attachments
@@ -89,6 +89,8 @@ services:
    environment:
      DO_NOT_TRACK: "1"
      FERRETDB_TELEMETRY: disable
+      # CVE-2026-98432: no MPTCP listener (Go's default since 1.24).
+      GODEBUG: multipathtcp=0
      # Pin a specific release instead of the newest by setting e.g.
      #   FERRETDB_RELEASE=download/v1.24.2
      FERRETDB_RELEASE: ${FERRETDB_RELEASE:-latest/download}
@@ -912,6 +914,35 @@ services:
      # it too, and its value there wins.
      #- USERS_DISABLE_INACTIVE_AFTER_DAYS=180
      #---------------------------------------------------------------
+      # LOGOUT_IDLE_MINUTES : Sign a browser session out after this many minutes without a key press, click,
+      # touch or scroll. Empty or 0 = off (default). REST API tokens are not affected.
+      #- LOGOUT_IDLE_MINUTES=30
+      #---------------------------------------------------------------
+      # REQUIRE_2FA : Compulsory two-factor authentication for accounts that sign in with a WeKan password:
+      # off (default), admins or all. They must set it up right after signing in.
+      #- REQUIRE_2FA=admins
+      #---------------------------------------------------------------
+      # PASSWORD_MIN_LENGTH : Minimum password length, in characters. Default 8. A sign-in with a shorter
+      # password is listed in Admin Panel / Problems / Password length; nothing is refused unless enforced:
+      #- PASSWORD_MIN_LENGTH=12
+      # PASSWORD_MIN_LENGTH_ENFORCE : true = refuse a shorter new password, and make an account that
+      # signs in with a shorter one change it; the change signs every session out. Off by default.
+      #- PASSWORD_MIN_LENGTH_ENFORCE=true
+      #---------------------------------------------------------------
+      # PASSWORD_CHECK_PWNED : true = refuse a new password found in a known data breach. Off by default.
+      # Only 5 hex digits of its SHA-1 are sent to api.pwnedpasswords.com.
+      #- PASSWORD_CHECK_PWNED=true
+      #---------------------------------------------------------------
+      # HSTS_MAX_AGE : Strict-Transport-Security max-age in seconds, sent only when ROOT_URL is https.
+      # Default 15552000 (180 days). 0 = do not send it.
+      #- HSTS_MAX_AGE=31536000
+      #---------------------------------------------------------------
+      # HSTS_INCLUDE_SUBDOMAINS : true = HSTS covers every subdomain too. Only when ALL of them have HTTPS.
+      #- HSTS_INCLUDE_SUBDOMAINS=false
+      #---------------------------------------------------------------
+      # HSTS_PRELOAD : true = add the preload token (needs includeSubDomains and max-age >= 31536000).
+      #- HSTS_PRELOAD=false
+      #---------------------------------------------------------------
      # BACKUP_KEEP_DAYS : after each successful Admin Panel backup, delete
      # local (filesystem) backups older than this many days; the newest is
      # always kept. Unset or 0 = keep all (default). Admin Panel / Attachments
@@ -43,6 +43,8 @@ services:
    restart: always
    environment:
      FERRETDB_POSTGRESQL_URL: postgres://ferretdb:${FERRETDB_POSTGRES_PASSWORD:-ferretdb_secret}@postgres-documentdb/postgres
+      # CVE-2026-98432: no MPTCP listener (Go's default since 1.24).
+      GODEBUG: multipathtcp=0
    depends_on:
      - postgres-documentdb
    networks:
@@ -818,6 +820,35 @@ services:
      # it too, and its value there wins.
      #- USERS_DISABLE_INACTIVE_AFTER_DAYS=180
      #---------------------------------------------------------------
+      # LOGOUT_IDLE_MINUTES : Sign a browser session out after this many minutes without a key press, click,
+      # touch or scroll. Empty or 0 = off (default). REST API tokens are not affected.
+      #- LOGOUT_IDLE_MINUTES=30
+      #---------------------------------------------------------------
+      # REQUIRE_2FA : Compulsory two-factor authentication for accounts that sign in with a WeKan password:
+      # off (default), admins or all. They must set it up right after signing in.
+      #- REQUIRE_2FA=admins
+      #---------------------------------------------------------------
+      # PASSWORD_MIN_LENGTH : Minimum password length, in characters. Default 8. A sign-in with a shorter
+      # password is listed in Admin Panel / Problems / Password length; nothing is refused unless enforced:
+      #- PASSWORD_MIN_LENGTH=12
+      # PASSWORD_MIN_LENGTH_ENFORCE : true = refuse a shorter new password, and make an account that
+      # signs in with a shorter one change it; the change signs every session out. Off by default.
+      #- PASSWORD_MIN_LENGTH_ENFORCE=true
+      #---------------------------------------------------------------
+      # PASSWORD_CHECK_PWNED : true = refuse a new password found in a known data breach. Off by default.
+      # Only 5 hex digits of its SHA-1 are sent to api.pwnedpasswords.com.
+      #- PASSWORD_CHECK_PWNED=true
+      #---------------------------------------------------------------
+      # HSTS_MAX_AGE : Strict-Transport-Security max-age in seconds, sent only when ROOT_URL is https.
+      # Default 15552000 (180 days). 0 = do not send it.
+      #- HSTS_MAX_AGE=31536000
+      #---------------------------------------------------------------
+      # HSTS_INCLUDE_SUBDOMAINS : true = HSTS covers every subdomain too. Only when ALL of them have HTTPS.
+      #- HSTS_INCLUDE_SUBDOMAINS=false
+      #---------------------------------------------------------------
+      # HSTS_PRELOAD : true = add the preload token (needs includeSubDomains and max-age >= 31536000).
+      #- HSTS_PRELOAD=false
+      #---------------------------------------------------------------
      # BACKUP_KEEP_DAYS : after each successful Admin Panel backup, delete
      # local (filesystem) backups older than this many days; the newest is
      # always kept. Unset or 0 = keep all (default). Admin Panel / Attachments
@@ -152,6 +152,8 @@ services:
  #  environment:
  #    # FerretDB stores everything in PostgreSQL
  #    - FERRETDB_POSTGRESQL_URL=postgresql://wekan:wekan@wekan-postgres:5432/wekan
+  #    # CVE-2026-98432: no MPTCP listener (Go's default since 1.24)
+  #    - GODEBUG=multipathtcp=0
  #    # Emulate MongoDB replica-set for Meteor OpLog (real-time updates)
  #    - FERRETDB_REPLICATION_SET_NAME=rs0
  #    # Suppress verbose debug output
@@ -1049,6 +1051,35 @@ services:
      # it too, and its value there wins.
      #- USERS_DISABLE_INACTIVE_AFTER_DAYS=180
      #---------------------------------------------------------------
+      # LOGOUT_IDLE_MINUTES : Sign a browser session out after this many minutes without a key press, click,
+      # touch or scroll. Empty or 0 = off (default). REST API tokens are not affected.
+      #- LOGOUT_IDLE_MINUTES=30
+      #---------------------------------------------------------------
+      # REQUIRE_2FA : Compulsory two-factor authentication for accounts that sign in with a WeKan password:
+      # off (default), admins or all. They must set it up right after signing in.
+      #- REQUIRE_2FA=admins
+      #---------------------------------------------------------------
+      # PASSWORD_MIN_LENGTH : Minimum password length, in characters. Default 8. A sign-in with a shorter
+      # password is listed in Admin Panel / Problems / Password length; nothing is refused unless enforced:
+      #- PASSWORD_MIN_LENGTH=12
+      # PASSWORD_MIN_LENGTH_ENFORCE : true = refuse a shorter new password, and make an account that
+      # signs in with a shorter one change it; the change signs every session out. Off by default.
+      #- PASSWORD_MIN_LENGTH_ENFORCE=true
+      #---------------------------------------------------------------
+      # PASSWORD_CHECK_PWNED : true = refuse a new password found in a known data breach. Off by default.
+      # Only 5 hex digits of its SHA-1 are sent to api.pwnedpasswords.com.
+      #- PASSWORD_CHECK_PWNED=true
+      #---------------------------------------------------------------
+      # HSTS_MAX_AGE : Strict-Transport-Security max-age in seconds, sent only when ROOT_URL is https.
+      # Default 15552000 (180 days). 0 = do not send it.
+      #- HSTS_MAX_AGE=31536000
+      #---------------------------------------------------------------
+      # HSTS_INCLUDE_SUBDOMAINS : true = HSTS covers every subdomain too. Only when ALL of them have HTTPS.
+      #- HSTS_INCLUDE_SUBDOMAINS=false
+      #---------------------------------------------------------------
+      # HSTS_PRELOAD : true = add the preload token (needs includeSubDomains and max-age >= 31536000).
+      #- HSTS_PRELOAD=false
+      #---------------------------------------------------------------
      # BACKUP_KEEP_DAYS : after each successful Admin Panel backup, delete
      # local (filesystem) backups older than this many days; the newest is
      # always kept. Unset or 0 = keep all (default). Admin Panel / Attachments
@@ -52,6 +52,8 @@ services:
    environment:
      DO_NOT_TRACK: "1"
      FERRETDB_TELEMETRY: disable
+      # CVE-2026-98432: no MPTCP listener (Go's default since 1.24).
+      GODEBUG: multipathtcp=0
      # Follow the newest published release. A specific download/vX.Y.Z remains
      # available for rollback; the marker below upgrades an older cached binary.
      FERRETDB_RELEASE: ${FERRETDB_RELEASE:-latest/download}
@@ -893,6 +895,35 @@ services:
      # it too, and its value there wins.
      #- USERS_DISABLE_INACTIVE_AFTER_DAYS=180
      #---------------------------------------------------------------
+      # LOGOUT_IDLE_MINUTES : Sign a browser session out after this many minutes without a key press, click,
+      # touch or scroll. Empty or 0 = off (default). REST API tokens are not affected.
+      #- LOGOUT_IDLE_MINUTES=30
+      #---------------------------------------------------------------
+      # REQUIRE_2FA : Compulsory two-factor authentication for accounts that sign in with a WeKan password:
+      # off (default), admins or all. They must set it up right after signing in.
+      #- REQUIRE_2FA=admins
+      #---------------------------------------------------------------
+      # PASSWORD_MIN_LENGTH : Minimum password length, in characters. Default 8. A sign-in with a shorter
+      # password is listed in Admin Panel / Problems / Password length; nothing is refused unless enforced:
+      #- PASSWORD_MIN_LENGTH=12
+      # PASSWORD_MIN_LENGTH_ENFORCE : true = refuse a shorter new password, and make an account that
+      # signs in with a shorter one change it; the change signs every session out. Off by default.
+      #- PASSWORD_MIN_LENGTH_ENFORCE=true
+      #---------------------------------------------------------------
+      # PASSWORD_CHECK_PWNED : true = refuse a new password found in a known data breach. Off by default.
+      # Only 5 hex digits of its SHA-1 are sent to api.pwnedpasswords.com.
+      #- PASSWORD_CHECK_PWNED=true
+      #---------------------------------------------------------------
+      # HSTS_MAX_AGE : Strict-Transport-Security max-age in seconds, sent only when ROOT_URL is https.
+      # Default 15552000 (180 days). 0 = do not send it.
+      #- HSTS_MAX_AGE=31536000
+      #---------------------------------------------------------------
+      # HSTS_INCLUDE_SUBDOMAINS : true = HSTS covers every subdomain too. Only when ALL of them have HTTPS.
+      #- HSTS_INCLUDE_SUBDOMAINS=false
+      #---------------------------------------------------------------
+      # HSTS_PRELOAD : true = add the preload token (needs includeSubDomains and max-age >= 31536000).
+      #- HSTS_PRELOAD=false
+      #---------------------------------------------------------------
      # BACKUP_KEEP_DAYS : after each successful Admin Panel backup, delete
      # local (filesystem) backups older than this many days; the newest is
      # always kept. Unset or 0 = keep all (default). Admin Panel / Attachments
@@ -329,15 +329,20 @@ docker compose up -d
 # Backup Wekan Snap to directory dump
 ```bash
 sudo snap stop wekan.wekan
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan/current/lib/x86_64-linux-gnu
-export PATH="/snap/wekan/current/bin:$PATH"
+S=/snap; [ -d /snap/wekan ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan/current/lib/$(uname -m)-linux-gnu"
+export PATH="$S/wekan/current/bin:$PATH"
 mongodump --port 27019
 sudo snap get wekan > snap-settings.sh
 ```
-NOTE for Arch Linux: Use this path instead. [Source](https://github.com/wekan/wekan/issues/3941).
-```bash
-export LD_LIBRARY_PATH=${LD_LIBRARY_PATH-}:/var/lib/snapd/snap/wekan/current/lib/x86_64-linux-gnu
-```
+The `S=` line picks where snapd keeps the snaps on this host. Ubuntu and Debian
+have `/snap`; Fedora, RHEL, AlmaLinux, Rocky Linux, CentOS Stream and Arch Linux
+keep them in `/var/lib/snapd/snap` and have no `/snap` unless somebody has made
+the symlink (`sudo ln -s /var/lib/snapd/snap /snap`). The data is in
+`/var/snap/wekan/common` on all of them. `$(uname -m)` picks the library
+directory of the CPU: `x86_64-linux-gnu` on amd64, `aarch64-linux-gnu` on arm64.
+[Arch Linux report](https://github.com/wekan/wekan/issues/3941).
+
 username is your /home/username
 ```bash
 sudo chown username:username snap-settings.sh
@@ -355,8 +360,9 @@ chmod +x snap-settings.sh
 # Restore Wekan Snap
 ```bash
 sudo snap stop wekan.wekan
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan/current/lib/x86_64-linux-gnu
-export PATH="$PATH:/snap/wekan/current/bin"
+S=/snap; [ -d /snap/wekan ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan/current/lib/$(uname -m)-linux-gnu"
+export PATH="$PATH:$S/wekan/current/bin"
 mongorestore --drop --port 27019
 sudo snap start wekan.wekan
 ./snap-settings.sh
@@ -454,8 +460,9 @@ sudo snap refresh
 # Backup Wekan Gantt GPLv2 Snap to directory dump
 ```bash
 sudo snap stop wekan-gantt-gpl.wekan
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan-gantt-gpl/current/lib/x86_64-linux-gnu
-export PATH="$PATH:/snap/wekan-gantt-gpl/current/bin"
+S=/snap; [ -d /snap/wekan-gantt-gpl ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan-gantt-gpl/current/lib/$(uname -m)-linux-gnu"
+export PATH="$PATH:$S/wekan-gantt-gpl/current/bin"
 mongodump --port 27019
 sudo snap get wekan-gantt-gpl > snap-settings.sh
 ```
@@ -476,8 +483,9 @@ chmod +x snap-settings.sh
 # Restore Wekan Gantt GPLv2 Snap
 ```bash
 sudo snap stop wekan-gantt-gpl.wekan
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan-gantt-gpl/current/lib/x86_64-linux-gnu
-export PATH="$PATH:/snap/wekan-gantt-gpl/current/bin"
+S=/snap; [ -d /snap/wekan-gantt-gpl ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan-gantt-gpl/current/lib/$(uname -m)-linux-gnu"
+export PATH="$PATH:$S/wekan-gantt-gpl/current/bin"
 mongorestore --drop --port 27019
 sudo snap start wekan-gantt-gpl.wekan
 ./snap-settings.sh
@@ -820,8 +828,9 @@ You could use [daff](https://github.com/paulfitz/daff) to compare tables.

 Add to your `~/.bashrc`
 ```bash
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan/current/lib/x86_64-linux-gnu
-export PATH="$PATH:/snap/wekan/current/bin"
+S=/snap; [ -d /snap/wekan ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan/current/lib/$(uname -m)-linux-gnu"
+export PATH="$PATH:$S/wekan/current/bin"
 ```
 Then you can backup:
 ```bash
@@ -838,7 +847,8 @@ mongoshell.sh
 ```bash
 #/bin/bash
 export LC_ALL=C
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan/current/lib/x86_64-linux-gnu
+S=/snap; [ -d /snap/wekan ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan/current/lib/$(uname -m)-linux-gnu"
 version=$(snap list | grep wekan | awk -F ' ' '{print $3}')
 mongo=$"/snap/wekan/$version/bin/mongo"
 $mongo --port 27019
@@ -856,7 +866,8 @@ wekan-backup.sh
 ```bash
 #!/bin/bash
 export LC_ALL=C
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan/current/lib/x86_64-linux-gnu
+S=/snap; [ -d /snap/wekan ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan/current/lib/$(uname -m)-linux-gnu"

 version=$(snap list | grep wekan | awk -F ' ' '{print $3}')
 now=$(date +"%Y%m%d-%H%M%S")
@@ -907,7 +918,8 @@ wekan-restore.sh
 ```bash
 #!/bin/bash
 export LC_ALL=C
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan/current/lib/x86_64-linux-gnu
+S=/snap; [ -d /snap/wekan ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan/current/lib/$(uname -m)-linux-gnu"

 makesRestore()
 {
@@ -5,9 +5,10 @@ sudo su

 snap stop wekan

-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan/current/lib/x86_64-linux-gnu
+S=/snap; [ -d /snap/wekan ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan/current/lib/$(uname -m)-linux-gnu"

-export PATH="/snap/wekan/current/bin:$PATH"
+export PATH="$S/wekan/current/bin:$PATH"

 mongod --dbpath "/var/snap/wekan/common" --repair >> /root/repairlog.txt

@@ -51,7 +51,8 @@ export PATH="/snap/wekan/current/migratemongo/bin:$PATH"
 export LD_LIBRARY_PATH="/snap/wekan/current/migratemongo/lib:$LD_LIBRARY_PATH"

 # MongoDB 7.x (default)
-export PATH="/snap/wekan/current/bin:$PATH"
+S=/snap; [ -d /snap/wekan ] || S=/var/lib/snapd/snap
+export PATH="$S/wekan/current/bin:$PATH"
 export LD_LIBRARY_PATH="/snap/wekan/current/usr/lib:$LD_LIBRARY_PATH"
 ```

@@ -257,7 +257,9 @@ plugin npm dependencies. `METEOR_PROFILE` defaults to 100 milliseconds, exposing
 Meteor tool timing diagnostics when available. Profiling output may appear only
 when a measured operation finishes; elapsed status still appears while it is quiet.

-During builds, Node module debugging prints module resolution as it happens. The
+Node module debugging, which prints every module resolution as it happens, is
+off unless `WEKAN_BUILD_TRACE_MODULES=1` is set: a Meteor build writes that trace
+at gigabytes a minute (1.1 GB in the first three minutes of a dev build). The
 local `tools/build-command-output.cjs` preload prints resolver subprocess commands
 and echoes their captured stdout and stderr while preserving exit codes and callback
 results. Both terminal and build log receive this output. Command arguments redact
@@ -1,6 +1,6 @@
-# Adding a "# Upcoming WeKan ® release" section to CHANGELOG.md
+# Adding a "# Upcoming WeKan ® release" section to CHANGELOG-big.md

-`CHANGELOG.md` does **not** carry an empty `# Upcoming WeKan ® release`
+`CHANGELOG-big.md` does **not** carry an empty `# Upcoming WeKan ® release`
 placeholder between releases. `releases/release-all.sh` used to auto-create one
 immediately after every release, with an `**In short:** nothing here yet.`
 paragraph — so the file always had a section that said nothing, sitting there
@@ -22,7 +22,7 @@ for years this page described four directories out of twenty and did not say so.
 | [sandstorm-src/](../../sandstorm-src) | the Sandstorm package |
 | [openapi/](../../openapi) | the REST API description, generated from the routes |
 | [meta/](../../meta) | signatures, icons, screenshots, project description |
-| [old-CHANGELOG/](../../old-CHANGELOG) | the CHANGELOG's history, by year and by month, a busy month in parts (`CHANGELOG.md` holds the newest releases that fit GitHub's 500 KiB Markdown limit) |
+| [old-CHANGELOG/](../../old-CHANGELOG) | the CHANGELOG's history, by year and by month, a busy month in parts (`CHANGELOG-big.md` holds the Status, the upcoming release and the newest releases that fit GitHub's 500 KiB Markdown limit; `CHANGELOG.md` only the In short of the upcoming release and the five newest) |
 | `.tools/` | NOT part of this repository: the companion repos and toolchains a build needs, ignored by git and by Meteor |
 | `node_modules/`, `.meteor/`, `.build/`, `_build/` | generated; never edited, never committed |

@@ -273,7 +273,10 @@ Other files:
  * **[translations/](../../releases/translations)** - the Transifex pull and the
    per-key merge that never overwrites a human translation.
  * **[changelog-archive.mjs](../../releases/changelog-archive.mjs)** - moves
-    finished months out of `CHANGELOG.md` into `old-CHANGELOG/`.
+    finished months out of `CHANGELOG-big.md` into `old-CHANGELOG/`.
+  * **[changelog-short.mjs](../../releases/changelog-short.mjs)** - writes
+    `CHANGELOG.md`, the In short of the upcoming release and the five newest,
+    from `CHANGELOG-big.md`.
 * **[tests/](../../tests)** - `*.test.cjs` suites run by
  **[run-node-suites.cjs](../../tests/run-node-suites.cjs)** (all of them, with
  every failure listed at the end), plus the Playwright browser tests and the
@@ -286,7 +289,8 @@ Other files:
 # Info

 * **[meta](../../meta)**: binary signatures, project description, icons, screenshots and, oui, a French change-log;
-* **[CHANGELOG.md](../../CHANGELOG.md)**;
+* **[CHANGELOG.md](../../CHANGELOG.md)** - the upcoming release and the five newest, in short, and
+  **[CHANGELOG-big.md](../../CHANGELOG-big.md)** - every change, the upcoming release and the status;
 * **[Contributing.md](../../CONTRIBUTING.md)**;
 * **[LICENSE](../../LICENSE)**;
 * **[README.md](../../README.md)**.
@@ -58,6 +58,7 @@ OAuth providers and Passwordless login each have their own menu entry.
 | `/admin/people/organizations` | Organizations | `org-setting` |
 | `/admin/people/teams` | Teams | `team-setting` |
 | `/admin/people/locked-users` | Locked Users | `locked-users-setting` |
+| `/admin/people/audit-log` | Audit log | `audit-log-setting` |
 | `/admin/people/roles` | Roles | `roles-setting` |
 | `/admin/people/shared-templates` | Shared templates | `templates-setting` |
 | `/admin/people/login` | Login | `registration-setting` |
@@ -80,6 +81,7 @@ OAuth providers and Passwordless login each have their own menu entry.
 | `/admin/problems/backup` | Backup (status and history; settings stay in Attachments / Backup) | `features-backup` |
 | `/admin/problems/security-report` | Security Report | `report-security` |
 | `/admin/problems/impersonation` | Impersonation Report | `report-impersonation` |
+| `/admin/problems/password-length` | Password length | `report-password-length` |
 | `/admin/problems/performance` | Performance | `features-performance` |
 | `/admin/problems/speed` | Speed | `report-speed` |
 | `/admin/problems/tests` | Tests | `report-tests` |
@@ -0,0 +1,22 @@
+# People / Audit log
+
+`/admin/people/audit-log`, site administrators only.
+
+Every administrative action of a site administrator, newest first, one row
+each: when, who, which action, whether it succeeded (a refused call is shown
+too, with its error), its arguments and the address it came from. The search
+box matches the administrator, the action and the arguments.
+
+What is recorded: changes to people (Add user, Set password, username, email,
+admin and active flags, removing a user, impersonation, unlocking), to
+organizations and teams, to login and site settings, to attachment storage,
+and backups, restores and data repairs. An administrator editing cards is a
+member editing cards and is not recorded. The list of actions is
+`AUDITED_METHODS` in `models/lib/adminAudit.js`.
+
+A password or a secret is never recorded: values under a credential-named key,
+the arguments that are a password by position and a password inside a URL are
+shown as `[redacted]`.
+
+Entries are kept for a year and then removed. Attacks WeKan refused are in
+Admin Panel / Problems instead; see [Security settings](../../../Security/Security-Settings.md).
@@ -19,6 +19,7 @@ Who may sign in, who they belong to, and what they may do — in menu order.
 | People / Teams | `teams` | [Teams.md](Teams.md) | Teams, their per-team switches, and the same-Team board restriction. |
 | People / People | `people` | [People.md](People.md) | Every user: e-mail, admin flag, active state, lockout, created date. |
 | People / Locked Users | `locked-users` | [Locked-Users.md](Locked-Users.md) | Brute-force protection settings and who is locked out. |
+| People / Audit log | `audit-log` | [Audit-Log.md](Audit-Log.md) | What site administrators did, newest first; kept for a year. |
 | People / Roles | `roles` | [Roles.md](Roles.md) | Which board roles may invite people to a board. |
 | People / Shared templates | `shared-templates` | [Shared-Templates.md](Shared-Templates.md) | Which scopes may share template boards. |

@@ -0,0 +1,83 @@
+# Admin Panel / Problems / Password length
+
+Who signs in with a password shorter than the minimum length, from where, and
+whether they have changed it since. The URL is `/admin/problems/password-length`.
+
+## Settings
+
+Above the table, with one **Save** button:
+
+| Setting | Environment variable | Default | What it does |
+| --- | --- | --- | --- |
+| Minimum password length | `PASSWORD_MIN_LENGTH` | `8` | A sign-in with a shorter password is listed in the table below. Nothing is refused for it. |
+| Enforce the minimum length | `PASSWORD_MIN_LENGTH_ENFORCE` | off | A shorter **new** password is refused (sign-up, Change Password, reset, enrolment, an administrator's Set password and Add user, `POST /users/register`), and an account that signs in with an older shorter password sees only **Change your password** until it has a long enough one. |
+
+Both are also in **Admin Panel / People / Login**, and saving either page saves
+the same setting. A value saved here overrides the environment variable; the
+page says so when an environment variable is set.
+
+**Signing in is never refused** for a short password, enforced or not: nobody
+is locked out by a minimum set after their password was. Changing a password -
+forced or not, in Member Settings or with a reset link - signs **every** session
+of the account out, the one that changed it too, and the account then signs in
+with the new password.
+
+LDAP, OAuth2, OIDC, SAML, CAS and Sandstorm accounts are neither listed nor
+asked: their password is their provider's, and so is its policy.
+
+## The table
+
+One row per account, never one per sign-in, like every Problems report: an
+account that signs in every day is one row whose count grows.
+
+| Column | What it shows |
+| --- | --- |
+| Username | The account. |
+| First login | The first time it signed in with a password shorter than the minimum. |
+| IPv4 address | The latest IPv4 address it did so from, with the country's flag and the city when a CDN or proxy in front of WeKan said where the address is. |
+| IPv6 address | The same for IPv6. |
+| Last login | The latest time it signed in with a short password. |
+| Times logged in | How many times it has. |
+| Fixed | When its password was changed. Empty while it is still too short. |
+
+The filter above the table, as on every [table page](../../General/Table.md):
+
+| Filter | Shows |
+| --- | --- |
+| **Too short password** (default) | Accounts that still have a short password. |
+| **Fixed to long enough password** | Accounts that changed theirs. |
+| **All** | Both. |
+
+The search box matches the username and the addresses.
+
+## How WeKan knows a password is short
+
+Meteor sends a password to the server hashed, so the server never sees how long
+it is. The browser that typed it does: after a sign-in that worked, it compares
+the length with the minimum and, when it is shorter, tells the server "this one
+was short" - never the password and never its length.
+
+The same is true of a password changed through a form, so **Fixed** means the
+password was changed and the account has not signed in with a short one since.
+An account that changes its password to another short one is listed as too short
+again the next time it signs in. An administrator's Set password is the one
+change the server can measure, so a short one set there does not count as fixed.
+
+Where an address is comes only from headers a CDN or proxy in front of WeKan sets
+(`models/lib/geoHeaders.js`). WeKan sends no address to a geolocation service,
+and the location is for display only - nothing is decided by it.
+
+## Related files
+
+| File | What it is |
+| --- | --- |
+| `models/lib/passwordPolicy.js` | The minimum, whether it is enforced, and which new passwords are refused. |
+| `models/lib/shortPasswordLogins.js` | What a row is, the filter, and how one more short sign-in updates a row. |
+| `models/shortPasswordLogins.js` | The collection. |
+| `server/lib/shortPasswordLogins.js` | Recording a short sign-in, marking it fixed, and one page of the table. |
+| `server/passwordChangeRequired.js` | The browser's report, the forced change, and signing every session out after a change. |
+| `client/components/settings/passwordLengthReport.*` | This page. |
+| `client/components/users/passwordChangeRequired.*` | **Change your password**, shown over everything while the change is required. |
+| `config/accounts.js` | Where the browser notes the length on the sign-in form and reports a short one. |
+| `tests/passwordPolicy.test.cjs`, `tests/passwordChangeRequired.test.cjs`, `tests/shortPasswordLogins.test.cjs` | Node tests. |
+| `tests/playwright/specs/password-min-length-signup-login.e2e.js`, `tests/playwright/specs/password-length-report.e2e.js` | Browser tests. |
@@ -64,7 +64,7 @@ unsafe or noisy:
  failed or overdue backup is also listed on Summary
  ([Backup.md](../../../Backup/Backup.md)).

-**Reports** — Security Report, Impersonation Report, Performance, Speed, Tests, CPU
+**Reports** — Security Report, Impersonation Report, Password length, Performance, Speed, Tests, CPU
 usage, Instrumentation, Broken Cards, Files Report, Rules Report, Boards Report,
 Cards Report, Recovery, Offices, API, Database problems, Filesystem integrity and
 Email.
@@ -127,6 +127,7 @@ the address uses: `/admin/problems/<slug>`.
 | Problems / Backup | `backup` | [Backup.md](../../../Backup/Backup.md#did-the-backup-work-history-health-and-monitoring) |
 | Problems / Security Report | `security-report` | — |
 | Problems / Impersonation Report | `impersonation` | — |
+| Problems / Password length | `password-length` | [Password-length.md](Password-length.md) |
 | Problems / Performance | `performance` | — |
 | Problems / Speed | `speed` | — |
 | Problems / Tests | `tests` | — |
@@ -146,7 +147,7 @@ the address uses: `/admin/problems/<slug>`.
 | Problems / Filesystem integrity | `integrity` | — |
 | Problems / Email | `mail` | [Bounces.md](../../General/Email/Bounces.md#when-something-goes-wrong) |

-15 of these 25 panes has no page of its own yet. A dash is a
+15 of these 26 panes has no page of its own yet. A dash is a
 gap to fill, not a pane that does nothing - what the pane shows is described in
 this README until somebody writes it up.

@@ -100,6 +100,31 @@ the person signed in. See [Optional APIs](../../../API/Optional-APIs.md).
  automatically in card text, one per line. Anything not listed is left as plain
  text, which is what stops `javascript:` and friends becoming clickable.

+  Each listed scheme opens the application the viewer's computer has for it, so
+  a link is something that runs on the machine of whoever clicks it, written by
+  anybody who can edit a card. Two kinds of scheme are never linked, even when
+  listed here:
+
+  - schemes that run code in the page or hide content in the URL: `javascript`,
+    `vbscript`, `data`, `blob`, `about`, `view-source`, `mhtml` and the like;
+  - operating-system handlers with a public code-execution history: `ms-msdt`
+    (Follina, CVE-2022-30190), `search-ms` and `search`, `ms-officecmd`,
+    `ms-appinstaller`, `ms-cxh` and `ms-cxh-full`, and `telnet` - the last step
+    of a 2026 browser full chain, where Windows ran a `telnet.exe` from a
+    directory any user can write to.
+
+  Somebody writing a link to one of the second kind in a card title or
+  description, a comment or a checklist is shown in **Admin Panel → Problems**
+  (HandlerLink, CWE-939): nobody needs such a link, because it is never
+  clickable. The text is saved as written, and nothing is said to the writer.
+
+  `file` is allowed, because linking a shared folder is what the setting is for
+  ([#3218](https://github.com/wekan/wekan/issues/3218)). On Windows a
+  `file://server/share` link is opened over SMB, and a link to a server
+  outside your network sends that server the clicker's Windows sign-in (an NTLM
+  hash). List `file` only where everybody who can edit cards is trusted, and
+  block outbound SMB (TCP 445) at the network edge.
+
 ## Product name

 The name WeKan calls itself: the browser tab title, and the branding on the sign-in
@@ -79,6 +79,7 @@ are not reachable from the current Admin Panel menu. Current storage panes use
 | Teams (`teams`) | [team.js](../../../models/team.js) | Team records and membership operations; scoped server permissions. |
 | People (`people`) | [users.js](../../../server/models/users.js) | Create/edit, roles, password/email operations, impersonation and removal. |
 | Locked Users (`locked-users`) | [lockedUsers.js](../../../server/methods/lockedUsers.js) | Locked-account listing and administrator unlock methods. |
+| Audit log (`audit-log`) | [adminAudit.js](../../../server/adminAudit.js) | New: every administrative method a site administrator calls, one document each for a year, secrets redacted; site administrators only. Real wrapper in [adminAudit.test.cjs](../../../tests/adminAudit.test.cjs). |
 | Roles (`roles`) | [inviteToBoardRolesSettings.js](../../../models/inviteToBoardRolesSettings.js) | Invitation-role defaults and per-role settings. |
 | Shared Templates (`shared-templates`) | [users.js](../../../server/models/users.js) | Shared-template administration with tenant boundaries. |

@@ -111,6 +112,7 @@ are not reachable from the current Admin Panel menu. Current storage panes use
 | Backup (`backup`) | [backup.js](../../../server/methods/backup.js) | Recorded backup runs, health of the instance backup and its history (backupHistory method); settings stay in Attachments / Backup. |
 | Security Report (`security-report`) | [eventLog.js](../../../models/eventLog.js) | Recorded security events, search, detail and acknowledgement. |
 | Impersonation Report (`impersonation`) | [impersonationReport.js](../../../server/publications/impersonationReport.js) | Scoped event publication and counts. |
+| Password length (`password-length`) | [shortPasswordLogins.js](../../../server/lib/shortPasswordLogins.js) | The minimum password length and whether it is enforced, saved as Login settings; one row per account that signed in with a shorter password, reported by its browser, with the Too short / Fixed / All filter. |
 | Performance (`performance`) | [adminProblems.js](../../../client/components/settings/adminProblems.js) | Persisted performance options; card loading uses the active loading policy. |
 | Speed (`speed`) | [eventLog.js](../../../models/eventLog.js) | Recorded speed events; no events is a valid empty report. |
 | Tests (`tests`) | [eventLog.js](../../../models/eventLog.js) | Recorded test results; opening the pane does not run every repository test. |
@@ -219,7 +219,7 @@ embedding in `.xlsx` is a file-format/library limitation rather than an omitted
 font asset; PDF is the format to use when identical glyph rendering on every
 device is required.

-The design and progress live here rather than in `CHANGELOG.md`'s TODO list so
+The design and progress live here rather than in `CHANGELOG-big.md`'s TODO list so
 implementation details stay beside the format they describe.

 ## What is kept
@@ -148,7 +148,7 @@ KanbanFlow, Basecamp and Taskcafe. Restyaboard's CSV export is a closed paid
 app with undocumented columns. YouTrack, Airtable and Leantime write CSV
 headers that are undocumented or in the user's language. Things 3 exports only
 its SQLite database. Wrike's automation rules have no export, import or API.
-The **TODO Later** section of [CHANGELOG.md](../../../../../CHANGELOG.md) keeps the
+The **TODO Later** section of [CHANGELOG-big.md](../../../../../CHANGELOG-big.md) keeps the
 reason for each.

 ## REST API and `api.py`
@@ -63,6 +63,7 @@ Menu path is what you click to reach the page.
 | Domains | Admin Panel / People / Domains | Every e-mail domain in use with the number of users on it. The first People pane converted to this design. |
 | Roles Status | Admin Panel / People / Roles | What each board role may do — which cards it sees, and whether it may comment, create and edit, or change the board's settings. **Read-only**: no `rowTemplate`, no actions, nothing editable, because a role's capabilities are a property of the code and not a setting. It sits BELOW the Save button of the checkbox list above it and follows that list's working copy, so an admin sees what a change means before saving it. Rendered from `models/lib/boardRoleCapabilities.js`, the same table the allow rules decide with — see [Board roles](../Board-Sidebar/Members/Roles.md). |
 | Security | Admin Panel / Problems / Security | Security events from the event log: blocked uploads, rejected URL schemes, auth failures. One row per event, newest first. |
+| Password length | Admin Panel / Problems / Password length | Accounts that signed in with a password shorter than the minimum: username, first and last such login, the latest IPv4 and IPv6 address each with its flag and city when known, the count, and when it was fixed. Its filter is the status - Too short password (the default), Fixed to long enough password, All - and above the table are the two settings, the minimum length and whether it is enforced. See [Password length](../Admin-Panel/Problems/Password-length.md). |
 | Speed | Admin Panel / Problems / Speed | Slow-operation events — what took too long, where, and for how long. |
 | Tests | Admin Panel / Problems / Tests | Test-run events recorded on the server. |
 | CPU usage | Admin Panel / Problems / CPU usage | Past high-CPU periods. Adds a **status row**: the live CPU percent, core count and load average, because the table itself is history, not the current state. |
@@ -2,8 +2,9 @@

 **a) Wekan Snap**
 ```
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan/current/lib/x86_64-linux-gnu
-export PATH="$PATH:/snap/wekan/current/bin"
+S=/snap; [ -d /snap/wekan ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan/current/lib/$(uname -m)-linux-gnu"
+export PATH="$PATH:$S/wekan/current/bin"
 mongo --port 27019
 ```
 If you have disabled new user registration at Admin Panel, you can enable it, and create new user your https://wekan.example.com/sign-up :
@@ -34,8 +35,9 @@ Then login to Wekan and change any users passwords at `Admin Panel / People / Pe

 **b) Wekan Gantt GPL Snap**
 ```
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan-gantt-gpl/current/lib/x86_64-linux-gnu
-export PATH="$PATH:/snap/wekan-gantt-gpl/current/bin"
+S=/snap; [ -d /snap/wekan-gantt-gpl ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan-gantt-gpl/current/lib/$(uname -m)-linux-gnu"
+export PATH="$PATH:$S/wekan-gantt-gpl/current/bin"
 mongo --port 27019
 ```
 If you have disabled new user registration at Admin Panel, you can enable it, and create new user your https://wekan.example.com/sign-up :
@@ -122,5 +122,5 @@ coverage, not native-speaker verification; specialist terminology still needs
 review. Chromium coverage exercises Gujarati block dragging,
 field editing, saving and context menus. The editor
 remains available; remaining languages and native terminology review are
-tracked under TODO Later in [the changelog](../../../../CHANGELOG.md).
+tracked under TODO Later in [the changelog](../../../../CHANGELOG-big.md).
 Message coverage and placeholder checks do not imply complete translation.
@@ -131,9 +131,10 @@ sudo snap stop wekan.wekan
 ```
 #### 10. Use WeKan Stable Snap mongodump version for dumping database
 ```
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan/current/lib/x86_64-linux-gnu
+S=/snap; [ -d /snap/wekan ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan/current/lib/$(uname -m)-linux-gnu"

-export PATH="$PATH:/snap/wekan/current/bin"
+export PATH="$PATH:$S/wekan/current/bin"

 mongodump --port 27019
 ```
@@ -10,7 +10,7 @@ This is without container (without Docker or Snap).

 Right click and download files 1-4:

-1. [wekan-12.71-win64.zip](https://github.com/wekan/wekan/releases/download/v12.71/wekan-12.71-win64.zip) or newest available at https://github.com/wekan/wekan/releases/
+1. [wekan-12.76-win64.zip](https://github.com/wekan/wekan/releases/download/v12.76/wekan-12.76-win64.zip) or newest available at https://github.com/wekan/wekan/releases/

 2. [node.exe](https://nodejs.org/dist/latest-v26.x/win-x64/node.exe)

@@ -22,7 +22,7 @@ Right click and download files 1-4:

 6. Double click `mongodb-windows-x86_64-7.0.34-signed.msi` . In installer, uncheck downloading MongoDB compass.

-7. Unzip `wekan-12.71-win64.zip` , inside it is directory `bundle`, to it copy other files:
+7. Unzip `wekan-12.76-win64.zip` , inside it is directory `bundle`, to it copy other files:

 ```
 bundle (directory)
@@ -6,6 +6,11 @@ sudo a2enmod ssl proxy proxy_http proxy_wstunnel proxy_balancer

 [Apache Mod_Proxy documentation](https://httpd.apache.org/docs/current/mod/mod_proxy.html)

+Use Apache httpd **2.4.60 or newer**. It fixes the 2024
+[Confusion Attacks](https://blog.orange.tw/posts/2024-08-confusion-attacks-en/)
+(CVE-2024-38472 to CVE-2024-38477 and CVE-2024-39573), and the examples below
+pass WeKan's WebSocket with `upgrade=websocket`, which needs 2.4.47 or newer.
+
 WeKan needs a reverse proxy only. Never enable `ProxyRequests On`: that turns
 Apache into a forward proxy through which Internet clients can request arbitrary
 third-party hosts. `ProxyMaxForwards` limits a forwarding chain's length; it does
@@ -26,8 +31,6 @@ sudo service apache2 restart
 ## 3) Enable SSL in Apache config
 ```
 Listen 443
-
-NameVirtualHost *:443
 ```
 ## 4) Set Apache proxy

@@ -55,8 +58,7 @@ Config at `/etc/apache2/sites-available/example.com.conf`:
     require all granted
    </Location>

-    ProxyPassMatch   "^/(sockjs\/.*\/websocket)$" "ws://127.0.0.1:3001/$1"
-    ProxyPass        "/" "http://127.0.0.1:3001/"
+    ProxyPass        "/" "http://127.0.0.1:3001/" upgrade=websocket
    ProxyPassReverse "/" "http://127.0.0.1:3001/"

 </VirtualHost>
@@ -70,7 +72,7 @@ Config at `/etc/apache2/sites-available/example.com.conf`:
 ```ApacheConf
 <VirtualHost *:443>

-    ServerName example.com/wekan
+    ServerName example.com

    SSLEngine On
    SSLCertificateFile      /etc/letsencrypt/live/example.com/fullchain.pem
@@ -79,8 +81,7 @@ Config at `/etc/apache2/sites-available/example.com.conf`:
    ServerSignature Off
    ProxyRequests Off

-    ProxyPassMatch   "^/(sockjs\/.*\/websocket)$" "ws://127.0.0.1:3001/wekan/$1"
-    ProxyPass        "/wekan" "http://127.0.0.1:3001/wekan"
+    ProxyPass        "/wekan" "http://127.0.0.1:3001/wekan" upgrade=websocket
    ProxyPassReverse "/wekan" "http://127.0.0.1:3001/wekan"

 </VirtualHost>
@@ -90,6 +91,29 @@ To run as default site:
 <VirtualHost _default_:443>
 ```

+### c) What not to add
+
+WeKan does its own access control and serves nothing from Apache's disk, so
+Apache only has to pass requests on. Each of these has turned that into a hole
+([Confusion Attacks](https://blog.orange.tw/posts/2024-08-confusion-attacks-en/)):
+
+- **No `RewriteRule` or `ProxyPassMatch` that puts part of the request into
+  the target**, such as `RewriteRule "^/x/(.*)$" "/$1"` or `... "ws://host/$1"`.
+  mod_rewrite cuts a target at a decoded `?` (`%3F`) and tries a rewritten path
+  both inside and outside `DocumentRoot`, so a capture can reach files anywhere
+  on the server, or another proxy target. The plain `ProxyPass` above maps a
+  fixed prefix, and `upgrade=websocket` replaced the `ProxyPassMatch` these
+  examples used for the WebSocket.
+- **No `<Files>` or `<Location>` rule to protect part of WeKan**, such as an
+  admin page behind a password. Apache matches its own idea of the name, which
+  a request can make differ from what WeKan serves; WeKan checks permissions
+  itself.
+- **Keep `AllowEncodedSlashes` Off and `MergeSlashes` On**, the defaults. On
+  Windows, `AllowEncodedSlashes On` let a request reach a UNC path and send the
+  server's NTLM hash to another host (CVE-2024-38472).
+- **Keep `<Directory />` at `Require all denied`**, and do not grant directories
+  such as `/usr/share` in the WeKan virtual host: nothing there is WeKan's.
+
 ## 5) Enable your site

 ```
@@ -0,0 +1,19 @@
+# Password breach check digest (CodeQL #599)
+
+Reviewed on **2026-10-31** from the saved alert in `.tools/log/wekansec2`.
+
+| Alert | Source review | Changes |
+| --- | --- | --- |
+| 599: use of password hash with insufficient computational effort (`js/insufficient-password-hash`, CWE-916) | `server/lib/passwordPolicy.js` computed the SHA-1 of a new password for `PASSWORD_CHECK_PWNED` (off by default, unreleased). That digest is not password storage: accounts-password stores passwords with bcrypt, and this one is never stored or logged. Have I Been Pwned's range API is keyed by SHA-1, so its first 5 hex digits are sent and the remaining 35 are compared with the answer in memory and dropped. A slow hash cannot be used, because the service could not match it. | The browser and the server now compute the lookup digest with ONE implementation, `breachLookupDigest` in `models/lib/passwordPolicy.js` (Web Crypto in both), whose comment says what it is and is not. The server no longer hashes a password with a hash of its own, and a failure to compute the digest lets the password through, like an unreachable service. Tests: the digest equals SHA-1 for ASCII and UTF-8 input, it reaches only the range lookup and the comparison, and nothing anywhere in WeKan hashes a password-named value with a fast hash (`tests/passwordPolicy.test.cjs`). |
+
+This is hardening of a check that had not been released, not a confirmed
+vulnerability: no password or password hash was stored or sent beyond five
+hex digits. No Hall of Fame entry is created, and nothing is recorded in Admin
+Panel / Problems - a password being checked is ordinary use, not an attack.
+
+If the alert is raised again for the Web Crypto digest, it is the same false
+positive and can be dismissed as "Won't fix - the API requires SHA-1; not
+stored", with a link to this page.
+
+Reference: [Have I Been Pwned range API](https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByRange),
+[OWASP Password Storage](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html).
@@ -0,0 +1,57 @@
+# Security settings
+
+Settings an administrator can turn on to harden a WeKan site. Every one of them
+is an environment variable on every platform (Snap: `sudo snap set wekan
+<key>=<value>`, Docker: `docker-compose.yml`, `start-wekan.sh`,
+`start-wekan.bat`, the Helm chart's `values.yaml`), and the ones marked
+**Admin Panel** can also be set there, where the value wins over the variable.
+
+## Signing in
+
+| Setting | Snap key | Default | What it does |
+| --- | --- | --- | --- |
+| `PASSWORD_MIN_LENGTH` | `password-min-length` | `8` | Minimum password length, in characters. A sign-in with a shorter password is listed in **Admin Panel / Problems / Password length**; nothing is refused unless `PASSWORD_MIN_LENGTH_ENFORCE` is on. Also set on that page and in **Admin Panel / People / Login**. |
+| `PASSWORD_MIN_LENGTH_ENFORCE` | `password-min-length-enforce` | `false` | Refuse a shorter NEW password, and make an account that signs in with an older shorter one change it before anything else; the change signs every session of the account out. Only WeKan's own password accounts: LDAP, OAuth2, OIDC, SAML, CAS and Sandstorm passwords are their provider's. [Password length](../Features/Admin-Panel/Problems/Password-length.md) |
+| `PASSWORD_CHECK_PWNED` | `password-check-pwned` | `false` | Refuse a new password that appears in a known data breach. Only the first 5 hex digits of its SHA-1 are sent to `api.pwnedpasswords.com`; if the service cannot be reached, the password is accepted. **Admin Panel / People / Login** |
+| `REQUIRE_2FA` | `require-2fa` | `off` | `admins` or `all`: accounts that sign in with a WeKan password must set up two-factor authentication right after signing in, and can do nothing else until they have. LDAP, OAuth2, SAML, CAS and Sandstorm accounts are not covered: their identity provider is where a second factor belongs. **Admin Panel / People / Login** |
+| `LOGOUT_IDLE_MINUTES` | `logout-idle-minutes` | off | Sign a browser session out after this many minutes without a key press, click, touch or scroll. REST API tokens are not affected. **Admin Panel / People / Login** |
+| `LOGOUT_WITH_TIMER`, `LOGOUT_IN`, `LOGOUT_ON_HOURS`, `LOGOUT_ON_MINUTES` | | off | Sign everybody out at a deadline after signing in, however busy. **Admin Panel / People / Login** |
+| `ACCOUNTS_LOCKOUT_*` | | on | Lock an account or an address after failed logins; [Brute force protection](brute-force-protection.md). **Admin Panel / People / Locked Users** |
+| `USERS_DISABLE_INACTIVE_AFTER_DAYS` | | off | Disable accounts unused for this many days. **Admin Panel / People / Login** |
+
+Each member can turn on two-factor authentication for themselves in Member
+Settings, whatever `REQUIRE_2FA` says, and can add passkeys.
+
+## HTTP
+
+| Setting | Snap key | Default | What it does |
+| --- | --- | --- | --- |
+| `HSTS_MAX_AGE` | `hsts-max-age` | `15552000` (180 days) | Strict-Transport-Security, sent only when `ROOT_URL` is https. `0` stops it. **Admin Panel / People / Login** |
+| `HSTS_INCLUDE_SUBDOMAINS` | `hsts-include-subdomains` | `false` | HSTS for every subdomain too. Only when all of them have HTTPS. |
+| `HSTS_PRELOAD` | `hsts-preload` | `false` | The preload token; sent only with includeSubDomains and a max-age of at least a year. |
+| `BROWSER_POLICY_ENABLED`, `TRUSTED_URL` | | | Which site may show WeKan in a frame. |
+
+Always on: `X-Content-Type-Options: nosniff`, `Referrer-Policy:
+strict-origin-when-cross-origin`, and a cross-site request guard - a POST, PUT,
+PATCH or DELETE that logs in only with the cookie must come from WeKan's own
+pages. A refused request appears in Admin Panel / Problems as
+`csrf.cross-site-cookie`.
+
+## Attachments
+
+- **Admin Panel / Attachments / S3 / Server-side encryption**: SSE-S3 or SSE-KMS
+  for every attachment, avatar and backup written to S3.
+- On the filesystem, encrypt the disk or volume that holds `WRITABLE_PATH`
+  (LUKS, an encrypted cloud volume).
+- `ATTACHMENTS_UPLOAD_MAX_SIZE`, `ATTACHMENTS_UPLOAD_MIME_TYPES` and
+  `ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM` (a virus scanner, `{file}` is the
+  upload) limit and check what can be uploaded; the same exist for avatars.
+
+## Watching
+
+- **Admin Panel / Problems** - attacks WeKan refused, summarised: what, how
+  often, since when, from whom.
+- **Admin Panel / People / Audit log** - every administrative action of a site
+  administrator: who set a password, made somebody an admin, changed a login
+  setting, restored a backup. Passwords and secrets are never recorded; kept
+  for a year.
@@ -2586,6 +2586,27 @@
  "speed": "Bagaih",
  "progress": "Keumajuan",
  "password-again": "Sandi (sigo treuk)",
+  "password-pwned": "Kata sandi nyoe ka meutamöng lam bocoran data. Pileh nyang laen.",
+  "password-too-short": "Kata sandi beu paleng kureung __min__ karakter.",
+  "password-length-report-title": "Panyang kata sandi",
+  "password-length-report-desc": "Akun nyang tamong ngön kata sandi nyang leubeh paneuk nibak panyang paleng kureung. Cit browser mantong nyang tuphö padum panyang kata sandi, maka jih jilapor kata sandi nyang paneuk lheuh tamong; kata sandi ngön panyang jih hana tom teubiet nibak browser. Ka geupeugot meunyo kata sandi akun ka geu-ubah - akun nyang tamong lom ngön kata sandi paneuk geupeuleumah lom sibagoe paneuk that.",
+  "password-length-no-results": "Hana akun disinoe.",
+  "password-length-first-login": "Tamong phon",
+  "password-length-last-login": "Tamong keuneulheuëh",
+  "password-length-login-count": "Padum go tamong",
+  "password-length-fixed": "Ka geupeugot",
+  "password-length-filter-short": "Kata sandi paneuk that",
+  "password-length-filter-fixed": "Ka geupeugot keu kata sandi nyang cukôp panyang",
+  "password-length-filter-all": "Mandum",
+  "password-min-length": "Panyang paleng kureung kata sandi",
+  "password-min-length-description": "Tamong ngön kata sandi nyang leubeh paneuk geupeuleumah di yup nyoe. Tamong hana tom geutolak keu nyan.",
+  "password-min-length-enforce": "Paksa panyang paleng kureung",
+  "password-min-length-enforce-description": "Kata sandi barô nyang leubeh paneuk geutolak, ngön akun nyang tamong ngön kata sandi leubeh paneuk wajeb jiubah dilee sigohlom nyang laen. Meng-ubah jih jiteubiet mandum sesi akun. Kata sandi LDAP, OAuth2, OIDC, SAML, CAS ngön Sandstorm nyan milek penyedia jih, ngön hana geuperiksa.",
+  "password-length-saved": "Ka geukeubah.",
+  "password-length-from-environment": "Nilai nyang geupasang lam lingkungan server teungöh beurlaku; keubah disinoe jigantoe nyan.",
+  "password-change-required-title": "Ubah kata sandi droeneuh",
+  "password-change-required-text": "Situs nyoe jinoe jilakee kata sandi paleng kureung __min__ karakter, ngön kata sandi droeneuh leubeh paneuk. Pileh nyang leubeh panyang mangat jeuet lanjut. Mandum sesi akun droeneuh laju geuteubiet, ngön droeneuh tamong lom ngön kata sandi barô.",
+  "password-same-as-username": "Kata sandi bek sama ngon nan ureueng ngui atawa alamat emel.",
  "if-you-already-have-an-account": "Meunyoe droeneueh ka na akun",
  "register": "Daftar",
  "forgot-password": "Tuwo sandi",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "Tingkap gagai (detik)",
  "accounts-lockout-settings-updated": "Peuatôran peulindông brute force ka geuubah",
  "accounts-lockout-locked-users": "Ureueng Ngui Geugunci",
+  "admin-audit-log": "Log Audit",
+  "admin-audit-log-info": "Peue nyang geupeubuet lé peungatô situs: meurubah ureueng ngui, tamöng, keubah data ngon saleunan, nyang barô phon. Kata sandi ngon rahsia hana tom geucatat. Geukeubah sithon.",
+  "admin-audit-log-when": "Watèe",
+  "admin-audit-log-who": "Peungatô",
+  "admin-audit-log-action": "Buet",
+  "admin-audit-log-details": "Haba Leungkap",
+  "admin-audit-log-empty": "Goh na sapeue nyang geucatat.",
  "accounts-lockout-locked-users-info": "Ureueng ngui nyang jinoe geugunci sabab le that usaha tamong nyang gagai",
  "accounts-lockout-no-locked-users": "Jinoe hana ureueng ngui nyang geugunci",
  "accounts-lockout-failed-attempts": "Usaha Gagai",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "Storan objek kompatibel S3: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces ngön nyang laén.",
  "s3-force-path-style": "Peupaksa URL gaya-rot",
  "s3-force-path-style-description": "Geupeureulee lé MinIO ngön le that server kompatibel S3 nyang kon AWS.",
+  "s3-sse": "Enkripsi bak peuladèn",
+  "s3-sse-none": "Hana geulakèe (standar bucket)",
+  "s3-sse-description": "S3 geu-enkripsi bandum lampiran, avatar ngon saleunan nyang geutuléh lé WeKan, ngon geubuka enkripsi keu WeKan watèe geubaca.",
+  "s3-sse-kms-key-id": "ID kunci KMS keu SSE-KMS (soh = kunci standar akun)",
  "azure-blob-storage": "Azure Blob Storage",
  "azure-blob-storage-description": "Teumpat keubah Microsoft Azure Blob.",
  "azure-account-name": "Nan akun",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "Scan kode QR nyoe ngön aplikasi otentikator (umpama Google Authenticator, Authy), laju neutuléh kode 6 angka nyang jipeuleumah keu peukong.",
  "twoFactorAuth-manual-entry": "Atawa tuléh kode nyoe ngon manual: ",
  "twoFactorAuth-confirm": "Peukong ngön Peuhudép",
+  "two-factor-required-title": "Atô Otentikasi Dua Faktor",
+  "two-factor-required-text": "Situs nyoe meuphôm otentikasi dua faktor keu akun droeneuh. Atô dilèe mangat jeut neulanjut.",
  "twoFactorCode-prompt": "Tuléh kode otentikasi 6 angka droe neuh",
  "twoFactorCode-submit": "Peukong",
  "twoFactorCode-cancel": "Pubateuë",
@@ -2586,6 +2586,27 @@
  "speed": "Spoed",
  "progress": "Vordering",
  "password-again": "Wagwoord (weer)",
+  "password-pwned": "Hierdie wagwoord het in 'n datalek verskyn. Kies 'n ander een.",
+  "password-too-short": "Die wagwoord moet ten minste __min__ karakters lank wees.",
+  "password-length-report-title": "Wagwoordlengte",
+  "password-length-report-desc": "Rekeninge wat aangemeld het met 'n wagwoord korter as die minimum lengte. Slegs die blaaier weet hoe lank 'n wagwoord is, dus rapporteer dit 'n kort een ná aanmelding; die wagwoord en sy lengte verlaat dit nooit. Reggestel is wanneer die rekening se wagwoord verander is - 'n rekening wat weer met 'n kort wagwoord aanmeld, word weer as te kort getoon.",
+  "password-length-no-results": "Geen rekeninge hier nie.",
+  "password-length-first-login": "Eerste aanmelding",
+  "password-length-last-login": "Laaste aanmelding",
+  "password-length-login-count": "Aantal kere aangemeld",
+  "password-length-fixed": "Reggestel",
+  "password-length-filter-short": "Te kort wagwoord",
+  "password-length-filter-fixed": "Reggestel na lank genoeg wagwoord",
+  "password-length-filter-all": "Alles",
+  "password-min-length": "Minimum wagwoordlengte",
+  "password-min-length-description": "Aanmelding met 'n korter wagwoord word hieronder gelys. Aanmelding word nooit daarom geweier nie.",
+  "password-min-length-enforce": "Dwing die minimum lengte af",
+  "password-min-length-enforce-description": "'n Korter nuwe wagwoord word geweier, en 'n rekening wat met 'n korter wagwoord aanmeld, moet dit eers verander voor enigiets anders. Om dit te verander, teken elke sessie van die rekening uit. LDAP-, OAuth2-, OIDC-, SAML-, CAS- en Sandstorm-wagwoorde behoort aan hul verskaffer en word nie nagegaan nie.",
+  "password-length-saved": "Gestoor.",
+  "password-length-from-environment": "'n Waarde wat in die bediener se omgewing gestel is, is van krag; om hier te stoor, oorskryf dit.",
+  "password-change-required-title": "Verander jou wagwoord",
+  "password-change-required-text": "Hierdie werf vereis nou wagwoorde van ten minste __min__ karakters, en joune is korter. Kies 'n langer een om voort te gaan. Elke sessie van jou rekening word dan uitgeteken, en jy meld weer aan met die nuwe wagwoord.",
+  "password-same-as-username": "Die wagwoord mag nie die gebruikersnaam of die e-posadres wees nie.",
  "if-you-already-have-an-account": "As jy reeds 'n rekening het",
  "register": "Registreer",
  "forgot-password": "Wagwoord vergeet",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "Mislukkingsvenster (sekondes)",
  "accounts-lockout-settings-updated": "Brute force beskerming instellings is opgedateer",
  "accounts-lockout-locked-users": "Geslote gebruikers",
+  "admin-audit-log": "Ouditlog",
+  "admin-audit-log-info": "Wat werfadministrateurs gedoen het: gebruiker-, aanmeld-, berging- en rugsteunveranderinge, nuutste eerste. Wagwoorde en geheime word nooit aangeteken nie. Word vir 'n jaar gehou.",
+  "admin-audit-log-when": "Wanneer",
+  "admin-audit-log-who": "Administrateur",
+  "admin-audit-log-action": "Aksie",
+  "admin-audit-log-details": "Besonderhede",
+  "admin-audit-log-empty": "Nog niks aangeteken nie.",
  "accounts-lockout-locked-users-info": "Gebruikers word tans uitgesluit weens te veel mislukte aanmeldpogings",
  "accounts-lockout-no-locked-users": "Daar is tans geen geslote gebruikers nie",
  "accounts-lockout-failed-attempts": "Mislukte pogings",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "S3-versoenbare objekberging: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces en ander.",
  "s3-force-path-style": "Dwing pad-styl URL's af",
  "s3-force-path-style-description": "Vereis deur MinIO en die meeste nie-AWS S3-versoenbare bedieners.",
+  "s3-sse": "Bedienerkant-enkripsie",
+  "s3-sse-none": "Niks versoek nie (die emmer se verstek)",
+  "s3-sse-description": "S3 enkripteer elke aanhegsel, avatar en rugsteun wat WeKan skryf, en dekripteer dit vir WeKan wanneer dit gelees word.",
+  "s3-sse-kms-key-id": "KMS-sleutel-ID vir SSE-KMS (leeg = die rekening se verstek sleutel)",
  "azure-blob-storage": "Azure Blob Storage",
  "azure-blob-storage-description": "Microsoft Azure Blob-berging.",
  "azure-account-name": "Rekeningnaam",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "Skandeer hierdie QR-kode met 'n verifikasie-toepassing (bv. Google Authenticator, Authy), voer dan die 6-syfer-kode wat gewys word in om te bevestig.",
  "twoFactorAuth-manual-entry": "Of voer hierdie kode self in: ",
  "twoFactorAuth-confirm": "Bevestig en aktiveer",
+  "two-factor-required-title": "Stel twee-faktor-verifikasie op",
+  "two-factor-required-text": "Hierdie werf vereis twee-faktor-verifikasie vir jou rekening. Stel dit op om voort te gaan.",
  "twoFactorCode-prompt": "Voer jou 6-syfer-verifikasiekode in",
  "twoFactorCode-submit": "Verifieer",
  "twoFactorCode-cancel": "Kanselleer",
@@ -2586,6 +2586,27 @@
  "speed": "Spoed",
  "progress": "Vordering",
  "password-again": "Wagwoord (weer)",
+  "password-pwned": "Hierdie wagwoord het in 'n datalek verskyn. Kies 'n ander een.",
+  "password-too-short": "Die wagwoord moet ten minste __min__ karakters lank wees.",
+  "password-length-report-title": "Wagwoordlengte",
+  "password-length-report-desc": "Rekeninge wat aangemeld het met 'n wagwoord korter as die minimum lengte. Slegs die blaaier weet hoe lank 'n wagwoord is, dus rapporteer dit 'n kort een ná aanmelding; die wagwoord en sy lengte verlaat dit nooit. Reggestel is wanneer die rekening se wagwoord verander is - 'n rekening wat weer met 'n kort wagwoord aanmeld, word weer as te kort getoon.",
+  "password-length-no-results": "Geen rekeninge hier nie.",
+  "password-length-first-login": "Eerste aanmelding",
+  "password-length-last-login": "Laaste aanmelding",
+  "password-length-login-count": "Aantal kere aangemeld",
+  "password-length-fixed": "Reggestel",
+  "password-length-filter-short": "Te kort wagwoord",
+  "password-length-filter-fixed": "Reggestel na lank genoeg wagwoord",
+  "password-length-filter-all": "Alles",
+  "password-min-length": "Minimum wagwoordlengte",
+  "password-min-length-description": "Aanmelding met 'n korter wagwoord word hieronder gelys. Aanmelding word nooit daarom geweier nie.",
+  "password-min-length-enforce": "Dwing die minimum lengte af",
+  "password-min-length-enforce-description": "'n Korter nuwe wagwoord word geweier, en 'n rekening wat met 'n korter wagwoord aanmeld, moet dit eers verander voor enigiets anders. Om dit te verander, teken elke sessie van die rekening uit. LDAP-, OAuth2-, OIDC-, SAML-, CAS- en Sandstorm-wagwoorde behoort aan hul verskaffer en word nie nagegaan nie.",
+  "password-length-saved": "Gestoor.",
+  "password-length-from-environment": "'n Waarde wat in die bediener se omgewing gestel is, is van krag; om hier te stoor, oorskryf dit.",
+  "password-change-required-title": "Verander jou wagwoord",
+  "password-change-required-text": "Hierdie werf vereis nou wagwoorde van ten minste __min__ karakters, en joune is korter. Kies 'n langer een om voort te gaan. Elke sessie van jou rekening word dan uitgeteken, en jy meld weer aan met die nuwe wagwoord.",
+  "password-same-as-username": "Die wagwoord mag nie die gebruikersnaam of die e-posadres wees nie.",
  "if-you-already-have-an-account": "As jy reeds 'n rekening het",
  "register": "Registreer",
  "forgot-password": "Wagwoord vergeet",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "Mislukkingsvenster (sekondes)",
  "accounts-lockout-settings-updated": "Brute force beskerming instellings is opgedateer",
  "accounts-lockout-locked-users": "Geslote gebruikers",
+  "admin-audit-log": "Ouditlog",
+  "admin-audit-log-info": "Wat werfadministrateurs gedoen het: gebruiker-, aanmeld-, berging- en rugsteunveranderinge, nuutste eerste. Wagwoorde en geheime word nooit aangeteken nie. Word vir 'n jaar gehou.",
+  "admin-audit-log-when": "Wanneer",
+  "admin-audit-log-who": "Administrateur",
+  "admin-audit-log-action": "Aksie",
+  "admin-audit-log-details": "Besonderhede",
+  "admin-audit-log-empty": "Nog niks aangeteken nie.",
  "accounts-lockout-locked-users-info": "Gebruikers word tans uitgesluit weens te veel mislukte aanmeldpogings",
  "accounts-lockout-no-locked-users": "Daar is tans geen geslote gebruikers nie",
  "accounts-lockout-failed-attempts": "Mislukte pogings",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "S3-versoenbare objekberging: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces en ander.",
  "s3-force-path-style": "Dwing pad-styl URL's af",
  "s3-force-path-style-description": "Vereis deur MinIO en die meeste nie-AWS S3-versoenbare bedieners.",
+  "s3-sse": "Bedienerkant-enkripsie",
+  "s3-sse-none": "Niks versoek nie (die emmer se verstek)",
+  "s3-sse-description": "S3 enkripteer elke aanhegsel, avatar en rugsteun wat WeKan skryf, en dekripteer dit vir WeKan wanneer dit gelees word.",
+  "s3-sse-kms-key-id": "KMS-sleutel-ID vir SSE-KMS (leeg = die rekening se verstek sleutel)",
  "azure-blob-storage": "Azure Blob Storage",
  "azure-blob-storage-description": "Microsoft Azure Blob-berging.",
  "azure-account-name": "Rekeningnaam",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "Skandeer hierdie QR-kode met 'n verifikasie-toepassing (bv. Google Authenticator, Authy), voer dan die 6-syfer-kode wat gewys word in om te bevestig.",
  "twoFactorAuth-manual-entry": "Of voer hierdie kode self in: ",
  "twoFactorAuth-confirm": "Bevestig en aktiveer",
+  "two-factor-required-title": "Stel twee-faktor-verifikasie op",
+  "two-factor-required-text": "Hierdie werf vereis twee-faktor-verifikasie vir jou rekening. Stel dit op om voort te gaan.",
  "twoFactorCode-prompt": "Voer jou 6-syfer-verifikasiekode in",
  "twoFactorCode-submit": "Verifieer",
  "twoFactorCode-cancel": "Kanselleer",
@@ -2586,6 +2586,27 @@
  "speed": "Ahoɔhare",
  "progress": "Nkɔso",
  "password-again": "Asɛmfua a wode kɔ mu (san hyɛ bio)",
+  "password-pwned": "Saa ahintasɛm yi apue wɔ data a ayi adi bi mu. Paw foforo.",
+  "password-too-short": "Ɛsɛ sɛ ahintasɛm no nkyerɛwde dodow yɛ __min__ anaa ɛboro saa.",
+  "password-length-report-title": "Ahintasɛm tenten",
+  "password-length-report-desc": "Akontaa a wɔde ahintasɛm a ɛyɛ tiaa sen tenten a ɛsɛ no na ɛkɔɔ mu. Brawsa no nko ara na enim ahintasɛm tenten, enti ɛbɔ amanneɛ fa tiaa bi ho wɔ wɔkɔ mu akyi; ahintasɛm no ne ne tenten mfi brawsa no mu da. Wɔasiesie kyerɛ bere a wɔsesaa akontaa no ahintasɛm - akontaa a ɛsan de ahintasɛm tiaa kɔ mu no, wɔsan kyerɛ sɛ ɛyɛ tiaa dodo.",
+  "password-length-no-results": "Akontaa biara nni ha.",
+  "password-length-first-login": "Kɔ mu a edi kan",
+  "password-length-last-login": "Kɔ mu a etwa to",
+  "password-length-login-count": "Mpɛn dodow a wɔkɔɔ mu",
+  "password-length-fixed": "Wɔasiesie",
+  "password-length-filter-short": "Ahintasɛm a ɛyɛ tiaa dodo",
+  "password-length-filter-fixed": "Wɔasiesie akɔ ahintasɛm a ɛware sɛnea ɛsɛ",
+  "password-length-filter-all": "Ne nyinaa",
+  "password-min-length": "Ahintasɛm tenten a ɛsɛ sɛ ɛyɛ kakraa koraa",
+  "password-min-length-description": "Wɔkyerɛw nkɔ-mu a wɔde ahintasɛm tiaa yɛe no wɔ ase ha. Wɔmpo nkɔ-mu da esiane eyi nti.",
+  "password-min-length-enforce": "Hyɛ tenten kakraa koraa no so",
+  "password-min-length-enforce-description": "Wɔpo ahintasɛm foforo a ɛyɛ tiaa, na akontaa a ɛde ahintasɛm tiaa kɔ mu no, ɛsɛ sɛ ɛsesa no ansa na ayɛ biribi foforo. Sɛ wosesa a, ɛyi akontaa no nhyiamu biara fi mu. LDAP, OAuth2, OIDC, SAML, CAS ne Sandstorm ahintasɛm yɛ wɔn mamfo dea, na wɔnhwɛ mu.",
+  "password-length-saved": "Wɔasie.",
+  "password-length-from-environment": "Botae bi a wɔde ahyɛ server no tebea mu na ɛreyɛ adwuma; sɛ wosie wɔ ha a, ɛsesa no.",
+  "password-change-required-title": "Sesa wo ahintasɛm",
+  "password-change-required-text": "Saa site yi hwehwɛ seesei sɛ ahintasɛm nkyerɛwde dodow yɛ __min__ anaa ɛboro saa, na wo dea yɛ tiaa. Paw nea ɛware kakra na toa so. Afei wobeyi wo akontaa nhyiamu biara afi mu, na wode ahintasɛm foforo no bɛsan akɔ mu.",
+  "password-same-as-username": "Ɛnsɛ sɛ ahintasɛm no yɛ dwumadini din anaa ɛmɛl address no.",
  "if-you-already-have-an-account": "Sɛ wowɔ akontaabu dedaw a",
  "register": "Kyerɛw wo din",
  "forgot-password": "Wo werɛ afi ahintasɛm",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "Bere a wɔkan nkogu wɔ mu (sɛkɛnd)",
  "accounts-lockout-settings-updated": "Wɔayɛ nsɛmfua ahintaw pii sɔhwɛ ntua ho banbɔ nhyehyɛe no foforo",
  "accounts-lockout-locked-users": "Locked Ɔdefos",
+  "admin-audit-log": "Nhwehwɛmu nkrataa",
+  "admin-audit-log-info": "Nea sohwɛfoɔ a wɔwɔ site no so ayɛ: dwumadini, ahyɛnmu, akorae ne nsɛm akora nsakrae, foforo di kan. Wɔnkyerɛw ahintasɛm ne kokoam nsɛm da. Wɔkora so afe baako.",
+  "admin-audit-log-when": "Bere",
+  "admin-audit-log-who": "Sohwɛfoɔ",
+  "admin-audit-log-action": "Adeyɛ",
+  "admin-audit-log-details": "Nkyerɛkyerɛmu",
+  "admin-audit-log-empty": "Biribiara nni hɔ a wɔakyerɛw ase.",
  "accounts-lockout-locked-users-info": "Wɔn a wɔde dwumadi yi di dwuma a wɔasiw wɔn kwan seesei esiane sɛ wɔabɔ mmɔden mpɛn pii sɛ wɔbɛkɔ mu na wɔantumi nti",
  "accounts-lockout-no-locked-users": "Seesei obiara nni hɔ a wɔasiw ne kwan",
  "accounts-lockout-failed-attempts": "Mfomso bi sii wɔ dwumadi yi mu",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "Nneɛma akorabea a ɛne S3 yɛ adwuma: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces ne afoforo.",
  "s3-force-path-style": "Hyɛ sɛ wɔmfa path-style URL nni dwuma",
  "s3-force-path-style-description": "MinIO ne sɛɛva dodow no ara a ɛne S3 yɛ adwuma na ɛnyɛ AWS no hia eyi.",
+  "s3-sse": "Som afiri fam ahintakyerɛw",
+  "s3-sse-none": "Wɔammisa biribiara (bucket no deɛ wɔahyɛ dedaw)",
+  "s3-sse-description": "S3 de ahintakyerɛw kata deɛ wɔde aka ho, avatar ne nsɛm akora biara a WeKan kyerɛw, na ɔyi ahintakyerɛw no ma WeKan bere a wɔkenkan.",
+  "s3-sse-kms-key-id": "KMS safe ID ma SSE-KMS (hwee nni mu = akawnt no safe a wɔahyɛ dedaw)",
  "azure-blob-storage": "Azure Blob Storage",
  "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
  "azure-account-name": "Akontaabu din",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "Fa nokwaredi app san QR koodu yi (sɛnea, Google Authenticator, Authy), afei hyɛ nɔma 6 a ɛda adi no ma wɔnhu mu.",
  "twoFactorAuth-manual-entry": "Anaasɛ fa wo nsa hyɛ koodu yi: ",
  "twoFactorAuth-confirm": "Si so dua na ma so",
+  "two-factor-required-title": "Hyehyɛ nneɛma abien nokwaredi",
+  "two-factor-required-text": "Saa site yi hwehwɛ nneɛma abien nokwaredi ma wo akawnt. Hyehyɛ no na woakɔ so.",
  "twoFactorCode-prompt": "Hyɛ wo nokwaredi nɔma 6 no",
  "twoFactorCode-submit": "Si so dua",
  "twoFactorCode-cancel": "Twa mu",
@@ -2586,6 +2586,27 @@
  "speed": "ፍጥነት",
  "progress": "ሂደት",
  "password-again": "የይለፍ ቃል (እንደገና)",
+  "password-pwned": "ይህ የይለፍ ቃል በመረጃ ፍሰት ውስጥ ታይቷል። ሌላ ይምረጡ።",
+  "password-too-short": "የይለፍ ቃሉ ቢያንስ __min__ ቁምፊዎች ሊኖሩት ይገባል።",
+  "password-length-report-title": "የይለፍ ቃል ርዝመት",
+  "password-length-report-desc": "ከዝቅተኛው ርዝመት ባጠረ የይለፍ ቃል የገቡ መለያዎች። የይለፍ ቃል ምን ያህል እንደሚረዝም የሚያውቀው አሳሹ ብቻ ነው፣ ስለዚህ ከገቡ በኋላ አጭር የይለፍ ቃልን ሪፖርት ያደርጋል፤ የይለፍ ቃሉና ርዝመቱ ከአሳሹ በጭራሽ አይወጡም። ተስተካክሏል ማለት የመለያው የይለፍ ቃል የተቀየረበት ጊዜ ነው - እንደገና በአጭር የይለፍ ቃል የሚገባ መለያ እንደገና በጣም አጭር ሆኖ ይታያል።",
+  "password-length-no-results": "እዚህ ምንም መለያዎች የሉም።",
+  "password-length-first-login": "የመጀመሪያ መግቢያ",
+  "password-length-last-login": "የመጨረሻ መግቢያ",
+  "password-length-login-count": "የገቡበት ብዛት",
+  "password-length-fixed": "ተስተካክሏል",
+  "password-length-filter-short": "በጣም አጭር የይለፍ ቃል",
+  "password-length-filter-fixed": "በበቂ ረጅም የይለፍ ቃል ተስተካክሏል",
+  "password-length-filter-all": "ሁሉም",
+  "password-min-length": "ዝቅተኛ የይለፍ ቃል ርዝመት",
+  "password-min-length-description": "በአጭር የይለፍ ቃል መግባት ከዚህ በታች ይዘረዘራል። በዚህ ምክንያት መግባት በጭራሽ አይከለከልም።",
+  "password-min-length-enforce": "ዝቅተኛውን ርዝመት አስገድድ",
+  "password-min-length-enforce-description": "አጭር አዲስ የይለፍ ቃል ውድቅ ይደረጋል፣ እና በአጭር የይለፍ ቃል የሚገባ መለያ ከማንኛውም ነገር በፊት መቀየር አለበት። መቀየሩ የመለያውን ሁሉንም ክፍለ ጊዜዎች ያስወጣል። የLDAP፣ OAuth2፣ OIDC፣ SAML፣ CAS እና Sandstorm የይለፍ ቃሎች የአቅራቢያቸው ናቸው፣ አይፈተሹም።",
+  "password-length-saved": "ተቀምጧል።",
+  "password-length-from-environment": "በአገልጋዩ አካባቢ የተቀመጠ እሴት በሥራ ላይ ነው፤ እዚህ ማስቀመጥ ይሽረዋል።",
+  "password-change-required-title": "የይለፍ ቃልዎን ይቀይሩ",
+  "password-change-required-text": "ይህ ጣቢያ አሁን ቢያንስ __min__ ቁምፊዎች ያላቸውን የይለፍ ቃሎች ይፈልጋል፣ የእርስዎም አጭር ነው። ለመቀጠል ረዘም ያለ ይምረጡ። ከዚያ የመለያዎ ሁሉም ክፍለ ጊዜዎች ይወጣሉ፣ እና በአዲሱ የይለፍ ቃል እንደገና ይገባሉ።",
+  "password-same-as-username": "የይለፍ ቃሉ የተጠቃሚ ስሙ ወይም የኢሜይል አድራሻው መሆን የለበትም።",
  "if-you-already-have-an-account": "አስቀድመው መለያ ካለዎት",
  "register": "ተመዝገብ",
  "forgot-password": "የይለፍ ቃል ረሱ",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "የውድቀት የጊዜ መስኮት (ሰከንዶች)",
  "accounts-lockout-settings-updated": "የጉልበት ጥቃት መከላከያ ቅንብሮች ተዘምነዋል",
  "accounts-lockout-locked-users": "የተቆለፉ ተጠቃሚዎች",
+  "admin-audit-log": "የኦዲት መዝገብ",
+  "admin-audit-log-info": "የጣቢያው አስተዳዳሪዎች ያደረጉት፦ የተጠቃሚ፣ የመግቢያ፣ የማከማቻ እና የምትኬ ለውጦች፣ አዲሶቹ መጀመሪያ። የይለፍ ቃላት እና ሚስጥሮች በፍጹም አይመዘገቡም። ለአንድ ዓመት ይቀመጣል።",
+  "admin-audit-log-when": "መቼ",
+  "admin-audit-log-who": "አስተዳዳሪ",
+  "admin-audit-log-action": "ድርጊት",
+  "admin-audit-log-details": "ዝርዝሮች",
+  "admin-audit-log-empty": "እስካሁን ምንም አልተመዘገበም።",
  "accounts-lockout-locked-users-info": "በብዙ ያልተሳኩ የመግቢያ ሙከራዎች ምክንያት አሁን የተቆለፉ ተጠቃሚዎች",
  "accounts-lockout-no-locked-users": "አሁን ምንም የተቆለፈ ተጠቃሚ የለም",
  "accounts-lockout-failed-attempts": "ያልተሳኩ ሙከራዎች",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "ከS3 ጋር ተኳሃኝ የነገር ማከማቻ፦ AWS S3፣ MinIO፣ Cloudflare R2፣ Backblaze B2፣ Wasabi፣ DigitalOcean Spaces እና ሌሎች።",
  "s3-force-path-style": "የዱካ ቅጥ URLዎችን አስገድድ",
  "s3-force-path-style-description": "ለMinIO እና ለአብዛኞቹ AWS ያልሆኑ S3-ተኳኋኝ አገልጋዮች ያስፈልጋል።",
+  "s3-sse": "በአገልጋይ በኩል ምስጠራ",
+  "s3-sse-none": "ምንም አልተጠየቀም (የባልዲው ነባሪ)",
+  "s3-sse-description": "S3 WeKan የሚጽፈውን እያንዳንዱን አባሪ፣ አምሳያ እና ምትኬ ያመሰጥራል፣ ሲነበብም ለWeKan ይፈታዋል።",
+  "s3-sse-kms-key-id": "ለSSE-KMS የKMS ቁልፍ መታወቂያ (ባዶ = የመለያው ነባሪ ቁልፍ)",
  "azure-blob-storage": "Azure Blob Storage",
  "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
  "azure-account-name": "የመለያ ስም",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "ይህን የQR ኮድ በማረጋገጫ መተግበሪያ ይቃኙ (ለምሳሌ Google Authenticator, Authy)፣ ከዚያ ለማረጋገጥ የሚታየውን የ6- አሃዝ ኮድ ያስገቡ።",
  "twoFactorAuth-manual-entry": "ወይም ይህን ኮድ በእጅ ያስገቡ፦ ",
  "twoFactorAuth-confirm": "አረጋግጥና አንቃ",
+  "two-factor-required-title": "ባለ ሁለት-ደረጃ ማረጋገጫን ያዋቅሩ",
+  "two-factor-required-text": "ይህ ጣቢያ ለመለያዎ ባለ ሁለት-ደረጃ ማረጋገጫ ይፈልጋል። ለመቀጠል ያዋቅሩት።",
  "twoFactorCode-prompt": "የ6-አሃዝ ማረጋገጫ ኮድዎን ያስገቡ",
  "twoFactorCode-submit": "አረጋግጥ",
  "twoFactorCode-cancel": "ሰርዝ",
@@ -2586,6 +2586,27 @@
  "speed": "Velocidad",
  "progress": "Progreso",
  "password-again": "Clau (repetir)",
+  "password-pwned": "Ista clau de paso ha amaneciu en una filtración de datos. Tría-ne unatra.",
+  "password-too-short": "La clau de paso ha de tener a lo menos __min__ caracters.",
+  "password-length-report-title": "Longaria d'a clau de paso",
+  "password-length-report-desc": "Cuentas que dentroron con una clau de paso más curta que a longaria minima. Nomás o navegador sabe quán larga ye una clau de paso, asinas que informa d'una curta dimpués de dentrar; a clau de paso y a suya longaria nunca no salen d'ell. Apanyau ye quan se cambió a clau de paso d'a cuenta - una cuenta que torna a dentrar con una clau de paso curta se torna a amostrar como masiau curta.",
+  "password-length-no-results": "No i hai cuentas aquí.",
+  "password-length-first-login": "Primer acceso",
+  "password-length-last-login": "Zaguer acceso",
+  "password-length-login-count": "Vegadas que ha dentrau",
+  "password-length-fixed": "Apanyau",
+  "password-length-filter-short": "Clau de paso masiau curta",
+  "password-length-filter-fixed": "Apanyau con una clau de paso prou larga",
+  "password-length-filter-all": "Totz",
+  "password-min-length": "Longaria minima d'a clau de paso",
+  "password-min-length-description": "Dentrar con una clau de paso más curta se lista aquí baixo. Nunca no se refusa l'acceso por ixo.",
+  "password-min-length-enforce": "Fer cumplir a longaria minima",
+  "password-min-length-enforce-description": "Se refusa una nueva clau de paso más curta, y una cuenta que dentra con una clau de paso más curta ha de cambiar-la antes que cosa más. Cambiar-la zarra totas as sesions d'a cuenta. As claus de paso de LDAP, OAuth2, OIDC, SAML, CAS y Sandstorm son d'o suyo proveyedor, y no se comprebán.",
+  "password-length-saved": "Alzau.",
+  "password-length-from-environment": "Ye en vigor una valor definida en l'entorno d'o servidor; alzar aquí la sobrescribe.",
+  "password-change-required-title": "Cambia a tuya clau de paso",
+  "password-change-required-text": "Iste puesto requiere agora claus de paso de a lo menos __min__ caracters, y a tuya ye más curta. Tría-ne una más larga pa continar. Dimpués se zarran totas as sesions d'a tuya cuenta, y tornas a dentrar con a nueva clau de paso.",
+  "password-same-as-username": "La clau de paso no puede estar o nombre d'usuario ni l'adreza de correu electronico.",
  "if-you-already-have-an-account": "Si ya tiens una cuenta",
  "register": "Rechistrar-se",
  "forgot-password": "He xublidau a clau de paso",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "Ventana de fallos (segundos)",
  "accounts-lockout-settings-updated": "La configuración de protección de fuerza bruta s'ha actualizado",
  "accounts-lockout-locked-users": "Usuarios bloqueados",
+  "admin-audit-log": "Rechistro d'auditoría",
+  "admin-audit-log-info": "Lo que han feito os administradors d'o sitio: cambeos d'usuarios, d'inicio de sesión, d'almagazenamiento y de copias de seguridat, os mas recients primero. As claus de paso y os secretos no se rechistran nunca. Se conserva un anyo.",
+  "admin-audit-log-when": "Quan",
+  "admin-audit-log-who": "Administrador",
+  "admin-audit-log-action": "Acción",
+  "admin-audit-log-details": "Detalles",
+  "admin-audit-log-empty": "Encara no s'ha rechistrau cosa.",
  "accounts-lockout-locked-users-info": "Usuarios blocaus actualment por masiaus intentos fallius d'iniciar sesión",
  "accounts-lockout-no-locked-users": "Actualment no i hai usuarios blocaus",
  "accounts-lockout-failed-attempts": "Intentos fallidos",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "Almagazenamiento d’obchectos compatible con S3: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces y atros.",
  "s3-force-path-style": "Forzar URLs de estilo de ruta",
  "s3-force-path-style-description": "Requerido por MinIO y la mayoría de os servidores compatibles con S3 que no son de AWS.",
+  "s3-sse": "Cifrau en o servidor",
+  "s3-sse-none": "Garra demandau (o valor por defecto d'o bucket)",
+  "s3-sse-description": "S3 cifra cada adchunto, avatar y copia de seguridat que escribe WeKan, y lo descifra pa WeKan quan se leye.",
+  "s3-sse-kms-key-id": "ID d'a clau KMS pa SSE-KMS (vuedo = la clau por defecto d'a cuenta)",
  "azure-blob-storage": "Almagazenamiento Azure Blob",
  "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
  "azure-account-name": "Nombre de cuenta",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "Escaneye iste codigo QR con una app d'autenticación (per eixemplo, Google Authenticator, Authy), dimpués introduzca lo codigo de 6 digitos que s'amuestra ta confirmar.",
  "twoFactorAuth-manual-entry": "U introduzca iste codigo manualment: ",
  "twoFactorAuth-confirm": "Confirmar y Activar",
+  "two-factor-required-title": "Configura l'autenticación de dos factors",
+  "two-factor-required-text": "Iste sitio requiere l'autenticación de dos factors pa la tuya cuenta. Configura-la pa continar.",
  "twoFactorCode-prompt": "Introduzca lo suyo codigo d'autenticación de 6 digitos",
  "twoFactorCode-submit": "Verificar",
  "twoFactorCode-cancel": "Cancelar",
@@ -2586,6 +2586,27 @@
  "speed": "السرعة",
  "progress": "التقدّم",
  "password-again": "كلمة المرور (مرة أخرى)",
+  "password-pwned": "ظهرت كلمة المرور هذه في تسريب بيانات. اختر كلمة مرور أخرى.",
+  "password-too-short": "يجب ألا يقل طول كلمة المرور عن __min__ حرفًا.",
+  "password-length-report-title": "طول كلمة المرور",
+  "password-length-report-desc": "الحسابات التي سجّلت الدخول بكلمة مرور أقصر من الحد الأدنى للطول. المتصفح وحده يعرف طول كلمة المرور، لذا فهو يُبلغ عن الكلمة القصيرة بعد تسجيل الدخول؛ ولا تغادره كلمة المرور ولا طولها أبدًا. «تم الإصلاح» هو وقت تغيير كلمة مرور الحساب - والحساب الذي يسجّل الدخول بكلمة مرور قصيرة مرة أخرى يُعرض مجددًا على أنه قصير جدًا.",
+  "password-length-no-results": "لا توجد حسابات هنا.",
+  "password-length-first-login": "أول تسجيل دخول",
+  "password-length-last-login": "آخر تسجيل دخول",
+  "password-length-login-count": "عدد مرات تسجيل الدخول",
+  "password-length-fixed": "تم الإصلاح",
+  "password-length-filter-short": "كلمة مرور قصيرة جدًا",
+  "password-length-filter-fixed": "تم الإصلاح إلى كلمة مرور بطول كافٍ",
+  "password-length-filter-all": "الكل",
+  "password-min-length": "الحد الأدنى لطول كلمة المرور",
+  "password-min-length-description": "يُدرَج أدناه تسجيل الدخول بكلمة مرور أقصر. ولا يُرفض تسجيل الدخول أبدًا بسبب ذلك.",
+  "password-min-length-enforce": "فرض الحد الأدنى للطول",
+  "password-min-length-enforce-description": "تُرفض كلمة المرور الجديدة الأقصر، ويجب على الحساب الذي يسجّل الدخول بكلمة مرور أقصر تغييرها قبل أي شيء آخر. يؤدي تغييرها إلى تسجيل خروج جميع جلسات الحساب. كلمات مرور LDAP وOAuth2 وOIDC وSAML وCAS وSandstorm تخص مزوّديها، ولا يتم فحصها.",
+  "password-length-saved": "تم الحفظ.",
+  "password-length-from-environment": "هناك قيمة مضبوطة في بيئة الخادم سارية المفعول؛ الحفظ هنا يتجاوزها.",
+  "password-change-required-title": "غيّر كلمة المرور",
+  "password-change-required-text": "يتطلب هذا الموقع الآن كلمات مرور لا تقل عن __min__ حرفًا، وكلمة مرورك أقصر. اختر كلمة أطول للمتابعة. بعد ذلك يتم تسجيل خروج جميع جلسات حسابك، وتسجّل الدخول مرة أخرى بكلمة المرور الجديدة.",
+  "password-same-as-username": "يجب ألا تكون كلمة المرور هي اسم المستخدم أو عنوان البريد الإلكتروني.",
  "if-you-already-have-an-account": "إذا كان لديك حساب بالفعل",
  "register": "تسجيل",
  "forgot-password": "نسيت كلمة المرور",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "نافذة الإخفاق (بالثواني)",
  "accounts-lockout-settings-updated": "تم تحديث إعدادات الحماية من القوة الغاشمة",
  "accounts-lockout-locked-users": "المستخدمون المقفلون",
+  "admin-audit-log": "سجل التدقيق",
+  "admin-audit-log-info": "ما قام به مديرو الموقع: تغييرات المستخدمين وتسجيل الدخول والتخزين والنسخ الاحتياطي، الأحدث أولاً. لا تُسجَّل كلمات المرور والأسرار أبدًا. يُحتفَظ به لمدة سنة.",
+  "admin-audit-log-when": "الوقت",
+  "admin-audit-log-who": "المدير",
+  "admin-audit-log-action": "الإجراء",
+  "admin-audit-log-details": "التفاصيل",
+  "admin-audit-log-empty": "لم يُسجَّل شيء بعد.",
  "accounts-lockout-locked-users-info": "المستخدمون المقفلون حالياً بسبب عدد كبير جداً من محاولات تسجيل الدخول الفاشلة",
  "accounts-lockout-no-locked-users": "لا يوجد حالياً مستخدمون مقفلون",
  "accounts-lockout-failed-attempts": "المحاولات الفاشلة",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "تخزين كائنات متوافق مع S3: AWS S3، MinIO، Cloudflare R2، Backblaze B2، Wasabi، DigitalOcean Spaces وغيرها.",
  "s3-force-path-style": "فرض روابط بنمط المسار (path-style)",
  "s3-force-path-style-description": "مطلوب لـ MinIO ومعظم الخوادم المتوافقة مع S3 غير التابعة لـ AWS.",
+  "s3-sse": "التشفير من جانب الخادم",
+  "s3-sse-none": "لم يُطلب أي تشفير (الإعداد الافتراضي للحاوية)",
+  "s3-sse-description": "يشفّر S3 كل مرفق وصورة رمزية ونسخة احتياطية يكتبها WeKan، ويفك تشفيرها لـ WeKan عند قراءتها.",
+  "s3-sse-kms-key-id": "معرّف مفتاح KMS لـ SSE-KMS (فارغ = المفتاح الافتراضي للحساب)",
  "azure-blob-storage": "Azure Blob Storage",
  "azure-blob-storage-description": "تخزين Microsoft Azure Blob.",
  "azure-account-name": "اسم الحساب",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "امسح رمز QR هذا باستخدام تطبيق مصادقة (مثل Google Authenticator أو Authy)، ثم أدخل الرمز المكوّن من 6 أرقام الظاهر للتأكيد.",
  "twoFactorAuth-manual-entry": "أو أدخل هذا الرمز يدويًا: ",
  "twoFactorAuth-confirm": "تأكيد وتفعيل",
+  "two-factor-required-title": "إعداد المصادقة الثنائية",
+  "two-factor-required-text": "يتطلب هذا الموقع المصادقة الثنائية لحسابك. قم بإعدادها للمتابعة.",
  "twoFactorCode-prompt": "أدخل رمز المصادقة المكوّن من 6 أرقام",
  "twoFactorCode-submit": "تحقق",
  "twoFactorCode-cancel": "إلغاء",
@@ -2586,6 +2586,27 @@
  "speed": "السرعة",
  "progress": "التقدّم",
  "password-again": "كلمة المرور (مرة أخرى)",
+  "password-pwned": "ظهرت كلمة المرور هذه في تسريب بيانات. اختر كلمة مرور أخرى.",
+  "password-too-short": "يجب ألا يقل طول كلمة المرور عن __min__ حرفًا.",
+  "password-length-report-title": "طول كلمة المرور",
+  "password-length-report-desc": "الحسابات التي سجّلت الدخول بكلمة مرور أقصر من الحد الأدنى للطول. المتصفح وحده يعرف طول كلمة المرور، لذا فهو يُبلغ عن الكلمة القصيرة بعد تسجيل الدخول؛ ولا تغادره كلمة المرور ولا طولها أبدًا. «تم الإصلاح» هو وقت تغيير كلمة مرور الحساب - والحساب الذي يسجّل الدخول بكلمة مرور قصيرة مرة أخرى يُعرض مجددًا على أنه قصير جدًا.",
+  "password-length-no-results": "لا توجد حسابات هنا.",
+  "password-length-first-login": "أول تسجيل دخول",
+  "password-length-last-login": "آخر تسجيل دخول",
+  "password-length-login-count": "عدد مرات تسجيل الدخول",
+  "password-length-fixed": "تم الإصلاح",
+  "password-length-filter-short": "كلمة مرور قصيرة جدًا",
+  "password-length-filter-fixed": "تم الإصلاح إلى كلمة مرور بطول كافٍ",
+  "password-length-filter-all": "الكل",
+  "password-min-length": "الحد الأدنى لطول كلمة المرور",
+  "password-min-length-description": "يُدرَج أدناه تسجيل الدخول بكلمة مرور أقصر. ولا يُرفض تسجيل الدخول أبدًا بسبب ذلك.",
+  "password-min-length-enforce": "فرض الحد الأدنى للطول",
+  "password-min-length-enforce-description": "تُرفض كلمة المرور الجديدة الأقصر، ويجب على الحساب الذي يسجّل الدخول بكلمة مرور أقصر تغييرها قبل أي شيء آخر. يؤدي تغييرها إلى تسجيل خروج جميع جلسات الحساب. كلمات مرور LDAP وOAuth2 وOIDC وSAML وCAS وSandstorm تخص مزوّديها، ولا يتم فحصها.",
+  "password-length-saved": "تم الحفظ.",
+  "password-length-from-environment": "هناك قيمة مضبوطة في بيئة الخادم سارية المفعول؛ الحفظ هنا يتجاوزها.",
+  "password-change-required-title": "غيّر كلمة المرور",
+  "password-change-required-text": "يتطلب هذا الموقع الآن كلمات مرور لا تقل عن __min__ حرفًا، وكلمة مرورك أقصر. اختر كلمة أطول للمتابعة. بعد ذلك يتم تسجيل خروج جميع جلسات حسابك، وتسجّل الدخول مرة أخرى بكلمة المرور الجديدة.",
+  "password-same-as-username": "يجب ألا تكون كلمة المرور هي اسم المستخدم أو عنوان البريد الإلكتروني.",
  "if-you-already-have-an-account": "إذا كان لديك حساب بالفعل",
  "register": "تسجيل",
  "forgot-password": "نسيت كلمة المرور",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "نافذة الإخفاق (بالثواني)",
  "accounts-lockout-settings-updated": "تم تحديث إعدادات الحماية من القوة الغاشمة",
  "accounts-lockout-locked-users": "المستخدمون المقفلون",
+  "admin-audit-log": "سجل التدقيق",
+  "admin-audit-log-info": "ما قام به مديرو الموقع: تغييرات المستخدمين وتسجيل الدخول والتخزين والنسخ الاحتياطي، الأحدث أولاً. لا تُسجَّل كلمات المرور والأسرار أبدًا. يُحتفَظ به لمدة سنة.",
+  "admin-audit-log-when": "الوقت",
+  "admin-audit-log-who": "المدير",
+  "admin-audit-log-action": "الإجراء",
+  "admin-audit-log-details": "التفاصيل",
+  "admin-audit-log-empty": "لم يُسجَّل شيء بعد.",
  "accounts-lockout-locked-users-info": "المستخدمون المقفلون حالياً بسبب عدد كبير جداً من محاولات تسجيل الدخول الفاشلة",
  "accounts-lockout-no-locked-users": "لا يوجد حالياً مستخدمون مقفلون",
  "accounts-lockout-failed-attempts": "المحاولات الفاشلة",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "تخزين كائنات متوافق مع S3: AWS S3، MinIO، Cloudflare R2، Backblaze B2، Wasabi، DigitalOcean Spaces وغيرها.",
  "s3-force-path-style": "فرض روابط بنمط المسار (path-style)",
  "s3-force-path-style-description": "مطلوب لـ MinIO ومعظم الخوادم المتوافقة مع S3 غير التابعة لـ AWS.",
+  "s3-sse": "التشفير من جانب الخادم",
+  "s3-sse-none": "لم يُطلب أي تشفير (الإعداد الافتراضي للحاوية)",
+  "s3-sse-description": "يشفّر S3 كل مرفق وصورة رمزية ونسخة احتياطية يكتبها WeKan، ويفك تشفيرها لـ WeKan عند قراءتها.",
+  "s3-sse-kms-key-id": "معرّف مفتاح KMS لـ SSE-KMS (فارغ = المفتاح الافتراضي للحساب)",
  "azure-blob-storage": "Azure Blob Storage",
  "azure-blob-storage-description": "تخزين Microsoft Azure Blob.",
  "azure-account-name": "اسم الحساب",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "امسح رمز QR هذا باستخدام تطبيق مصادقة (مثل Google Authenticator أو Authy)، ثم أدخل الرمز المكوّن من 6 أرقام الظاهر للتأكيد.",
  "twoFactorAuth-manual-entry": "أو أدخل هذا الرمز يدويًا: ",
  "twoFactorAuth-confirm": "تأكيد وتفعيل",
+  "two-factor-required-title": "إعداد المصادقة الثنائية",
+  "two-factor-required-text": "يتطلب هذا الموقع المصادقة الثنائية لحسابك. قم بإعدادها للمتابعة.",
  "twoFactorCode-prompt": "أدخل رمز المصادقة المكوّن من 6 أرقام",
  "twoFactorCode-submit": "تحقق",
  "twoFactorCode-cancel": "إلغاء",
@@ -2586,6 +2586,27 @@
  "speed": "السرعة",
  "progress": "التقدّم",
  "password-again": "كلمة المرور (مرة أخرى)",
+  "password-pwned": "ظهرت كلمة المرور هذه في تسريب بيانات. اختر كلمة مرور أخرى.",
+  "password-too-short": "يجب ألا يقل طول كلمة المرور عن __min__ حرفًا.",
+  "password-length-report-title": "طول كلمة المرور",
+  "password-length-report-desc": "الحسابات التي سجّلت الدخول بكلمة مرور أقصر من الحد الأدنى للطول. المتصفح وحده يعرف طول كلمة المرور، لذا فهو يُبلغ عن الكلمة القصيرة بعد تسجيل الدخول؛ ولا تغادره كلمة المرور ولا طولها أبدًا. «تم الإصلاح» هو وقت تغيير كلمة مرور الحساب - والحساب الذي يسجّل الدخول بكلمة مرور قصيرة مرة أخرى يُعرض مجددًا على أنه قصير جدًا.",
+  "password-length-no-results": "لا توجد حسابات هنا.",
+  "password-length-first-login": "أول تسجيل دخول",
+  "password-length-last-login": "آخر تسجيل دخول",
+  "password-length-login-count": "عدد مرات تسجيل الدخول",
+  "password-length-fixed": "تم الإصلاح",
+  "password-length-filter-short": "كلمة مرور قصيرة جدًا",
+  "password-length-filter-fixed": "تم الإصلاح إلى كلمة مرور بطول كافٍ",
+  "password-length-filter-all": "الكل",
+  "password-min-length": "الحد الأدنى لطول كلمة المرور",
+  "password-min-length-description": "يُدرَج أدناه تسجيل الدخول بكلمة مرور أقصر. ولا يُرفض تسجيل الدخول أبدًا بسبب ذلك.",
+  "password-min-length-enforce": "فرض الحد الأدنى للطول",
+  "password-min-length-enforce-description": "تُرفض كلمة المرور الجديدة الأقصر، ويجب على الحساب الذي يسجّل الدخول بكلمة مرور أقصر تغييرها قبل أي شيء آخر. يؤدي تغييرها إلى تسجيل خروج جميع جلسات الحساب. كلمات مرور LDAP وOAuth2 وOIDC وSAML وCAS وSandstorm تخص مزوّديها، ولا يتم فحصها.",
+  "password-length-saved": "تم الحفظ.",
+  "password-length-from-environment": "هناك قيمة مضبوطة في بيئة الخادم سارية المفعول؛ الحفظ هنا يتجاوزها.",
+  "password-change-required-title": "غيّر كلمة المرور",
+  "password-change-required-text": "يتطلب هذا الموقع الآن كلمات مرور لا تقل عن __min__ حرفًا، وكلمة مرورك أقصر. اختر كلمة أطول للمتابعة. بعد ذلك يتم تسجيل خروج جميع جلسات حسابك، وتسجّل الدخول مرة أخرى بكلمة المرور الجديدة.",
+  "password-same-as-username": "يجب ألا تكون كلمة المرور هي اسم المستخدم أو عنوان البريد الإلكتروني.",
  "if-you-already-have-an-account": "إذا كان لديك حساب بالفعل",
  "register": "تسجيل",
  "forgot-password": "نسيت كلمة المرور",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "نافذة الإخفاق (بالثواني)",
  "accounts-lockout-settings-updated": "تم تحديث إعدادات الحماية من القوة الغاشمة",
  "accounts-lockout-locked-users": "المستخدمون المقفلون",
+  "admin-audit-log": "سجل التدقيق",
+  "admin-audit-log-info": "ما قام به مديرو الموقع: تغييرات المستخدمين وتسجيل الدخول والتخزين والنسخ الاحتياطي، الأحدث أولاً. لا تُسجَّل كلمات المرور والأسرار أبدًا. يُحتفَظ به لمدة سنة.",
+  "admin-audit-log-when": "الوقت",
+  "admin-audit-log-who": "المدير",
+  "admin-audit-log-action": "الإجراء",
+  "admin-audit-log-details": "التفاصيل",
+  "admin-audit-log-empty": "لم يُسجَّل شيء بعد.",
  "accounts-lockout-locked-users-info": "المستخدمون المقفلون حالياً بسبب عدد كبير جداً من محاولات تسجيل الدخول الفاشلة",
  "accounts-lockout-no-locked-users": "لا يوجد حالياً مستخدمون مقفلون",
  "accounts-lockout-failed-attempts": "المحاولات الفاشلة",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "تخزين كائنات متوافق مع S3: AWS S3، MinIO، Cloudflare R2، Backblaze B2، Wasabi، DigitalOcean Spaces وغيرها.",
  "s3-force-path-style": "فرض روابط بنمط المسار (path-style)",
  "s3-force-path-style-description": "مطلوب لـ MinIO ومعظم الخوادم المتوافقة مع S3 غير التابعة لـ AWS.",
+  "s3-sse": "التشفير من جانب الخادم",
+  "s3-sse-none": "لم يُطلب أي تشفير (الإعداد الافتراضي للحاوية)",
+  "s3-sse-description": "يشفّر S3 كل مرفق وصورة رمزية ونسخة احتياطية يكتبها WeKan، ويفك تشفيرها لـ WeKan عند قراءتها.",
+  "s3-sse-kms-key-id": "معرّف مفتاح KMS لـ SSE-KMS (فارغ = المفتاح الافتراضي للحساب)",
  "azure-blob-storage": "Azure Blob Storage",
  "azure-blob-storage-description": "تخزين Microsoft Azure Blob.",
  "azure-account-name": "اسم الحساب",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "امسح رمز QR هذا باستخدام تطبيق مصادقة (مثل Google Authenticator أو Authy)، ثم أدخل الرمز المكوّن من 6 أرقام الظاهر للتأكيد.",
  "twoFactorAuth-manual-entry": "أو أدخل هذا الرمز يدويًا: ",
  "twoFactorAuth-confirm": "تأكيد وتفعيل",
+  "two-factor-required-title": "إعداد المصادقة الثنائية",
+  "two-factor-required-text": "يتطلب هذا الموقع المصادقة الثنائية لحسابك. قم بإعدادها للمتابعة.",
  "twoFactorCode-prompt": "أدخل رمز المصادقة المكوّن من 6 أرقام",
  "twoFactorCode-submit": "تحقق",
  "twoFactorCode-cancel": "إلغاء",
@@ -2586,6 +2586,27 @@
  "speed": "السرعة",
  "progress": "التقدّم",
  "password-again": "كلمة المرور (مرة أخرى)",
+  "password-pwned": "هاد كلمة المرور بانت فشي تسريب ديال البيانات. ختار شي وحدة أخرى.",
+  "password-too-short": "خاص كلمة المرور يكون فيها على الأقل __min__ حروف.",
+  "password-length-report-title": "الطول ديال كلمة المرور",
+  "password-length-report-desc": "الحسابات اللي دخلات بكلمة مرور قصيرة على الطول الأدنى. غير المتصفح اللي كيعرف شحال طويلة كلمة المرور، داكشي علاش كيبلّغ على القصيرة من بعد الدخول؛ كلمة المرور والطول ديالها عمرهم ما كيخرجو منو. «تصلّح» هو الوقت اللي تبدّلات فيه كلمة المرور ديال الحساب - والحساب اللي كيدخل عاوتاني بكلمة مرور قصيرة كيبان عاوتاني قصير بزاف.",
+  "password-length-no-results": "ما كاين حتى حساب هنا.",
+  "password-length-first-login": "أول دخول",
+  "password-length-last-login": "آخر دخول",
+  "password-length-login-count": "شحال من مرة دخل",
+  "password-length-fixed": "تصلّح",
+  "password-length-filter-short": "كلمة مرور قصيرة بزاف",
+  "password-length-filter-fixed": "تصلّح لكلمة مرور طويلة بما فيه الكفاية",
+  "password-length-filter-all": "كلشي",
+  "password-min-length": "الطول الأدنى ديال كلمة المرور",
+  "password-min-length-description": "الدخول بكلمة مرور قصيرة كيتسجّل لتحت. والدخول عمرو ما كيترفض على قبلها.",
+  "password-min-length-enforce": "فرض الطول الأدنى",
+  "password-min-length-enforce-description": "كلمة المرور الجديدة القصيرة كاتترفض، والحساب اللي كيدخل بكلمة مرور قصيرة خاصو يبدّلها قبل أي حاجة أخرى. التبديل ديالها كيخرّج كاع الجلسات ديال الحساب. كلمات المرور ديال LDAP وOAuth2 وOIDC وSAML وCAS وSandstorm ديال المزوّد ديالهم، وما كاتّفحصش.",
+  "password-length-saved": "تسجّل.",
+  "password-length-from-environment": "كاينة قيمة محطوطة فالبيئة ديال السيرفر خدّامة دابا؛ التسجيل هنا كيعوّضها.",
+  "password-change-required-title": "بدّل كلمة المرور ديالك",
+  "password-change-required-text": "هاد الموقع دابا كيطلب كلمات مرور فيها على الأقل __min__ حروف، وديالك قصيرة. ختار وحدة أطول باش تكمّل. من بعد كاع الجلسات ديال الحساب ديالك كيتخرّجو، وكتدخل عاوتاني بكلمة المرور الجديدة.",
+  "password-same-as-username": "كلمة المرور ما خاصهاش تكون هي اسم المستخدم ولا عنوان البريد الإلكتروني.",
  "if-you-already-have-an-account": "إذا كان لديك حساب بالفعل",
  "register": "تسجيل",
  "forgot-password": "نسيت كلمة المرور",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "نافذة الإخفاق (بالثواني)",
  "accounts-lockout-settings-updated": "تم تحديث إعدادات الحماية من القوة الغاشمة",
  "accounts-lockout-locked-users": "المستخدمون المقفلون",
+  "admin-audit-log": "سجل التدقيق",
+  "admin-audit-log-info": "شنو دارو المسيرين ديال الموقع: التبديلات ديال المستخدمين، الدخول، التخزين والنسخ الاحتياطي، الجديد هو اللول. كلمات المرور والأسرار عمرهم ما كيتسجلو. كيتحفظ لمدة عام.",
+  "admin-audit-log-when": "إمتى",
+  "admin-audit-log-who": "المدير",
+  "admin-audit-log-action": "الإجراء",
+  "admin-audit-log-details": "التفاصيل",
+  "admin-audit-log-empty": "مازال ما تسجل والو.",
  "accounts-lockout-locked-users-info": "المستخدمون المقفلون حالياً بسبب عدد كبير جداً من محاولات تسجيل الدخول الفاشلة",
  "accounts-lockout-no-locked-users": "لا يوجد حالياً مستخدمون مقفلون",
  "accounts-lockout-failed-attempts": "المحاولات الفاشلة",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "تخزين كائنات متوافق مع S3: AWS S3، MinIO، Cloudflare R2، Backblaze B2، Wasabi، DigitalOcean Spaces وغيرها.",
  "s3-force-path-style": "فرض روابط بنمط المسار (path-style)",
  "s3-force-path-style-description": "مطلوب لـ MinIO ومعظم الخوادم المتوافقة مع S3 غير التابعة لـ AWS.",
+  "s3-sse": "التشفير من جهة الخادم",
+  "s3-sse-none": "ما مطلوب والو (الإعداد الافتراضي ديال الحاوية)",
+  "s3-sse-description": "S3 كيشفر كل مرفق، صورة رمزية ونسخة احتياطية كيكتبها WeKan، وكيفك التشفير ديالها لـ WeKan ملي كتتقرا.",
+  "s3-sse-kms-key-id": "معرف مفتاح KMS لـ SSE-KMS (خاوي = المفتاح الافتراضي ديال الحساب)",
  "azure-blob-storage": "Azure Blob Storage",
  "azure-blob-storage-description": "تخزين Microsoft Azure Blob.",
  "azure-account-name": "اسم الحساب",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "امسح رمز QR هذا باستخدام تطبيق مصادقة (مثل Google Authenticator أو Authy)، ثم أدخل الرمز المكوّن من 6 أرقام الظاهر للتأكيد.",
  "twoFactorAuth-manual-entry": "أو أدخل هذا الرمز يدويًا: ",
  "twoFactorAuth-confirm": "تأكيد وتفعيل",
+  "two-factor-required-title": "وجّد المصادقة الثنائية",
+  "two-factor-required-text": "هاد الموقع كيطلب المصادقة الثنائية للحساب ديالك. وجّدها باش تكمل.",
  "twoFactorCode-prompt": "أدخل رمز المصادقة المكوّن من 6 أرقام",
  "twoFactorCode-submit": "تحقق",
  "twoFactorCode-cancel": "إلغاء",
@@ -2586,6 +2586,27 @@
  "speed": "গতি",
  "progress": "অগ্ৰগতি",
  "password-again": "পাছৱৰ্ড (পুনৰ)",
+  "password-pwned": "এই পাছৱৰ্ডটো এটা তথ্য ফাদিলত দেখা গৈছে। আন এটা বাছনি কৰক।",
+  "password-too-short": "পাছৱৰ্ডটো অতি কমেও __min__ টা আখৰৰ হ'ব লাগিব।",
+  "password-length-report-title": "পাছৱৰ্ডৰ দৈৰ্ঘ্য",
+  "password-length-report-desc": "নিম্নতম দৈৰ্ঘ্যতকৈ চুটি পাছৱৰ্ডেৰে লগ ইন কৰা একাউণ্টসমূহ। পাছৱৰ্ড কিমান দীঘল সেয়া কেৱল ব্ৰাউজাৰেহে জানে, সেয়েহে ই লগ ইনৰ পিছত চুটি পাছৱৰ্ডৰ বিষয়ে জনায়; পাছৱৰ্ড আৰু ইয়াৰ দৈৰ্ঘ্য কেতিয়াও ব্ৰাউজাৰৰ পৰা ওলাই নাযায়। সমাধান হৈছে মানে একাউণ্টৰ পাছৱৰ্ড সলনি কৰাৰ সময় - পুনৰ চুটি পাছৱৰ্ডেৰে লগ ইন কৰা একাউণ্ট পুনৰ অতি চুটি বুলি দেখুওৱা হয়।",
+  "password-length-no-results": "ইয়াত কোনো একাউণ্ট নাই।",
+  "password-length-first-login": "প্ৰথম লগ ইন",
+  "password-length-last-login": "শেষ লগ ইন",
+  "password-length-login-count": "লগ ইন কৰাৰ সংখ্যা",
+  "password-length-fixed": "সমাধান হৈছে",
+  "password-length-filter-short": "অতি চুটি পাছৱৰ্ড",
+  "password-length-filter-fixed": "যথেষ্ট দীঘল পাছৱৰ্ডলৈ সমাধান হৈছে",
+  "password-length-filter-all": "সকলো",
+  "password-min-length": "নিম্নতম পাছৱৰ্ড দৈৰ্ঘ্য",
+  "password-min-length-description": "চুটি পাছৱৰ্ডেৰে লগ ইন কৰাটো তলত তালিকাভুক্ত কৰা হয়। ইয়াৰ বাবে লগ ইন কেতিয়াও নাকচ কৰা নহয়।",
+  "password-min-length-enforce": "নিম্নতম দৈৰ্ঘ্য বাধ্যতামূলক কৰক",
+  "password-min-length-enforce-description": "চুটি নতুন পাছৱৰ্ড নাকচ কৰা হয়, আৰু চুটি পাছৱৰ্ডেৰে লগ ইন কৰা একাউণ্টে আন যিকোনো কামৰ আগতে ইয়াক সলনি কৰিব লাগিব। ইয়াক সলনি কৰিলে একাউণ্টৰ সকলো ছেছন লগ আউট হয়। LDAP, OAuth2, OIDC, SAML, CAS আৰু Sandstorm পাছৱৰ্ডসমূহ সিহঁতৰ প্ৰদানকাৰীৰ, আৰু পৰীক্ষা কৰা নহয়।",
+  "password-length-saved": "সংৰক্ষিত।",
+  "password-length-from-environment": "ছাৰ্ভাৰৰ পৰিৱেশত ছেট কৰা এটা মান কাৰ্যকৰী হৈ আছে; ইয়াত সংৰক্ষণ কৰিলে সেয়া অগ্ৰাহ্য হয়।",
+  "password-change-required-title": "আপোনাৰ পাছৱৰ্ড সলনি কৰক",
+  "password-change-required-text": "এই চাইটে এতিয়া অতি কমেও __min__ টা আখৰৰ পাছৱৰ্ড বিচাৰে, আৰু আপোনাৰটো চুটি। আগবাঢ়িবলৈ এটা দীঘল পাছৱৰ্ড বাছক। তাৰ পিছত আপোনাৰ একাউণ্টৰ সকলো ছেছন লগ আউট হয়, আৰু আপুনি নতুন পাছৱৰ্ডেৰে পুনৰ লগ ইন কৰে।",
+  "password-same-as-username": "পাছৱৰ্ডটো ব্যৱহাৰকাৰীৰ নাম বা ইমেইল ঠিকনা হ'ব নালাগে।",
  "if-you-already-have-an-account": "যদি আপোনাৰ ইতিমধ্যে একাউণ্ট আছে",
  "register": "পঞ্জীয়ন কৰক",
  "forgot-password": "পাছৱৰ্ড পাহৰিছে",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "বিফলতাৰ সময়-খিৰিকী (ছেকেণ্ড)",
  "accounts-lockout-settings-updated": "ব্ৰুট ফ'ৰ্চ সুৰক্ষাৰ ছেটিংছ আপডেট কৰা হৈছে",
  "accounts-lockout-locked-users": "লক কৰা ব্যৱহাৰকাৰীসকল",
+  "admin-audit-log": "নিৰীক্ষণ লগ",
+  "admin-audit-log-info": "ছাইটৰ প্ৰশাসকসকলে কি কৰিছিল: ব্যৱহাৰকাৰী, লগইন, সংৰক্ষণ আৰু বেকআপৰ সলনি, শেহতীয়াখিনি প্ৰথমে। পাছৱৰ্ড আৰু গোপন তথ্য কেতিয়াও ৰেকৰ্ড কৰা নহয়। এবছৰৰ বাবে ৰখা হয়।",
+  "admin-audit-log-when": "কেতিয়া",
+  "admin-audit-log-who": "প্ৰশাসক",
+  "admin-audit-log-action": "কাৰ্য",
+  "admin-audit-log-details": "সবিশেষ",
+  "admin-audit-log-empty": "এতিয়ালৈকে একো ৰেকৰ্ড কৰা হোৱা নাই।",
  "accounts-lockout-locked-users-info": "অত্যধিক বিফল লগইন প্ৰচেষ্টাৰ বাবে বৰ্তমান লক কৰা ব্যৱহাৰকাৰীসকল",
  "accounts-lockout-no-locked-users": "বৰ্তমান কোনো লক কৰা ব্যৱহাৰকাৰী নাই",
  "accounts-lockout-failed-attempts": "বিফল প্ৰচেষ্টাসমূহ",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "S3-সামঞ্জস্যপূৰ্ণ অবজেক্ট সংৰক্ষণ: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces আৰু অন্যান্য।",
  "s3-force-path-style": "পথ-শৈলীৰ URL বাধ্যতামূলক কৰক",
  "s3-force-path-style-description": "MinIO আৰু অধিকাংশ AWS-বহিৰ্ভূত S3-সুসংগত ছাৰ্ভাৰৰ বাবে প্ৰয়োজনীয়।",
+  "s3-sse": "ছাৰ্ভাৰ-পক্ষৰ এনক্ৰিপচন",
+  "s3-sse-none": "একো অনুৰোধ কৰা হোৱা নাই (বাকেটৰ অবিকল্পিত)",
+  "s3-sse-description": "WeKan-এ লিখা প্ৰতিটো সংলগ্ন, অৱতাৰ আৰু বেকআপ S3-এ এনক্ৰিপ্ট কৰে, আৰু পঢ়োঁতে WeKan-ৰ বাবে ডিক্ৰিপ্ট কৰে।",
+  "s3-sse-kms-key-id": "SSE-KMS-ৰ বাবে KMS চাবিৰ ID (খালী = একাউণ্টৰ অবিকল্পিত চাবি)",
  "azure-blob-storage": "Azure Blob Storage",
  "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
  "azure-account-name": "একাউণ্টৰ নাম",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "এটা প্ৰমাণীকৰণ এপৰ সৈতে এই QR ক'ডটো স্কেন কৰক (যেনে Google Authenticator, Authy), তাৰ পিছত নিশ্চিত কৰিবলৈ দেখুওৱা 6-অংকীয় ক'ডটো দিয়ক।",
  "twoFactorAuth-manual-entry": "নাইবা এই ক'ডটো হাতেৰে দিয়ক: ",
  "twoFactorAuth-confirm": "নিশ্চিত কৰক আৰু সক্ৰিয় কৰক",
+  "two-factor-required-title": "দুই-উপাদান প্ৰমাণীকৰণ ছেট আপ কৰক",
+  "two-factor-required-text": "এই ছাইটে আপোনাৰ একাউণ্টৰ বাবে দুই-উপাদান প্ৰমাণীকৰণ বিচাৰে। আগবাঢ়িবলৈ ইয়াক ছেট আপ কৰক।",
  "twoFactorCode-prompt": "আপোনাৰ 6-অংকীয় প্ৰমাণীকৰণ ক'ড দিয়ক",
  "twoFactorCode-submit": "নিশ্চিত কৰক",
  "twoFactorCode-cancel": "বাতিল কৰক",
@@ -2586,6 +2586,27 @@
  "speed": "Velocidad",
  "progress": "Progreso",
  "password-again": "Contraseña (repetir)",
+  "password-pwned": "Esta contraseña apaeció nuna filtración de datos. Escueyi otra.",
+  "password-too-short": "La contraseña tien de tener polo menos __min__ caráuteres.",
+  "password-length-report-title": "Llonxitú de la contraseña",
+  "password-length-report-desc": "Cuentes qu'aniciaron sesión con una contraseña más curtia que la llonxitú mínima. Namás el restolador sabe cuánto mide una contraseña, polo qu'informa d'una curtia dempués d'aniciar sesión; la contraseña y la so llonxitú enxamás nun salen d'él. Iguada ye cuando se camudó la contraseña de la cuenta - una cuenta qu'anicia sesión otra vegada con una contraseña curtia amuésase otra vegada como enforma curtia.",
+  "password-length-no-results": "Equí nun hai cuentes.",
+  "password-length-first-login": "Primer aniciu de sesión",
+  "password-length-last-login": "Últimu aniciu de sesión",
+  "password-length-login-count": "Vegaes qu'anició sesión",
+  "password-length-fixed": "Iguada",
+  "password-length-filter-short": "Contraseña enforma curtia",
+  "password-length-filter-fixed": "Iguada a una contraseña abondo llarga",
+  "password-length-filter-all": "Too",
+  "password-min-length": "Llonxitú mínima de la contraseña",
+  "password-min-length-description": "Aniciar sesión con una contraseña más curtia apaez llistao abaxo. Enxamás nun se refuga l'aniciu de sesión por ello.",
+  "password-min-length-enforce": "Imponer la llonxitú mínima",
+  "password-min-length-enforce-description": "Refúgase una contraseña nueva más curtia, y una cuenta qu'anicia sesión con una contraseña más curtia tien de camudala enantes de cualquier otra cosa. Camudala zarra toles sesiones de la cuenta. Les contraseñes de LDAP, OAuth2, OIDC, SAML, CAS y Sandstorm son del so fornidor y nun se comprueben.",
+  "password-length-saved": "Guardóse.",
+  "password-length-from-environment": "Ta n'efeutu un valor definíu nel entornu del sirvidor; guardar equí sobrescríbelu.",
+  "password-change-required-title": "Camuda la to contraseña",
+  "password-change-required-text": "Esti sitiu agora rique contraseñes de polo menos __min__ caráuteres, y la to ye más curtia. Escueyi una más llarga pa siguir. Dempués zárrense toles sesiones de la to cuenta, y anicies sesión otra vegada cola contraseña nueva.",
+  "password-same-as-username": "La contraseña nun pue ser el nome d'usuariu nin la direición de corréu electrónicu.",
  "if-you-already-have-an-account": "Si ja tens un compte",
  "register": "Registra't",
  "forgot-password": "Has oblidat la contrasenya",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "Ventana de fallos (segundos)",
  "accounts-lockout-settings-updated": "Actualizáronse les preferencies de proteición contra ataques de fuercia bruto",
  "accounts-lockout-locked-users": "Usuarios bloquiaos",
+  "admin-audit-log": "Rexistru d'auditoría",
+  "admin-audit-log-info": "Lo que ficieron los alministradores del sitiu: cambeos d'usuarios, d'aniciu de sesión, d'almacenamientu y de copies de seguridá, primero lo más recién. Les contraseñes y los secretos enxamás se rexistren. Caltiénse un añu.",
+  "admin-audit-log-when": "Cuándo",
+  "admin-audit-log-who": "Administrador",
+  "admin-audit-log-action": "Aición",
+  "admin-audit-log-details": "Detalles",
+  "admin-audit-log-empty": "Entá nun se rexistró nada.",
  "accounts-lockout-locked-users-info": "Usuarios bloquiaos anguaño por demasiaos intentos fallíos d'aniciu de sesión",
  "accounts-lockout-no-locked-users": "Anguaño nun hai usuarios bloquiaos",
  "accounts-lockout-failed-attempts": "Intentos fallidos",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "Almacenamientu d'oxetos compatible con S3: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces y otros.",
  "s3-force-path-style": "Forzar URLs con estilu de ruta",
  "s3-force-path-style-description": "Necesariu pa MinIO y la mayoría de los sirvidores compatibles con S3 que nun son d'AWS.",
+  "s3-sse": "Cifráu nel sirvidor",
+  "s3-sse-none": "Nun se pidió nengún (el predetermináu del bucket)",
+  "s3-sse-description": "S3 cifra cada axuntu, avatar y copia de seguridá qu'escribe WeKan, y descífralo pa WeKan al lleelo.",
+  "s3-sse-kms-key-id": "ID de clave KMS pa SSE-KMS (baleru = la clave predeterminada de la cuenta)",
  "azure-blob-storage": "Azure Blob Storage",
  "azure-blob-storage-description": "Almacenamientu Microsoft Azure Blob.",
  "azure-account-name": "Nome de la cuenta",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "Escanea esti códigu QR con una aplicación autenticadora (p. ex. Google Authenticator, Authy), y dempués introduz el códigu de 6 díxitos qu'amuesa pa confirmar.",
  "twoFactorAuth-manual-entry": "O introduz esti códigu manualmente: ",
  "twoFactorAuth-confirm": "Confirmar y Activar",
+  "two-factor-required-title": "Configura l'autenticación de dos factores",
+  "two-factor-required-text": "Esti sitiu rique l'autenticación de dos factores pa la to cuenta. Configúrala pa siguir.",
  "twoFactorCode-prompt": "Introduz el to códigu d'autenticación de 6 díxitos",
  "twoFactorCode-submit": "Verificar",
  "twoFactorCode-cancel": "Encaboxar",
@@ -2586,6 +2586,27 @@
  "speed": "Aymar aruna: Speed",
  "progress": "Nayrar sartawi",
  "password-again": "jamasaru (again)",
+  "password-pwned": "Aka imantata aruxa mä datos lluqhsuwinwa uñstawayi. Yaqha ajlliñamawa.",
+  "password-too-short": "Imantata aruxa __min__ qillqanakat juk'ampiniwa utjañapa.",
+  "password-length-report-title": "Imantata aru jach'a",
+  "password-length-report-desc": "Jakhuwinaka, imantata aru jisk'ampimpi mantapki, juk'a jach'atxa jisk'akiwa. Navegadorakiw imantata aru qhawqha jach'achixa uk yati, ukatwa mantatat qhipat jisk'a imantata aru yatiyi; imantata aru, jach'apasa janipuniw navegadorat mistki. Askichatawa, jakhuwin imantata arupa mayjt'ayatäki uka pachawa - mayamp jisk'a imantata arumpi mantki uka jakhuwixa mayampiw sinti jisk'jam uñacht'ayasi.",
+  "password-length-no-results": "Akan janiw jakhuwinakax utjkiti.",
+  "password-length-first-login": "Nayrïr mantawi",
+  "password-length-last-login": "Qhipïr mantawi",
+  "password-length-login-count": "Qhawqha kuti mantawi",
+  "password-length-fixed": "Askichata",
+  "password-length-filter-short": "Sinti jisk'a imantata aru",
+  "password-length-filter-fixed": "Jach'a imantata aruru askichata",
+  "password-length-filter-all": "Taqpacha",
+  "password-min-length": "Imantata aru juk'a jach'a",
+  "password-min-length-description": "Jisk'ampi imantata arumpi mantawixa aka manqhan qillqatawa. Mantawixa janipuniw ukatxa jark'atäkiti.",
+  "password-min-length-enforce": "Juk'a jach'a phuqhayaña",
+  "password-min-length-enforce-description": "Machaq jisk'a imantata aruxa janiw katuqatäkiti, ukat jisk'a imantata arumpi mantki uka jakhuwixa yaqha luräwinak nayraqatxa mayjt'ayañapawa. Mayjt'ayañaxa jakhuwin taqpach sesionanakap mistuyi. LDAP, OAuth2, OIDC, SAML, CAS, Sandstorm imantata arunakaxa churirinakapankiwa, janiw uñakipatäkiti.",
+  "password-length-saved": "Imatawa.",
+  "password-length-from-environment": "Servidoran pachapan uskuta chimpuw jichhax irnaqaski; akan imañaxa ukar mayjt'ayi.",
+  "password-change-required-title": "Imantata arum mayjt'ayam",
+  "password-change-required-text": "Aka sitioxa jichhax __min__ qillqanakat juk'ampi imantata arunak mayi, jumanxa jisk'awa. Sarantañatakix juk'amp jach'a ajllim. Ukatxa jakhuwiman taqpach sesionanakapax mistuyatawa, ukat machaq imantata arumpiw mayamp mantäta.",
+  "password-same-as-username": "Imantata aruxa apnaqirin sutipa jan ukax aruskipäwi chiqapa janiw utjañapakiti.",
  "if-you-already-have-an-account": "Aymar aruna: If you already have an account",
  "register": "Qillqantasiña",
  "forgot-password": "Imantata aru armt'ata",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "Failure window (segundunaka)",
  "accounts-lockout-settings-updated": "Brute force protection wakichäwinaka have been updated",
  "accounts-lockout-locked-users": "Locked apnaqirinaka",
+  "admin-audit-log": "Uñakipäwi qillqata",
+  "admin-audit-log-info": "Kuntix sitio apnaqirinakax lurapki: apnaqirinaka, mantañanaka, imañanaka ukat jark'aqawi copia mayjt'ayawinaka, machaqanakax nayraqata. Imantata arunaka ukat imantatanakax janipuniw qillqatäkiti. Mä mara imatawa.",
+  "admin-audit-log-when": "Kunawsa",
+  "admin-audit-log-who": "Apnaqañ irpiri",
+  "admin-audit-log-action": "Lurawi",
+  "admin-audit-log-details": "Qhanañchäwinaka",
+  "admin-audit-log-empty": "Janiw kunas qillqatäkiti.",
  "accounts-lockout-locked-users-info": "apnaqirinaka currently locked out tukuyañ ukaru too many jani phuqhata login yantʼawinaka",
  "accounts-lockout-no-locked-users": "There apxi currently janiwa locked apnaqirinaka",
  "accounts-lockout-failed-attempts": "jani phuqhata yantʼawinaka",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "S3 kikip yänak imaña: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces ukat yaqhanaka.",
  "s3-force-path-style": "Aymar aruna: Force path-style URLs",
  "s3-force-path-style-description": "wakisiri by MinIO ukat most non-AWS S3-compatible servers.",
+  "s3-sse": "Servidor tuqin imantaña",
+  "s3-sse-none": "Janiw mayitäkiti (bucket nayrïri)",
+  "s3-sse-description": "S3 ukax sapa chinuta, avatar ukat jark'aqawi copia WeKan qillqki ukanak imantaraki, ullañanx WeKan layku jist'arakiwa.",
+  "s3-sse-kms-key-id": "SSE-KMS layku KMS llave ID (ch'usa = cuenta nayrïri llave)",
  "azure-blob-storage": "Azure Blob Storage",
  "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
  "azure-account-name": "Account suti",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "Aka código QR ukar sarayam mä app chiqapachañataki (Google Authenticator, Authy ukhamanaka), ukat 6 jakhu código uñacht'ayatapa yatiyañataki qillqam.",
  "twoFactorAuth-manual-entry": "Jan ukax aka código amparampi qillqam: ",
  "twoFactorAuth-confirm": "Chiqapachaña ukat Apnaqaña",
+  "two-factor-required-title": "Pä Kunayman Chaqañ Chiqapachäwi wakicht'aña",
+  "two-factor-required-text": "Aka sitiox cuentamatakix Pä Kunayman Chaqañ Chiqapachäwi mayi. Sarantañatakix wakicht'am.",
  "twoFactorCode-prompt": "Jumana 6 jakhu chiqapachäwi código qillqam",
  "twoFactorCode-submit": "Chiqapachaña",
  "twoFactorCode-cancel": "Jark'aña",
@@ -2586,6 +2586,27 @@
  "speed": "Sürət",
  "progress": "Tərəqqi",
  "password-again": "Parol (yenidən)",
+  "password-pwned": "Bu parol məlumat sızmasında aşkar edilib. Başqa parol seçin.",
+  "password-too-short": "Parol ən azı __min__ simvol uzunluğunda olmalıdır.",
+  "password-length-report-title": "Parol uzunluğu",
+  "password-length-report-desc": "Minimum uzunluqdan qısa parolla daxil olan hesablar. Parolun nə qədər uzun olduğunu yalnız brauzer bilir, buna görə daxil olduqdan sonra qısa parol barədə məlumat verir; parol və onun uzunluğu heç vaxt brauzeri tərk etmir. Düzəldildi hesabın parolunun dəyişdirildiyi vaxtdır - yenidən qısa parolla daxil olan hesab yenidən çox qısa kimi göstərilir.",
+  "password-length-no-results": "Burada hesab yoxdur.",
+  "password-length-first-login": "İlk giriş",
+  "password-length-last-login": "Son giriş",
+  "password-length-login-count": "Giriş sayı",
+  "password-length-fixed": "Düzəldildi",
+  "password-length-filter-short": "Çox qısa parol",
+  "password-length-filter-fixed": "Kifayət qədər uzun parola düzəldildi",
+  "password-length-filter-all": "Hamısı",
+  "password-min-length": "Minimum parol uzunluğu",
+  "password-min-length-description": "Daha qısa parolla daxil olmaq aşağıda siyahıya alınır. Buna görə giriş heç vaxt rədd edilmir.",
+  "password-min-length-enforce": "Minimum uzunluğu tətbiq et",
+  "password-min-length-enforce-description": "Daha qısa yeni parol rədd edilir və daha qısa parolla daxil olan hesab hər şeydən əvvəl onu dəyişməlidir. Onu dəyişmək hesabın bütün sessiyalarından çıxış edir. LDAP, OAuth2, OIDC, SAML, CAS və Sandstorm parolları öz provayderlərinə aiddir və yoxlanılmır.",
+  "password-length-saved": "Saxlanıldı.",
+  "password-length-from-environment": "Serverin mühitində təyin edilmiş dəyər qüvvədədir; burada saxlamaq onu əvəz edir.",
+  "password-change-required-title": "Parolunuzu dəyişin",
+  "password-change-required-text": "Bu sayt indi ən azı __min__ simvoldan ibarət parollar tələb edir, sizinki isə daha qısadır. Davam etmək üçün daha uzun birini seçin. Sonra hesabınızın bütün sessiyalarından çıxış edilir və yeni parolla yenidən daxil olursunuz.",
+  "password-same-as-username": "Parol istifadəçi adı və ya e-poçt ünvanı olmamalıdır.",
  "if-you-already-have-an-account": "Əgər artıq hesabınız varsa",
  "register": "Qeydiyyatdan keçin",
  "forgot-password": "parol unutmusunuz",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "Xəta pəncərəsi (saniyə)",
  "accounts-lockout-settings-updated": "Qəddar qüvvədən qorunma parametrləri yeniləndi",
  "accounts-lockout-locked-users": "Bağlı İstifadəçilər",
+  "admin-audit-log": "Audit jurnalı",
+  "admin-audit-log-info": "Sayt inzibatçılarının etdikləri: istifadəçi, giriş, yaddaş və ehtiyat nüsxə dəyişiklikləri, ən yenilər əvvəldə. Parollar və gizli məlumatlar heç vaxt qeydə alınmır. Bir il saxlanılır.",
+  "admin-audit-log-when": "Nə vaxt",
+  "admin-audit-log-who": "İnzibatçı",
+  "admin-audit-log-action": "Əməliyyat",
+  "admin-audit-log-details": "Təfərrüatlar",
+  "admin-audit-log-empty": "Hələ heç nə qeydə alınmayıb.",
  "accounts-lockout-locked-users-info": "İstifadəçilər çoxlu uğursuz giriş cəhdləri səbəbindən hazırda bloklanıb",
  "accounts-lockout-no-locked-users": "Hazırda kilidlənmiş istifadəçi yoxdur",
  "accounts-lockout-failed-attempts": "Uğursuz cəhdlər",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "S3 uyğun obyekt saxlaması: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces və digərləri.",
  "s3-force-path-style": "Yol tərzli URL-ləri məcbur et",
  "s3-force-path-style-description": "MinIO və əksər qeyri-AWS S3 uyğun serverləri üçün tələb olunur.",
+  "s3-sse": "Server tərəfində şifrələmə",
+  "s3-sse-none": "Tələb olunmayıb (bucket-in defolt ayarı)",
+  "s3-sse-description": "S3 WeKan-ın yazdığı hər qoşmanı, avatarı və ehtiyat nüsxəni şifrələyir və oxunduqda WeKan üçün deşifrə edir.",
+  "s3-sse-kms-key-id": "SSE-KMS üçün KMS açar ID-si (boş = hesabın defolt açarı)",
  "azure-blob-storage": "Azure Blob Storage",
  "azure-blob-storage-description": "Microsoft Azure Blob saxlancı.",
  "azure-account-name": "Hesab adı",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "Bu QR kodunu doğrulama tətbiqi ilə (məsələn, Google Authenticator, Authy) skan edin, sonra təsdiqləmək üçün göstərilən 6 rəqəmli kodu daxil edin.",
  "twoFactorAuth-manual-entry": "Və ya bu kodu əl ilə daxil edin: ",
  "twoFactorAuth-confirm": "Təsdiqlə və Aktiv Et",
+  "two-factor-required-title": "İki faktorlu doğrulamanı qurun",
+  "two-factor-required-text": "Bu sayt hesabınız üçün iki faktorlu doğrulama tələb edir. Davam etmək üçün onu qurun.",
  "twoFactorCode-prompt": "6 rəqəmli doğrulama kodunuzu daxil edin",
  "twoFactorCode-submit": "Doğrula",
  "twoFactorCode-cancel": "Ləğv et",
@@ -2586,6 +2586,27 @@
  "speed": "Sürət",
  "progress": "Tərəqqi",
  "password-again": "Parol (yenidən)",
+  "password-pwned": "Bu parol məlumat sızmasında aşkar edilib. Başqa parol seçin.",
+  "password-too-short": "Parol ən azı __min__ simvol uzunluğunda olmalıdır.",
+  "password-length-report-title": "Parol uzunluğu",
+  "password-length-report-desc": "Minimum uzunluqdan qısa parolla daxil olan hesablar. Parolun nə qədər uzun olduğunu yalnız brauzer bilir, buna görə daxil olduqdan sonra qısa parol barədə məlumat verir; parol və onun uzunluğu heç vaxt brauzeri tərk etmir. Düzəldildi hesabın parolunun dəyişdirildiyi vaxtdır - yenidən qısa parolla daxil olan hesab yenidən çox qısa kimi göstərilir.",
+  "password-length-no-results": "Burada hesab yoxdur.",
+  "password-length-first-login": "İlk giriş",
+  "password-length-last-login": "Son giriş",
+  "password-length-login-count": "Giriş sayı",
+  "password-length-fixed": "Düzəldildi",
+  "password-length-filter-short": "Çox qısa parol",
+  "password-length-filter-fixed": "Kifayət qədər uzun parola düzəldildi",
+  "password-length-filter-all": "Hamısı",
+  "password-min-length": "Minimum parol uzunluğu",
+  "password-min-length-description": "Daha qısa parolla daxil olmaq aşağıda siyahıya alınır. Buna görə giriş heç vaxt rədd edilmir.",
+  "password-min-length-enforce": "Minimum uzunluğu tətbiq et",
+  "password-min-length-enforce-description": "Daha qısa yeni parol rədd edilir və daha qısa parolla daxil olan hesab hər şeydən əvvəl onu dəyişməlidir. Onu dəyişmək hesabın bütün sessiyalarından çıxış edir. LDAP, OAuth2, OIDC, SAML, CAS və Sandstorm parolları öz provayderlərinə aiddir və yoxlanılmır.",
+  "password-length-saved": "Saxlanıldı.",
+  "password-length-from-environment": "Serverin mühitində təyin edilmiş dəyər qüvvədədir; burada saxlamaq onu əvəz edir.",
+  "password-change-required-title": "Parolunuzu dəyişin",
+  "password-change-required-text": "Bu sayt indi ən azı __min__ simvoldan ibarət parollar tələb edir, sizinki isə daha qısadır. Davam etmək üçün daha uzun birini seçin. Sonra hesabınızın bütün sessiyalarından çıxış edilir və yeni parolla yenidən daxil olursunuz.",
+  "password-same-as-username": "Parol istifadəçi adı və ya e-poçt ünvanı olmamalıdır.",
  "if-you-already-have-an-account": "Əgər artıq hesabınız varsa",
  "register": "Qeydiyyatdan keçin",
  "forgot-password": "parol unutmusunuz",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "Xəta pəncərəsi (saniyə)",
  "accounts-lockout-settings-updated": "Qəddar qüvvədən qorunma parametrləri yeniləndi",
  "accounts-lockout-locked-users": "Bağlı İstifadəçilər",
+  "admin-audit-log": "Audit jurnalı",
+  "admin-audit-log-info": "Sayt inzibatçılarının etdikləri: istifadəçi, giriş, yaddaş və ehtiyat nüsxə dəyişiklikləri, ən yenilər əvvəldə. Parollar və gizli məlumatlar heç vaxt qeydə alınmır. Bir il saxlanılır.",
+  "admin-audit-log-when": "Nə vaxt",
+  "admin-audit-log-who": "İnzibatçı",
+  "admin-audit-log-action": "Əməliyyat",
+  "admin-audit-log-details": "Təfərrüatlar",
+  "admin-audit-log-empty": "Hələ heç nə qeydə alınmayıb.",
  "accounts-lockout-locked-users-info": "İstifadəçilər çoxlu uğursuz giriş cəhdləri səbəbindən hazırda bloklanıb",
  "accounts-lockout-no-locked-users": "Hazırda kilidlənmiş istifadəçi yoxdur",
  "accounts-lockout-failed-attempts": "Uğursuz cəhdlər",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "S3 uyğun obyekt saxlaması: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces və digərləri.",
  "s3-force-path-style": "Yol tərzli URL-ləri məcbur et",
  "s3-force-path-style-description": "MinIO və əksər qeyri-AWS S3 uyğun serverləri üçün tələb olunur.",
+  "s3-sse": "Server tərəfində şifrələmə",
+  "s3-sse-none": "Tələb olunmayıb (bucket-in defolt ayarı)",
+  "s3-sse-description": "S3 WeKan-ın yazdığı hər qoşmanı, avatarı və ehtiyat nüsxəni şifrələyir və oxunduqda WeKan üçün deşifrə edir.",
+  "s3-sse-kms-key-id": "SSE-KMS üçün KMS açar ID-si (boş = hesabın defolt açarı)",
  "azure-blob-storage": "Azure Blob Storage",
  "azure-blob-storage-description": "Microsoft Azure Blob saxlancı.",
  "azure-account-name": "Hesab adı",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "Bu QR kodu autentifikasiya tətbiqi ilə skan edin (məs. Google Authenticator, Authy), sonra təsdiq üçün göstərilən 6 rəqəmli kodu daxil edin.",
  "twoFactorAuth-manual-entry": "Və ya bu kodu əl ilə daxil edin: ",
  "twoFactorAuth-confirm": "Təsdiq Et və Aktivləşdir",
+  "two-factor-required-title": "İki mərhələli doğrulamanı qurun",
+  "two-factor-required-text": "Bu sayt hesabınız üçün iki mərhələli doğrulama tələb edir. Davam etmək üçün onu qurun.",
  "twoFactorCode-prompt": "6 rəqəmli doğrulama kodunuzu daxil edin",
  "twoFactorCode-submit": "Doğrula",
  "twoFactorCode-cancel": "Ləğv et",
@@ -2586,6 +2586,27 @@
  "speed": "Sürət",
  "progress": "Tərəqqi",
  "password-again": "Parol (yenidən)",
+  "password-pwned": "Bu parol məlumat sızmasında aşkar edilib. Başqa parol seçin.",
+  "password-too-short": "Parol ən azı __min__ simvol uzunluğunda olmalıdır.",
+  "password-length-report-title": "Parol uzunluğu",
+  "password-length-report-desc": "Minimum uzunluqdan qısa parolla daxil olan hesablar. Parolun nə qədər uzun olduğunu yalnız brauzer bilir, buna görə daxil olduqdan sonra qısa parol barədə məlumat verir; parol və onun uzunluğu heç vaxt brauzeri tərk etmir. Düzəldildi hesabın parolunun dəyişdirildiyi vaxtdır - yenidən qısa parolla daxil olan hesab yenidən çox qısa kimi göstərilir.",
+  "password-length-no-results": "Burada hesab yoxdur.",
+  "password-length-first-login": "İlk giriş",
+  "password-length-last-login": "Son giriş",
+  "password-length-login-count": "Giriş sayı",
+  "password-length-fixed": "Düzəldildi",
+  "password-length-filter-short": "Çox qısa parol",
+  "password-length-filter-fixed": "Kifayət qədər uzun parola düzəldildi",
+  "password-length-filter-all": "Hamısı",
+  "password-min-length": "Minimum parol uzunluğu",
+  "password-min-length-description": "Daha qısa parolla daxil olmaq aşağıda siyahıya alınır. Buna görə giriş heç vaxt rədd edilmir.",
+  "password-min-length-enforce": "Minimum uzunluğu tətbiq et",
+  "password-min-length-enforce-description": "Daha qısa yeni parol rədd edilir və daha qısa parolla daxil olan hesab hər şeydən əvvəl onu dəyişməlidir. Onu dəyişmək hesabın bütün sessiyalarından çıxış edir. LDAP, OAuth2, OIDC, SAML, CAS və Sandstorm parolları öz provayderlərinə aiddir və yoxlanılmır.",
+  "password-length-saved": "Saxlanıldı.",
+  "password-length-from-environment": "Serverin mühitində təyin edilmiş dəyər qüvvədədir; burada saxlamaq onu əvəz edir.",
+  "password-change-required-title": "Parolunuzu dəyişin",
+  "password-change-required-text": "Bu sayt indi ən azı __min__ simvoldan ibarət parollar tələb edir, sizinki isə daha qısadır. Davam etmək üçün daha uzun birini seçin. Sonra hesabınızın bütün sessiyalarından çıxış edilir və yeni parolla yenidən daxil olursunuz.",
+  "password-same-as-username": "Parol istifadəçi adı və ya e-poçt ünvanı olmamalıdır.",
  "if-you-already-have-an-account": "Əgər artıq hesabınız varsa",
  "register": "Qeydiyyatdan keçin",
  "forgot-password": "parol unutmusunuz",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "Xəta pəncərəsi (saniyə)",
  "accounts-lockout-settings-updated": "Qəddar qüvvədən qorunma parametrləri yeniləndi",
  "accounts-lockout-locked-users": "Bağlı İstifadəçilər",
+  "admin-audit-log": "Audit jurnalı",
+  "admin-audit-log-info": "Sayt inzibatçılarının etdikləri: istifadəçi, giriş, yaddaş və ehtiyat nüsxə dəyişiklikləri, ən yenilər əvvəldə. Parollar və gizli məlumatlar heç vaxt qeydə alınmır. Bir il saxlanılır.",
+  "admin-audit-log-when": "Nə vaxt",
+  "admin-audit-log-who": "İnzibatçı",
+  "admin-audit-log-action": "Əməliyyat",
+  "admin-audit-log-details": "Təfərrüatlar",
+  "admin-audit-log-empty": "Hələ heç nə qeydə alınmayıb.",
  "accounts-lockout-locked-users-info": "İstifadəçilər çoxlu uğursuz giriş cəhdləri səbəbindən hazırda bloklanıb",
  "accounts-lockout-no-locked-users": "Hazırda kilidlənmiş istifadəçi yoxdur",
  "accounts-lockout-failed-attempts": "Uğursuz cəhdlər",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "S3 uyğun obyekt saxlaması: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces və digərləri.",
  "s3-force-path-style": "Yol tərzli URL-ləri məcbur et",
  "s3-force-path-style-description": "MinIO və əksər qeyri-AWS S3 uyğun serverləri üçün tələb olunur.",
+  "s3-sse": "Server tərəfində şifrələmə",
+  "s3-sse-none": "Tələb olunmayıb (bucket-in defolt ayarı)",
+  "s3-sse-description": "S3 WeKan-ın yazdığı hər qoşmanı, avatarı və ehtiyat nüsxəni şifrələyir və oxunduqda WeKan üçün deşifrə edir.",
+  "s3-sse-kms-key-id": "SSE-KMS üçün KMS açar ID-si (boş = hesabın defolt açarı)",
  "azure-blob-storage": "Azure Blob Storage",
  "azure-blob-storage-description": "Microsoft Azure Blob saxlancı.",
  "azure-account-name": "Hesab adı",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "Bu QR kodu autentifikasiya tətbiqi ilə skan edin (məs. Google Authenticator, Authy), sonra təsdiq üçün göstərilən 6 rəqəmli kodu daxil edin.",
  "twoFactorAuth-manual-entry": "Və ya bu kodu əl ilə daxil edin: ",
  "twoFactorAuth-confirm": "Təsdiq Et və Aktivləşdir",
+  "two-factor-required-title": "İki mərhələli doğrulamanı qurun",
+  "two-factor-required-text": "Bu sayt hesabınız üçün iki mərhələli doğrulama tələb edir. Davam etmək üçün onu qurun.",
  "twoFactorCode-prompt": "6 rəqəmli doğrulama kodunuzu daxil edin",
  "twoFactorCode-submit": "Doğrula",
  "twoFactorCode-cancel": "Ləğv et",
@@ -2586,6 +2586,27 @@
  "speed": "Тиҙлек",
  "progress": "Алға китеш",
  "password-again": "Серһүҙ (ҡабат)",
+  "password-pwned": "Был серһүҙ мәғлүмәттәр ағыуында күренгән. Башҡаһын һайлағыҙ.",
+  "password-too-short": "Серһүҙ кәмендә __min__ символдан торорға тейеш.",
+  "password-length-report-title": "Серһүҙ оҙонлоғо",
+  "password-length-report-desc": "Минималь оҙонлоҡтан ҡыҫҡараҡ серһүҙ менән ингән иҫәп яҙмалары. Серһүҙҙең оҙонлоғон браузер ғына белә, шуға ла ул ингәндән һуң ҡыҫҡа серһүҙ тураһында хәбәр итә; серһүҙ һәм уның оҙонлоғо бер ҡасан да браузерҙан сыҡмай. Төҙәтелгән — иҫәп яҙмаһының серһүҙе үҙгәртелгән ваҡыт - яңынан ҡыҫҡа серһүҙ менән ингән иҫәп яҙмаһы яңынан бик ҡыҫҡа булып күрһәтелә.",
+  "password-length-no-results": "Бында иҫәп яҙмалары юҡ.",
+  "password-length-first-login": "Беренсе инеү",
+  "password-length-last-login": "Һуңғы инеү",
+  "password-length-login-count": "Инеүҙәр һаны",
+  "password-length-fixed": "Төҙәтелгән",
+  "password-length-filter-short": "Бик ҡыҫҡа серһүҙ",
+  "password-length-filter-fixed": "Етерлек оҙон серһүҙгә төҙәтелгән",
+  "password-length-filter-all": "Барыһы ла",
+  "password-min-length": "Серһүҙҙең минималь оҙонлоғо",
+  "password-min-length-description": "Ҡыҫҡараҡ серһүҙ менән инеү түбәндә күрһәтелә. Был сәбәпле инеү бер ҡасан да кире ҡағылмай.",
+  "password-min-length-enforce": "Минималь оҙонлоҡто мотлаҡ итеү",
+  "password-min-length-enforce-description": "Ҡыҫҡараҡ яңы серһүҙ кире ҡағыла, ә ҡыҫҡараҡ серһүҙ менән ингән иҫәп яҙмаһы уны барыһынан да элек үҙгәртергә тейеш. Уны үҙгәртеү иҫәп яҙмаһының бөтә сеанстарын ябып сығара. LDAP, OAuth2, OIDC, SAML, CAS һәм Sandstorm серһүҙҙәре уларҙың провайдерыныҡы, һәм тикшерелмәй.",
+  "password-length-saved": "Һаҡланды.",
+  "password-length-from-environment": "Серверҙың мөхитендә ҡуйылған ҡиммәт ғәмәлдә; бында һаҡлау уны алмаштыра.",
+  "password-change-required-title": "Серһүҙегеҙҙе үҙгәртегеҙ",
+  "password-change-required-text": "Был сайт хәҙер кәмендә __min__ символлы серһүҙҙәр талап итә, ә һеҙҙеке ҡыҫҡараҡ. Дауам итеү өсөн оҙонораҡ серһүҙ һайлағыҙ. Шунан һеҙҙең иҫәп яҙмағыҙҙың бөтә сеанстары ябыла, һәм һеҙ яңы серһүҙ менән яңынан инәһегеҙ.",
+  "password-same-as-username": "Серһүҙ ҡулланыусы исеме йәки электрон почта адресы булырға тейеш түгел.",
  "if-you-already-have-an-account": "Иҫәбегеҙ булһа",
  "register": "Теркәлеү",
  "forgot-password": "Серһүҙҙе онотҡанһығыҙмы",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "Уңышһыҙлыҡ арауығы (секунд)",
  "accounts-lockout-settings-updated": "Тупаҫ көс һөжүменән һаҡлау көйләүҙәре яңыртылды",
  "accounts-lockout-locked-users": "Бикләнгән ҡулланыусылар",
+  "admin-audit-log": "Аудит журналы",
+  "admin-audit-log-info": "Сайт администраторҙары ни эшләгән: ҡулланыусы, инеү, һаҡлағыс һәм резерв күсермә үҙгәрештәре, иң яңылары башта. Серһүҙҙәр һәм серҙәр бер ҡасан да яҙылмай. Бер йыл һаҡлана.",
+  "admin-audit-log-when": "Ҡасан",
+  "admin-audit-log-who": "Администратор",
+  "admin-audit-log-action": "Ғәмәл",
+  "admin-audit-log-details": "Ентеклектәр",
+  "admin-audit-log-empty": "Әлегә бер нәмә лә яҙылмаған.",
  "accounts-lockout-locked-users-info": "Артыҡ күп уңышһыҙ инеү ынтылышы арҡаһында әлеге ваҡытта бикләнгән ҡулланыусылар",
  "accounts-lockout-no-locked-users": "Әлеге ваҡытта бикләнгән ҡулланыусылар юҡ",
  "accounts-lockout-failed-attempts": "Уңышһыҙ ынтылыштар",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "S3 менән тап килгән объект һаҡлағысы: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces һәм башҡалар.",
  "s3-force-path-style": "Юл стилендәге URL-дарҙы мәжбүри ҡулланырға",
  "s3-force-path-style-description": "MinIO һәм AWS булмаған күпселек S3-ярашлы серверҙар өсөн кәрәк.",
+  "s3-sse": "Сервер яғында шифрлау",
+  "s3-sse-none": "Һоралмаған (bucket-тың килешелгән көйләүе)",
+  "s3-sse-description": "S3 WeKan яҙған һәр ҡушымтаны, аватарҙы һәм резерв күсермәне шифрлай, ә уҡығанда WeKan өсөн шифрҙы сисә.",
+  "s3-sse-kms-key-id": "SSE-KMS өсөн KMS асҡыс ID-һы (буш = иҫәп яҙмаһының килешелгән асҡысы)",
  "azure-blob-storage": "Azure Blob Storage",
  "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
  "azure-account-name": "Иҫәп исеме",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "Был QR-кодты раҫлау ҡушымтаһы менән (мәҫәлән, Google Authenticator, Authy) сканерлағыҙ, унан раҫлау өсөн күрһәтелгән 6 цифрлы кодты индерегеҙ.",
  "twoFactorAuth-manual-entry": "Йәки был кодты ҡулдан индерегеҙ: ",
  "twoFactorAuth-confirm": "Раҫларға һәм асырға",
+  "two-factor-required-title": "Ике факторлы раҫлауҙы көйләгеҙ",
+  "two-factor-required-text": "Был сайт һеҙҙең иҫәп яҙмағыҙ өсөн ике факторлы раҫлау талап итә. Дауам итер өсөн уны көйләгеҙ.",
  "twoFactorCode-prompt": "6 цифрлы раҫлау кодыгыҙҙы индерегеҙ",
  "twoFactorCode-submit": "Тикшерергә",
  "twoFactorCode-cancel": "Кире ҡағырға",
@@ -2586,6 +2586,27 @@
  "speed": "Хуткасць",
  "progress": "Прагрэс",
  "password-again": "Пароль (яшчэ раз)",
+  "password-pwned": "Гэты пароль трапіў ва ўцечку даных. Выберыце іншы.",
+  "password-too-short": "Пароль павінен мець не менш за __min__ сімвалаў.",
+  "password-length-report-title": "Даўжыня пароля",
+  "password-length-report-desc": "Уліковыя запісы, якія ўвайшлі з паролем, карацейшым за мінімальную даўжыню. Толькі браўзер ведае, якой даўжыні пароль, таму ён паведамляе пра кароткі пасля ўваходу; пароль і яго даўжыня ніколі яго не пакідаюць. Выпраўлена — гэта калі пароль уліковага запісу быў зменены - уліковы запіс, які зноў уваходзіць з кароткім паролем, зноў паказваецца як занадта кароткі.",
+  "password-length-no-results": "Тут няма ўліковых запісаў.",
+  "password-length-first-login": "Першы ўваход",
+  "password-length-last-login": "Апошні ўваход",
+  "password-length-login-count": "Колькасць уваходаў",
+  "password-length-fixed": "Выпраўлена",
+  "password-length-filter-short": "Занадта кароткі пароль",
+  "password-length-filter-fixed": "Выпраўлена на дастаткова доўгі пароль",
+  "password-length-filter-all": "Усе",
+  "password-min-length": "Мінімальная даўжыня пароля",
+  "password-min-length-description": "Уваход з карацейшым паролем пералічваецца ніжэй. Уваход праз гэта ніколі не адхіляецца.",
+  "password-min-length-enforce": "Патрабаваць мінімальную даўжыню",
+  "password-min-length-enforce-description": "Карацейшы новы пароль адхіляецца, а ўліковы запіс, які ўваходзіць з карацейшым паролем, павінен змяніць яго перш за ўсё. Змена пароля завяршае ўсе сеансы ўліковага запісу. Паролі LDAP, OAuth2, OIDC, SAML, CAS і Sandstorm належаць іх пастаўшчыку і не правяраюцца.",
+  "password-length-saved": "Захавана.",
+  "password-length-from-environment": "Дзейнічае значэнне, зададзенае ў асяроддзі сервера; захаванне тут перавызначае яго.",
+  "password-change-required-title": "Змяніце свой пароль",
+  "password-change-required-text": "Гэты сайт цяпер патрабуе паролі даўжынёй не менш за __min__ сімвалаў, а ваш карацейшы. Выберыце даўжэйшы, каб працягнуць. Пасля гэтага ўсе сеансы вашага ўліковага запісу будуць завершаны, і вы ўвойдзеце зноў з новым паролем.",
+  "password-same-as-username": "Пароль не павінен супадаць з імем карыстальніка або адрасам электроннай пошты.",
  "if-you-already-have-an-account": "Калі ў вас ужо ёсць акаўнт",
  "register": "Зарэгістравацца",
  "forgot-password": "Забыў пароль",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "Акно няўдач (секунды)",
  "accounts-lockout-settings-updated": "Налады абароны ад грубай сілы абноўлены",
  "accounts-lockout-locked-users": "Заблакіраваныя карыстальнікі",
+  "admin-audit-log": "Журнал аўдыту",
+  "admin-audit-log-info": "Што рабілі адміністратары сайта: змены карыстальнікаў, уваходу, сховішча і рэзервовых копій, спачатку найноўшыя. Паролі і сакрэты ніколі не запісваюцца. Захоўваецца адзін год.",
+  "admin-audit-log-when": "Калі",
+  "admin-audit-log-who": "Адміністратар",
+  "admin-audit-log-action": "Дзеянне",
+  "admin-audit-log-details": "Дэталі",
+  "admin-audit-log-empty": "Пакуль нічога не запісана.",
  "accounts-lockout-locked-users-info": "Карыстальнікі, у цяперашні час заблакіраваныя праз занадта шмат няўдалых спроб уваходу",
  "accounts-lockout-no-locked-users": "У цяперашні час няма заблакіраваных карыстальнікаў",
  "accounts-lockout-failed-attempts": "Няўдалыя спробы",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "S3-сумяшчальнае аб'ектнае сховішча: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces і іншыя.",
  "s3-force-path-style": "Прымусова выкарыстоўваць URL у стылі шляху",
  "s3-force-path-style-description": "Патрабуецца MinIO і большасцю не-AWS S3-сумяшчальных сервераў.",
+  "s3-sse": "Шыфраванне на баку сервера",
+  "s3-sse-none": "Не запытана (прадвызначана для бакета)",
+  "s3-sse-description": "S3 шыфруе кожнае ўкладанне, аватар і рэзервовую копію, якія запісвае WeKan, і расшыфроўвае іх для WeKan пры чытанні.",
+  "s3-sse-kms-key-id": "Ідэнтыфікатар ключа KMS для SSE-KMS (пуста = прадвызначаны ключ уліковага запісу)",
  "azure-blob-storage": "Azure Blob Storage",
  "azure-blob-storage-description": "Сховішча Microsoft Azure Blob.",
  "azure-account-name": "Назва акаўнта",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "Скануйце гэты QR-код з дапамогай прыкладання-аўтэнтыфікатара (напрыклад, Google Authenticator, Authy), затым увядзіце паказаны 6-значны код для пацвярджэння.",
  "twoFactorAuth-manual-entry": "Або ўвядзіце гэты код уручную: ",
  "twoFactorAuth-confirm": "Пацвердзіць і ўключыць",
+  "two-factor-required-title": "Наладзьце двухфактарную аўтэнтыфікацыю",
+  "two-factor-required-text": "Гэты сайт патрабуе двухфактарную аўтэнтыфікацыю для вашага ўліковага запісу. Наладзьце яе, каб працягнуць.",
  "twoFactorCode-prompt": "Увядзіце ваш 6-значны код аўтэнтыфікацыі",
  "twoFactorCode-submit": "Праверыць",
  "twoFactorCode-cancel": "Скасаваць",
@@ -2586,6 +2586,27 @@
  "speed": "Скорост",
  "progress": "Напредък",
  "password-again": "Парола (повторно)",
+  "password-pwned": "Тази парола е открита при изтичане на данни. Изберете друга.",
+  "password-too-short": "Паролата трябва да е дълга поне __min__ знака.",
+  "password-length-report-title": "Дължина на паролата",
+  "password-length-report-desc": "Профили, които са влезли с парола, по-къса от минималната дължина. Само браузърът знае колко дълга е паролата, затова съобщава за къса парола след влизане; паролата и дължината ѝ никога не го напускат. Поправено е моментът, в който паролата на профила е била сменена - профил, който отново влезе с къса парола, отново се показва като твърде къса.",
+  "password-length-no-results": "Няма профили тук.",
+  "password-length-first-login": "Първо влизане",
+  "password-length-last-login": "Последно влизане",
+  "password-length-login-count": "Брой влизания",
+  "password-length-fixed": "Поправено",
+  "password-length-filter-short": "Твърде къса парола",
+  "password-length-filter-fixed": "Поправено с достатъчно дълга парола",
+  "password-length-filter-all": "Всички",
+  "password-min-length": "Минимална дължина на паролата",
+  "password-min-length-description": "Влизането с по-къса парола се показва по-долу. Влизането никога не се отказва заради това.",
+  "password-min-length-enforce": "Налагане на минималната дължина",
+  "password-min-length-enforce-description": "По-къса нова парола се отхвърля, а профил, който влиза с по-къса парола, трябва да я смени преди всичко друго. Смяната ѝ излиза от всички сесии на профила. Паролите от LDAP, OAuth2, OIDC, SAML, CAS и Sandstorm са на техния доставчик и не се проверяват.",
+  "password-length-saved": "Запазено.",
+  "password-length-from-environment": "В сила е стойност, зададена в средата на сървъра; запазването тук я замества.",
+  "password-change-required-title": "Сменете паролата си",
+  "password-change-required-text": "Този сайт вече изисква пароли от поне __min__ знака, а вашата е по-къса. Изберете по-дълга, за да продължите. След това всички сесии на профила ви се прекратяват и влизате отново с новата парола.",
+  "password-same-as-username": "Паролата не трябва да бъде потребителското име или имейл адресът.",
  "if-you-already-have-an-account": "Ако вече имате акаунт",
  "register": "Регистрация",
  "forgot-password": "Забравена парола",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "Период за отчитане на неуспешните опити (секунди)",
  "accounts-lockout-settings-updated": "Настройките за защита от атаки с отгатване на пароли са обновени",
  "accounts-lockout-locked-users": "Блокирани потребители",
+  "admin-audit-log": "Одитен журнал",
+  "admin-audit-log-info": "Какво са направили администраторите на сайта: промени в потребители, вход, хранилище и резервни копия, най-новите първо. Пароли и тайни никога не се записват. Пази се една година.",
+  "admin-audit-log-when": "Кога",
+  "admin-audit-log-who": "Администратор",
+  "admin-audit-log-action": "Действие",
+  "admin-audit-log-details": "Подробности",
+  "admin-audit-log-empty": "Все още няма записи.",
  "accounts-lockout-locked-users-info": "Потребители, блокирани в момента поради твърде много неуспешни опити за вход",
  "accounts-lockout-no-locked-users": "В момента няма блокирани потребители",
  "accounts-lockout-failed-attempts": "Неуспешни опити",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "S3-съвместимо обектно хранилище: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces и други.",
  "s3-force-path-style": "Наложи URL адреси в стил път (path-style)",
  "s3-force-path-style-description": "Изисква се от MinIO и повечето не-AWS S3-съвместими сървъри.",
+  "s3-sse": "Криптиране от страна на сървъра",
+  "s3-sse-none": "Не е заявено (по подразбиране за bucket-а)",
+  "s3-sse-description": "S3 криптира всеки прикачен файл, аватар и резервно копие, които WeKan записва, и ги декриптира за WeKan при четене.",
+  "s3-sse-kms-key-id": "ID на KMS ключ за SSE-KMS (празно = ключът по подразбиране на акаунта)",
  "azure-blob-storage": "Azure Blob Storage",
  "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
  "azure-account-name": "Име на акаунта",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "Сканирайте този QR код с приложение за удостоверяване (напр. Google Authenticator, Authy), след което въведете показания 6-цифрен код за потвърждение.",
  "twoFactorAuth-manual-entry": "Или въведете този код ръчно: ",
  "twoFactorAuth-confirm": "Потвърждаване и активиране",
+  "two-factor-required-title": "Настройте двуфакторно удостоверяване",
+  "two-factor-required-text": "Този сайт изисква двуфакторно удостоверяване за вашия акаунт. Настройте го, за да продължите.",
  "twoFactorCode-prompt": "Въведете вашия 6-цифрен код за удостоверяване",
  "twoFactorCode-submit": "Проверка",
  "twoFactorCode-cancel": "Отмени",
@@ -2586,6 +2586,27 @@
  "speed": "गति",
  "progress": "प्रगति",
  "password-again": "पासवर्ड (फेर से)",
+  "password-pwned": "ई पासवर्ड कवनो डेटा लीक में देखाई देले बा। कवनो दोसर चुनीं।",
+  "password-too-short": "पासवर्ड कम से कम __min__ अक्षर के होखे के चाहीं।",
+  "password-length-report-title": "पासवर्ड के लंबाई",
+  "password-length-report-desc": "ऊ खाता जवन न्यूनतम लंबाई से छोट पासवर्ड से साइन इन कइलें। पासवर्ड केतना लंबा बा ई खाली ब्राउजर जानेला, एही से साइन इन के बाद ऊ छोट पासवर्ड के जानकारी देला; पासवर्ड आ ओकर लंबाई कबो ओकरा से बाहर ना जाला। ठीक भइल माने जब खाता के पासवर्ड बदलल गइल - जवन खाता फेर से छोट पासवर्ड से साइन इन करी, ऊ फेर से बहुत छोट देखावल जाई।",
+  "password-length-no-results": "इहाँ कवनो खाता नइखे।",
+  "password-length-first-login": "पहिला लॉगिन",
+  "password-length-last-login": "आखिरी लॉगिन",
+  "password-length-login-count": "केतना बेर लॉगिन भइल",
+  "password-length-fixed": "ठीक भइल",
+  "password-length-filter-short": "बहुत छोट पासवर्ड",
+  "password-length-filter-fixed": "काफी लंबा पासवर्ड से ठीक भइल",
+  "password-length-filter-all": "सब",
+  "password-min-length": "न्यूनतम पासवर्ड लंबाई",
+  "password-min-length-description": "छोट पासवर्ड से साइन इन कइल नीचे सूची में देखावल जाला। एकरा चलते साइन इन कबो मना ना कइल जाला।",
+  "password-min-length-enforce": "न्यूनतम लंबाई लागू करीं",
+  "password-min-length-enforce-description": "छोट नया पासवर्ड मना कर दिहल जाला, आ जवन खाता छोट पासवर्ड से साइन इन करेला ओकरा कवनो दोसर काम से पहिले एकरा के बदले के पड़ी। एकरा के बदलला से खाता के हर सत्र से साइन आउट हो जाला। LDAP, OAuth2, OIDC, SAML, CAS आ Sandstorm के पासवर्ड ओह लोग के प्रदाता के होला, आ जाँचल ना जाला।",
+  "password-length-saved": "सहेजल गइल।",
+  "password-length-from-environment": "सर्वर के वातावरण में सेट कइल एगो मान लागू बा; इहाँ सहेजला से ऊ बदल जाला।",
+  "password-change-required-title": "आपन पासवर्ड बदलीं",
+  "password-change-required-text": "ई साइट अब कम से कम __min__ अक्षर के पासवर्ड माँगेले, आ रउआ के छोट बा। आगे बढ़े खातिर एगो लंबा पासवर्ड चुनीं। ओकरा बाद रउआ खाता के हर सत्र से साइन आउट हो जाई, आ रउआ नया पासवर्ड से फेर से साइन इन करब।",
+  "password-same-as-username": "पासवर्ड उपयोगकर्ता नाम भा ईमेल पता ना होखे के चाहीं।",
  "if-you-already-have-an-account": "अगर रउआ लगे पहिले से खाता बा",
  "register": "पंजीकरण करीं",
  "forgot-password": "पासवर्ड भुला गइनी",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "असफलता समय-सीमा (सेकंड)",
  "accounts-lockout-settings-updated": "जबरदस्ती हमला सुरक्षा सेटिंग नया कर दिहल गइल",
  "accounts-lockout-locked-users": "तालाबंद उपयोगकर्ता",
+  "admin-audit-log": "ऑडिट लॉग",
+  "admin-audit-log-info": "साइट के प्रशासक लोग का कइल: उपयोगकर्ता, लॉगिन, स्टोरेज आ बैकअप में बदलाव, सबसे नया पहिले। पासवर्ड आ गुप्त बात कबो दर्ज ना कइल जाला। एक साल ले रखल जाला।",
+  "admin-audit-log-when": "कब",
+  "admin-audit-log-who": "प्रशासक",
+  "admin-audit-log-action": "कार्रवाई",
+  "admin-audit-log-details": "विवरण",
+  "admin-audit-log-empty": "अबहीं ले कुछुओ दर्ज नइखे भइल।",
  "accounts-lockout-locked-users-info": "बहुत अधिक असफल लॉग इन कोसिस के कारण अबहीं तालाबंद उपयोगकर्ता",
  "accounts-lockout-no-locked-users": "अबहीं कवनो तालाबंद उपयोगकर्ता नइखे",
  "accounts-lockout-failed-attempts": "असफल कोसिस",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "S3-संगत ऑब्जेक्ट भंडारण: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces आ दोसर।",
  "s3-force-path-style": "पथ-जइसन URL जरूरी करीं",
  "s3-force-path-style-description": "MinIO आ अधिकतर गैर-AWS S3-संगत सर्वर खातिर जरूरी।",
+  "s3-sse": "सर्वर ओर एन्क्रिप्शन",
+  "s3-sse-none": "कुछ ना माँगल गइल (बकेट के पहिले से तय)",
+  "s3-sse-description": "WeKan जवन हर संलग्नक, अवतार आ बैकअप लिखेला, ओकरा के S3 एन्क्रिप्ट करेला, आ पढ़े घरी WeKan खातिर डिक्रिप्ट करेला।",
+  "s3-sse-kms-key-id": "SSE-KMS खातिर KMS कुंजी ID (खाली = खाता के पहिले से तय कुंजी)",
  "azure-blob-storage": "Azure Blob Storage",
  "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
  "azure-account-name": "खाता नाँव",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "ई QR कोड के प्रमाणीकरण ऐप से स्कैन करीं (जइसे Google Authenticator, Authy), फेर पुष्टि करे खातिर देखावल 6-अंक के कोड डालीं।",
  "twoFactorAuth-manual-entry": "या ई कोड मैन्युअल रूप से डालीं: ",
  "twoFactorAuth-confirm": "पुष्टि करीं आ चालू करीं",
+  "two-factor-required-title": "दू-कारक प्रमाणीकरण सेट करीं",
+  "two-factor-required-text": "ई साइट रउरा खाता खातिर दू-कारक प्रमाणीकरण माँगेले। आगे बढ़े खातिर एकरा के सेट करीं।",
  "twoFactorCode-prompt": "अपना 6-अंक के प्रमाणीकरण कोड डालीं",
  "twoFactorCode-submit": "सत्यापित करीं",
  "twoFactorCode-cancel": "रद्द करीं",
@@ -2586,6 +2586,27 @@
  "speed": "Spid",
  "progress": "Wok we i gohed",
  "password-again": "Sikret wod (bakegen)",
+  "password-pwned": "Paswod ia i bin kamaot long wan data we i lik. Jusum narawan.",
+  "password-too-short": "Paswod i mas gat __min__ leta o moa.",
+  "password-length-report-title": "Longfala blong paswod",
+  "password-length-report-desc": "Ol akaon we oli saen-in wetem wan paswod we i sot moa long smol longfala. Bravsa nomo i save hamas paswod i long, ale hem i ripotem wan sot paswod afta long saen-in; paswod mo longfala blong hem oli neva lego bravsa. Stretem i taem we paswod blong akaon i jenis - wan akaon we i saen-in bakegen wetem sot paswod bambae i soem bakegen se i sot tumas.",
+  "password-length-no-results": "I no gat akaon long ples ia.",
+  "password-length-first-login": "Fes login",
+  "password-length-last-login": "Las login",
+  "password-length-login-count": "Hamas taem i login",
+  "password-length-fixed": "Stretem finis",
+  "password-length-filter-short": "Paswod i sot tumas",
+  "password-length-filter-fixed": "Stretem finis long paswod we i long naf",
+  "password-length-filter-all": "Evriwan",
+  "password-min-length": "Smol longfala blong paswod",
+  "password-min-length-description": "Saen-in wetem wan sot paswod i stap long lis daon. Saen-in i neva blokem from samting ia.",
+  "password-min-length-enforce": "Mekem man i folem smol longfala",
+  "password-min-length-enforce-description": "Wan niu paswod we i sot moa bambae oli no akseptem, mo wan akaon we i saen-in wetem sot paswod i mas jenisim fastaem bifo long eni narafala samting. Taem yu jenisim, evri sesen blong akaon i aot. Ol paswod blong LDAP, OAuth2, OIDC, SAML, CAS mo Sandstorm oli blong provaeda blong olgeta, mo oli no jekem.",
+  "password-length-saved": "I sevem finis.",
+  "password-length-from-environment": "Wan valiu we oli putum long envaeronmen blong seva i wok naoia; sevem long ples ia i jenisim hem.",
+  "password-change-required-title": "Jenisim paswod blong yu",
+  "password-change-required-text": "Saet ia naoia i nidim ol paswod we i gat __min__ leta o moa, mo paswod blong yu i sot moa. Jusum wan we i long moa blong gohed. Afta, evri sesen blong akaon blong yu i aot, mo yu saen-in bakegen wetem niu paswod.",
+  "password-same-as-username": "Paswod i no save sem mak nem blong yusa o adres blong imel.",
  "if-you-already-have-an-account": "Sapos yu gat wan akaon finis",
  "register": "Rejista",
  "forgot-password": "Yu fogetem paswod",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "Taem blong kaontem ol fel (seken)",
  "accounts-lockout-settings-updated": "Oli jenisim ol seting blong protektem long atak blong traem plante paswod",
  "accounts-lockout-locked-users": "Ol yusa we oli Lokem",
+  "admin-audit-log": "Odit lok",
+  "admin-audit-log-info": "Wanem ol administreta blong saet oli mekem: ol jenis long yusa, login, storej mo bekap, niuwan fastaem. Oli neva raetemdaon ol paswod mo ol sikret. Oli kipim blong wan yia.",
+  "admin-audit-log-when": "Wetaem",
+  "admin-audit-log-who": "Administreta",
+  "admin-audit-log-action": "Aksen",
+  "admin-audit-log-details": "Ol ditel",
+  "admin-audit-log-empty": "I no gat samting we oli raetemdaon yet.",
  "accounts-lockout-locked-users-info": "Ol yusa we oli lokem olgeta naoia from oli traem go insaed plante taem tumas we i no wok",
  "accounts-lockout-no-locked-users": "Naoia i no gat yusa we oli lokem",
  "accounts-lockout-failed-attempts": "Ol traem we oli fel",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "S3-compatible object storage: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces mo others.",
  "s3-force-path-style": "Fosem ol URL blong yusum fomat blong rod",
  "s3-force-path-style-description": "I mas gat blong MinIO mo plante seva we oli wok olsem S3 be oli no blong AWS.",
+  "s3-sse": "Enkripsen long saed blong seva",
+  "s3-sse-none": "I no askem wan (stamba blong baket)",
+  "s3-sse-description": "S3 i enkriptem evri samting we i joen, avata mo bekap we WeKan i raetem, mo i dekriptem bakegen blong WeKan taem i ridim.",
+  "s3-sse-kms-key-id": "KMS ki ID blong SSE-KMS (i emti = stamba ki blong akaon)",
  "azure-blob-storage": "Azure Blob Storage",
  "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
  "azure-account-name": "Nem blong akaon",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "Skanem QR kod ia wetem wan aplikesen blong pruvum (olsem Google Authenticator, Authy), biaen putum kod we i gat 6 namba we hem i soem blong pruvum.",
  "twoFactorAuth-manual-entry": "O putum kod ia wetem han blong yu: ",
  "twoFactorAuth-confirm": "Pruvum mo Statem",
+  "two-factor-required-title": "Setemap Tu-Fakta Pruvum",
+  "two-factor-required-text": "Saet ia i nidim Tu-Fakta Pruvum blong akaon blong yu. Setemap blong go hed.",
  "twoFactorCode-prompt": "Putum kod blong yu we i gat 6 namba blong pruvum",
  "twoFactorCode-submit": "Pruvum",
  "twoFactorCode-cancel": "Kanselem",
@@ -2586,6 +2586,27 @@
  "speed": "Teliya",
  "progress": "Ɲɛtaa",
  "password-again": "Tɔgɔgundo (kokura)",
+  "password-pwned": "Gundo daɲɛ nin yera kunnafoni bɔnen dɔ kɔnɔ. Wɛrɛ sugandi.",
+  "password-too-short": "Gundo daɲɛ ka kan ka sɛbɛnni __min__ sɔrɔ a dɔgɔyalen na.",
+  "password-length-report-title": "Gundo daɲɛ janya",
+  "password-length-report-desc": "Jatebɔw minnu donna ni gundo daɲɛ ye min surunyalen don ka tɛmɛ janya dɔgɔman kan. Ɲɛgɛnɛjɛ dama de b'a dɔn gundo daɲɛ janya bɛ min bɔ, o de kosɔn a b'a fɔ ko gundo daɲɛ surun don ni donni kɛra; gundo daɲɛ n'a janya tɛ bɔ a kɔnɔ abada. Labɛnna ye waati ye min na jatebɔ gundo daɲɛ yɛlɛmana - jatebɔ min bɛ don tugun ni gundo daɲɛ surun ye, o bɛ jira tugun ko a ka surun kojugu.",
+  "password-length-no-results": "Jatebɔ si tɛ yan.",
+  "password-length-first-login": "Donni fɔlɔ",
+  "password-length-last-login": "Donni laban",
+  "password-length-login-count": "Donni hakɛ",
+  "password-length-fixed": "Labɛnna",
+  "password-length-filter-short": "Gundo daɲɛ ka surun kojugu",
+  "password-length-filter-fixed": "Labɛnna ka kɛ gundo daɲɛ jan ye",
+  "password-length-filter-all": "A bɛɛ",
+  "password-min-length": "Gundo daɲɛ janya dɔgɔman",
+  "password-min-length-description": "Donni ni gundo daɲɛ surun ye bɛ sɛbɛn duguma. Donni tɛ ban abada o kosɔn.",
+  "password-min-length-enforce": "Janya dɔgɔman labato",
+  "password-min-length-enforce-description": "Gundo daɲɛ kura surun bɛ ban, wa jatebɔ min bɛ don ni gundo daɲɛ surun ye, o ka kan k'a yɛlɛma sani fɛn wɛrɛ ka kɛ. A yɛlɛmani bɛ jatebɔ ka sesiyɔn bɛɛ bɔ. LDAP, OAuth2, OIDC, SAML, CAS ani Sandstorm gundo daɲɛw ye u dibaga ta ye, u tɛ sɛgɛsɛgɛ.",
+  "password-length-saved": "A marara.",
+  "password-length-from-environment": "Hakɛ min sigira sɛriwɛri sigida la, o bɛ baara la; ka mara yan bɛ o yɛlɛma.",
+  "password-change-required-title": "I ka gundo daɲɛ yɛlɛma",
+  "password-change-required-text": "Nin siti in bɛ gundo daɲɛ ɲini sisan minnu sɛbɛnni bɛ __min__ bɔ ka taa a fɛ, ka i ta surun. Ka taa a fɛ, gundo daɲɛ jan sugandi. O kɔ, i ka jatebɔ ka sesiyɔn bɛɛ bɛ bɔ, ka i don tugun ni gundo daɲɛ kura ye.",
+  "password-same-as-username": "Gundo daɲɛ man kan ka kɛ baarakɛla tɔgɔ ye walima imɛli sigiyɔrɔ ye.",
  "if-you-already-have-an-account": "Ni jate b'i bolo kaban",
  "register": "I tɔgɔ sɛbɛn",
  "forgot-password": "I ɲinɛna gundo daɲɛ kɔ",
@@ -2661,6 +2682,13 @@
  "accounts-lockout-failure-window": "Fili waati (sekɔndi)",
  "accounts-lockout-settings-updated": "Sɛnbali kojugu kama lakana labɛnniw kuraya len don",
  "accounts-lockout-locked-users": "Baarakɛla datugulenw",
+  "admin-audit-log": "Sɛgɛsɛgɛli sɛbɛn",
+  "admin-audit-log-info": "Siti ɲɛmɔgɔw ye min kɛ: baarakɛla, donni, maarali ani labɛn yɛlɛmaniw, kuraw fɔlɔ. Gundo daɲɛw ni gundow tɛ sɛbɛn abada. A bɛ mara san kelen.",
+  "admin-audit-log-when": "Tuma",
+  "admin-audit-log-who": "Ɲɛmɔgɔ",
+  "admin-audit-log-action": "Kɛwale",
+  "admin-audit-log-details": "Kunnafoniw",
+  "admin-audit-log-empty": "Foyi ma sɛbɛn fɔlɔ.",
  "accounts-lockout-locked-users-info": "Baarakɛla minnu datugulen don sisan donni lajɛli fililen caman kosɔn",
  "accounts-lockout-no-locked-users": "Baarakɛla datugulen si tɛ sisan",
  "accounts-lockout-failed-attempts": "Lajɛli fililenw",
@@ -2738,6 +2766,10 @@
  "s3-minio-storage-description": "Fɛn marayɔrɔ min bɛ bɛn S3 ma: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces ani wɛrɛw.",
  "s3-force-path-style": "Sira cogoya URL wajibiya",
  "s3-force-path-style-description": "A wajibi don MinIO ni non-AWS S3-compatible sɛrvɛri caman ma.",
+  "s3-sse": "Jɔyɔrɔ-masina fan fɛ gundoli",
+  "s3-sse-none": "Foyi ma ɲini (bucket ka dantigɛlen)",
+  "s3-sse-description": "S3 bɛ nɔrɔlen, avatar ani labɛn o labɛn WeKan bɛ minnu sɛbɛn, olu gundo, ka u gundo bɔ WeKan ye ni u kalanna.",
+  "s3-sse-kms-key-id": "KMS kile ID SSE-KMS kama (lankolon = jatebɔsɛbɛn ka kile dantigɛlen)",
  "azure-blob-storage": "Azure Blob Storage",
  "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
  "azure-account-name": "Jate tɔgɔ",
@@ -3255,6 +3287,8 @@
  "twoFactorAuth-scan-instructions": "Ka QR nimɔrɔ in bila dannaya porogaramu kɔnɔ (i ko Google Authenticator, Authy), o kɔ ka nimɔrɔ 6 min jirala don ka daminɛ.",
  "twoFactorAuth-manual-entry": "Walima ka nin nimɔrɔ in don aw yɛrɛ bolo la: ",
  "twoFactorAuth-confirm": "Daminɛ ani ka labɛn",
+  "two-factor-required-title": "Sɛbɛnni Fila-Dannaya labɛn",
+  "two-factor-required-text": "Siti nin bɛ Sɛbɛnni Fila-Dannaya ɲini i ka jatebɔsɛbɛn kama. A labɛn walasa ka taa a fɛ.",
  "twoFactorCode-prompt": "Aw ka nimɔrɔ 6 dannaya nimɔrɔ don",
  "twoFactorCode-submit": "Daminɛ",
  "twoFactorCode-cancel": "Dabila",