Bump versions for v12.76

#6834 is fixed in part and #6837 needs a decision: both in TODO Later.

Thanks to mimZD and xet7 !

CHANGELOG-big.md

@@ -118,11 +118,459 @@ its reason.
   `node_modules`, so a clean install comes first.
 - The WebKit stage cannot run in the Flatpak sandbox: MiniBrowser needs its
   own sandbox, and turning that off is not allowed there. Run it on a host.
+- [#6834](https://github.com/wekan/wekan/issues/6834) (the minicard due date is fixed; the board header bar wrapping to a second row and the list header icons under the card count did not reproduce on the current code at the same window width, in Persian, with the card count on - which WeKan release and browser zoom showed them is asked; wrapping the header rather than hiding buttons is by design)
+
+</details>
+
+<details>
+<summary>Needs a maintainer decision on the intended contract</summary>
+
+- [#6837](https://github.com/wekan/wekan/issues/6837) (a Simple and an Advanced mode, or profiles an administrator defines and assigns, to hide features from new users: which features each mode or profile shows, who chooses it, and how it relates to the existing per-board Board Settings / Card and Show on Minicard switches and the Admin Panel feature toggles)
 
 </details>
 
 </details>
 
+# v12.76 2026-10-31 WeKan ® release
+
+**In short:** Security features: a **password policy** with an optional
+breached-password check, **Admin Panel / Problems / Password length**,
+**compulsory two-factor authentication**, sign-out of **idle sessions** and of
+every session after a password change, an **audit log** of what administrators
+did, **HSTS**, a cross-site request guard, and **S3 encryption at rest**.
+**Sign-up** works again; the date picker has **Today**, the whole card title
+edits and **every popup can be moved**; and an old **Sandstorm** grain migrated
+from MongoDB 3 shows its boards again.
+
+This release adds the following security features:
+
+**Signing in** - which passwords are accepted and which are reported, who must
+have a second factor, and when sessions end.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/d7abe9910a">New passwords have a minimum length, and a breached one can be refused</a>. Thanks to xet7.</summary>
+
+`PASSWORD_MIN_LENGTH` (default 8) and `PASSWORD_CHECK_PWNED` (off by default),
+in Admin Panel / People / Login and on every platform. The browser sends a
+password to Meteor hashed, so the server checks every password that reaches it
+as text - Admin Panel Set password and Add user, `POST /users/register` - and
+the sign-up, Change Password, reset and enrolment forms check in the browser.
+Signing in is never checked, so an existing shorter password keeps working
+until it is changed. A breached password is found with Have I Been Pwned's
+k-anonymity range API: only 5 hex digits of the SHA-1 leave WeKan, and an
+unreachable service never refuses a password. A refused password is ordinary
+use, not an attack, so it is not recorded in Admin Panel / Problems.
+`tests/passwordPolicy.test.cjs` checks every place a password reaches the
+server as text, and that nothing else sets one without the check.
+
+</details>
+
+- [The breached-password check computes its lookup digest once, with Web Crypto, in browser and server; it is never stored (CodeQL \#599)](https://github.com/wekan/wekan/commit/f406d46fe7).
+  Thanks to GitHub CodeQL and xet7.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/c99aa7f845">Admin Panel / Problems / Password length lists who signs in with a too short password</a>. Thanks to xet7.</summary>
+
+The minimum above was enforced as soon as it existed. Now `PASSWORD_MIN_LENGTH`
+(default 8) is the length below which a sign-in is REPORTED, and the new
+`PASSWORD_MIN_LENGTH_ENFORCE` (off by default) makes it a rule: a shorter new
+password is refused, and an account that signs in with an older shorter one
+sees only "Change your password" until it has a long enough one. Signing in is
+never refused, so nobody is locked out by a minimum set after their password.
+LDAP, OAuth2, OIDC, SAML, CAS and Sandstorm passwords are their provider's, and
+are neither reported nor asked. Meteor sends a password hashed, so the browser
+that typed it says "it was short" after signing in - never the password or its
+length. The page has both settings and one row per account: username, first and
+last such login, the latest IPv4 and IPv6 address with flag and city when a CDN
+says where it is, the count and when it was fixed, filtered Too short (default),
+Fixed or All. Node suites `passwordPolicy`, `passwordChangeRequired` and
+`shortPasswordLogins`; Playwright `password-length-report` changes each setting
+on the page and checks what it does, in Chromium and WebKit.
+[Password length](docs/Features/Admin-Panel/Problems/Password-length.md).
+
+</details>
+
+- [The Password length pane names itself in the title bar, like every other Admin Panel pane](https://github.com/wekan/wekan/commit/85af731c1b).
+  Thanks to xet7.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/c99aa7f845">Changing one's own password signs every session of the account out, this one too</a>. Thanks to xet7.</summary>
+
+Meteor's Change Password kept the session that changed it, and a reset link
+signed the reset in. Now Member Settings, the forced change and a reset link
+all end every session of the account, and only the new password signs in
+again; the browser goes to the sign-in page as soon as it is signed out, since
+the server closes the connection before the answer can arrive. An
+administrator's Set password already signed everything out.
+`password-change-other-sessions.e2e.js` changes it in one of two browsers:
+both are signed out, the old password is refused and the new one signs in.
+
+</details>
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/d7abe9910a">Two-factor authentication can be made compulsory, for administrators or for everybody</a>. Thanks to xet7.</summary>
+
+`REQUIRE_2FA`: `off` (default), `admins` or `all`. It covers the accounts that
+sign in with a WeKan password; LDAP, OAuth2, SAML, CAS and Sandstorm accounts
+sign in through an identity provider and are never asked. Such an account can
+still sign in - it has to, to enrol - and sees only the set-up until it has
+2FA. Until then the server refuses every method and publication but signing in
+and enrolling, HTTP routes do not accept its login and the REST API gives it no
+token; once required, 2FA cannot be switched off. An account between signing
+in and enrolling is ordinary use, so nothing is recorded in Problems.
+`tests/requireTwoFactor.test.cjs` runs the real wrappers.
+
+</details>
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/41173f0f6b">A browser session is signed out after LOGOUT_IDLE_MINUTES without activity</a>. Thanks to xet7.</summary>
+
+`LOGOUT_WITH_TIMER` ends a login at a deadline however busy its user is; nothing
+ended a session somebody walked away from. The browser now reports a key press,
+click, touch or scroll at most once a minute, the server keeps the time per
+login token in `idleSessions`, and once a minute every token idle past the
+limit is removed, which signs its connections out. A tab that reconnects by
+itself - a laptop waking up - is not activity, and REST API tokens are never
+removed. The time is kept beside the user rather than on the token, because
+updating one element of the token array needs the positional `$` operator,
+which not every database WeKan runs on supports. `tests/idleLogout.test.cjs`.
+
+</details>
+
+**HTTP** - what every response tells the browser, and which requests are
+accepted only from WeKan's own pages.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/4993242c5f">Strict-Transport-Security on every response of an HTTPS site</a>. Thanks to xet7.</summary>
+
+Without HSTS, a link typed as plain HTTP or a downgrade on a hostile network
+could strip TLS from the next visit unless the reverse proxy added the header.
+It is now sent whenever `ROOT_URL` is https: 180 days, this host only.
+`HSTS_MAX_AGE`, `HSTS_INCLUDE_SUBDOMAINS` and `HSTS_PRELOAD` change it; 0 stops
+it, and preload is sent only with includeSubDomains and at least a year. Every
+response also carries `X-Content-Type-Options: nosniff` and
+`Referrer-Policy: strict-origin-when-cross-origin`. A header has no attempt to
+record. `tests/securityHeaders.test.cjs`.
+
+</details>
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/48a2e97ea3">A state-changing request that logs in only with the cookie must come from WeKan itself</a>. Thanks to xet7.</summary>
+
+`POST /import-trello` and other routes accept the login cookie as the login.
+The cookie is SameSite=Strict, which keeps it off a cross-site request in
+today's browsers; this is the second line, for older browsers, same-site
+sibling hosts and routes added later. A POST, PUT, PATCH or DELETE whose only
+login is the cookie must carry an Origin, or Referer, naming `ROOT_URL`'s host
+or the Host / X-Forwarded-Host it was sent to - on Sandstorm, the grain's own
+host. A refusal is recorded in Admin Panel / Problems as
+`csrf.cross-site-cookie` and never blocks the account whose cookie it was.
+`tests/crossSiteRequest.test.cjs` also fails when a route registers a handler
+that runs before the guard.
+
+</details>
+
+**The Admin Panel** - a record of what administrators changed.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/4d5b832499">People / Audit log shows what site administrators did</a>. Thanks to xet7.</summary>
+
+Nothing recorded who set somebody's password, made somebody an admin, changed
+a login setting or restored a backup. Every call of those administrative
+methods by a site administrator is now kept for a year, one document each:
+when, who, the action, its outcome - a refused call too - its arguments and
+the address. A password or a secret never reaches the trail: credential-named
+keys, password arguments by position and passwords inside URLs are replaced by
+`[redacted]`. An administrator editing cards is not in it, and a trail that
+cannot be written never changes what the method did.
+`tests/adminAudit.test.cjs`.
+
+</details>
+
+- [The audit log has its own URL, /admin/people/audit-log, a title, and right-to-left alignment](https://github.com/wekan/wekan/commit/2017f2871f).
+  Thanks to xet7.
+
+**Attachments** - where the files are kept, and how.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/482c2c29f4">Files and backups in S3 can be encrypted at rest</a>. Thanks to xet7.</summary>
+
+Admin Panel / Attachments / S3 / Server-side encryption: SSE-S3 (AES256) or
+SSE-KMS, with a KMS key or the account's default. S3 encrypts each object as it
+is written and decrypts it for WeKan on read, so reads, range requests and
+moves are unchanged; every upload, renamed object and backup written to S3
+carries it. On the filesystem, encryption at rest stays with the disk or volume
+(LUKS, an encrypted cloud volume): exports, PDF, thumbnails, virus scans,
+backups and WebDAV all read the stored files directly.
+`tests/s3Encryption.test.cjs`.
+
+</details>
+
+and adds the following new features:
+
+**Dates** - choosing a date in a date popup.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/bc21c901f4">The date picker has a Today button, back to today's month from wherever the arrows went</a>. Thanks to mimZD and xet7.</summary>
+
+The board Calendar view and Calendar mode already had Today; the date picker
+of every date popup had only « ‹ › ». Today shows today's month and focuses
+today, and changes nothing until a day is clicked and saved. Testing it found a
+picker bug that was already there: a month navigated back to was drawn wrong -
+October as "29, empty, 30, empty", without its 31st - because Blaze matched the
+weeks and days, which had no `_id`, by position. Every week and cell has one
+now. `calendarPickerControls.test.cjs` and `calendar-today-marker.e2e.js`,
+which checks every day of the month in order after Today.
+
+</details>
+
+**The opened card and popups** - editing a card's title, and moving windows.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/22a12dc7f8">The whole card title edits; the window and every popup move by their bar or drag handle</a>. Thanks to mimZD and xet7.</summary>
+
+The title was split like a minicard's: the leading half edited and the
+trailing half dragged the window, so a click on the right of the title did not
+edit. All of it edits now. With drag handles off the window is moved from the
+empty space of its header row above the title, between the collapse caret and
+the menu; with them on, by the drag handle alone. Every popup moves the same
+way - by its title bar, or its handle alone - where only four kinds moved
+before, and a drag no longer makes a popup placed from the right edge, or one
+with a margin, jump as it begins. `card-title-edit-and-move-6839.e2e.js` in
+Chromium and WebKit.
+
+</details>
+
+**Member Settings** - Change Settings.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/ffd5cbd2ad">Change Settings: icons in a column on the first line, compact wrapped lines, rows divided</a>. Thanks to mimZD and xet7.</summary>
+
+Its settings are sentences, and most wrap; on the shared popup list each line
+was 33px high with the icon centred between them and nothing between one
+setting and the next. Each row is an icon column, the words and the check mark
+now, the icon on the first line, a wrapped line an ordinary line high, and a
+rule between rows. `change-settings-popup-6835.e2e.js` in Persian and English.
+
+</details>
+
+and fixes the following bugs:
+
+**The d shortcut** - opening the Due date editor from the keyboard.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/b1403ca7af">d opens the Due date editor of a card that is still being opened, and it stays open</a>. Thanks to mimZD and xet7.</summary>
+
+On a slower server a card's details render a few hundred milliseconds after
+the click that opens it, and `d` pressed in that moment found no Due date
+control and did nothing; only the hovered-minicard path waited. Both wait now
+for that card's control. The card details also closed their card's popup when
+merely rendered again, so a popup could open and shut at once; they close it
+now only when the card is closed or another card opened. The Playwright test
+emulates a 300 ms connection, and fails on the code before this change.
+
+</details>
+
+- [Typing d in the card title types at the end of the title in WebKit too](https://github.com/wekan/wekan/commit/73c21dfe3e).
+  Thanks to xet7.
+
+**Minicards** - what a minicard shows, and where.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/cf4b48df09">A due date uses the minicard's width instead of three lines beside an empty strip</a>. Thanks to mimZD and xet7.</summary>
+
+The dates row reserved 84px at its trailing edge - a third of a narrow card -
+for nothing, and a due date with its "1 day left" was broken over three lines.
+It reserves the drag handle's 24px now. The rest of
+[#6834](https://github.com/wekan/wekan/issues/6834) is in TODO Later.
+`minicard-dates-width-6834.e2e.js` in English and Persian.
+
+</details>
+
+- [A card-button rule is a button on the minicard: Board Settings / Card, Card buttons, Show on Minicard, since v12.16, now with a test](https://github.com/wekan/wekan/commit/429fdc5319).
+  Thanks to mimZD and xet7.
+
+**Signing up** - registering a new account with the sign-up form.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/508484ef1e">Registering no longer answers Internal server error, and signs the new user in</a>. Thanks to xet7.</summary>
+
+The REQUIRE_2FA wrapper of every method and publication, and the Audit log's
+wrapper of the administrators' methods, awaited before calling the handler -
+even with REQUIRE_2FA off. audit-argument-checks asks synchronously, the moment
+a handler returns, whether check() saw every argument, so the handler's own
+check() came too late: sign-up answered "Internal server error" while the
+account was created anyway (the next try said it already existed), and the
+starredPublicBoards and translation publications failed for everybody. A
+wrapper now calls the handler at once when it needs no lookup, and hands the
+audit over when it must await (`server/lib/argumentChecks.js`).
+`tests/wrappedHandlerArgumentChecks.test.cjs` runs both wrappers under a model
+of the audit, and the sign-up Playwright test registers - with no mail server
+configured - and checks that the new user is signed in.
+
+</details>
+
+**Upgrading old data** - documents from old WeKan versions are brought to the
+current structure at startup, so nothing that is in the database stays hidden.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/2ab0afdc93">Boards from before the templates feature are shown on All Boards again</a>. Thanks to xet7.</summary>
+
+A Sandstorm grain migrated from MongoDB 3 to FerretDB copied every document -
+1 board, 31 cards, 8 lists - and then showed an empty All Boards page. Boards,
+swimlanes, lists and cards made before the templates feature have no `type`:
+the schemas fill it on insert only. All Boards publishes `type: 'board'` and
+the card queries ask for `cardType-card`, and a missing field matches neither.
+The new `type-defaults-backfill` startup step sets the schema default where
+`type` is missing, null or empty, and never changes an explicit type such as
+a template or a linked card. `tests/schemaUpgradeSteps.test.cjs` upgrades the
+grain's shape and checks that typed documents are left alone.
+
+The same log showed `merge-per-swimlane-lists FAILED ... missing schema for key
+"swimlaneId"`: FerretDB's SQLite `distinct` could not read documents without
+the fields it asked for. That is fixed in the FerretDB fork (Upcoming FerretDB
+release), which the next bundle includes.
+
+</details>
+
+**Snap** - backing up, restoring and repairing a snap from the host's shell.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/0b5c855820">Backup and restore instructions find mongodump and mongorestore on AlmaLinux, Rocky Linux and Fedora</a>. Thanks to Group-Deed and xet7.</summary>
+
+snapd keeps the snaps in `/var/lib/snapd/snap` on Fedora, RHEL, AlmaLinux,
+Rocky Linux, CentOS Stream and Arch Linux, which have no `/snap`. The
+instructions exported `/snap/wekan/current/bin` and its `lib/x86_64-linux-gnu`,
+so restoring a backup on Rocky Linux failed until both were found by hand, and
+only Arch had a note - for the library path alone. Every instruction now picks
+the directory with one `S=` line and the CPU's library directory with
+`$(uname -m)`, so arm64 works too. `database-role`, `database-compare` and
+`database-merge`, which can be run from a host shell, find the snap in either
+place. `tests/snapPathElLinux.test.cjs` fails on an export of a `/snap`-only
+path in any document and on a script that falls back to `/snap` alone.
+
+</details>
+
+and has the following developer-tooling fixes:
+
+**The build log** - what a build from build.sh and build.bat writes while it
+runs, and how much of it.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/6551062492">EVERYTHING builds without the per-require module trace, so it no longer fills the disk</a>. Thanks to xet7.</summary>
+
+The build's `NODE_DEBUG=module` trace wrote over 12 GB in the first half hour
+of an EVERYTHING run on macOS - twice, through tee - and slowed the build it
+traced, so the run would fill the disk before it reached the tests. A build
+from the `build.sh` menu still traces by default; `WEKAN_BUILD_TRACE_MODULES=0`
+turns it off, and EVERYTHING sets that unless the caller asked for `1`. The
+other build diagnostics (resolver commands, npm verbose, `METEOR_PROFILE`) are
+unchanged. `tests/buildCommandOutput.test.cjs` checks that a menu build still
+traces and that nothing exports the module trace unconditionally.
+
+</details>
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/5a13e927bc">Every build traces module resolution only when WEKAN_BUILD_TRACE_MODULES=1 asks for it</a>. Thanks to xet7.</summary>
+
+Turning the trace off for EVERYTHING alone was not enough: a dev build from the
+menu wrote 1.1 GB, three million lines, in its first three minutes. So the
+trace is now opt-in in `build.sh` and `build.bat` alike, and the diagnostics
+line says whether it is on and how to turn it on. The entry above describes
+the menu default as it was then. `tests/buildCommandOutput.test.cjs` pins the
+opt-in in both scripts, and fails on a trace turned on by default or
+unconditionally.
+
+</details>
+
+**Meteor in .tools** - starting the Meteor that build.sh and build.bat keep in
+the repository's own tools directory.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/9a118c83b2">Meteor starts with one springboard instead of springboarding forever</a>. Thanks to xet7.</summary>
+
+A build from the menu printed `uname -p` and `sysctl hw.cpu64bit_capable` over
+and over and never reached its first package. With `METEOR_WAREHOUSE_DIR` set
+and no `SANDBOX`, Meteor takes the running tool to be wherever the warehouse's
+`meteor` link points - 3.5.4, the release it was installed with - so with
+`.meteor/release` at 3.6-rc.1 every start springboarded to 3.6.0-rc.1, found
+itself the wrong tool again and springboarded again: 28 times in 20 seconds of
+`meteor --version`. The 1.1 GB build log above was the same loop, its module
+trace printed again on every exec. `releases/tools-env.sh` and `tools-env.bat`
+now set `SANDBOX=true` beside the warehouse, as Meteor's own self-test does,
+and so do the Nextcloud test scripts and the dev-source runner.
+`tests/meteorSpringboardLoop.test.cjs` checks both scripts, fails on any file
+that sets the warehouse without `SANDBOX`, and runs the installed Meteor to
+count its springboards.
+
+</details>
+
+and updates the following documentation:
+
+- [Security settings: every hardening option of a WeKan site on one page](https://github.com/wekan/wekan/commit/302b47db6f).
+  Thanks to xet7.
+- [Admin Panel / People / Audit log: what it records and what it never does](https://github.com/wekan/wekan/commit/f165a24192).
+  Thanks to xet7.
+
+and updates the following translations:
+
+**Languages updated:** 234 languages.
+
+**Password length** - the strings of Admin Panel / Problems / Password length
+and of the Change your password dialog.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/3f9379ac86">The 18 new password-length strings in every language</a>. Thanks to xet7.</summary>
+
+Each string is in the language and script its locale tag names, with the terms
+the file already uses for password, account, save and sign in, and `__min__`
+kept exactly; only those 18 keys changed in each file. The commit lists the
+languages written with low confidence, for a speaker to correct on Transifex.
+
+</details>
+
+**Security features** - the strings of the password policy, two-factor, the
+audit log and S3 encryption.
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/de23dece66">The 16 new security strings in every language, and Frisian two-factor text that was Dutch</a>. Thanks to xet7.</summary>
+
+Each string is in the language and script its locale tag names, with the terms
+the file already uses for password, account, attachment, backup and two-factor
+authentication, and `__min__` kept exactly. fy and fy-NL had Dutch two-factor
+strings, now Frisian (`tests/frisianTwoFactorLanguage.test.cjs`); Tigre spells
+storage መክዘን, not Tigrinya's መኽዘን. The commit lists the languages written
+with low confidence, for a speaker to correct on Transifex.
+
+</details>
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v12.75 2026-10-30 WeKan ® release
+
+**In short:** Changing a password signs the account out in every other browser,
+and now a test proves it in two real browsers.
+
+This release adds the following security regression test:
+
+<details>
+<summary><a href="https://github.com/wekan/wekan/commit/dc9a7bb1ac">A changed password signs the account out in every other browser</a>. Thanks to xet7.</summary>
+
+A report described a session that stayed signed in on a second browser after
+the password was changed on the first. WeKan does not do that: Member Settings
+/ Change Password is Meteor's changePassword, which removes every login token
+but the changing session's, the admin's Set password and a password reset
+remove them all, and a session whose token is gone is closed.
+`password-change-other-sessions.e2e.js` runs the report in two browsers - the
+other one is signed out within seconds, stays signed out after a reload, and
+only the new password works - three times in Chromium and in WebKit.
+`tests/passwordChangeSessions.test.cjs` pins those paths and fails on a password
+change that keeps the other sessions.
+
+</details>
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
 # v12.74 2026-10-30 WeKan ® release
 
 **In short:** **Caddy** and **FerretDB**, the Go servers WeKan ships, no longer

CHANGELOG.md

@@ -5,6 +5,26 @@ each one changed and the project status are in
 Written by `node releases/changelog-short.mjs` from CHANGELOG-big.md:
 make changes there.
 
+# v12.76 2026-10-31 WeKan ® release
+
+Security features: a **password policy** with an optional
+breached-password check, **Admin Panel / Problems / Password length**,
+**compulsory two-factor authentication**, sign-out of **idle sessions** and of
+every session after a password change, an **audit log** of what administrators
+did, **HSTS**, a cross-site request guard, and **S3 encryption at rest**.
+**Sign-up** works again; the date picker has **Today**, the whole card title
+edits and **every popup can be moved**; and an old **Sandstorm** grain migrated
+from MongoDB 3 shows its boards again.
+
+[All changes in v12.76](CHANGELOG-big.md#v1276-2026-10-31-wekan--release)
+
+# v12.75 2026-10-30 WeKan ® release
+
+Changing a password signs the account out in every other browser,
+and now a test proves it in two real browsers.
+
+[All changes in v12.75](CHANGELOG-big.md#v1275-2026-10-30-wekan--release)
+
 # v12.74 2026-10-30 WeKan ® release
 
 **Caddy** and **FerretDB**, the Go servers WeKan ships, no longer
@@ -32,22 +52,3 @@ Problems**. The **Apache** guide follows the 2024 Confusion Attacks, and the
 Sandstorm store build publishes to **both app markets**.
 
 [All changes in v12.72](CHANGELOG-big.md#v1272-2026-10-30-wekan--release)
-
-# v12.71 2026-10-30 WeKan ® release
-
-The **Sandstorm** build installs Sandstorm from
-**install.sandstorm.org**, as the Sandstorm workflows already did, and the
-docs link sandstorm.org. The Hall of Fame guards read every vulnerability name
-now that each one links to its own page.
-
-[All changes in v12.71](CHANGELOG-big.md#v1271-2026-10-30-wekan--release)
-
-# v12.70 2026-10-29 WeKan ® release
-
-The **AppImages** and the **Launchpad** snaps build again: their
-FerretDB and mongo-tools are readable by every user, and the snap source
-carries what its downloads need. **Continuous backup** names a changed
-encrypted file as changed with **OpenSSL 4**, and the release and test tooling
-runs on macOS and reports a bad certificate as one.
-
-[All changes in v12.70](CHANGELOG-big.md#v1270-2026-10-29-wekan--release)

Dockerfile

@@ -38,7 +38,7 @@ FROM --platform=$BUILDPLATFORM debian:trixie AS bundle
 
 ARG TARGETARCH
 ARG TARGETVARIANT
-ARG VERSION=12.74
+ARG VERSION=12.76
 ARG DEBIAN_FRONTEND=noninteractive
 
 COPY --chmod=755 releases/check-telemetry.py /tmp/check-telemetry.py
@@ -292,6 +292,14 @@ ENV \
     LOGOUT_ON_HOURS="" \
     LOGOUT_ON_MINUTES="" \
     USERS_DISABLE_INACTIVE_AFTER_DAYS="" \
+    LOGOUT_IDLE_MINUTES="" \
+    REQUIRE_2FA="" \
+    PASSWORD_MIN_LENGTH="" \
+    PASSWORD_MIN_LENGTH_ENFORCE="" \
+    PASSWORD_CHECK_PWNED="" \
+    HSTS_MAX_AGE="" \
+    HSTS_INCLUDE_SUBDOMAINS="" \
+    HSTS_PRELOAD="" \
     ATTACHMENTS_RETENTION_DAYS="" \
     ATTACHMENTS_RETENTION_MODE="" \
     ATTACHMENTS_PURGE_DELETED_AFTER_DAYS="" \

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v12.74.0"
+appVersion: "v12.76.0"
 files:
   userUploads:
     - README.md

build.bat

@@ -989,15 +989,18 @@ exit /b %errorlevel%
 
 :buildcommon
 REM The same diagnostics as build.sh build_wekan: npm verbose output and
-REM foreground install scripts, METEOR_PROFILE, Node module resolution and the
-REM resolver command/output tracer, so a failed Windows build leaves the same
-REM evidence in its log. WEKAN_BUILD_HEAP_SNAPSHOT=1 caps the heap at
+REM foreground install scripts, METEOR_PROFILE and the resolver command/output
+REM tracer, so a failed Windows build leaves the same evidence in its log. Node
+REM module resolution (one line per require, gigabytes a minute) only with
+REM WEKAN_BUILD_TRACE_MODULES=1. WEKAN_BUILD_HEAP_SNAPSHOT=1 caps the heap at
 REM WEKAN_BUILD_HEAP_SNAPSHOT_MB (4096) and writes a heap snapshot near the limit.
 setlocal
 set "npm_config_loglevel=verbose"
 set "npm_config_foreground_scripts=true"
 if not defined METEOR_PROFILE set "METEOR_PROFILE=100"
-if defined NODE_DEBUG (set "NODE_DEBUG=%NODE_DEBUG%,module") else (set "NODE_DEBUG=module")
+if "%WEKAN_BUILD_TRACE_MODULES%"=="1" (
+  if defined NODE_DEBUG (set "NODE_DEBUG=!NODE_DEBUG!,module") else (set "NODE_DEBUG=module")
+)
 if "%WEKAN_BUILD_HEAP_SNAPSHOT%"=="1" (
   if not defined WEKAN_BUILD_HEAP_SNAPSHOT_MB set "WEKAN_BUILD_HEAP_SNAPSHOT_MB=4096"
   set "TOOL_NODE_FLAGS=--max-old-space-size=!WEKAN_BUILD_HEAP_SNAPSHOT_MB! --heapsnapshot-near-heap-limit=1"
@@ -1005,7 +1008,7 @@ if "%WEKAN_BUILD_HEAP_SNAPSHOT%"=="1" (
   echo Heap snapshot: ON, heap capped at !WEKAN_BUILD_HEAP_SNAPSHOT_MB! MB; the build will fail sooner and write Heap.*.heapsnapshot.
 )
 set "NODE_OPTIONS=%NODE_OPTIONS% --require="%REPO%\tools\build-command-output.cjs""
-echo Build diagnostics: resolver command/output tracing, Node module resolution, npm verbose output, foreground install scripts, METEOR_PROFILE=%METEOR_PROFILE% ^(milliseconds^).
+echo Build diagnostics: resolver command/output tracing, npm verbose output, foreground install scripts, METEOR_PROFILE=%METEOR_PROFILE% ^(milliseconds^).
 call :buildcommon_steps
 set "BUILD_RC=%errorlevel%"
 if not "%BUILD_RC%"=="0" if defined WEKAN_BUILD_LOG (

build.sh

@@ -468,10 +468,17 @@ function build_wekan(){
 		echo "===== wekan build started $(date '+%F %T') ====="
 		export npm_config_loglevel=verbose npm_config_foreground_scripts=true
 		export METEOR_PROFILE="${METEOR_PROFILE:-100}"
-		export NODE_DEBUG="${NODE_DEBUG:+$NODE_DEBUG,}module"
+		# Node module resolution, one line per require. OFF unless
+		# WEKAN_BUILD_TRACE_MODULES=1: a Meteor build writes it at gigabytes a
+		# minute - 1.1 GB in the first three minutes of a menu dev build, over
+		# 12 GB in the first half hour of EVERYTHING on macOS, written twice
+		# through tee - and slows the build it is tracing.
+		if [ "${WEKAN_BUILD_TRACE_MODULES:-0}" = 1 ]; then
+			export NODE_DEBUG="${NODE_DEBUG:+$NODE_DEBUG,}module"
+		fi
 		# NODE_OPTIONS parses quoted paths, including checkouts with spaces.
 		export NODE_OPTIONS="${NODE_OPTIONS:-} --require=\"$(pwd)/tools/build-command-output.cjs\""
-		echo "Build diagnostics: resolver command/output tracing, Node module resolution, npm verbose output, foreground install scripts, METEOR_PROFILE=$METEOR_PROFILE (milliseconds)."
+		echo "Build diagnostics: resolver command/output tracing, npm verbose output, foreground install scripts, METEOR_PROFILE=$METEOR_PROFILE (milliseconds), Node module resolution $([ "${WEKAN_BUILD_TRACE_MODULES:-0}" = 1 ] && echo on || echo 'off (WEKAN_BUILD_TRACE_MODULES=1 turns it on)')."
 		build_stage "1/4 Remove dependencies and build caches" rm -rf node_modules node_modules/.cache .meteor/local .build _build || return $?
 		# Updating npm metadata has historically been best effort; installation is required.
 		build_stage "2/4 Compile app to resolve Meteor plugin npm dependencies" meteor update --npm || echo "WARNING: Meteor plugin npm dependency compilation failed; trying dependency installation."

client/00-startup.js

@@ -111,6 +111,28 @@ Meteor.startup(() => {
     }
   });
 
+  // LOGOUT_IDLE_MINUTES: report the user's activity while signed in, if the
+  // limit is set (models/lib/idleLogout.js).
+  const { createIdleActivityReporter } = require('/client/lib/idleActivity');
+  const idleReporter = createIdleActivityReporter({
+    target: document,
+    touch: () => Meteor.call('touchActivity', () => {}),
+  });
+  let idleCheckedFor = null;
+  Tracker.autorun(() => {
+    const userId = Meteor.userId();
+    if (!userId) {
+      idleCheckedFor = null;
+      idleReporter.stop();
+      return;
+    }
+    if (idleCheckedFor === userId) return;
+    idleCheckedFor = userId;
+    Meteor.call('getIdleLogout', (error, result) => {
+      if (!error && result && result.enabled && Meteor.userId() === userId) idleReporter.start();
+    });
+  });
+
   // Initialize mobile mode on startup for iOS devices
   // This ensures mobile mode is applied correctly on page load
   Tracker.afterFlush(() => {

client/components/cards/cardDetails.css

@@ -366,43 +366,43 @@ body.desktop-mode .card-details.card-details-collapsed {
   position: relative;
 }
 
-/* The title is two things at once, split like a minicard's: the LEADING half
-   opens the editor, the trailing half drags the window. With drag handles OFF
-   there is no handle, so the title bar is what the window is moved by - and a
-   heading that is entirely an edit target leaves nothing to take hold of.
+/* #6839: the whole title edits - every word of it and the space beside a
+   short last line, which is what anybody clicks to change the title. The window
+   is moved from the empty space ABOVE the title, in the row of the collapse
+   caret and the menu (cardDetails.js), or by the drag handle when drag handles
+   are on. It was split like a minicard's - the trailing half dragged - and a
+   click on the right of the title did nothing anybody expected.
 
-   An overlay rather than a split of the text, because the text is a `.viewer`
-   and cutting it in two would cut the sentence in two. `inset-inline-start`, so
-   the edit half is the left in English and the right in Arabic from one rule.
-   The drag handler steps aside for this zone (cardDetails.js). */
+   An overlay rather than a link around the text, because the text is a
+   `.viewer` with its own links. */
 .card-details .card-details-header .card-details-title .card-details-title-edit-zone {
   position: absolute;
   top: 0;
   bottom: 0;
   inset-inline-start: 0;
-  /* Half of the heading - and the heading is stretched to the row below, so
-     this is half of the BAR however long the title happens to be. */
-  width: 50%;
+  width: 100%;
   cursor: text;
   z-index: 1;
 }
 
-/* The heading fills the row rather than shrinking to its text, so "half the
-   title" and "half the bar" are the same half however long the title is. A
-   heading only as wide as its words leaves the empty space beside it belonging
-   to nothing - and that space is where anybody would grab to move the window.
-   It stays inline-block so the complete-toggle beside it keeps its place; the
-   buttons floating at the trailing edge take their room out of this width. */
+/* The heading fills the row rather than shrinking to its text, so the edit
+   zone covers the space beside a short title too. It stays inline-block so
+   the complete-toggle beside it keeps its place. */
 .card-details .card-details-header .card-details-title {
   min-width: 60%;
 }
 
-/* With drag handles ON the handle is the only drag source, so the whole title
-   is the edit target - the same rule the minicard follows, from the same
-   question: `card-details-with-handle` is set by the template from
-   isTouchScreenOrShowDesktopDragHandles, which is Utils.showDragHandles(). */
-.card-details.card-details-with-handle .card-details-header .card-details-title .card-details-title-edit-zone {
-  width: 100%;
+/* The empty part of the header row is what moves the window when there is no
+   drag handle; with one, the handle alone does. */
+.card-details:not(.card-details-with-handle) .card-details-header {
+  cursor: move;
+}
+.card-details .card-details-header .card-details-title,
+.card-details .card-details-header a {
+  cursor: auto;
+}
+.card-details .card-details-header a {
+  cursor: pointer;
 }
 .card-details .card-details-header .linked-card-location {
   font-style: italic;

client/components/cards/cardDetails.jade

@@ -49,10 +49,9 @@ template(name="cardDetails")
           a.card-details-menu.js-open-card-details-menu(title="{{_ 'cardDetailsActionsPopup-title'}}")
             i.fa.fa-bars
           //- The handle appears only when drag handles are ON, like the
-            minicard's. With them off the window is dragged by its own title bar
-            - the trailing half of the title - so a handle would be a second way
-            to do what the bar already does; with them on it is the ONLY way, and
-            the title is all edit target.
+            minicard's. With them off the window is dragged by the empty space
+            of its header row, so a handle would be a second way to do what the
+            bar already does; with them on it is the ONLY way.
             client/components/cards/minicard.jade
           if canModifyCard
             if isTouchScreenOrShowDesktopDragHandles
@@ -80,12 +79,12 @@ template(name="cardDetails")
           if currentBoard.allowsDueComplete
             a.card-details-complete-toggle.js-toggle-due-complete(title="{{#if getDueComplete}}{{_ 'card-mark-incomplete'}}{{else}}{{_ 'card-mark-complete'}}{{/if}}")
               .materialCheckBox(class="{{#if getDueComplete}}is-checked{{/if}}")
-        //- The title is BOTH: the leading half opens the editor and the
-          trailing half drags the window, exactly as a minicard's title splits
-          between editing and dragging the card. `js-card-title-drag-handle`
-          stays on the whole heading - the drag handler is what steps aside for
-          the edit zone - so a reader who may not write can still drag the
-          window by any part of it, which is what that class was for.
+        //- #6839: the whole title opens the editor. The window is moved from
+          the empty space of the header row above it, or by the drag handle
+          when drag handles are on. `js-card-title-drag-handle` stays on the
+          whole header - the drag handler is what steps aside for the edit zone
+          - so a reader who may not write, who has no edit zone, can still drag
+          the window by the title.
         if showLabelsAboveTitleOnCard
           .card-details-labels-above-title
             +minicardLabels(show=labelsShownAboveTitle labels=labels hideText=hiddenCardLabelText)

client/components/cards/cardDetails.js

@@ -701,9 +701,12 @@ Template.cardDetails.onDestroyed(function () {
 
   // #6686: see the comment in onCreated above. Only close a popup that is
   // still showing THIS card's data at the base of its stack - a popup opened
-  // for an unrelated card/context must not be touched.
+  // for an unrelated card/context must not be touched. #6840: and only when
+  // this card is no longer the open one - closed, or another card opened. A
+  // card whose details are merely rendered again is still open, and its popup
+  // (the Due date one `d` just opened) must not flash shut.
   const openedCardId = this.openedCardId;
-  if (openedCardId && Popup.isOpen()) {
+  if (openedCardId && Popup.isOpen() && Utils.getCurrentCardId() !== openedCardId) {
     const baseStackEntry = Popup._stack?.[0];
     if (baseStackEntry?.dataContext?._id === openedCardId) {
       Popup.close();
@@ -1287,17 +1290,18 @@ Template.cardDetails.events({
       // selects text instead of moving the card window.
       return;
     }
-    // ...and don't drag from the half that EDITS. The title is split like a
-    // minicard's: the leading half opens the editor, the trailing half is what
-    // you take hold of. With drag handles ON the zone covers the whole title
-    // (cardDetails.css), so the window is dragged by its handle alone - which is
-    // what turning handles on means.
+    // #6839: ...and never from the title, which edits - all of it
+    // (cardDetails.css). The window is moved from the empty space of the
+    // header row above it, beside the collapse caret and the menu.
     if ($(event.target).closest('.card-details-title-edit-zone').length > 0) {
       return;
     }
     // The drag handle has its own handler; without this both would run and the
-    // window would be moved twice by one press.
-    if ($(event.target).closest('.js-card-drag-handle').length > 0) {
+    // window would be moved twice by one press. And when there IS a handle -
+    // drag handles on - it is the only thing that moves the window, which is
+    // what turning handles on means.
+    if ($(event.target).closest('.js-card-drag-handle').length > 0
+      || $(event.target).closest('.card-details').find('.js-card-drag-handle').length > 0) {
       return;
     }
 

client/components/cards/minicard.css

@@ -374,7 +374,12 @@
   flex-wrap: wrap;
   position: relative;
   z-index: 5;
-  margin-inline-end: 84px;
+  /* #6834: room for the drag handle beside it (20px, 1px from the edge), and
+     no more. It reserved 84px - a third of a 250px minicard - for nothing:
+     the avatars float AFTER this row and `clear: both` starts it below the
+     menu, so a due date "1405-08-10 12:00 (1 day left)" was broken over three
+     lines beside an empty strip. */
+  margin-inline-end: 24px;
   clear: both;
 }
 .minicard .date {

client/components/forms/calendarDateInput.css

@@ -102,6 +102,11 @@
   padding-inline: 4px;
 }
 
+/* #6838: a word, not an arrow - it may be wider than the arrows beside it. */
+.selected-calendar-heading .js-calendar-today {
+  white-space: nowrap;
+  padding-inline: 6px;
+}
 .selected-calendar-heading .selected-calendar-date {
   margin-inline-start: 4px;
 }

client/components/forms/calendarDateInput.jade

@@ -22,6 +22,9 @@ template(name="calendarDateInput")
               | {{monthLabel}}
               if inline
                 span.selected-calendar-date {{headingDateText}}
+            //- #6838: back to today's month from wherever the arrows went. It only
+            //- shows the month; the date stays as it is until a day is clicked.
+            button.primary.js-calendar-today(type="button" aria-label="{{_ 'today'}}") {{_ 'today'}}
             button.primary.js-calendar-next(type="button" aria-label="{{_ 'next'}} {{_ 'month'}}") ›
             button.primary.js-calendar-year-next(type="button" aria-label="{{_ 'next'}} {{_ 'predicate-year'}}") »
           table
@@ -34,5 +37,5 @@ template(name="calendarDateInput")
                 tr
                   each days
                     td(class="{{#if this.today}}is-today-cell{{/if}}")
-                      if this
+                      unless this.empty
                         button.primary.js-calendar-day(type="button" class="{{#if today}}is-today{{/if}}" data-date=iso title=title aria-label=title aria-pressed=selected aria-current=ariaCurrent tabindex=tabIndex) {{label}}

client/components/forms/calendarDateInput.js

@@ -86,9 +86,17 @@ Template.calendarDateInput.helpers({
     // the browser's local day, the same local calendar day formatDate() gives
     // every other cell, so it is the cell the user means by "today".
     const todayIso = formatDate(new Date());
+    // #6838: every row and every cell - an empty one too - has its own _id.
+    // Blaze matches list items by _id; without one, going from one month to
+    // another reused cells by position and the empty cells, all alike, were
+    // moved around: October came back as "29, empty, 30, empty", without the
+    // 31st. The month is part of each id, so a new month is new cells.
+    const month = days.find(Boolean);
+    const monthId = month ? formatDate(month) : 'empty';
     const rows = [];
     for (let index = 0; index < days.length; index += 7) {
-      rows.push({ days: days.slice(index, index + 7).map(date => date && ({
+      rows.push({ _id: `${monthId}-week-${index / 7}`, days: days.slice(index, index + 7).map((date, cell) => (date ? {
+        _id: formatDate(date),
         iso: formatDate(date),
         today: formatDate(date) === todayIso,
         // null omits the attribute: only today's button carries aria-current.
@@ -97,7 +105,7 @@ Template.calendarDateInput.helpers({
         title: formatDateForDisplay(date, false),
         selected: tpl.selectedDate.get() && formatDate(tpl.selectedDate.get()) === formatDate(date),
         tabIndex: focusDate && formatDate(focusDate) === formatDate(date) ? 0 : -1,
-      })) });
+      } : { _id: `${monthId}-empty-${index + cell}`, empty: true })) });
     }
     return rows;
   },
@@ -121,6 +129,11 @@ Template.calendarDateInput.events({
     event.preventDefault();
     tpl.shownDate.set(calendarMonthRange(tpl.shownDate.get(), selectedSystem().intl).end);
   },
+  'click .js-calendar-today'(event, tpl) {
+    event.preventDefault();
+    tpl.shownDate.set(new Date());
+    Tracker.afterFlush(() => tpl.find('.js-calendar-day.is-today')?.focus());
+  },
   'click .js-calendar-year-previous'(event, tpl) { event.preventDefault(); tpl.shownDate.set(shiftCalendarYear(tpl.shownDate.get(), -1, selectedSystem().intl)); },
   'click .js-calendar-year-next'(event, tpl) { event.preventDefault(); tpl.shownDate.set(shiftCalendarYear(tpl.shownDate.get(), 1, selectedSystem().intl)); },
   'click .js-calendar-day'(event, tpl) {

client/components/main/popup.css

@@ -1446,9 +1446,18 @@ body.mobile-mode .pop-over .content-wrapper {
   cursor: move;
   color: #888;
 }
-.pop-over .header:has(.popup-drag-handle) {
+/* #6839: the title bar moves every popup while drag handles are off; with
+   them on, the handle does, and the bar is an ordinary title. */
+.pop-over .header {
   cursor: move;
 }
+.pop-over .header:has(.popup-drag-handle) {
+  cursor: auto;
+}
+.pop-over .header a,
+.pop-over .header button {
+  cursor: pointer;
+}
 .pop-over .header .popup-maximize-btn {
   position: absolute;
   top: 0;

client/components/main/popup.js

@@ -29,8 +29,11 @@ function resizeDatePopup(element, width, height) {
   Object.entries(styles).forEach(([key, value]) => element.style.setProperty(key, value, 'important'));
 }
 
-// Popups dragged by their title bar (or the drag handle beside it), as the
-// opened card is. A date popup is movable too, found by its .edit-date.
+// #6839: EVERY popup is moved like the opened card: by its title bar when drag
+// handles are off, by the drag handle before its title when they are on - the
+// handle alone, then, as the card's. These are the popups that may also GROW
+// past the window while open (Drawing replacing a menu), so they are kept
+// inside it as they grow; so is any popup the user has dragged.
 const MOVABLE_POPUPS = new Set(['boardViewSettingsPopup', 'cardDrawingPopup', 'boardCardSettingsPopup']);
 // Popups with the opened card's maximize / minimize button.
 const MAXIMIZABLE_POPUPS = new Set(['cardDrawingPopup', 'boardCardSettingsPopup']);
@@ -66,7 +69,7 @@ Popup.template.onCreated(function () {
 
 Popup.template.helpers({
   popupMovable() {
-    return MOVABLE_POPUPS.has(this.popupName);
+    return true;
   },
   popupMaximizable() {
     return MAXIMIZABLE_POPUPS.has(this.popupName);
@@ -87,21 +90,43 @@ Popup.template.events({
   'pointerdown .header'(evt, tpl) {
     const element = evt.currentTarget.closest('.pop-over');
     // A maximized popup has no place to be dragged to.
+    // With drag handles on, the handle is the only thing that moves it.
+    const handle = element.querySelector('.js-popup-drag-handle');
     if (evt.button !== 0 || element.classList.contains('pop-over--maximized') ||
-        (!element.querySelector('.edit-date') && !MOVABLE_POPUPS.has(element.dataset.popup)) ||
+        (handle && !evt.target.closest('.js-popup-drag-handle')) ||
         evt.target.closest('a, button, input, select')) return;
     evt.preventDefault(); evt.stopPropagation();
     const bounds = element.getBoundingClientRect();
+    // Pin it where it is before it moves. A popup is placed by its margins, by
+    // inset-inline-end (the member menu, at the right edge) or by left/top, so
+    // `left: bounds.left` alone put some of them elsewhere - one jumped across
+    // the window as the drag began. Set it, see where it went, and correct.
+    const place = (left, top) => {
+      element.style.setProperty('inset-inline-start', 'auto', 'important');
+      element.style.setProperty('inset-inline-end', 'auto', 'important');
+      element.style.setProperty('left', `${left}px`, 'important');
+      element.style.setProperty('top', `${top}px`, 'important');
+    };
+    place(bounds.left, bounds.top);
+    const placed = element.getBoundingClientRect();
+    const left = bounds.left + (bounds.left - placed.left);
+    const top = bounds.top + (bounds.top - placed.top);
+    place(left, top);
+    element.dataset.userMoved = 'true';
     tpl._dateMove = { element, pointerId: evt.pointerId, x: evt.clientX, y: evt.clientY,
-      left: bounds.left, top: bounds.top, width: bounds.width, height: bounds.height };
+      left, top, width: bounds.width, height: bounds.height,
+      // The clamp keeps the popup's VISIBLE box 12px inside the window.
+      dx: bounds.left - left, dy: bounds.top - top };
     evt.currentTarget.setPointerCapture(evt.pointerId);
   },
   'pointermove .header'(evt, tpl) {
     const drag = tpl._dateMove;
     if (!drag || drag.pointerId !== evt.pointerId) return;
     evt.preventDefault(); evt.stopPropagation();
-    const left = Math.max(12, Math.min(window.innerWidth - drag.width - 12, drag.left + evt.clientX - drag.x));
-    const top = Math.max(12, Math.min(window.innerHeight - drag.height - 12, drag.top + evt.clientY - drag.y));
+    const boxLeft = Math.max(12, Math.min(window.innerWidth - drag.width - 12, drag.left + drag.dx + evt.clientX - drag.x));
+    const boxTop = Math.max(12, Math.min(window.innerHeight - drag.height - 12, drag.top + drag.dy + evt.clientY - drag.y));
+    const left = boxLeft - drag.dx;
+    const top = boxTop - drag.dy;
     // Dragging uses physical pointer coordinates in either text direction.
     drag.element.style.setProperty('inset-inline-start', 'auto', 'important');
     drag.element.style.setProperty('inset-inline-end', 'auto', 'important');
@@ -221,7 +246,8 @@ Popup.template.onRendered(function () {
     if (typeof ResizeObserver !== 'undefined') {
       const element = this._popupElement;
       this._boundsObserver = new ResizeObserver(() => {
-        if (!MOVABLE_POPUPS.has(element.dataset.popup) || element.classList.contains('pop-over--maximized')) return;
+        if (!(MOVABLE_POPUPS.has(element.dataset.popup) || element.dataset.userMoved)
+          || element.classList.contains('pop-over--maximized')) return;
         const box = element.getBoundingClientRect();
         const moved = keptInside(box, window.innerWidth, window.innerHeight);
         if (!moved) return;

client/components/main/popup.tpl.jade

@@ -14,10 +14,10 @@
   .header
     a.back-btn.js-back-view(class="{{#unless hasPopupParent}}is-hidden{{/unless}}" aria-label="{{_ 'go-back'}}")
       i.fa.fa-caret-left(aria-hidden="true")
-    //- A movable popup (popup.js MOVABLE_POPUPS) is dragged by its title bar
-      or this handle, like the opened card - and, like the card's, the handle
-      is there only while drag handles are on; a maximizable one has the
-      card's maximize / minimize button beside its close button.
+    //- #6839: every popup is moved like the opened card - by its title bar
+      while drag handles are off, by this handle alone while they are on
+      (popup.js); a maximizable one has the card's maximize / minimize button
+      beside its close button.
     if popupMovable
       if isTouchScreenOrShowDesktopDragHandles
         span.popup-drag-handle.js-popup-drag-handle(title="{{_ 'drag-to-move'}}")

client/components/settings/adminAuditLog.css

@@ -0,0 +1,11 @@
+.admin-audit-log-search { margin: 0.5rem 0; max-width: 24rem; }
+.admin-audit-log-table { width: 100%; border-collapse: collapse; }
+.admin-audit-log-table th, .admin-audit-log-table td {
+  padding: 0.3rem 0.5rem;
+  border-bottom: 1px solid rgba(128, 128, 128, 0.3);
+  text-align: start;
+  vertical-align: top;
+}
+.admin-audit-args { white-space: pre-wrap; word-break: break-all; font-size: 0.85em; }
+.admin-audit-failed .admin-audit-error { color: #c0392b; }
+.admin-audit-log-pager { margin-top: 0.5rem; display: flex; gap: 0.5rem; align-items: center; }

client/components/settings/adminAuditLog.jade

@@ -0,0 +1,39 @@
+template(name="adminAuditLog")
+  //- Admin Panel / People / Audit log (models/lib/adminAudit.js): every
+  //- administrative action of a site administrator, newest first. The
+  //- arguments are shown as stored - passwords and secrets never are.
+  .admin-audit-log
+    p {{_ 'admin-audit-log-info'}}
+    .admin-audit-log-search
+      input.wekan-form-control.js-admin-audit-search(type="search" placeholder="{{_ 'search'}}" value=search)
+    if loading
+      +spinner
+    else
+      table.admin-audit-log-table
+        thead
+          tr
+            th {{_ 'admin-audit-log-when'}}
+            th {{_ 'admin-audit-log-who'}}
+            th {{_ 'admin-audit-log-action'}}
+            th {{_ 'admin-audit-log-details'}}
+            th IP
+        tbody
+          each rows
+            tr(class="{{#unless ok}}admin-audit-failed{{/unless}}")
+              td {{when at}}
+              td {{actorUsername}}
+              td
+                code {{method}}
+                unless ok
+                  |  
+                  span.admin-audit-error {{error}}
+              td
+                code.admin-audit-args {{args}}
+              td {{ip}}
+          else
+            tr
+              td(colspan="5") {{_ 'admin-audit-log-empty'}}
+      .admin-audit-log-pager
+        button.js-admin-audit-prev(type="button" disabled=noPrev) ‹
+        span {{page}} / {{pages}} ({{total}})
+        button.js-admin-audit-next(type="button" disabled=noNext) ›

client/components/settings/adminAuditLog.js

@@ -0,0 +1,47 @@
+import { ReactiveVar } from 'meteor/reactive-var';
+import { Template } from 'meteor/templating';
+
+// Admin Panel / People / Audit log: pages of server/adminAudit.js's trail.
+Template.adminAuditLog.onCreated(function () {
+  this.page = new ReactiveVar(1);
+  this.search = new ReactiveVar('');
+  this.result = new ReactiveVar({ rows: [], total: 0, page: 1, perPage: 50 });
+  this.loading = new ReactiveVar(true);
+  this.autorun(() => {
+    const options = { page: this.page.get(), search: this.search.get() };
+    this.loading.set(true);
+    Meteor.call('adminAuditLogPage', options, (error, result) => {
+      this.loading.set(false);
+      if (!error && result) this.result.set(result);
+    });
+  });
+});
+
+Template.adminAuditLog.helpers({
+  loading() { return Template.instance().loading.get(); },
+  rows() { return Template.instance().result.get().rows; },
+  total() { return Template.instance().result.get().total; },
+  page() { return Template.instance().page.get(); },
+  search() { return Template.instance().search.get(); },
+  pages() {
+    const { total, perPage } = Template.instance().result.get();
+    return Math.max(1, Math.ceil(total / perPage));
+  },
+  noPrev() { return Template.instance().page.get() <= 1; },
+  noNext() {
+    const { total, perPage } = Template.instance().result.get();
+    return Template.instance().page.get() >= Math.ceil(total / perPage);
+  },
+  when(at) { return at ? new Date(at).toLocaleString() : ''; },
+});
+
+let searchTimer = null;
+Template.adminAuditLog.events({
+  'input .js-admin-audit-search'(event, tpl) {
+    const value = event.currentTarget.value;
+    clearTimeout(searchTimer);
+    searchTimer = setTimeout(() => { tpl.page.set(1); tpl.search.set(value); }, 300);
+  },
+  'click .js-admin-audit-prev'(event, tpl) { tpl.page.set(Math.max(1, tpl.page.get() - 1)); },
+  'click .js-admin-audit-next'(event, tpl) { tpl.page.set(tpl.page.get() + 1); },
+});

client/components/settings/adminProblems.jade

@@ -58,6 +58,8 @@ template(name="adminProblems")
             +eventStreamReport(stream="api")
           else if isPane 'report-office'
             +officeReport
+          else if isPane 'report-password-length'
+            +passwordLengthReport
           else if tablePageData
             +tablePage(tablePageData)
 

client/components/settings/adminProblems.js

@@ -321,6 +321,9 @@ const PROBLEMS_MENU = [
   // Security, and the two sit in the same menu.
   { id: 'report-security', icon: 'fa-shield', labelKey: 'securityReportTitle' },
   { id: 'report-impersonation', icon: 'fa-user-secret', labelKey: 'impersonationReportTitle' },
+  // Who signs in with a password shorter than PASSWORD_MIN_LENGTH, and the two
+  // settings that decide it (passwordLengthReport.js).
+  { id: 'report-password-length', icon: 'fa-key', labelKey: 'password-length-report-title' },
   { id: 'features-performance', icon: 'fa-tachometer', labelKey: 'features-performance', emoji: true },
   { id: 'report-speed', icon: 'fa-tachometer', labelKey: 'speedReportTitle' },
   { id: 'report-tests', icon: 'fa-flask', labelKey: 'testsReportTitle' },
@@ -538,6 +541,8 @@ const SELF_LOADING_PANES = [
   'report-security', 'report-speed', 'report-tests', 'report-cpu', 'report-ram', 'report-disk',
   'report-instrumentation',
   'report-database', 'report-integrity', 'report-office', 'report-api', 'report-mail',
+  // passwordLengthReport.js loads its own rows and settings through methods.
+  'report-password-length',
 ];
 
 function openReportPane(tmpl, targetID) {

client/components/settings/attachments.jade

@@ -281,6 +281,17 @@ template(name="attachments")
                       .materialCheckBox#s3-force-path-style(class="{{#if cloudValue.s3.forcePathStyle}}is-checked{{/if}}")
                       span {{_ 's3-force-path-style'}}
                   small.form-text.text-muted {{_ 's3-force-path-style-description'}}
+                //- Encryption at rest (models/lib/s3Encryption.js).
+                .form-group
+                  label(for="s3-sse") {{_ 's3-sse'}}
+                  select.wekan-form-control#s3-sse
+                    option(value="" selected="{{s3SseSelected ''}}") {{_ 's3-sse-none'}}
+                    option(value="AES256" selected="{{s3SseSelected 'AES256'}}") SSE-S3 (AES256)
+                    option(value="aws:kms" selected="{{s3SseSelected 'aws:kms'}}") SSE-KMS (aws:kms)
+                  small.form-text.text-muted {{_ 's3-sse-description'}}
+                .form-group
+                  label(for="s3-sse-kms-key-id") {{_ 's3-sse-kms-key-id'}}
+                  input.wekan-form-control#s3-sse-kms-key-id(type="text" value="{{cloudValue.s3.sseKmsKeyId}}" placeholder="arn:aws:kms:eu-north-1:111122223333:key/…")
 
                 .form-group
                   button.js-test-cloud-connection.btn.btn-secondary(data-provider="s3") {{_ 'test-cloud-connection'}}

client/components/settings/attachments.js

@@ -32,6 +32,8 @@ const CLOUD_FIELD_IDS = {
     accessKeyId: '#s3-access-key',
     secretAccessKey: '#s3-secret-key',
     forcePathStyle: '#s3-force-path-style',
+    serverSideEncryption: '#s3-sse',
+    sseKmsKeyId: '#s3-sse-kms-key-id',
   },
   azure: {
     enabled: '#azure-enabled',
@@ -858,6 +860,11 @@ Template.attachments.helpers({
     CLOUD_PROVIDERS.forEach(p => { out[p] = cloudConfigFromSettings(tpl, p).read !== false; });
     return out;
   },
+  // The S3 server-side encryption option that is stored (models/lib/s3Encryption.js).
+  s3SseSelected(mode) {
+    const stored = cloudConfigFromSettings(Template.instance(), 's3').serverSideEncryption || '';
+    return stored === mode ? 'selected' : null;
+  },
   cloudValue() {
     const tpl = Template.instance();
     const s3 = cloudConfigFromSettings(tpl, 's3');
@@ -872,6 +879,8 @@ Template.attachments.helpers({
         bucket: s3.bucket || '',
         accessKeyId: s3.accessKeyId || '',
         forcePathStyle: s3.forcePathStyle !== false,
+        serverSideEncryption: s3.serverSideEncryption || '',
+        sseKmsKeyId: s3.sseKmsKeyId || '',
       },
       azure: {
         accountName: azure.accountName || '',

client/components/settings/passwordLengthReport.jade

@@ -0,0 +1,23 @@
+//- Admin Panel / Problems / Password length (docs/Features/Admin-Panel/Problems/Password-length.md):
+//- the minimum, whether it is enforced, and who signs in with a shorter
+//- password - through the shared table page (docs/Features/General/Table.md).
+template(name="passwordLengthReport")
+  ul.setting-detail.password-length-settings
+    li
+      label(for="password-min-length-input") {{_ 'password-min-length'}}
+      input#password-min-length-input.js-password-min-length(type="number" min="1" max="256" value="{{minLength}}")
+      p.description {{_ 'password-min-length-description'}}
+    li
+      a.flex.js-toggle-password-min-length-enforce
+        .materialCheckBox(class="{{#if enforce}}is-checked{{/if}}")
+        span {{_ 'password-min-length-enforce'}}
+      p.description {{_ 'password-min-length-enforce-description'}}
+    li
+      button.primary.js-save-password-length(type="button") {{_ 'save'}}
+      if saved
+        span.password-length-saved {{_ 'password-length-saved'}}
+      if saveError
+        p.error.password-length-error= saveError
+      if fromEnvironment
+        p.description {{_ 'password-length-from-environment'}}
+  +tablePage(tablePageData)

client/components/settings/passwordLengthReport.js

@@ -0,0 +1,157 @@
+import { ReactiveVar } from 'meteor/reactive-var';
+import { Template } from 'meteor/templating';
+import { formatDateForDisplay } from '/client/lib/dateDisplay';
+import { buildFilters, buildHeader, buildRows, pageInfo } from '/models/lib/tablePage';
+import { errorMessage } from '/client/lib/errorMessage';
+
+// Admin Panel / Problems / Password length: the two settings and the table of
+// accounts that sign in with a password shorter than the minimum
+// (server/lib/shortPasswordLogins.js; docs/Features/Admin-Panel/Problems/Password-length.md).
+const { addressValue, locationText, locationFlag } = require('/models/lib/addressReportColumns');
+const { DEFAULT_FILTER } = require('/models/lib/shortPasswordLogins');
+
+const PER_PAGE = 25;
+const formatDate = date => (date ? formatDateForDisplay(date) : '');
+
+// One cell per family: the address, then the city when a CDN in front of
+// WeKan said where it is, and the country's flag before both.
+const addressColumn = (labelKey, family) => ({
+  labelKey,
+  nowrap: true,
+  value: row => [addressValue(row, family), locationText(row, family)].filter(Boolean).join(' '),
+  flag: row => locationFlag(row, family),
+});
+
+const COLUMNS = [
+  { labelKey: 'username', value: row => row.username || row.userId },
+  { labelKey: 'password-length-first-login', nowrap: true, value: row => formatDate(row.firstAt) },
+  addressColumn('event-ipv4', 'ipv4'),
+  addressColumn('event-ipv6', 'ipv6'),
+  { labelKey: 'password-length-last-login', nowrap: true, value: row => formatDate(row.at) },
+  { labelKey: 'password-length-login-count', align: 'end', value: row => row.count || 0 },
+  { labelKey: 'password-length-fixed', nowrap: true, value: row => formatDate(row.fixedAt) },
+];
+
+const FILTER_OPTIONS = [
+  { value: 'short', labelKey: 'password-length-filter-short' },
+  { value: 'fixed', labelKey: 'password-length-filter-fixed' },
+  { value: 'all', labelKey: 'password-length-filter-all' },
+];
+
+Template.passwordLengthReport.onCreated(function () {
+  this.rows = new ReactiveVar([]);
+  this.total = new ReactiveVar(0);
+  this.page = new ReactiveVar(1);
+  this.search = new ReactiveVar('');
+  this.filter = new ReactiveVar(DEFAULT_FILTER);
+  this.sources = new ReactiveVar(null);
+  // The working copy of the two settings, until Save.
+  this.minLength = new ReactiveVar(8);
+  this.enforce = new ReactiveVar(false);
+  this.saved = new ReactiveVar(false);
+  this.error = new ReactiveVar('');
+
+  this.load = () => {
+    Meteor.call('shortPasswordLoginsPage', {
+      filter: this.filter.get(),
+      search: this.search.get() || undefined,
+      limit: PER_PAGE,
+      skip: (this.page.get() - 1) * PER_PAGE,
+    }, (error, result) => {
+      if (error) return;
+      this.rows.set((result && result.rows) || []);
+      this.total.set((result && result.total) || 0);
+    });
+  };
+  this.loadSettings = () => {
+    Meteor.call('getAuthConfigSources', 'login', (error, result) => {
+      if (error || !result) return;
+      this.sources.set(result.sources || {});
+      this.minLength.set(result.sources?.passwordMinLength?.value || 8);
+      this.enforce.set(result.sources?.passwordMinLengthEnforce?.value === true);
+    });
+  };
+  this.load();
+  this.loadSettings();
+});
+
+Template.passwordLengthReport.helpers({
+  minLength() { return Template.instance().minLength.get(); },
+  enforce() { return Template.instance().enforce.get(); },
+  saved() { return Template.instance().saved.get(); },
+  saveError() { return Template.instance().error.get(); },
+  // An environment variable set on the host is overridden by a save here; say
+  // so, rather than let the admin wonder which one is in effect.
+  fromEnvironment() {
+    const sources = Template.instance().sources.get() || {};
+    return ['passwordMinLength', 'passwordMinLengthEnforce'].some(key => sources[key]?.source === 'env');
+  },
+  tablePageData() {
+    const t = Template.instance();
+    const rows = t.rows.get() || [];
+    const info = pageInfo(t.total.get(), t.page.get(), PER_PAGE);
+    return {
+      descKey: 'password-length-report-desc',
+      emptyKey: 'password-length-no-results',
+      searchTerm: t.search.get(),
+      filters: buildFilters([{
+        id: 'password-length-status', labelKey: 'status', current: t.filter.get(), options: FILTER_OPTIONS,
+      }]),
+      header: buildHeader(COLUMNS),
+      rows: buildRows(rows, COLUMNS),
+      rowCount: rows.length,
+      totalCount: t.total.get(),
+      page: info.page,
+      totalPages: info.totalPages,
+      hasPrev: info.hasPrev,
+      hasNext: info.hasNext,
+    };
+  },
+});
+
+Template.passwordLengthReport.events({
+  'input .js-password-min-length'(event, tmpl) {
+    tmpl.minLength.set(parseInt(event.currentTarget.value, 10) || '');
+    tmpl.saved.set(false);
+  },
+  'click .js-toggle-password-min-length-enforce'(event, tmpl) {
+    event.preventDefault();
+    tmpl.enforce.set(!tmpl.enforce.get());
+    tmpl.saved.set(false);
+  },
+  'click .js-save-password-length'(event, tmpl) {
+    event.preventDefault();
+    Meteor.call('saveAuthConfigSettings', 'login', {
+      passwordMinLength: tmpl.minLength.get() || null,
+      passwordMinLengthEnforce: tmpl.enforce.get(),
+    }, error => {
+      tmpl.error.set(error ? errorMessage(error) : '');
+      if (error) return;
+      tmpl.saved.set(true);
+      tmpl.loadSettings();
+    });
+  },
+  'change .js-table-page-filter'(event, tmpl) {
+    tmpl.filter.set(event.currentTarget.value || DEFAULT_FILTER);
+    tmpl.page.set(1);
+    tmpl.load();
+  },
+  'click .js-table-page-prev'(event, tmpl) {
+    event.preventDefault();
+    if (tmpl.page.get() > 1) { tmpl.page.set(tmpl.page.get() - 1); tmpl.load(); }
+  },
+  'click .js-table-page-next'(event, tmpl) {
+    event.preventDefault();
+    const info = pageInfo(tmpl.total.get(), tmpl.page.get(), PER_PAGE);
+    if (info.hasNext) { tmpl.page.set(tmpl.page.get() + 1); tmpl.load(); }
+  },
+  'keydown .js-table-page-search'(event, tmpl) {
+    if (event.keyCode === 13 && !event.shiftKey) {
+      event.preventDefault();
+      event.stopPropagation();
+      tmpl.search.set(event.currentTarget.value || '');
+      tmpl.page.set(1);
+      tmpl.load();
+    }
+  },
+});

client/components/settings/peopleBody.jade

@@ -36,6 +36,8 @@ template(name="people")
               +authProviderSettings(loginOptionsData)
               //- Windows SSO, which works only on a Windows server.
               +authProviderSettings(windowsSsoData)
+              //- Strict-Transport-Security, sent when ROOT_URL is https.
+              +authProviderSettings(httpSecurityData)
             else if samlSetting
               +authProviderSettings(samlSettingsData)
             else if authConfigSection
@@ -56,6 +58,8 @@ template(name="people")
               +peopleGeneral(peopleTablePageData)
             else if lockedUsersSetting.get
               +lockedUsersGeneral
+            else if auditLogSetting.get
+              +adminAuditLog
             else if rolesSetting.get
               +rolesGeneral
             else if templatesSetting.get

client/components/settings/peopleBody.js

@@ -142,6 +142,7 @@ Template.people.onCreated(function () {
   this.teamSetting = new ReactiveVar(false);
   this.peopleSetting = new ReactiveVar(false);
   this.lockedUsersSetting = new ReactiveVar(false);
+  this.auditLogSetting = new ReactiveVar(false);
   this.rolesSetting = new ReactiveVar(false);
   this.templatesSetting = new ReactiveVar(false);
   // #5850: Admin Panel > People > Domains tab. The domains table itself
@@ -434,6 +435,7 @@ Template.people.onCreated(function () {
       this.teamSetting.set('team-setting' === targetID);
       this.peopleSetting.set('people-setting' === targetID);
       this.lockedUsersSetting.set('locked-users-setting' === targetID);
+      this.auditLogSetting.set('audit-log-setting' === targetID);
       this.rolesSetting.set('roles-setting' === targetID);
       this.templatesSetting.set('templates-setting' === targetID);
       this.domainSetting.set('domains-setting' === targetID);
@@ -551,6 +553,9 @@ function peopleMenu(user) {
     { id: 'team-setting', icon: 'fa-users', labelKey: 'teams' },
     { id: 'people-setting', icon: 'fa-user', labelKey: 'people' },
     { id: 'locked-users-setting', icon: 'fa-lock', labelKey: 'accounts-lockout-locked-users', iconWrapCls: 'text-red' },
+    // What site administrators did (models/lib/adminAudit.js). Site admins only:
+    // tenantAdminPeopleMenu keeps a per-tenant admin's menu to its own panes.
+    { id: 'audit-log-setting', icon: 'fa-list-alt', labelKey: 'admin-audit-log' },
     { id: 'roles-setting', icon: 'fa-key', labelKey: 'roles' },
     { id: 'templates-setting', icon: 'fa-clone', labelKey: 'shared-templates' },
     { id: 'registration-setting', icon: 'fa-key', labelKey: 'login', emoji: true },
@@ -581,6 +586,15 @@ function peopleMenu(user) {
   return items;
 }
 
+// A password the server refused (server/lib/passwordPolicy.js), in the
+// reader's language; the popup that sent it has already closed.
+function passwordErrorMessage(error) {
+  const key = error && error.error;
+  if (key === 'password-too-short') return TAPi18n.__('password-too-short', { min: error.details?.min });
+  if (['password-pwned', 'password-same-as-username'].includes(key)) return TAPi18n.__(key);
+  return error.reason || error.message;
+}
+
 // People panes drawn from models/lib/authConfigCatalog.js, and the data the
 // catalog form (authProviderSettings) needs for one section.
 const AUTH_CONFIG_PANES = {
@@ -899,6 +913,8 @@ Template.people.helpers({
   // The Login pane's own login settings (PASSWORD_LOGIN_ENABLED, ...).
   loginOptionsData() { return authConfigData('login'); },
   windowsSsoData() { return authConfigData('windowsSso'); },
+  // HSTS (HSTS_MAX_AGE, ...), below the login settings.
+  httpSecurityData() { return authConfigData('httpSecurity'); },
   ldapPane() { return Template.instance().activeMenuId.get() === 'ldap-setting'; },
   authenticationSection() {
     return {
@@ -927,6 +943,9 @@ Template.people.helpers({
   lockedUsersSetting() {
     return Template.instance().lockedUsersSetting;
   },
+  auditLogSetting() {
+    return Template.instance().auditLogSetting;
+  },
   rolesSetting() {
     return Template.instance().rolesSetting;
   },
@@ -2352,7 +2371,9 @@ Template.editUserPopup.events({
     });
 
     if (isChangePassword) {
-      Meteor.call('setPassword', password, this.userId);
+      Meteor.call('setPassword', password, this.userId, error => {
+        if (error) alert(passwordErrorMessage(error));
+      });
     }
 
     if (isChangeEmailVerified) {
@@ -2651,6 +2672,8 @@ Template.newUserPopup.events({
           } else if (errorElement === 'email-already-taken') {
             usernameMessageElement.hide();
             emailMessageElement.show();
+          } else if (String(errorElement).startsWith('password-')) {
+            alert(passwordErrorMessage(error));
           }
         } else {
           usernameMessageElement.hide();

client/components/users/passwordChangeRequired.css

@@ -0,0 +1,27 @@
+/* PASSWORD_MIN_LENGTH: the Change Password form over everything, until done. */
+.password-change-required {
+  position: fixed;
+  inset: 0;
+  z-index: 100000;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  overflow: auto;
+  background: rgba(0, 0, 0, 0.6);
+}
+.password-change-required-box {
+  max-width: 32rem;
+  width: calc(100% - 2rem);
+  margin: 1rem;
+  padding: 1.5rem;
+  border-radius: 6px;
+  background: #fff;
+  color: #222;
+}
+.password-change-required-box h2 {
+  margin-top: 0;
+}
+/* layouts.css hides the password form until a page shows it (#6380). */
+.password-change-required .at-pwd-form {
+  display: block;
+}

client/components/users/passwordChangeRequired.jade

@@ -0,0 +1,12 @@
+template(name="passwordChangeRequired")
+  //- PASSWORD_MIN_LENGTH (server/passwordChangeRequired.js): an account whose
+  //- password is shorter than the minimum signed in, and sees only this until
+  //- it has a longer one. The form is the same Change Password Member
+  //- Settings opens; changing it signs every session out, this one too.
+  .password-change-required(role="dialog" aria-modal="true" aria-labelledby="password-change-required-title")
+    .password-change-required-box
+      h2#password-change-required-title {{_ 'password-change-required-title'}}
+      p {{_ 'password-change-required-text' min=min}}
+      +atForm(state='changePwd')
+      .buttonsContainer
+        button.js-password-change-required-logout(type="button") {{_ 'log-out'}}

client/components/users/passwordChangeRequired.js

@@ -0,0 +1,77 @@
+import { Blaze } from 'meteor/blaze';
+import { Template } from 'meteor/templating';
+import { Tracker } from 'meteor/tracker';
+import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
+
+// PASSWORD_MIN_LENGTH: after signing in, ask whether this account must change
+// a password shorter than the minimum, and if so show nothing but the Change
+// Password form (passwordChangeRequired.jade). The server asks the question
+// (server/passwordChangeRequired.js); config/accounts.js tells it when the
+// password just typed was too short. Changing a password signs every session
+// out, so the account then signs in again, with the new password.
+let overlay = null;
+
+function closeOverlay() {
+  if (!overlay) return;
+  Blaze.remove(overlay.view);
+  overlay.node.remove();
+  overlay = null;
+}
+
+function openOverlay(min) {
+  if (overlay) return;
+  const node = document.createElement('div');
+  document.body.appendChild(node);
+  overlay = { node, view: Blaze.renderWithData(Template.passwordChangeRequired, { min }, node) };
+}
+
+Template.passwordChangeRequired.events({
+  'click .js-password-change-required-logout'() {
+    Meteor.logout(() => closeOverlay());
+  },
+});
+
+export function checkPasswordChangeRequirement() {
+  const userId = Meteor.userId();
+  if (!userId) return;
+  Meteor.call('getPasswordChangeRequirement', (error, result) => {
+    if (error || !result || Meteor.userId() !== userId) return;
+    if (result.required) openOverlay(result.minLength);
+  });
+}
+
+// A changed password signs this session out too (server/passwordChangeRequired.js).
+// The server closes the connection as it removes the token, so the answer to
+// the change - and useraccounts' onSubmitHook - may never arrive; being signed
+// out soon after submitting a change is the answer, and the next stop is the
+// sign-in page, from Member Settings and from this overlay alike.
+const SIGN_OUT_WAIT_MS = 2 * 60 * 1000;
+let changeSubmittedAt = 0;
+document.addEventListener('submit', event => {
+  const form = event.target;
+  if (form && form.id === 'at-pwd-form' && form.querySelector('#at-field-current_password')) {
+    changeSubmittedAt = Date.now();
+  }
+}, true);
+
+Meteor.startup(() => {
+  let askedFor = null;
+  Tracker.autorun(() => {
+    const userId = Meteor.userId();
+    if (!userId) {
+      askedFor = null;
+      const changed = Date.now() - changeSubmittedAt < SIGN_OUT_WAIT_MS;
+      if (overlay || changed) {
+        // The change signed every session out: sign in with the new password.
+        changeSubmittedAt = 0;
+        closeOverlay();
+        Popup.close?.();
+        FlowRouter.go('atSignIn');
+      }
+      return;
+    }
+    if (askedFor === userId) return;
+    askedFor = userId;
+    Tracker.nonreactive(checkPasswordChangeRequirement);
+  });
+});

client/components/users/twoFactorRequired.css

@@ -0,0 +1,23 @@
+/* REQUIRE_2FA: the set-up over everything, until it is done. */
+.two-factor-required {
+  position: fixed;
+  inset: 0;
+  z-index: 100000;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  overflow: auto;
+  background: rgba(0, 0, 0, 0.6);
+}
+.two-factor-required-box {
+  max-width: 32rem;
+  width: calc(100% - 2rem);
+  margin: 1rem;
+  padding: 1.5rem;
+  border-radius: 6px;
+  background: #fff;
+  color: #222;
+}
+.two-factor-required-box h2 {
+  margin-top: 0;
+}

client/components/users/twoFactorRequired.jade

@@ -0,0 +1,13 @@
+template(name="twoFactorRequired")
+  //- REQUIRE_2FA (models/lib/twoFactorRequirement.js): an account that must
+  //- have two-factor authentication sees only this until it has set it up.
+  //- The server refuses everything else meanwhile (server/requireTwoFactor.js);
+  //- this is what the account can do about it. The set-up is the same
+  //- twoFactorAuthPopup Member Settings opens.
+  .two-factor-required(role="dialog" aria-modal="true" aria-labelledby="two-factor-required-title")
+    .two-factor-required-box
+      h2#two-factor-required-title {{_ 'two-factor-required-title'}}
+      p {{_ 'two-factor-required-text'}}
+      +twoFactorAuthPopup
+      .buttonsContainer
+        button.js-two-factor-required-logout(type="button") {{_ 'log-out'}}

client/components/users/twoFactorRequired.js

@@ -0,0 +1,55 @@
+import { Blaze } from 'meteor/blaze';
+import { Template } from 'meteor/templating';
+import { Tracker } from 'meteor/tracker';
+
+// REQUIRE_2FA: after signing in, ask whether this account must still set up
+// two-factor authentication, and if so show nothing but the set-up
+// (twoFactorRequired.jade). accounts-2fa publishes the account's own
+// services.twoFactorAuthentication.type, so finishing the set-up is seen at
+// once; the page then reloads, because every subscription the server left
+// empty meanwhile has to be made again.
+let overlay = null;
+
+function closeOverlay() {
+  if (!overlay) return;
+  Blaze.remove(overlay.view);
+  overlay.node.remove();
+  overlay = null;
+}
+
+function openOverlay() {
+  if (overlay) return;
+  const node = document.createElement('div');
+  document.body.appendChild(node);
+  overlay = { node, view: Blaze.render(Template.twoFactorRequired, node) };
+}
+
+Template.twoFactorRequired.events({
+  'click .js-two-factor-required-logout'() {
+    Meteor.logout(() => closeOverlay());
+  },
+});
+
+Meteor.startup(() => {
+  let askedFor = null;
+  Tracker.autorun(() => {
+    const userId = Meteor.userId();
+    const user = Meteor.user({ fields: { 'services.twoFactorAuthentication.type': 1 } });
+    if (!userId) {
+      askedFor = null;
+      closeOverlay();
+      return;
+    }
+    const enabled = user?.services?.twoFactorAuthentication?.type === 'otp';
+    if (overlay && enabled) {
+      window.location.reload();
+      return;
+    }
+    if (askedFor === userId) return;
+    askedFor = userId;
+    Meteor.call('getTwoFactorRequirement', (error, result) => {
+      if (error || !result || Meteor.userId() !== userId) return;
+      if (result.required && !result.enabled) openOverlay();
+    });
+  });
+});

client/components/users/userForm.css

@@ -204,3 +204,57 @@ body.mobile-mode.userform-layout {
   #at-meteor-developer, #at-weibo, #at-meetup) {
   display: none;
 }
+
+/* #6835: Member Settings / Change Settings. Its rows are the shared popup list
+   (popup.css: a flex row, every line 33px high, the icon centred), which reads
+   well for one-line items and badly for these: a setting whose words wrap -
+   most of them, in Persian and German - became two 33px lines with its icon
+   floating between them and the next setting right below, with nothing to
+   tell one from the other. Here a row is an icon column, the words, and the
+   check mark at the end; the icon sits on the first line of the words, a
+   wrapped line is an ordinary line high, and a rule divides the rows. Scoped
+   to the list's own class: the member menu before it shares its .pop-over. */
+.pop-over-list.change-settings-list li + li {
+  border-top: 1px solid rgba(0, 0, 0, 0.12);
+}
+.pop-over-list.change-settings-list li > a {
+  align-items: flex-start;
+  gap: 0;
+  line-height: 1.35;
+  padding: 8px 10px;
+}
+.pop-over-list.change-settings-list li > a > i.fa:first-child {
+  flex: 0 0 1.4em;
+  margin-inline-end: 0.6em;
+  line-height: inherit;
+  text-align: center;
+}
+.pop-over-list.change-settings-list li > a > i.fa-check {
+  flex: 0 0 auto;
+  margin-inline-start: auto;
+  padding-inline-start: 0.6em;
+  line-height: inherit;
+}
+.pop-over-list.change-settings-list li > label.bold {
+  display: flex;
+  align-items: flex-start;
+  line-height: 1.35;
+  padding: 8px 10px 4px;
+}
+.pop-over-list.change-settings-list li > label.bold > i.fa {
+  flex: 0 0 1.4em;
+  margin-inline-end: 0.6em;
+  text-align: center;
+  line-height: inherit;
+}
+/* The Card settings checkbox row: the box on the first line of its words,
+   with the same space between them as an icon has. */
+.pop-over-list.change-settings-list .js-rescue-card-description {
+  align-items: flex-start;
+  gap: 0.6em;
+  line-height: 1.35;
+}
+.pop-over-list.change-settings-list .js-rescue-card-description .materialCheckBox {
+  flex: 0 0 auto;
+  margin-top: 0.15em;
+}

client/components/users/userHeader.jade

@@ -410,7 +410,10 @@ template(name="changeFontPopup")
       a.js-reset-text-color(class="{{#unless hasTextColor}}disabled{{/unless}}") {{_ 'remove-btn'}}
 
 template(name="changeSettingsPopup")
-  ul.pop-over-list
+  //- #6835: its own class - a popup keeps the screens before it (the member
+    menu) side by side in the same .pop-over, so the popup's data-popup would
+    restyle those too. userForm.css
+  ul.pop-over-list.change-settings-list
     li
       a.js-toggle-desktop-drag-handles
         i.fa.fa-arrows

client/features/settings.js

@@ -1,4 +1,5 @@
 import '/client/components/settings/adminProblems.jade';
+import '/client/components/settings/adminAuditLog.jade';
 import '/client/components/settings/attachments.jade';
 // Backup status and history, shared by Attachments / Backup and Problems / Backup.
 import '/client/components/settings/backupRunsStatus.jade';
@@ -33,6 +34,7 @@ import '/client/components/settings/invitationCode.js';
 // the `collapsed` class either. docs/Features/All-Boards/Left-Menu.md
 import '/client/components/settings/leftMenu.js';
 import '/client/components/settings/lockedUsersBody.js';
+import '/client/components/settings/adminAuditLog.js';
 import '/client/components/settings/migrationProgress.js';
 import '/client/components/settings/notificationSettingsPopup.js';
 // #3695: notification delivery (content, grouping, schedule) per channel, in
@@ -48,6 +50,8 @@ import '/client/components/settings/sharedLabelsSettings.js';
 import '/client/components/settings/settingHeader.js';
 import '/client/components/settings/problemsSummary.jade';
 import '/client/components/settings/problemsSummary.js';
+import '/client/components/settings/passwordLengthReport.jade';
+import '/client/components/settings/passwordLengthReport.js';
 import '/client/components/settings/translationBody.js';
 
 // adminProblems.css was missing here, so NONE of the Admin Panel report styling
@@ -59,6 +63,7 @@ import '/client/components/settings/adminProblems.css';
 import '/client/components/settings/attachments.css';
 import '/client/components/settings/informationBody.css';
 import '/client/components/settings/lockedUsersBody.css';
+import '/client/components/settings/adminAuditLog.css';
 import '/client/components/settings/migrationProgress.css';
 import '/client/components/settings/peopleBody.css';
 import '/client/components/settings/settingBody.css';

client/features/users.js

@@ -2,13 +2,19 @@ import '/client/components/users/passwordInput.jade';
 import '/client/components/users/userAvatar.jade';
 import '/client/components/users/userHeader.jade';
 import '/client/components/users/dependencyMenu.jade';
+import '/client/components/users/twoFactorRequired.jade';
+import '/client/components/users/passwordChangeRequired.jade';
 
 import '/client/components/users/passwordInput.js';
 import '/client/components/users/userAvatar.js';
 import '/client/components/users/userHeader.js';
 import '/client/components/users/dependencyMenu.js';
+import '/client/components/users/twoFactorRequired.js';
+import '/client/components/users/passwordChangeRequired.js';
 
 import '/client/components/users/userAvatar.css';
 import '/client/components/users/userForm.css';
 import '/client/components/users/dependencyMenu.css';
+import '/client/components/users/twoFactorRequired.css';
+import '/client/components/users/passwordChangeRequired.css';
 

client/lib/idleActivity.js

@@ -0,0 +1,36 @@
+// LOGOUT_IDLE_MINUTES: tell the server, at most once a minute, that the user
+// did something here - a key press, a click, a touch, a scroll - so a session
+// in use is not signed out as idle (models/lib/idleLogout.js). Nothing is sent
+// while the page only sits open, and nothing at all when the limit is off.
+
+const { TOUCH_INTERVAL_MS } = require('../../models/lib/idleLogout');
+
+const EVENTS = ['keydown', 'mousedown', 'touchstart', 'wheel', 'scroll'];
+
+// target: where to listen (document); touch(): report; now(): clock.
+function createIdleActivityReporter({ target, touch, now = () => Date.now(), interval = TOUCH_INTERVAL_MS }) {
+  let last = 0;
+  let listening = false;
+  function onActivity() {
+    const t = now();
+    if (t - last < interval) return;
+    last = t;
+    touch();
+  }
+  return {
+    start() {
+      if (listening) return;
+      listening = true;
+      last = now(); // signing in was the activity that started this
+      for (const name of EVENTS) target.addEventListener(name, onActivity, { capture: true, passive: true });
+    },
+    stop() {
+      if (!listening) return;
+      listening = false;
+      for (const name of EVENTS) target.removeEventListener(name, onActivity, { capture: true });
+    },
+    onActivity,
+  };
+}
+
+module.exports = { createIdleActivityReporter, EVENTS };

client/lib/keyboard.js

@@ -404,10 +404,30 @@ function clickDueDateControl(cardId) {
   control.click();
   return true;
 }
+// #6840: the card's details render a moment AFTER the route names it - a few
+// hundred milliseconds on a slow server. Pressing `d` right after opening a
+// card found no control yet and did nothing, while the previous card's details
+// were still on screen. So the click waits until THIS card's control is there,
+// both for an opened card and for one `d` opens itself (#6755), and clicks it
+// once; it gives up quietly after 3 seconds (no due dates on this board).
+function clickDueDateControlWhenRendered(cardId) {
+  const started = Date.now();
+  const tryClick = () => {
+    if (Utils.getCurrentCardId() !== cardId) return;
+    if (clickDueDateControl(cardId)) return;
+    if (Date.now() - started < 3000) setTimeout(tryClick, 50);
+  };
+  tryClick();
+}
 export function openDueDateEditorOfOpenedCard() {
   if (Meteor.userId() === null) return false;
   const cardId = Utils.getCurrentCardId();
-  if (cardId) return clickDueDateControl(cardId);
+  if (cardId) {
+    const card = ReactiveCache.getCard(cardId);
+    if (!card || !Utils.canModifyCard(card)) return false;
+    clickDueDateControlWhenRendered(cardId);
+    return true;
+  }
   // #6755: with no card opened, `d` on a hovered or selected minicard - the
   // card every other card shortcut here acts on - opens that card and then
   // its Due date editor, rather than doing nothing until the card is opened.
@@ -415,14 +435,7 @@ export function openDueDateEditorOfOpenedCard() {
   const minicard = minicardId && ReactiveCache.getCard(minicardId);
   if (!minicard || !Utils.canModifyCard(minicard)) return false;
   Utils.goCardId(minicardId);
-  // The card details render after the route changes; wait for its control,
-  // and give up quietly if it never comes (no due dates on this board).
-  const started = Date.now();
-  const tryClick = () => {
-    if (Utils.getCurrentCardId() === minicardId && clickDueDateControl(minicardId)) return;
-    if (Date.now() - started < 3000) setTimeout(tryClick, 50);
-  };
-  setTimeout(tryClick, 0);
+  setTimeout(() => clickDueDateControlWhenRendered(minicardId), 0);
   return true;
 }
 hotkeys('d, shift+d', (event) => {

client/lib/newPasswordCheck.js

@@ -0,0 +1,55 @@
+// Breached-password check for the forms that set a NEW password - sign-up,
+// Change Password, reset and enrolment (models/lib/passwordPolicy.js says why
+// it is done in the browser). It captures the submit before useraccounts sees
+// it, asks the server for the SHA-1 range of the password - five hex digits,
+// never the password - and replays the submit when the password is not in it.
+//
+// A form that sets a new password is the one with a "password again" or a
+// "current password" field; the sign-in form has neither and is left alone.
+
+const { isPwned, breachLookupDigest } = require('../../models/lib/passwordPolicy');
+
+function isNewPasswordForm(form) {
+  return !!(form && form.id === 'at-pwd-form' && form.querySelector('#at-field-password')
+    && (form.querySelector('#at-field-password_again') || form.querySelector('#at-field-current_password')));
+}
+
+// policy() -> { checkPwned } (cached by the caller); range(prefix) -> Promise
+// of suffixes or null; subtle is crypto.subtle (absent outside a secure
+// context, where the check is skipped); showError(message); replay(form).
+function createNewPasswordSubmitHandler({ policy, range, subtle, showError, replay, pwnedMessage }) {
+  let replaying = false;
+  let pending = false;
+  return async function submit(event) {
+    const form = event.target;
+    if (replaying || !isNewPasswordForm(form) || !policy().checkPwned || !subtle) return;
+    const password = form.querySelector('#at-field-password').value;
+    if (!password) return;
+    event.preventDefault();
+    event.stopImmediatePropagation();
+    if (pending) return;
+    pending = true;
+    try {
+      let breached = false;
+      try {
+        const hex = await breachLookupDigest(password, subtle);
+        const suffixes = await range(hex.slice(0, 5));
+        breached = Array.isArray(suffixes) && isPwned(hex, suffixes);
+      } catch (e) {
+        // An unreachable service must not stop anybody from setting a password.
+        breached = false;
+      }
+      if (breached) {
+        showError(pwnedMessage());
+        return;
+      }
+      await new Promise(resolve => setTimeout(resolve, 0));
+      replaying = true;
+      try { replay(form); } finally { replaying = false; }
+    } finally {
+      pending = false;
+    }
+  };
+}
+
+module.exports = { createNewPasswordSubmitHandler, isNewPasswordForm };

config/accounts.js

@@ -115,6 +115,63 @@ AccountsTemplates.addFields([
   },
 ]);
 
+// PASSWORD_MIN_LENGTH and PASSWORD_CHECK_PWNED (models/lib/passwordPolicy.js).
+// useraccounts checks a NEW password's minLength in the browser - sign-up,
+// Change Password, reset, enrolment; never sign-in - and reads it from the
+// field at submit time, so the server's value applies once it has arrived.
+// Unless the minimum is enforced (PASSWORD_MIN_LENGTH_ENFORCE, off by
+// default) the fields keep their own 6.
+// The breached-password check runs before useraccounts sees the submit.
+if (Meteor.isClient) {
+  const passwordPolicy = { minLength: 8, enforce: false, checkPwned: false };
+  Meteor.call('getPasswordPolicy', (error, result) => {
+    if (error || !result) return;
+    Object.assign(passwordPolicy, result);
+    if (!passwordPolicy.enforce) return;
+    for (const id of ['password', 'password_again']) {
+      const field = AccountsTemplates.getField(id);
+      if (field) field.minLength = passwordPolicy.minLength;
+    }
+  });
+  // Signing in is never refused for a short password: it is reported to
+  // Admin Panel / Problems / Password length, and with the minimum enforced the
+  // account is asked to change it (server/passwordChangeRequired.js). Only this
+  // browser knows the length, so it is noted on the sign-in form - the length,
+  // never the password - and compared with the minimum once the login worked.
+  const { isNewPasswordForm } = require('/client/lib/newPasswordCheck');
+  let signInPasswordLength = null;
+  document.addEventListener('submit', event => {
+    const form = event.target;
+    const field = form && form.id === 'at-pwd-form' && form.querySelector('#at-field-password');
+    if (field && !isNewPasswordForm(form)) signInPasswordLength = [...field.value].length;
+  }, true);
+  Accounts.onLogin(() => {
+    const length = signInPasswordLength;
+    signInPasswordLength = null;
+    if (length === null) return;
+    // Asked again: the minimum may have changed since the page loaded.
+    Meteor.call('getPasswordPolicy', (error, result) => {
+      if (error || !result || !(result.minLength > 0) || length >= result.minLength) return;
+      Meteor.call('reportShortPasswordLogin', () => {
+        const { checkPasswordChangeRequirement } = require('/client/components/users/passwordChangeRequired');
+        checkPasswordChangeRequirement();
+      });
+    });
+  });
+  const { createNewPasswordSubmitHandler } = require('/client/lib/newPasswordCheck');
+  document.addEventListener('submit', createNewPasswordSubmitHandler({
+    policy: () => passwordPolicy,
+    range: prefix => Meteor.callAsync('passwordPwnedRange', prefix),
+    subtle: globalThis.crypto && globalThis.crypto.subtle,
+    pwnedMessage: () => tr('password-pwned'),
+    showError(message) {
+      AccountsTemplates.setDisabled(false);
+      AccountsTemplates.state.form.set('error', [message]);
+    },
+    replay: form => form.dispatchEvent(new Event('submit', { bubbles: true, cancelable: true })),
+  }), true);
+}
+
 // The sign-in / register form field labels and placeholders were rendered through
 // accounts-t9n (`T9n.get`), whose per-language coverage is incomplete, and
 // useraccounts' `getPlaceholder()` never invokes a function placeholder (unlike
@@ -333,6 +390,12 @@ AccountsTemplates.configure({
   forbidClientAccountCreation: disableRegistration,
   homeRoutePath: '/',
   onSubmitHook(error, state) {
+    if (!error && state === 'changePwd') {
+      // The server has signed every session of the account out, this one too
+      // (server/passwordChangeRequired.js): sign in with the new password.
+      Meteor.logout(() => FlowRouter.go('atSignIn'));
+      return;
+    }
     if (!error && (state === 'signUp' || state === 'signIn')) {
       hideTwoFactorPrompt();
       goHomeWhenSignedIn();

docker-compose-ferretdb-v1-mariadb.yml

@@ -908,6 +908,35 @@ services:
       # it too, and its value there wins.
       #- USERS_DISABLE_INACTIVE_AFTER_DAYS=180
       #---------------------------------------------------------------
+      # LOGOUT_IDLE_MINUTES : Sign a browser session out after this many minutes without a key press, click,
+      # touch or scroll. Empty or 0 = off (default). REST API tokens are not affected.
+      #- LOGOUT_IDLE_MINUTES=30
+      #---------------------------------------------------------------
+      # REQUIRE_2FA : Compulsory two-factor authentication for accounts that sign in with a WeKan password:
+      # off (default), admins or all. They must set it up right after signing in.
+      #- REQUIRE_2FA=admins
+      #---------------------------------------------------------------
+      # PASSWORD_MIN_LENGTH : Minimum password length, in characters. Default 8. A sign-in with a shorter
+      # password is listed in Admin Panel / Problems / Password length; nothing is refused unless enforced:
+      #- PASSWORD_MIN_LENGTH=12
+      # PASSWORD_MIN_LENGTH_ENFORCE : true = refuse a shorter new password, and make an account that
+      # signs in with a shorter one change it; the change signs every session out. Off by default.
+      #- PASSWORD_MIN_LENGTH_ENFORCE=true
+      #---------------------------------------------------------------
+      # PASSWORD_CHECK_PWNED : true = refuse a new password found in a known data breach. Off by default.
+      # Only 5 hex digits of its SHA-1 are sent to api.pwnedpasswords.com.
+      #- PASSWORD_CHECK_PWNED=true
+      #---------------------------------------------------------------
+      # HSTS_MAX_AGE : Strict-Transport-Security max-age in seconds, sent only when ROOT_URL is https.
+      # Default 15552000 (180 days). 0 = do not send it.
+      #- HSTS_MAX_AGE=31536000
+      #---------------------------------------------------------------
+      # HSTS_INCLUDE_SUBDOMAINS : true = HSTS covers every subdomain too. Only when ALL of them have HTTPS.
+      #- HSTS_INCLUDE_SUBDOMAINS=false
+      #---------------------------------------------------------------
+      # HSTS_PRELOAD : true = add the preload token (needs includeSubDomains and max-age >= 31536000).
+      #- HSTS_PRELOAD=false
+      #---------------------------------------------------------------
       # BACKUP_KEEP_DAYS : after each successful Admin Panel backup, delete
       # local (filesystem) backups older than this many days; the newest is
       # always kept. Unset or 0 = keep all (default). Admin Panel / Attachments

docker-compose-ferretdb-v1-mysql.yml

@@ -910,6 +910,35 @@ services:
       # it too, and its value there wins.
       #- USERS_DISABLE_INACTIVE_AFTER_DAYS=180
       #---------------------------------------------------------------
+      # LOGOUT_IDLE_MINUTES : Sign a browser session out after this many minutes without a key press, click,
+      # touch or scroll. Empty or 0 = off (default). REST API tokens are not affected.
+      #- LOGOUT_IDLE_MINUTES=30
+      #---------------------------------------------------------------
+      # REQUIRE_2FA : Compulsory two-factor authentication for accounts that sign in with a WeKan password:
+      # off (default), admins or all. They must set it up right after signing in.
+      #- REQUIRE_2FA=admins
+      #---------------------------------------------------------------
+      # PASSWORD_MIN_LENGTH : Minimum password length, in characters. Default 8. A sign-in with a shorter
+      # password is listed in Admin Panel / Problems / Password length; nothing is refused unless enforced:
+      #- PASSWORD_MIN_LENGTH=12
+      # PASSWORD_MIN_LENGTH_ENFORCE : true = refuse a shorter new password, and make an account that
+      # signs in with a shorter one change it; the change signs every session out. Off by default.
+      #- PASSWORD_MIN_LENGTH_ENFORCE=true
+      #---------------------------------------------------------------
+      # PASSWORD_CHECK_PWNED : true = refuse a new password found in a known data breach. Off by default.
+      # Only 5 hex digits of its SHA-1 are sent to api.pwnedpasswords.com.
+      #- PASSWORD_CHECK_PWNED=true
+      #---------------------------------------------------------------
+      # HSTS_MAX_AGE : Strict-Transport-Security max-age in seconds, sent only when ROOT_URL is https.
+      # Default 15552000 (180 days). 0 = do not send it.
+      #- HSTS_MAX_AGE=31536000
+      #---------------------------------------------------------------
+      # HSTS_INCLUDE_SUBDOMAINS : true = HSTS covers every subdomain too. Only when ALL of them have HTTPS.
+      #- HSTS_INCLUDE_SUBDOMAINS=false
+      #---------------------------------------------------------------
+      # HSTS_PRELOAD : true = add the preload token (needs includeSubDomains and max-age >= 31536000).
+      #- HSTS_PRELOAD=false
+      #---------------------------------------------------------------
       # BACKUP_KEEP_DAYS : after each successful Admin Panel backup, delete
       # local (filesystem) backups older than this many days; the newest is
       # always kept. Unset or 0 = keep all (default). Admin Panel / Attachments

docker-compose-ferretdb-v1-postgresql.yml

@@ -897,6 +897,35 @@ services:
       # it too, and its value there wins.
       #- USERS_DISABLE_INACTIVE_AFTER_DAYS=180
       #---------------------------------------------------------------
+      # LOGOUT_IDLE_MINUTES : Sign a browser session out after this many minutes without a key press, click,
+      # touch or scroll. Empty or 0 = off (default). REST API tokens are not affected.
+      #- LOGOUT_IDLE_MINUTES=30
+      #---------------------------------------------------------------
+      # REQUIRE_2FA : Compulsory two-factor authentication for accounts that sign in with a WeKan password:
+      # off (default), admins or all. They must set it up right after signing in.
+      #- REQUIRE_2FA=admins
+      #---------------------------------------------------------------
+      # PASSWORD_MIN_LENGTH : Minimum password length, in characters. Default 8. A sign-in with a shorter
+      # password is listed in Admin Panel / Problems / Password length; nothing is refused unless enforced:
+      #- PASSWORD_MIN_LENGTH=12
+      # PASSWORD_MIN_LENGTH_ENFORCE : true = refuse a shorter new password, and make an account that
+      # signs in with a shorter one change it; the change signs every session out. Off by default.
+      #- PASSWORD_MIN_LENGTH_ENFORCE=true
+      #---------------------------------------------------------------
+      # PASSWORD_CHECK_PWNED : true = refuse a new password found in a known data breach. Off by default.
+      # Only 5 hex digits of its SHA-1 are sent to api.pwnedpasswords.com.
+      #- PASSWORD_CHECK_PWNED=true
+      #---------------------------------------------------------------
+      # HSTS_MAX_AGE : Strict-Transport-Security max-age in seconds, sent only when ROOT_URL is https.
+      # Default 15552000 (180 days). 0 = do not send it.
+      #- HSTS_MAX_AGE=31536000
+      #---------------------------------------------------------------
+      # HSTS_INCLUDE_SUBDOMAINS : true = HSTS covers every subdomain too. Only when ALL of them have HTTPS.
+      #- HSTS_INCLUDE_SUBDOMAINS=false
+      #---------------------------------------------------------------
+      # HSTS_PRELOAD : true = add the preload token (needs includeSubDomains and max-age >= 31536000).
+      #- HSTS_PRELOAD=false
+      #---------------------------------------------------------------
       # BACKUP_KEEP_DAYS : after each successful Admin Panel backup, delete
       # local (filesystem) backups older than this many days; the newest is
       # always kept. Unset or 0 = keep all (default). Admin Panel / Attachments

docker-compose-ferretdb-v1-sap-hana.yml

@@ -914,6 +914,35 @@ services:
       # it too, and its value there wins.
       #- USERS_DISABLE_INACTIVE_AFTER_DAYS=180
       #---------------------------------------------------------------
+      # LOGOUT_IDLE_MINUTES : Sign a browser session out after this many minutes without a key press, click,
+      # touch or scroll. Empty or 0 = off (default). REST API tokens are not affected.
+      #- LOGOUT_IDLE_MINUTES=30
+      #---------------------------------------------------------------
+      # REQUIRE_2FA : Compulsory two-factor authentication for accounts that sign in with a WeKan password:
+      # off (default), admins or all. They must set it up right after signing in.
+      #- REQUIRE_2FA=admins
+      #---------------------------------------------------------------
+      # PASSWORD_MIN_LENGTH : Minimum password length, in characters. Default 8. A sign-in with a shorter
+      # password is listed in Admin Panel / Problems / Password length; nothing is refused unless enforced:
+      #- PASSWORD_MIN_LENGTH=12
+      # PASSWORD_MIN_LENGTH_ENFORCE : true = refuse a shorter new password, and make an account that
+      # signs in with a shorter one change it; the change signs every session out. Off by default.
+      #- PASSWORD_MIN_LENGTH_ENFORCE=true
+      #---------------------------------------------------------------
+      # PASSWORD_CHECK_PWNED : true = refuse a new password found in a known data breach. Off by default.
+      # Only 5 hex digits of its SHA-1 are sent to api.pwnedpasswords.com.
+      #- PASSWORD_CHECK_PWNED=true
+      #---------------------------------------------------------------
+      # HSTS_MAX_AGE : Strict-Transport-Security max-age in seconds, sent only when ROOT_URL is https.
+      # Default 15552000 (180 days). 0 = do not send it.
+      #- HSTS_MAX_AGE=31536000
+      #---------------------------------------------------------------
+      # HSTS_INCLUDE_SUBDOMAINS : true = HSTS covers every subdomain too. Only when ALL of them have HTTPS.
+      #- HSTS_INCLUDE_SUBDOMAINS=false
+      #---------------------------------------------------------------
+      # HSTS_PRELOAD : true = add the preload token (needs includeSubDomains and max-age >= 31536000).
+      #- HSTS_PRELOAD=false
+      #---------------------------------------------------------------
       # BACKUP_KEEP_DAYS : after each successful Admin Panel backup, delete
       # local (filesystem) backups older than this many days; the newest is
       # always kept. Unset or 0 = keep all (default). Admin Panel / Attachments

docker-compose-ferretdb-v2-postgresql.yml

@@ -820,6 +820,35 @@ services:
       # it too, and its value there wins.
       #- USERS_DISABLE_INACTIVE_AFTER_DAYS=180
       #---------------------------------------------------------------
+      # LOGOUT_IDLE_MINUTES : Sign a browser session out after this many minutes without a key press, click,
+      # touch or scroll. Empty or 0 = off (default). REST API tokens are not affected.
+      #- LOGOUT_IDLE_MINUTES=30
+      #---------------------------------------------------------------
+      # REQUIRE_2FA : Compulsory two-factor authentication for accounts that sign in with a WeKan password:
+      # off (default), admins or all. They must set it up right after signing in.
+      #- REQUIRE_2FA=admins
+      #---------------------------------------------------------------
+      # PASSWORD_MIN_LENGTH : Minimum password length, in characters. Default 8. A sign-in with a shorter
+      # password is listed in Admin Panel / Problems / Password length; nothing is refused unless enforced:
+      #- PASSWORD_MIN_LENGTH=12
+      # PASSWORD_MIN_LENGTH_ENFORCE : true = refuse a shorter new password, and make an account that
+      # signs in with a shorter one change it; the change signs every session out. Off by default.
+      #- PASSWORD_MIN_LENGTH_ENFORCE=true
+      #---------------------------------------------------------------
+      # PASSWORD_CHECK_PWNED : true = refuse a new password found in a known data breach. Off by default.
+      # Only 5 hex digits of its SHA-1 are sent to api.pwnedpasswords.com.
+      #- PASSWORD_CHECK_PWNED=true
+      #---------------------------------------------------------------
+      # HSTS_MAX_AGE : Strict-Transport-Security max-age in seconds, sent only when ROOT_URL is https.
+      # Default 15552000 (180 days). 0 = do not send it.
+      #- HSTS_MAX_AGE=31536000
+      #---------------------------------------------------------------
+      # HSTS_INCLUDE_SUBDOMAINS : true = HSTS covers every subdomain too. Only when ALL of them have HTTPS.
+      #- HSTS_INCLUDE_SUBDOMAINS=false
+      #---------------------------------------------------------------
+      # HSTS_PRELOAD : true = add the preload token (needs includeSubDomains and max-age >= 31536000).
+      #- HSTS_PRELOAD=false
+      #---------------------------------------------------------------
       # BACKUP_KEEP_DAYS : after each successful Admin Panel backup, delete
       # local (filesystem) backups older than this many days; the newest is
       # always kept. Unset or 0 = keep all (default). Admin Panel / Attachments

docker-compose-mongodb-v7.yml

@@ -1051,6 +1051,35 @@ services:
       # it too, and its value there wins.
       #- USERS_DISABLE_INACTIVE_AFTER_DAYS=180
       #---------------------------------------------------------------
+      # LOGOUT_IDLE_MINUTES : Sign a browser session out after this many minutes without a key press, click,
+      # touch or scroll. Empty or 0 = off (default). REST API tokens are not affected.
+      #- LOGOUT_IDLE_MINUTES=30
+      #---------------------------------------------------------------
+      # REQUIRE_2FA : Compulsory two-factor authentication for accounts that sign in with a WeKan password:
+      # off (default), admins or all. They must set it up right after signing in.
+      #- REQUIRE_2FA=admins
+      #---------------------------------------------------------------
+      # PASSWORD_MIN_LENGTH : Minimum password length, in characters. Default 8. A sign-in with a shorter
+      # password is listed in Admin Panel / Problems / Password length; nothing is refused unless enforced:
+      #- PASSWORD_MIN_LENGTH=12
+      # PASSWORD_MIN_LENGTH_ENFORCE : true = refuse a shorter new password, and make an account that
+      # signs in with a shorter one change it; the change signs every session out. Off by default.
+      #- PASSWORD_MIN_LENGTH_ENFORCE=true
+      #---------------------------------------------------------------
+      # PASSWORD_CHECK_PWNED : true = refuse a new password found in a known data breach. Off by default.
+      # Only 5 hex digits of its SHA-1 are sent to api.pwnedpasswords.com.
+      #- PASSWORD_CHECK_PWNED=true
+      #---------------------------------------------------------------
+      # HSTS_MAX_AGE : Strict-Transport-Security max-age in seconds, sent only when ROOT_URL is https.
+      # Default 15552000 (180 days). 0 = do not send it.
+      #- HSTS_MAX_AGE=31536000
+      #---------------------------------------------------------------
+      # HSTS_INCLUDE_SUBDOMAINS : true = HSTS covers every subdomain too. Only when ALL of them have HTTPS.
+      #- HSTS_INCLUDE_SUBDOMAINS=false
+      #---------------------------------------------------------------
+      # HSTS_PRELOAD : true = add the preload token (needs includeSubDomains and max-age >= 31536000).
+      #- HSTS_PRELOAD=false
+      #---------------------------------------------------------------
       # BACKUP_KEEP_DAYS : after each successful Admin Panel backup, delete
       # local (filesystem) backups older than this many days; the newest is
       # always kept. Unset or 0 = keep all (default). Admin Panel / Attachments

docker-compose.yml

@@ -895,6 +895,35 @@ services:
       # it too, and its value there wins.
       #- USERS_DISABLE_INACTIVE_AFTER_DAYS=180
       #---------------------------------------------------------------
+      # LOGOUT_IDLE_MINUTES : Sign a browser session out after this many minutes without a key press, click,
+      # touch or scroll. Empty or 0 = off (default). REST API tokens are not affected.
+      #- LOGOUT_IDLE_MINUTES=30
+      #---------------------------------------------------------------
+      # REQUIRE_2FA : Compulsory two-factor authentication for accounts that sign in with a WeKan password:
+      # off (default), admins or all. They must set it up right after signing in.
+      #- REQUIRE_2FA=admins
+      #---------------------------------------------------------------
+      # PASSWORD_MIN_LENGTH : Minimum password length, in characters. Default 8. A sign-in with a shorter
+      # password is listed in Admin Panel / Problems / Password length; nothing is refused unless enforced:
+      #- PASSWORD_MIN_LENGTH=12
+      # PASSWORD_MIN_LENGTH_ENFORCE : true = refuse a shorter new password, and make an account that
+      # signs in with a shorter one change it; the change signs every session out. Off by default.
+      #- PASSWORD_MIN_LENGTH_ENFORCE=true
+      #---------------------------------------------------------------
+      # PASSWORD_CHECK_PWNED : true = refuse a new password found in a known data breach. Off by default.
+      # Only 5 hex digits of its SHA-1 are sent to api.pwnedpasswords.com.
+      #- PASSWORD_CHECK_PWNED=true
+      #---------------------------------------------------------------
+      # HSTS_MAX_AGE : Strict-Transport-Security max-age in seconds, sent only when ROOT_URL is https.
+      # Default 15552000 (180 days). 0 = do not send it.
+      #- HSTS_MAX_AGE=31536000
+      #---------------------------------------------------------------
+      # HSTS_INCLUDE_SUBDOMAINS : true = HSTS covers every subdomain too. Only when ALL of them have HTTPS.
+      #- HSTS_INCLUDE_SUBDOMAINS=false
+      #---------------------------------------------------------------
+      # HSTS_PRELOAD : true = add the preload token (needs includeSubDomains and max-age >= 31536000).
+      #- HSTS_PRELOAD=false
+      #---------------------------------------------------------------
       # BACKUP_KEEP_DAYS : after each successful Admin Panel backup, delete
       # local (filesystem) backups older than this many days; the newest is
       # always kept. Unset or 0 = keep all (default). Admin Panel / Attachments

docs/Backup/Backup.md

@@ -329,15 +329,20 @@ docker compose up -d
 # Backup Wekan Snap to directory dump
 ```bash
 sudo snap stop wekan.wekan
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan/current/lib/x86_64-linux-gnu
-export PATH="/snap/wekan/current/bin:$PATH"
+S=/snap; [ -d /snap/wekan ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan/current/lib/$(uname -m)-linux-gnu"
+export PATH="$S/wekan/current/bin:$PATH"
 mongodump --port 27019
 sudo snap get wekan > snap-settings.sh
 ```
-NOTE for Arch Linux: Use this path instead. [Source](https://github.com/wekan/wekan/issues/3941).
-```bash
-export LD_LIBRARY_PATH=${LD_LIBRARY_PATH-}:/var/lib/snapd/snap/wekan/current/lib/x86_64-linux-gnu
-```
+The `S=` line picks where snapd keeps the snaps on this host. Ubuntu and Debian
+have `/snap`; Fedora, RHEL, AlmaLinux, Rocky Linux, CentOS Stream and Arch Linux
+keep them in `/var/lib/snapd/snap` and have no `/snap` unless somebody has made
+the symlink (`sudo ln -s /var/lib/snapd/snap /snap`). The data is in
+`/var/snap/wekan/common` on all of them. `$(uname -m)` picks the library
+directory of the CPU: `x86_64-linux-gnu` on amd64, `aarch64-linux-gnu` on arm64.
+[Arch Linux report](https://github.com/wekan/wekan/issues/3941).
+
 username is your /home/username
 ```bash
 sudo chown username:username snap-settings.sh
@@ -355,8 +360,9 @@ chmod +x snap-settings.sh
 # Restore Wekan Snap
 ```bash
 sudo snap stop wekan.wekan
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan/current/lib/x86_64-linux-gnu
-export PATH="$PATH:/snap/wekan/current/bin"
+S=/snap; [ -d /snap/wekan ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan/current/lib/$(uname -m)-linux-gnu"
+export PATH="$PATH:$S/wekan/current/bin"
 mongorestore --drop --port 27019
 sudo snap start wekan.wekan
 ./snap-settings.sh
@@ -454,8 +460,9 @@ sudo snap refresh
 # Backup Wekan Gantt GPLv2 Snap to directory dump
 ```bash
 sudo snap stop wekan-gantt-gpl.wekan
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan-gantt-gpl/current/lib/x86_64-linux-gnu
-export PATH="$PATH:/snap/wekan-gantt-gpl/current/bin"
+S=/snap; [ -d /snap/wekan-gantt-gpl ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan-gantt-gpl/current/lib/$(uname -m)-linux-gnu"
+export PATH="$PATH:$S/wekan-gantt-gpl/current/bin"
 mongodump --port 27019
 sudo snap get wekan-gantt-gpl > snap-settings.sh
 ```
@@ -476,8 +483,9 @@ chmod +x snap-settings.sh
 # Restore Wekan Gantt GPLv2 Snap
 ```bash
 sudo snap stop wekan-gantt-gpl.wekan
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan-gantt-gpl/current/lib/x86_64-linux-gnu
-export PATH="$PATH:/snap/wekan-gantt-gpl/current/bin"
+S=/snap; [ -d /snap/wekan-gantt-gpl ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan-gantt-gpl/current/lib/$(uname -m)-linux-gnu"
+export PATH="$PATH:$S/wekan-gantt-gpl/current/bin"
 mongorestore --drop --port 27019
 sudo snap start wekan-gantt-gpl.wekan
 ./snap-settings.sh
@@ -820,8 +828,9 @@ You could use [daff](https://github.com/paulfitz/daff) to compare tables.
 
 Add to your `~/.bashrc`
 ```bash
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan/current/lib/x86_64-linux-gnu
-export PATH="$PATH:/snap/wekan/current/bin"
+S=/snap; [ -d /snap/wekan ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan/current/lib/$(uname -m)-linux-gnu"
+export PATH="$PATH:$S/wekan/current/bin"
 ```
 Then you can backup:
 ```bash
@@ -838,7 +847,8 @@ mongoshell.sh
 ```bash
 #/bin/bash
 export LC_ALL=C
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan/current/lib/x86_64-linux-gnu
+S=/snap; [ -d /snap/wekan ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan/current/lib/$(uname -m)-linux-gnu"
 version=$(snap list | grep wekan | awk -F ' ' '{print $3}')
 mongo=$"/snap/wekan/$version/bin/mongo"
 $mongo --port 27019
@@ -856,7 +866,8 @@ wekan-backup.sh
 ```bash
 #!/bin/bash
 export LC_ALL=C
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan/current/lib/x86_64-linux-gnu
+S=/snap; [ -d /snap/wekan ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan/current/lib/$(uname -m)-linux-gnu"
 
 version=$(snap list | grep wekan | awk -F ' ' '{print $3}')
 now=$(date +"%Y%m%d-%H%M%S")
@@ -907,7 +918,8 @@ wekan-restore.sh
 ```bash
 #!/bin/bash
 export LC_ALL=C
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan/current/lib/x86_64-linux-gnu
+S=/snap; [ -d /snap/wekan ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan/current/lib/$(uname -m)-linux-gnu"
 
 makesRestore()
 {

docs/Backup/Repair-MongoDB.md

@@ -5,9 +5,10 @@ sudo su
 
 snap stop wekan
 
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan/current/lib/x86_64-linux-gnu
+S=/snap; [ -d /snap/wekan ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan/current/lib/$(uname -m)-linux-gnu"
 
-export PATH="/snap/wekan/current/bin:$PATH"
+export PATH="$S/wekan/current/bin:$PATH"
 
 mongod --dbpath "/var/snap/wekan/common" --repair >> /root/repairlog.txt
 

docs/Databases/MongoDB/Version-Management.md

@@ -51,7 +51,8 @@ export PATH="/snap/wekan/current/migratemongo/bin:$PATH"
 export LD_LIBRARY_PATH="/snap/wekan/current/migratemongo/lib:$LD_LIBRARY_PATH"
 
 # MongoDB 7.x (default)
-export PATH="/snap/wekan/current/bin:$PATH"
+S=/snap; [ -d /snap/wekan ] || S=/var/lib/snapd/snap
+export PATH="$S/wekan/current/bin:$PATH"
 export LD_LIBRARY_PATH="/snap/wekan/current/usr/lib:$LD_LIBRARY_PATH"
 ```
 

docs/DeveloperDocs/Build-from-source.md

@@ -257,7 +257,9 @@ plugin npm dependencies. `METEOR_PROFILE` defaults to 100 milliseconds, exposing
 Meteor tool timing diagnostics when available. Profiling output may appear only
 when a measured operation finishes; elapsed status still appears while it is quiet.
 
-During builds, Node module debugging prints module resolution as it happens. The
+Node module debugging, which prints every module resolution as it happens, is
+off unless `WEKAN_BUILD_TRACE_MODULES=1` is set: a Meteor build writes that trace
+at gigabytes a minute (1.1 GB in the first three minutes of a dev build). The
 local `tools/build-command-output.cjs` preload prints resolver subprocess commands
 and echoes their captured stdout and stderr while preserving exit codes and callback
 results. Both terminal and build log receive this output. Command arguments redact

docs/Features/Admin-Panel/Admin-Panel-URLs.md

@@ -58,6 +58,7 @@ OAuth providers and Passwordless login each have their own menu entry.
 | `/admin/people/organizations` | Organizations | `org-setting` |
 | `/admin/people/teams` | Teams | `team-setting` |
 | `/admin/people/locked-users` | Locked Users | `locked-users-setting` |
+| `/admin/people/audit-log` | Audit log | `audit-log-setting` |
 | `/admin/people/roles` | Roles | `roles-setting` |
 | `/admin/people/shared-templates` | Shared templates | `templates-setting` |
 | `/admin/people/login` | Login | `registration-setting` |
@@ -80,6 +81,7 @@ OAuth providers and Passwordless login each have their own menu entry.
 | `/admin/problems/backup` | Backup (status and history; settings stay in Attachments / Backup) | `features-backup` |
 | `/admin/problems/security-report` | Security Report | `report-security` |
 | `/admin/problems/impersonation` | Impersonation Report | `report-impersonation` |
+| `/admin/problems/password-length` | Password length | `report-password-length` |
 | `/admin/problems/performance` | Performance | `features-performance` |
 | `/admin/problems/speed` | Speed | `report-speed` |
 | `/admin/problems/tests` | Tests | `report-tests` |

docs/Features/Admin-Panel/People/Audit-Log.md

@@ -0,0 +1,22 @@
+# People / Audit log
+
+`/admin/people/audit-log`, site administrators only.
+
+Every administrative action of a site administrator, newest first, one row
+each: when, who, which action, whether it succeeded (a refused call is shown
+too, with its error), its arguments and the address it came from. The search
+box matches the administrator, the action and the arguments.
+
+What is recorded: changes to people (Add user, Set password, username, email,
+admin and active flags, removing a user, impersonation, unlocking), to
+organizations and teams, to login and site settings, to attachment storage,
+and backups, restores and data repairs. An administrator editing cards is a
+member editing cards and is not recorded. The list of actions is
+`AUDITED_METHODS` in `models/lib/adminAudit.js`.
+
+A password or a secret is never recorded: values under a credential-named key,
+the arguments that are a password by position and a password inside a URL are
+shown as `[redacted]`.
+
+Entries are kept for a year and then removed. Attacks WeKan refused are in
+Admin Panel / Problems instead; see [Security settings](../../../Security/Security-Settings.md).

docs/Features/Admin-Panel/People/README.md

@@ -19,6 +19,7 @@ Who may sign in, who they belong to, and what they may do — in menu order.
 | People / Teams | `teams` | [Teams.md](Teams.md) | Teams, their per-team switches, and the same-Team board restriction. |
 | People / People | `people` | [People.md](People.md) | Every user: e-mail, admin flag, active state, lockout, created date. |
 | People / Locked Users | `locked-users` | [Locked-Users.md](Locked-Users.md) | Brute-force protection settings and who is locked out. |
+| People / Audit log | `audit-log` | [Audit-Log.md](Audit-Log.md) | What site administrators did, newest first; kept for a year. |
 | People / Roles | `roles` | [Roles.md](Roles.md) | Which board roles may invite people to a board. |
 | People / Shared templates | `shared-templates` | [Shared-Templates.md](Shared-Templates.md) | Which scopes may share template boards. |
 

docs/Features/Admin-Panel/Problems/Password-length.md

@@ -0,0 +1,83 @@
+# Admin Panel / Problems / Password length
+
+Who signs in with a password shorter than the minimum length, from where, and
+whether they have changed it since. The URL is `/admin/problems/password-length`.
+
+## Settings
+
+Above the table, with one **Save** button:
+
+| Setting | Environment variable | Default | What it does |
+| --- | --- | --- | --- |
+| Minimum password length | `PASSWORD_MIN_LENGTH` | `8` | A sign-in with a shorter password is listed in the table below. Nothing is refused for it. |
+| Enforce the minimum length | `PASSWORD_MIN_LENGTH_ENFORCE` | off | A shorter **new** password is refused (sign-up, Change Password, reset, enrolment, an administrator's Set password and Add user, `POST /users/register`), and an account that signs in with an older shorter password sees only **Change your password** until it has a long enough one. |
+
+Both are also in **Admin Panel / People / Login**, and saving either page saves
+the same setting. A value saved here overrides the environment variable; the
+page says so when an environment variable is set.
+
+**Signing in is never refused** for a short password, enforced or not: nobody
+is locked out by a minimum set after their password was. Changing a password -
+forced or not, in Member Settings or with a reset link - signs **every** session
+of the account out, the one that changed it too, and the account then signs in
+with the new password.
+
+LDAP, OAuth2, OIDC, SAML, CAS and Sandstorm accounts are neither listed nor
+asked: their password is their provider's, and so is its policy.
+
+## The table
+
+One row per account, never one per sign-in, like every Problems report: an
+account that signs in every day is one row whose count grows.
+
+| Column | What it shows |
+| --- | --- |
+| Username | The account. |
+| First login | The first time it signed in with a password shorter than the minimum. |
+| IPv4 address | The latest IPv4 address it did so from, with the country's flag and the city when a CDN or proxy in front of WeKan said where the address is. |
+| IPv6 address | The same for IPv6. |
+| Last login | The latest time it signed in with a short password. |
+| Times logged in | How many times it has. |
+| Fixed | When its password was changed. Empty while it is still too short. |
+
+The filter above the table, as on every [table page](../../General/Table.md):
+
+| Filter | Shows |
+| --- | --- |
+| **Too short password** (default) | Accounts that still have a short password. |
+| **Fixed to long enough password** | Accounts that changed theirs. |
+| **All** | Both. |
+
+The search box matches the username and the addresses.
+
+## How WeKan knows a password is short
+
+Meteor sends a password to the server hashed, so the server never sees how long
+it is. The browser that typed it does: after a sign-in that worked, it compares
+the length with the minimum and, when it is shorter, tells the server "this one
+was short" - never the password and never its length.
+
+The same is true of a password changed through a form, so **Fixed** means the
+password was changed and the account has not signed in with a short one since.
+An account that changes its password to another short one is listed as too short
+again the next time it signs in. An administrator's Set password is the one
+change the server can measure, so a short one set there does not count as fixed.
+
+Where an address is comes only from headers a CDN or proxy in front of WeKan sets
+(`models/lib/geoHeaders.js`). WeKan sends no address to a geolocation service,
+and the location is for display only - nothing is decided by it.
+
+## Related files
+
+| File | What it is |
+| --- | --- |
+| `models/lib/passwordPolicy.js` | The minimum, whether it is enforced, and which new passwords are refused. |
+| `models/lib/shortPasswordLogins.js` | What a row is, the filter, and how one more short sign-in updates a row. |
+| `models/shortPasswordLogins.js` | The collection. |
+| `server/lib/shortPasswordLogins.js` | Recording a short sign-in, marking it fixed, and one page of the table. |
+| `server/passwordChangeRequired.js` | The browser's report, the forced change, and signing every session out after a change. |
+| `client/components/settings/passwordLengthReport.*` | This page. |
+| `client/components/users/passwordChangeRequired.*` | **Change your password**, shown over everything while the change is required. |
+| `config/accounts.js` | Where the browser notes the length on the sign-in form and reports a short one. |
+| `tests/passwordPolicy.test.cjs`, `tests/passwordChangeRequired.test.cjs`, `tests/shortPasswordLogins.test.cjs` | Node tests. |
+| `tests/playwright/specs/password-min-length-signup-login.e2e.js`, `tests/playwright/specs/password-length-report.e2e.js` | Browser tests. |

docs/Features/Admin-Panel/Problems/README.md

@@ -64,7 +64,7 @@ unsafe or noisy:
   failed or overdue backup is also listed on Summary
   ([Backup.md](../../../Backup/Backup.md)).
 
-**Reports** — Security Report, Impersonation Report, Performance, Speed, Tests, CPU
+**Reports** — Security Report, Impersonation Report, Password length, Performance, Speed, Tests, CPU
 usage, Instrumentation, Broken Cards, Files Report, Rules Report, Boards Report,
 Cards Report, Recovery, Offices, API, Database problems, Filesystem integrity and
 Email.
@@ -127,6 +127,7 @@ the address uses: `/admin/problems/<slug>`.
 | Problems / Backup | `backup` | [Backup.md](../../../Backup/Backup.md#did-the-backup-work-history-health-and-monitoring) |
 | Problems / Security Report | `security-report` | — |
 | Problems / Impersonation Report | `impersonation` | — |
+| Problems / Password length | `password-length` | [Password-length.md](Password-length.md) |
 | Problems / Performance | `performance` | — |
 | Problems / Speed | `speed` | — |
 | Problems / Tests | `tests` | — |
@@ -146,7 +147,7 @@ the address uses: `/admin/problems/<slug>`.
 | Problems / Filesystem integrity | `integrity` | — |
 | Problems / Email | `mail` | [Bounces.md](../../General/Email/Bounces.md#when-something-goes-wrong) |
 
-15 of these 25 panes has no page of its own yet. A dash is a
+15 of these 26 panes has no page of its own yet. A dash is a
 gap to fill, not a pane that does nothing - what the pane shows is described in
 this README until somebody writes it up.
 

docs/Features/Admin-Panel/Validation.md

@@ -79,6 +79,7 @@ are not reachable from the current Admin Panel menu. Current storage panes use
 | Teams (`teams`) | [team.js](../../../models/team.js) | Team records and membership operations; scoped server permissions. |
 | People (`people`) | [users.js](../../../server/models/users.js) | Create/edit, roles, password/email operations, impersonation and removal. |
 | Locked Users (`locked-users`) | [lockedUsers.js](../../../server/methods/lockedUsers.js) | Locked-account listing and administrator unlock methods. |
+| Audit log (`audit-log`) | [adminAudit.js](../../../server/adminAudit.js) | New: every administrative method a site administrator calls, one document each for a year, secrets redacted; site administrators only. Real wrapper in [adminAudit.test.cjs](../../../tests/adminAudit.test.cjs). |
 | Roles (`roles`) | [inviteToBoardRolesSettings.js](../../../models/inviteToBoardRolesSettings.js) | Invitation-role defaults and per-role settings. |
 | Shared Templates (`shared-templates`) | [users.js](../../../server/models/users.js) | Shared-template administration with tenant boundaries. |
 
@@ -111,6 +112,7 @@ are not reachable from the current Admin Panel menu. Current storage panes use
 | Backup (`backup`) | [backup.js](../../../server/methods/backup.js) | Recorded backup runs, health of the instance backup and its history (backupHistory method); settings stay in Attachments / Backup. |
 | Security Report (`security-report`) | [eventLog.js](../../../models/eventLog.js) | Recorded security events, search, detail and acknowledgement. |
 | Impersonation Report (`impersonation`) | [impersonationReport.js](../../../server/publications/impersonationReport.js) | Scoped event publication and counts. |
+| Password length (`password-length`) | [shortPasswordLogins.js](../../../server/lib/shortPasswordLogins.js) | The minimum password length and whether it is enforced, saved as Login settings; one row per account that signed in with a shorter password, reported by its browser, with the Too short / Fixed / All filter. |
 | Performance (`performance`) | [adminProblems.js](../../../client/components/settings/adminProblems.js) | Persisted performance options; card loading uses the active loading policy. |
 | Speed (`speed`) | [eventLog.js](../../../models/eventLog.js) | Recorded speed events; no events is a valid empty report. |
 | Tests (`tests`) | [eventLog.js](../../../models/eventLog.js) | Recorded test results; opening the pane does not run every repository test. |

docs/Features/General/Table.md

@@ -63,6 +63,7 @@ Menu path is what you click to reach the page.
 | Domains | Admin Panel / People / Domains | Every e-mail domain in use with the number of users on it. The first People pane converted to this design. |
 | Roles Status | Admin Panel / People / Roles | What each board role may do — which cards it sees, and whether it may comment, create and edit, or change the board's settings. **Read-only**: no `rowTemplate`, no actions, nothing editable, because a role's capabilities are a property of the code and not a setting. It sits BELOW the Save button of the checkbox list above it and follows that list's working copy, so an admin sees what a change means before saving it. Rendered from `models/lib/boardRoleCapabilities.js`, the same table the allow rules decide with — see [Board roles](../Board-Sidebar/Members/Roles.md). |
 | Security | Admin Panel / Problems / Security | Security events from the event log: blocked uploads, rejected URL schemes, auth failures. One row per event, newest first. |
+| Password length | Admin Panel / Problems / Password length | Accounts that signed in with a password shorter than the minimum: username, first and last such login, the latest IPv4 and IPv6 address each with its flag and city when known, the count, and when it was fixed. Its filter is the status - Too short password (the default), Fixed to long enough password, All - and above the table are the two settings, the minimum length and whether it is enforced. See [Password length](../Admin-Panel/Problems/Password-length.md). |
 | Speed | Admin Panel / Problems / Speed | Slow-operation events — what took too long, where, and for how long. |
 | Tests | Admin Panel / Problems / Tests | Test-run events recorded on the server. |
 | CPU usage | Admin Panel / Problems / CPU usage | Past high-CPU periods. Adds a **status row**: the live CPU percent, core count and load average, because the table itself is history, not the current state. |

docs/Features/Login-Page/Forgot-Password.md

@@ -2,8 +2,9 @@
 
 **a) Wekan Snap**
 ```
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan/current/lib/x86_64-linux-gnu
-export PATH="$PATH:/snap/wekan/current/bin"
+S=/snap; [ -d /snap/wekan ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan/current/lib/$(uname -m)-linux-gnu"
+export PATH="$PATH:$S/wekan/current/bin"
 mongo --port 27019
 ```
 If you have disabled new user registration at Admin Panel, you can enable it, and create new user your https://wekan.example.com/sign-up :
@@ -34,8 +35,9 @@ Then login to Wekan and change any users passwords at `Admin Panel / People / Pe
 
 **b) Wekan Gantt GPL Snap**
 ```
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan-gantt-gpl/current/lib/x86_64-linux-gnu
-export PATH="$PATH:/snap/wekan-gantt-gpl/current/bin"
+S=/snap; [ -d /snap/wekan-gantt-gpl ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan-gantt-gpl/current/lib/$(uname -m)-linux-gnu"
+export PATH="$PATH:$S/wekan-gantt-gpl/current/bin"
 mongo --port 27019
 ```
 If you have disabled new user registration at Admin Panel, you can enable it, and create new user your https://wekan.example.com/sign-up :

docs/Platforms/FOSS/Container/Snap/Candidate-WeKan-Snap-Manual-Upgrade.md

@@ -131,9 +131,10 @@ sudo snap stop wekan.wekan
 ```
 #### 10. Use WeKan Stable Snap mongodump version for dumping database
 ```
-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/snap/wekan/current/lib/x86_64-linux-gnu
+S=/snap; [ -d /snap/wekan ] || S=/var/lib/snapd/snap
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH-}:$S/wekan/current/lib/$(uname -m)-linux-gnu"
 
-export PATH="$PATH:/snap/wekan/current/bin"
+export PATH="$PATH:$S/wekan/current/bin"
 
 mongodump --port 27019
 ```

docs/Platforms/Propietary/OS/Windows/Offline.md

@@ -10,7 +10,7 @@ This is without container (without Docker or Snap).
 
 Right click and download files 1-4:
 
-1. [wekan-12.74-win64.zip](https://github.com/wekan/wekan/releases/download/v12.74/wekan-12.74-win64.zip) or newest available at https://github.com/wekan/wekan/releases/
+1. [wekan-12.76-win64.zip](https://github.com/wekan/wekan/releases/download/v12.76/wekan-12.76-win64.zip) or newest available at https://github.com/wekan/wekan/releases/
 
 2. [node.exe](https://nodejs.org/dist/latest-v26.x/win-x64/node.exe)
 
@@ -22,7 +22,7 @@ Right click and download files 1-4:
 
 6. Double click `mongodb-windows-x86_64-7.0.34-signed.msi` . In installer, uncheck downloading MongoDB compass.
 
-7. Unzip `wekan-12.74-win64.zip` , inside it is directory `bundle`, to it copy other files:
+7. Unzip `wekan-12.76-win64.zip` , inside it is directory `bundle`, to it copy other files:
 
 ```
 bundle (directory)

docs/Security/Password-Breach-Check-Digest-2026-10-31.md

@@ -0,0 +1,19 @@
+# Password breach check digest (CodeQL #599)
+
+Reviewed on **2026-10-31** from the saved alert in `.tools/log/wekansec2`.
+
+| Alert | Source review | Changes |
+| --- | --- | --- |
+| 599: use of password hash with insufficient computational effort (`js/insufficient-password-hash`, CWE-916) | `server/lib/passwordPolicy.js` computed the SHA-1 of a new password for `PASSWORD_CHECK_PWNED` (off by default, unreleased). That digest is not password storage: accounts-password stores passwords with bcrypt, and this one is never stored or logged. Have I Been Pwned's range API is keyed by SHA-1, so its first 5 hex digits are sent and the remaining 35 are compared with the answer in memory and dropped. A slow hash cannot be used, because the service could not match it. | The browser and the server now compute the lookup digest with ONE implementation, `breachLookupDigest` in `models/lib/passwordPolicy.js` (Web Crypto in both), whose comment says what it is and is not. The server no longer hashes a password with a hash of its own, and a failure to compute the digest lets the password through, like an unreachable service. Tests: the digest equals SHA-1 for ASCII and UTF-8 input, it reaches only the range lookup and the comparison, and nothing anywhere in WeKan hashes a password-named value with a fast hash (`tests/passwordPolicy.test.cjs`). |
+
+This is hardening of a check that had not been released, not a confirmed
+vulnerability: no password or password hash was stored or sent beyond five
+hex digits. No Hall of Fame entry is created, and nothing is recorded in Admin
+Panel / Problems - a password being checked is ordinary use, not an attack.
+
+If the alert is raised again for the Web Crypto digest, it is the same false
+positive and can be dismissed as "Won't fix - the API requires SHA-1; not
+stored", with a link to this page.
+
+Reference: [Have I Been Pwned range API](https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByRange),
+[OWASP Password Storage](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html).

docs/Security/Security-Settings.md

@@ -0,0 +1,57 @@
+# Security settings
+
+Settings an administrator can turn on to harden a WeKan site. Every one of them
+is an environment variable on every platform (Snap: `sudo snap set wekan
+<key>=<value>`, Docker: `docker-compose.yml`, `start-wekan.sh`,
+`start-wekan.bat`, the Helm chart's `values.yaml`), and the ones marked
+**Admin Panel** can also be set there, where the value wins over the variable.
+
+## Signing in
+
+| Setting | Snap key | Default | What it does |
+| --- | --- | --- | --- |
+| `PASSWORD_MIN_LENGTH` | `password-min-length` | `8` | Minimum password length, in characters. A sign-in with a shorter password is listed in **Admin Panel / Problems / Password length**; nothing is refused unless `PASSWORD_MIN_LENGTH_ENFORCE` is on. Also set on that page and in **Admin Panel / People / Login**. |
+| `PASSWORD_MIN_LENGTH_ENFORCE` | `password-min-length-enforce` | `false` | Refuse a shorter NEW password, and make an account that signs in with an older shorter one change it before anything else; the change signs every session of the account out. Only WeKan's own password accounts: LDAP, OAuth2, OIDC, SAML, CAS and Sandstorm passwords are their provider's. [Password length](../Features/Admin-Panel/Problems/Password-length.md) |
+| `PASSWORD_CHECK_PWNED` | `password-check-pwned` | `false` | Refuse a new password that appears in a known data breach. Only the first 5 hex digits of its SHA-1 are sent to `api.pwnedpasswords.com`; if the service cannot be reached, the password is accepted. **Admin Panel / People / Login** |
+| `REQUIRE_2FA` | `require-2fa` | `off` | `admins` or `all`: accounts that sign in with a WeKan password must set up two-factor authentication right after signing in, and can do nothing else until they have. LDAP, OAuth2, SAML, CAS and Sandstorm accounts are not covered: their identity provider is where a second factor belongs. **Admin Panel / People / Login** |
+| `LOGOUT_IDLE_MINUTES` | `logout-idle-minutes` | off | Sign a browser session out after this many minutes without a key press, click, touch or scroll. REST API tokens are not affected. **Admin Panel / People / Login** |
+| `LOGOUT_WITH_TIMER`, `LOGOUT_IN`, `LOGOUT_ON_HOURS`, `LOGOUT_ON_MINUTES` | | off | Sign everybody out at a deadline after signing in, however busy. **Admin Panel / People / Login** |
+| `ACCOUNTS_LOCKOUT_*` | | on | Lock an account or an address after failed logins; [Brute force protection](brute-force-protection.md). **Admin Panel / People / Locked Users** |
+| `USERS_DISABLE_INACTIVE_AFTER_DAYS` | | off | Disable accounts unused for this many days. **Admin Panel / People / Login** |
+
+Each member can turn on two-factor authentication for themselves in Member
+Settings, whatever `REQUIRE_2FA` says, and can add passkeys.
+
+## HTTP
+
+| Setting | Snap key | Default | What it does |
+| --- | --- | --- | --- |
+| `HSTS_MAX_AGE` | `hsts-max-age` | `15552000` (180 days) | Strict-Transport-Security, sent only when `ROOT_URL` is https. `0` stops it. **Admin Panel / People / Login** |
+| `HSTS_INCLUDE_SUBDOMAINS` | `hsts-include-subdomains` | `false` | HSTS for every subdomain too. Only when all of them have HTTPS. |
+| `HSTS_PRELOAD` | `hsts-preload` | `false` | The preload token; sent only with includeSubDomains and a max-age of at least a year. |
+| `BROWSER_POLICY_ENABLED`, `TRUSTED_URL` | | | Which site may show WeKan in a frame. |
+
+Always on: `X-Content-Type-Options: nosniff`, `Referrer-Policy:
+strict-origin-when-cross-origin`, and a cross-site request guard - a POST, PUT,
+PATCH or DELETE that logs in only with the cookie must come from WeKan's own
+pages. A refused request appears in Admin Panel / Problems as
+`csrf.cross-site-cookie`.
+
+## Attachments
+
+- **Admin Panel / Attachments / S3 / Server-side encryption**: SSE-S3 or SSE-KMS
+  for every attachment, avatar and backup written to S3.
+- On the filesystem, encrypt the disk or volume that holds `WRITABLE_PATH`
+  (LUKS, an encrypted cloud volume).
+- `ATTACHMENTS_UPLOAD_MAX_SIZE`, `ATTACHMENTS_UPLOAD_MIME_TYPES` and
+  `ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM` (a virus scanner, `{file}` is the
+  upload) limit and check what can be uploaded; the same exist for avatars.
+
+## Watching
+
+- **Admin Panel / Problems** - attacks WeKan refused, summarised: what, how
+  often, since when, from whom.
+- **Admin Panel / People / Audit log** - every administrative action of a site
+  administrator: who set a password, made somebody an admin, changed a login
+  setting, restored a backup. Passwords and secrets are never recorded; kept
+  for a year.

imports/i18n/data/ace.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Bagaih",
   "progress": "Keumajuan",
   "password-again": "Sandi (sigo treuk)",
+  "password-pwned": "Kata sandi nyoe ka meutamöng lam bocoran data. Pileh nyang laen.",
+  "password-too-short": "Kata sandi beu paleng kureung __min__ karakter.",
+  "password-length-report-title": "Panyang kata sandi",
+  "password-length-report-desc": "Akun nyang tamong ngön kata sandi nyang leubeh paneuk nibak panyang paleng kureung. Cit browser mantong nyang tuphö padum panyang kata sandi, maka jih jilapor kata sandi nyang paneuk lheuh tamong; kata sandi ngön panyang jih hana tom teubiet nibak browser. Ka geupeugot meunyo kata sandi akun ka geu-ubah - akun nyang tamong lom ngön kata sandi paneuk geupeuleumah lom sibagoe paneuk that.",
+  "password-length-no-results": "Hana akun disinoe.",
+  "password-length-first-login": "Tamong phon",
+  "password-length-last-login": "Tamong keuneulheuëh",
+  "password-length-login-count": "Padum go tamong",
+  "password-length-fixed": "Ka geupeugot",
+  "password-length-filter-short": "Kata sandi paneuk that",
+  "password-length-filter-fixed": "Ka geupeugot keu kata sandi nyang cukôp panyang",
+  "password-length-filter-all": "Mandum",
+  "password-min-length": "Panyang paleng kureung kata sandi",
+  "password-min-length-description": "Tamong ngön kata sandi nyang leubeh paneuk geupeuleumah di yup nyoe. Tamong hana tom geutolak keu nyan.",
+  "password-min-length-enforce": "Paksa panyang paleng kureung",
+  "password-min-length-enforce-description": "Kata sandi barô nyang leubeh paneuk geutolak, ngön akun nyang tamong ngön kata sandi leubeh paneuk wajeb jiubah dilee sigohlom nyang laen. Meng-ubah jih jiteubiet mandum sesi akun. Kata sandi LDAP, OAuth2, OIDC, SAML, CAS ngön Sandstorm nyan milek penyedia jih, ngön hana geuperiksa.",
+  "password-length-saved": "Ka geukeubah.",
+  "password-length-from-environment": "Nilai nyang geupasang lam lingkungan server teungöh beurlaku; keubah disinoe jigantoe nyan.",
+  "password-change-required-title": "Ubah kata sandi droeneuh",
+  "password-change-required-text": "Situs nyoe jinoe jilakee kata sandi paleng kureung __min__ karakter, ngön kata sandi droeneuh leubeh paneuk. Pileh nyang leubeh panyang mangat jeuet lanjut. Mandum sesi akun droeneuh laju geuteubiet, ngön droeneuh tamong lom ngön kata sandi barô.",
+  "password-same-as-username": "Kata sandi bek sama ngon nan ureueng ngui atawa alamat emel.",
   "if-you-already-have-an-account": "Meunyoe droeneueh ka na akun",
   "register": "Daftar",
   "forgot-password": "Tuwo sandi",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Tingkap gagai (detik)",
   "accounts-lockout-settings-updated": "Peuatôran peulindông brute force ka geuubah",
   "accounts-lockout-locked-users": "Ureueng Ngui Geugunci",
+  "admin-audit-log": "Log Audit",
+  "admin-audit-log-info": "Peue nyang geupeubuet lé peungatô situs: meurubah ureueng ngui, tamöng, keubah data ngon saleunan, nyang barô phon. Kata sandi ngon rahsia hana tom geucatat. Geukeubah sithon.",
+  "admin-audit-log-when": "Watèe",
+  "admin-audit-log-who": "Peungatô",
+  "admin-audit-log-action": "Buet",
+  "admin-audit-log-details": "Haba Leungkap",
+  "admin-audit-log-empty": "Goh na sapeue nyang geucatat.",
   "accounts-lockout-locked-users-info": "Ureueng ngui nyang jinoe geugunci sabab le that usaha tamong nyang gagai",
   "accounts-lockout-no-locked-users": "Jinoe hana ureueng ngui nyang geugunci",
   "accounts-lockout-failed-attempts": "Usaha Gagai",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "Storan objek kompatibel S3: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces ngön nyang laén.",
   "s3-force-path-style": "Peupaksa URL gaya-rot",
   "s3-force-path-style-description": "Geupeureulee lé MinIO ngön le that server kompatibel S3 nyang kon AWS.",
+  "s3-sse": "Enkripsi bak peuladèn",
+  "s3-sse-none": "Hana geulakèe (standar bucket)",
+  "s3-sse-description": "S3 geu-enkripsi bandum lampiran, avatar ngon saleunan nyang geutuléh lé WeKan, ngon geubuka enkripsi keu WeKan watèe geubaca.",
+  "s3-sse-kms-key-id": "ID kunci KMS keu SSE-KMS (soh = kunci standar akun)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Teumpat keubah Microsoft Azure Blob.",
   "azure-account-name": "Nan akun",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Scan kode QR nyoe ngön aplikasi otentikator (umpama Google Authenticator, Authy), laju neutuléh kode 6 angka nyang jipeuleumah keu peukong.",
   "twoFactorAuth-manual-entry": "Atawa tuléh kode nyoe ngon manual: ",
   "twoFactorAuth-confirm": "Peukong ngön Peuhudép",
+  "two-factor-required-title": "Atô Otentikasi Dua Faktor",
+  "two-factor-required-text": "Situs nyoe meuphôm otentikasi dua faktor keu akun droeneuh. Atô dilèe mangat jeut neulanjut.",
   "twoFactorCode-prompt": "Tuléh kode otentikasi 6 angka droe neuh",
   "twoFactorCode-submit": "Peukong",
   "twoFactorCode-cancel": "Pubateuë",

imports/i18n/data/af.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Spoed",
   "progress": "Vordering",
   "password-again": "Wagwoord (weer)",
+  "password-pwned": "Hierdie wagwoord het in 'n datalek verskyn. Kies 'n ander een.",
+  "password-too-short": "Die wagwoord moet ten minste __min__ karakters lank wees.",
+  "password-length-report-title": "Wagwoordlengte",
+  "password-length-report-desc": "Rekeninge wat aangemeld het met 'n wagwoord korter as die minimum lengte. Slegs die blaaier weet hoe lank 'n wagwoord is, dus rapporteer dit 'n kort een ná aanmelding; die wagwoord en sy lengte verlaat dit nooit. Reggestel is wanneer die rekening se wagwoord verander is - 'n rekening wat weer met 'n kort wagwoord aanmeld, word weer as te kort getoon.",
+  "password-length-no-results": "Geen rekeninge hier nie.",
+  "password-length-first-login": "Eerste aanmelding",
+  "password-length-last-login": "Laaste aanmelding",
+  "password-length-login-count": "Aantal kere aangemeld",
+  "password-length-fixed": "Reggestel",
+  "password-length-filter-short": "Te kort wagwoord",
+  "password-length-filter-fixed": "Reggestel na lank genoeg wagwoord",
+  "password-length-filter-all": "Alles",
+  "password-min-length": "Minimum wagwoordlengte",
+  "password-min-length-description": "Aanmelding met 'n korter wagwoord word hieronder gelys. Aanmelding word nooit daarom geweier nie.",
+  "password-min-length-enforce": "Dwing die minimum lengte af",
+  "password-min-length-enforce-description": "'n Korter nuwe wagwoord word geweier, en 'n rekening wat met 'n korter wagwoord aanmeld, moet dit eers verander voor enigiets anders. Om dit te verander, teken elke sessie van die rekening uit. LDAP-, OAuth2-, OIDC-, SAML-, CAS- en Sandstorm-wagwoorde behoort aan hul verskaffer en word nie nagegaan nie.",
+  "password-length-saved": "Gestoor.",
+  "password-length-from-environment": "'n Waarde wat in die bediener se omgewing gestel is, is van krag; om hier te stoor, oorskryf dit.",
+  "password-change-required-title": "Verander jou wagwoord",
+  "password-change-required-text": "Hierdie werf vereis nou wagwoorde van ten minste __min__ karakters, en joune is korter. Kies 'n langer een om voort te gaan. Elke sessie van jou rekening word dan uitgeteken, en jy meld weer aan met die nuwe wagwoord.",
+  "password-same-as-username": "Die wagwoord mag nie die gebruikersnaam of die e-posadres wees nie.",
   "if-you-already-have-an-account": "As jy reeds 'n rekening het",
   "register": "Registreer",
   "forgot-password": "Wagwoord vergeet",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Mislukkingsvenster (sekondes)",
   "accounts-lockout-settings-updated": "Brute force beskerming instellings is opgedateer",
   "accounts-lockout-locked-users": "Geslote gebruikers",
+  "admin-audit-log": "Ouditlog",
+  "admin-audit-log-info": "Wat werfadministrateurs gedoen het: gebruiker-, aanmeld-, berging- en rugsteunveranderinge, nuutste eerste. Wagwoorde en geheime word nooit aangeteken nie. Word vir 'n jaar gehou.",
+  "admin-audit-log-when": "Wanneer",
+  "admin-audit-log-who": "Administrateur",
+  "admin-audit-log-action": "Aksie",
+  "admin-audit-log-details": "Besonderhede",
+  "admin-audit-log-empty": "Nog niks aangeteken nie.",
   "accounts-lockout-locked-users-info": "Gebruikers word tans uitgesluit weens te veel mislukte aanmeldpogings",
   "accounts-lockout-no-locked-users": "Daar is tans geen geslote gebruikers nie",
   "accounts-lockout-failed-attempts": "Mislukte pogings",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "S3-versoenbare objekberging: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces en ander.",
   "s3-force-path-style": "Dwing pad-styl URL's af",
   "s3-force-path-style-description": "Vereis deur MinIO en die meeste nie-AWS S3-versoenbare bedieners.",
+  "s3-sse": "Bedienerkant-enkripsie",
+  "s3-sse-none": "Niks versoek nie (die emmer se verstek)",
+  "s3-sse-description": "S3 enkripteer elke aanhegsel, avatar en rugsteun wat WeKan skryf, en dekripteer dit vir WeKan wanneer dit gelees word.",
+  "s3-sse-kms-key-id": "KMS-sleutel-ID vir SSE-KMS (leeg = die rekening se verstek sleutel)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob-berging.",
   "azure-account-name": "Rekeningnaam",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Skandeer hierdie QR-kode met 'n verifikasie-toepassing (bv. Google Authenticator, Authy), voer dan die 6-syfer-kode wat gewys word in om te bevestig.",
   "twoFactorAuth-manual-entry": "Of voer hierdie kode self in: ",
   "twoFactorAuth-confirm": "Bevestig en aktiveer",
+  "two-factor-required-title": "Stel twee-faktor-verifikasie op",
+  "two-factor-required-text": "Hierdie werf vereis twee-faktor-verifikasie vir jou rekening. Stel dit op om voort te gaan.",
   "twoFactorCode-prompt": "Voer jou 6-syfer-verifikasiekode in",
   "twoFactorCode-submit": "Verifieer",
   "twoFactorCode-cancel": "Kanselleer",

imports/i18n/data/af_ZA.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Spoed",
   "progress": "Vordering",
   "password-again": "Wagwoord (weer)",
+  "password-pwned": "Hierdie wagwoord het in 'n datalek verskyn. Kies 'n ander een.",
+  "password-too-short": "Die wagwoord moet ten minste __min__ karakters lank wees.",
+  "password-length-report-title": "Wagwoordlengte",
+  "password-length-report-desc": "Rekeninge wat aangemeld het met 'n wagwoord korter as die minimum lengte. Slegs die blaaier weet hoe lank 'n wagwoord is, dus rapporteer dit 'n kort een ná aanmelding; die wagwoord en sy lengte verlaat dit nooit. Reggestel is wanneer die rekening se wagwoord verander is - 'n rekening wat weer met 'n kort wagwoord aanmeld, word weer as te kort getoon.",
+  "password-length-no-results": "Geen rekeninge hier nie.",
+  "password-length-first-login": "Eerste aanmelding",
+  "password-length-last-login": "Laaste aanmelding",
+  "password-length-login-count": "Aantal kere aangemeld",
+  "password-length-fixed": "Reggestel",
+  "password-length-filter-short": "Te kort wagwoord",
+  "password-length-filter-fixed": "Reggestel na lank genoeg wagwoord",
+  "password-length-filter-all": "Alles",
+  "password-min-length": "Minimum wagwoordlengte",
+  "password-min-length-description": "Aanmelding met 'n korter wagwoord word hieronder gelys. Aanmelding word nooit daarom geweier nie.",
+  "password-min-length-enforce": "Dwing die minimum lengte af",
+  "password-min-length-enforce-description": "'n Korter nuwe wagwoord word geweier, en 'n rekening wat met 'n korter wagwoord aanmeld, moet dit eers verander voor enigiets anders. Om dit te verander, teken elke sessie van die rekening uit. LDAP-, OAuth2-, OIDC-, SAML-, CAS- en Sandstorm-wagwoorde behoort aan hul verskaffer en word nie nagegaan nie.",
+  "password-length-saved": "Gestoor.",
+  "password-length-from-environment": "'n Waarde wat in die bediener se omgewing gestel is, is van krag; om hier te stoor, oorskryf dit.",
+  "password-change-required-title": "Verander jou wagwoord",
+  "password-change-required-text": "Hierdie werf vereis nou wagwoorde van ten minste __min__ karakters, en joune is korter. Kies 'n langer een om voort te gaan. Elke sessie van jou rekening word dan uitgeteken, en jy meld weer aan met die nuwe wagwoord.",
+  "password-same-as-username": "Die wagwoord mag nie die gebruikersnaam of die e-posadres wees nie.",
   "if-you-already-have-an-account": "As jy reeds 'n rekening het",
   "register": "Registreer",
   "forgot-password": "Wagwoord vergeet",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Mislukkingsvenster (sekondes)",
   "accounts-lockout-settings-updated": "Brute force beskerming instellings is opgedateer",
   "accounts-lockout-locked-users": "Geslote gebruikers",
+  "admin-audit-log": "Ouditlog",
+  "admin-audit-log-info": "Wat werfadministrateurs gedoen het: gebruiker-, aanmeld-, berging- en rugsteunveranderinge, nuutste eerste. Wagwoorde en geheime word nooit aangeteken nie. Word vir 'n jaar gehou.",
+  "admin-audit-log-when": "Wanneer",
+  "admin-audit-log-who": "Administrateur",
+  "admin-audit-log-action": "Aksie",
+  "admin-audit-log-details": "Besonderhede",
+  "admin-audit-log-empty": "Nog niks aangeteken nie.",
   "accounts-lockout-locked-users-info": "Gebruikers word tans uitgesluit weens te veel mislukte aanmeldpogings",
   "accounts-lockout-no-locked-users": "Daar is tans geen geslote gebruikers nie",
   "accounts-lockout-failed-attempts": "Mislukte pogings",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "S3-versoenbare objekberging: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces en ander.",
   "s3-force-path-style": "Dwing pad-styl URL's af",
   "s3-force-path-style-description": "Vereis deur MinIO en die meeste nie-AWS S3-versoenbare bedieners.",
+  "s3-sse": "Bedienerkant-enkripsie",
+  "s3-sse-none": "Niks versoek nie (die emmer se verstek)",
+  "s3-sse-description": "S3 enkripteer elke aanhegsel, avatar en rugsteun wat WeKan skryf, en dekripteer dit vir WeKan wanneer dit gelees word.",
+  "s3-sse-kms-key-id": "KMS-sleutel-ID vir SSE-KMS (leeg = die rekening se verstek sleutel)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob-berging.",
   "azure-account-name": "Rekeningnaam",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Skandeer hierdie QR-kode met 'n verifikasie-toepassing (bv. Google Authenticator, Authy), voer dan die 6-syfer-kode wat gewys word in om te bevestig.",
   "twoFactorAuth-manual-entry": "Of voer hierdie kode self in: ",
   "twoFactorAuth-confirm": "Bevestig en aktiveer",
+  "two-factor-required-title": "Stel twee-faktor-verifikasie op",
+  "two-factor-required-text": "Hierdie werf vereis twee-faktor-verifikasie vir jou rekening. Stel dit op om voort te gaan.",
   "twoFactorCode-prompt": "Voer jou 6-syfer-verifikasiekode in",
   "twoFactorCode-submit": "Verifieer",
   "twoFactorCode-cancel": "Kanselleer",

imports/i18n/data/ak.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Ahoɔhare",
   "progress": "Nkɔso",
   "password-again": "Asɛmfua a wode kɔ mu (san hyɛ bio)",
+  "password-pwned": "Saa ahintasɛm yi apue wɔ data a ayi adi bi mu. Paw foforo.",
+  "password-too-short": "Ɛsɛ sɛ ahintasɛm no nkyerɛwde dodow yɛ __min__ anaa ɛboro saa.",
+  "password-length-report-title": "Ahintasɛm tenten",
+  "password-length-report-desc": "Akontaa a wɔde ahintasɛm a ɛyɛ tiaa sen tenten a ɛsɛ no na ɛkɔɔ mu. Brawsa no nko ara na enim ahintasɛm tenten, enti ɛbɔ amanneɛ fa tiaa bi ho wɔ wɔkɔ mu akyi; ahintasɛm no ne ne tenten mfi brawsa no mu da. Wɔasiesie kyerɛ bere a wɔsesaa akontaa no ahintasɛm - akontaa a ɛsan de ahintasɛm tiaa kɔ mu no, wɔsan kyerɛ sɛ ɛyɛ tiaa dodo.",
+  "password-length-no-results": "Akontaa biara nni ha.",
+  "password-length-first-login": "Kɔ mu a edi kan",
+  "password-length-last-login": "Kɔ mu a etwa to",
+  "password-length-login-count": "Mpɛn dodow a wɔkɔɔ mu",
+  "password-length-fixed": "Wɔasiesie",
+  "password-length-filter-short": "Ahintasɛm a ɛyɛ tiaa dodo",
+  "password-length-filter-fixed": "Wɔasiesie akɔ ahintasɛm a ɛware sɛnea ɛsɛ",
+  "password-length-filter-all": "Ne nyinaa",
+  "password-min-length": "Ahintasɛm tenten a ɛsɛ sɛ ɛyɛ kakraa koraa",
+  "password-min-length-description": "Wɔkyerɛw nkɔ-mu a wɔde ahintasɛm tiaa yɛe no wɔ ase ha. Wɔmpo nkɔ-mu da esiane eyi nti.",
+  "password-min-length-enforce": "Hyɛ tenten kakraa koraa no so",
+  "password-min-length-enforce-description": "Wɔpo ahintasɛm foforo a ɛyɛ tiaa, na akontaa a ɛde ahintasɛm tiaa kɔ mu no, ɛsɛ sɛ ɛsesa no ansa na ayɛ biribi foforo. Sɛ wosesa a, ɛyi akontaa no nhyiamu biara fi mu. LDAP, OAuth2, OIDC, SAML, CAS ne Sandstorm ahintasɛm yɛ wɔn mamfo dea, na wɔnhwɛ mu.",
+  "password-length-saved": "Wɔasie.",
+  "password-length-from-environment": "Botae bi a wɔde ahyɛ server no tebea mu na ɛreyɛ adwuma; sɛ wosie wɔ ha a, ɛsesa no.",
+  "password-change-required-title": "Sesa wo ahintasɛm",
+  "password-change-required-text": "Saa site yi hwehwɛ seesei sɛ ahintasɛm nkyerɛwde dodow yɛ __min__ anaa ɛboro saa, na wo dea yɛ tiaa. Paw nea ɛware kakra na toa so. Afei wobeyi wo akontaa nhyiamu biara afi mu, na wode ahintasɛm foforo no bɛsan akɔ mu.",
+  "password-same-as-username": "Ɛnsɛ sɛ ahintasɛm no yɛ dwumadini din anaa ɛmɛl address no.",
   "if-you-already-have-an-account": "Sɛ wowɔ akontaabu dedaw a",
   "register": "Kyerɛw wo din",
   "forgot-password": "Wo werɛ afi ahintasɛm",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Bere a wɔkan nkogu wɔ mu (sɛkɛnd)",
   "accounts-lockout-settings-updated": "Wɔayɛ nsɛmfua ahintaw pii sɔhwɛ ntua ho banbɔ nhyehyɛe no foforo",
   "accounts-lockout-locked-users": "Locked Ɔdefos",
+  "admin-audit-log": "Nhwehwɛmu nkrataa",
+  "admin-audit-log-info": "Nea sohwɛfoɔ a wɔwɔ site no so ayɛ: dwumadini, ahyɛnmu, akorae ne nsɛm akora nsakrae, foforo di kan. Wɔnkyerɛw ahintasɛm ne kokoam nsɛm da. Wɔkora so afe baako.",
+  "admin-audit-log-when": "Bere",
+  "admin-audit-log-who": "Sohwɛfoɔ",
+  "admin-audit-log-action": "Adeyɛ",
+  "admin-audit-log-details": "Nkyerɛkyerɛmu",
+  "admin-audit-log-empty": "Biribiara nni hɔ a wɔakyerɛw ase.",
   "accounts-lockout-locked-users-info": "Wɔn a wɔde dwumadi yi di dwuma a wɔasiw wɔn kwan seesei esiane sɛ wɔabɔ mmɔden mpɛn pii sɛ wɔbɛkɔ mu na wɔantumi nti",
   "accounts-lockout-no-locked-users": "Seesei obiara nni hɔ a wɔasiw ne kwan",
   "accounts-lockout-failed-attempts": "Mfomso bi sii wɔ dwumadi yi mu",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "Nneɛma akorabea a ɛne S3 yɛ adwuma: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces ne afoforo.",
   "s3-force-path-style": "Hyɛ sɛ wɔmfa path-style URL nni dwuma",
   "s3-force-path-style-description": "MinIO ne sɛɛva dodow no ara a ɛne S3 yɛ adwuma na ɛnyɛ AWS no hia eyi.",
+  "s3-sse": "Som afiri fam ahintakyerɛw",
+  "s3-sse-none": "Wɔammisa biribiara (bucket no deɛ wɔahyɛ dedaw)",
+  "s3-sse-description": "S3 de ahintakyerɛw kata deɛ wɔde aka ho, avatar ne nsɛm akora biara a WeKan kyerɛw, na ɔyi ahintakyerɛw no ma WeKan bere a wɔkenkan.",
+  "s3-sse-kms-key-id": "KMS safe ID ma SSE-KMS (hwee nni mu = akawnt no safe a wɔahyɛ dedaw)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
   "azure-account-name": "Akontaabu din",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Fa nokwaredi app san QR koodu yi (sɛnea, Google Authenticator, Authy), afei hyɛ nɔma 6 a ɛda adi no ma wɔnhu mu.",
   "twoFactorAuth-manual-entry": "Anaasɛ fa wo nsa hyɛ koodu yi: ",
   "twoFactorAuth-confirm": "Si so dua na ma so",
+  "two-factor-required-title": "Hyehyɛ nneɛma abien nokwaredi",
+  "two-factor-required-text": "Saa site yi hwehwɛ nneɛma abien nokwaredi ma wo akawnt. Hyehyɛ no na woakɔ so.",
   "twoFactorCode-prompt": "Hyɛ wo nokwaredi nɔma 6 no",
   "twoFactorCode-submit": "Si so dua",
   "twoFactorCode-cancel": "Twa mu",

imports/i18n/data/am.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "ፍጥነት",
   "progress": "ሂደት",
   "password-again": "የይለፍ ቃል (እንደገና)",
+  "password-pwned": "ይህ የይለፍ ቃል በመረጃ ፍሰት ውስጥ ታይቷል። ሌላ ይምረጡ።",
+  "password-too-short": "የይለፍ ቃሉ ቢያንስ __min__ ቁምፊዎች ሊኖሩት ይገባል።",
+  "password-length-report-title": "የይለፍ ቃል ርዝመት",
+  "password-length-report-desc": "ከዝቅተኛው ርዝመት ባጠረ የይለፍ ቃል የገቡ መለያዎች። የይለፍ ቃል ምን ያህል እንደሚረዝም የሚያውቀው አሳሹ ብቻ ነው፣ ስለዚህ ከገቡ በኋላ አጭር የይለፍ ቃልን ሪፖርት ያደርጋል፤ የይለፍ ቃሉና ርዝመቱ ከአሳሹ በጭራሽ አይወጡም። ተስተካክሏል ማለት የመለያው የይለፍ ቃል የተቀየረበት ጊዜ ነው - እንደገና በአጭር የይለፍ ቃል የሚገባ መለያ እንደገና በጣም አጭር ሆኖ ይታያል።",
+  "password-length-no-results": "እዚህ ምንም መለያዎች የሉም።",
+  "password-length-first-login": "የመጀመሪያ መግቢያ",
+  "password-length-last-login": "የመጨረሻ መግቢያ",
+  "password-length-login-count": "የገቡበት ብዛት",
+  "password-length-fixed": "ተስተካክሏል",
+  "password-length-filter-short": "በጣም አጭር የይለፍ ቃል",
+  "password-length-filter-fixed": "በበቂ ረጅም የይለፍ ቃል ተስተካክሏል",
+  "password-length-filter-all": "ሁሉም",
+  "password-min-length": "ዝቅተኛ የይለፍ ቃል ርዝመት",
+  "password-min-length-description": "በአጭር የይለፍ ቃል መግባት ከዚህ በታች ይዘረዘራል። በዚህ ምክንያት መግባት በጭራሽ አይከለከልም።",
+  "password-min-length-enforce": "ዝቅተኛውን ርዝመት አስገድድ",
+  "password-min-length-enforce-description": "አጭር አዲስ የይለፍ ቃል ውድቅ ይደረጋል፣ እና በአጭር የይለፍ ቃል የሚገባ መለያ ከማንኛውም ነገር በፊት መቀየር አለበት። መቀየሩ የመለያውን ሁሉንም ክፍለ ጊዜዎች ያስወጣል። የLDAP፣ OAuth2፣ OIDC፣ SAML፣ CAS እና Sandstorm የይለፍ ቃሎች የአቅራቢያቸው ናቸው፣ አይፈተሹም።",
+  "password-length-saved": "ተቀምጧል።",
+  "password-length-from-environment": "በአገልጋዩ አካባቢ የተቀመጠ እሴት በሥራ ላይ ነው፤ እዚህ ማስቀመጥ ይሽረዋል።",
+  "password-change-required-title": "የይለፍ ቃልዎን ይቀይሩ",
+  "password-change-required-text": "ይህ ጣቢያ አሁን ቢያንስ __min__ ቁምፊዎች ያላቸውን የይለፍ ቃሎች ይፈልጋል፣ የእርስዎም አጭር ነው። ለመቀጠል ረዘም ያለ ይምረጡ። ከዚያ የመለያዎ ሁሉም ክፍለ ጊዜዎች ይወጣሉ፣ እና በአዲሱ የይለፍ ቃል እንደገና ይገባሉ።",
+  "password-same-as-username": "የይለፍ ቃሉ የተጠቃሚ ስሙ ወይም የኢሜይል አድራሻው መሆን የለበትም።",
   "if-you-already-have-an-account": "አስቀድመው መለያ ካለዎት",
   "register": "ተመዝገብ",
   "forgot-password": "የይለፍ ቃል ረሱ",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "የውድቀት የጊዜ መስኮት (ሰከንዶች)",
   "accounts-lockout-settings-updated": "የጉልበት ጥቃት መከላከያ ቅንብሮች ተዘምነዋል",
   "accounts-lockout-locked-users": "የተቆለፉ ተጠቃሚዎች",
+  "admin-audit-log": "የኦዲት መዝገብ",
+  "admin-audit-log-info": "የጣቢያው አስተዳዳሪዎች ያደረጉት፦ የተጠቃሚ፣ የመግቢያ፣ የማከማቻ እና የምትኬ ለውጦች፣ አዲሶቹ መጀመሪያ። የይለፍ ቃላት እና ሚስጥሮች በፍጹም አይመዘገቡም። ለአንድ ዓመት ይቀመጣል።",
+  "admin-audit-log-when": "መቼ",
+  "admin-audit-log-who": "አስተዳዳሪ",
+  "admin-audit-log-action": "ድርጊት",
+  "admin-audit-log-details": "ዝርዝሮች",
+  "admin-audit-log-empty": "እስካሁን ምንም አልተመዘገበም።",
   "accounts-lockout-locked-users-info": "በብዙ ያልተሳኩ የመግቢያ ሙከራዎች ምክንያት አሁን የተቆለፉ ተጠቃሚዎች",
   "accounts-lockout-no-locked-users": "አሁን ምንም የተቆለፈ ተጠቃሚ የለም",
   "accounts-lockout-failed-attempts": "ያልተሳኩ ሙከራዎች",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "ከS3 ጋር ተኳሃኝ የነገር ማከማቻ፦ AWS S3፣ MinIO፣ Cloudflare R2፣ Backblaze B2፣ Wasabi፣ DigitalOcean Spaces እና ሌሎች።",
   "s3-force-path-style": "የዱካ ቅጥ URLዎችን አስገድድ",
   "s3-force-path-style-description": "ለMinIO እና ለአብዛኞቹ AWS ያልሆኑ S3-ተኳኋኝ አገልጋዮች ያስፈልጋል።",
+  "s3-sse": "በአገልጋይ በኩል ምስጠራ",
+  "s3-sse-none": "ምንም አልተጠየቀም (የባልዲው ነባሪ)",
+  "s3-sse-description": "S3 WeKan የሚጽፈውን እያንዳንዱን አባሪ፣ አምሳያ እና ምትኬ ያመሰጥራል፣ ሲነበብም ለWeKan ይፈታዋል።",
+  "s3-sse-kms-key-id": "ለSSE-KMS የKMS ቁልፍ መታወቂያ (ባዶ = የመለያው ነባሪ ቁልፍ)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
   "azure-account-name": "የመለያ ስም",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "ይህን የQR ኮድ በማረጋገጫ መተግበሪያ ይቃኙ (ለምሳሌ Google Authenticator, Authy)፣ ከዚያ ለማረጋገጥ የሚታየውን የ6- አሃዝ ኮድ ያስገቡ።",
   "twoFactorAuth-manual-entry": "ወይም ይህን ኮድ በእጅ ያስገቡ፦ ",
   "twoFactorAuth-confirm": "አረጋግጥና አንቃ",
+  "two-factor-required-title": "ባለ ሁለት-ደረጃ ማረጋገጫን ያዋቅሩ",
+  "two-factor-required-text": "ይህ ጣቢያ ለመለያዎ ባለ ሁለት-ደረጃ ማረጋገጫ ይፈልጋል። ለመቀጠል ያዋቅሩት።",
   "twoFactorCode-prompt": "የ6-አሃዝ ማረጋገጫ ኮድዎን ያስገቡ",
   "twoFactorCode-submit": "አረጋግጥ",
   "twoFactorCode-cancel": "ሰርዝ",

imports/i18n/data/an.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Velocidad",
   "progress": "Progreso",
   "password-again": "Clau (repetir)",
+  "password-pwned": "Ista clau de paso ha amaneciu en una filtración de datos. Tría-ne unatra.",
+  "password-too-short": "La clau de paso ha de tener a lo menos __min__ caracters.",
+  "password-length-report-title": "Longaria d'a clau de paso",
+  "password-length-report-desc": "Cuentas que dentroron con una clau de paso más curta que a longaria minima. Nomás o navegador sabe quán larga ye una clau de paso, asinas que informa d'una curta dimpués de dentrar; a clau de paso y a suya longaria nunca no salen d'ell. Apanyau ye quan se cambió a clau de paso d'a cuenta - una cuenta que torna a dentrar con una clau de paso curta se torna a amostrar como masiau curta.",
+  "password-length-no-results": "No i hai cuentas aquí.",
+  "password-length-first-login": "Primer acceso",
+  "password-length-last-login": "Zaguer acceso",
+  "password-length-login-count": "Vegadas que ha dentrau",
+  "password-length-fixed": "Apanyau",
+  "password-length-filter-short": "Clau de paso masiau curta",
+  "password-length-filter-fixed": "Apanyau con una clau de paso prou larga",
+  "password-length-filter-all": "Totz",
+  "password-min-length": "Longaria minima d'a clau de paso",
+  "password-min-length-description": "Dentrar con una clau de paso más curta se lista aquí baixo. Nunca no se refusa l'acceso por ixo.",
+  "password-min-length-enforce": "Fer cumplir a longaria minima",
+  "password-min-length-enforce-description": "Se refusa una nueva clau de paso más curta, y una cuenta que dentra con una clau de paso más curta ha de cambiar-la antes que cosa más. Cambiar-la zarra totas as sesions d'a cuenta. As claus de paso de LDAP, OAuth2, OIDC, SAML, CAS y Sandstorm son d'o suyo proveyedor, y no se comprebán.",
+  "password-length-saved": "Alzau.",
+  "password-length-from-environment": "Ye en vigor una valor definida en l'entorno d'o servidor; alzar aquí la sobrescribe.",
+  "password-change-required-title": "Cambia a tuya clau de paso",
+  "password-change-required-text": "Iste puesto requiere agora claus de paso de a lo menos __min__ caracters, y a tuya ye más curta. Tría-ne una más larga pa continar. Dimpués se zarran totas as sesions d'a tuya cuenta, y tornas a dentrar con a nueva clau de paso.",
+  "password-same-as-username": "La clau de paso no puede estar o nombre d'usuario ni l'adreza de correu electronico.",
   "if-you-already-have-an-account": "Si ya tiens una cuenta",
   "register": "Rechistrar-se",
   "forgot-password": "He xublidau a clau de paso",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Ventana de fallos (segundos)",
   "accounts-lockout-settings-updated": "La configuración de protección de fuerza bruta s'ha actualizado",
   "accounts-lockout-locked-users": "Usuarios bloqueados",
+  "admin-audit-log": "Rechistro d'auditoría",
+  "admin-audit-log-info": "Lo que han feito os administradors d'o sitio: cambeos d'usuarios, d'inicio de sesión, d'almagazenamiento y de copias de seguridat, os mas recients primero. As claus de paso y os secretos no se rechistran nunca. Se conserva un anyo.",
+  "admin-audit-log-when": "Quan",
+  "admin-audit-log-who": "Administrador",
+  "admin-audit-log-action": "Acción",
+  "admin-audit-log-details": "Detalles",
+  "admin-audit-log-empty": "Encara no s'ha rechistrau cosa.",
   "accounts-lockout-locked-users-info": "Usuarios blocaus actualment por masiaus intentos fallius d'iniciar sesión",
   "accounts-lockout-no-locked-users": "Actualment no i hai usuarios blocaus",
   "accounts-lockout-failed-attempts": "Intentos fallidos",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "Almagazenamiento d’obchectos compatible con S3: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces y atros.",
   "s3-force-path-style": "Forzar URLs de estilo de ruta",
   "s3-force-path-style-description": "Requerido por MinIO y la mayoría de os servidores compatibles con S3 que no son de AWS.",
+  "s3-sse": "Cifrau en o servidor",
+  "s3-sse-none": "Garra demandau (o valor por defecto d'o bucket)",
+  "s3-sse-description": "S3 cifra cada adchunto, avatar y copia de seguridat que escribe WeKan, y lo descifra pa WeKan quan se leye.",
+  "s3-sse-kms-key-id": "ID d'a clau KMS pa SSE-KMS (vuedo = la clau por defecto d'a cuenta)",
   "azure-blob-storage": "Almagazenamiento Azure Blob",
   "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
   "azure-account-name": "Nombre de cuenta",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Escaneye iste codigo QR con una app d'autenticación (per eixemplo, Google Authenticator, Authy), dimpués introduzca lo codigo de 6 digitos que s'amuestra ta confirmar.",
   "twoFactorAuth-manual-entry": "U introduzca iste codigo manualment: ",
   "twoFactorAuth-confirm": "Confirmar y Activar",
+  "two-factor-required-title": "Configura l'autenticación de dos factors",
+  "two-factor-required-text": "Iste sitio requiere l'autenticación de dos factors pa la tuya cuenta. Configura-la pa continar.",
   "twoFactorCode-prompt": "Introduzca lo suyo codigo d'autenticación de 6 digitos",
   "twoFactorCode-submit": "Verificar",
   "twoFactorCode-cancel": "Cancelar",

imports/i18n/data/ar-DZ.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "السرعة",
   "progress": "التقدّم",
   "password-again": "كلمة المرور (مرة أخرى)",
+  "password-pwned": "ظهرت كلمة المرور هذه في تسريب بيانات. اختر كلمة مرور أخرى.",
+  "password-too-short": "يجب ألا يقل طول كلمة المرور عن __min__ حرفًا.",
+  "password-length-report-title": "طول كلمة المرور",
+  "password-length-report-desc": "الحسابات التي سجّلت الدخول بكلمة مرور أقصر من الحد الأدنى للطول. المتصفح وحده يعرف طول كلمة المرور، لذا فهو يُبلغ عن الكلمة القصيرة بعد تسجيل الدخول؛ ولا تغادره كلمة المرور ولا طولها أبدًا. «تم الإصلاح» هو وقت تغيير كلمة مرور الحساب - والحساب الذي يسجّل الدخول بكلمة مرور قصيرة مرة أخرى يُعرض مجددًا على أنه قصير جدًا.",
+  "password-length-no-results": "لا توجد حسابات هنا.",
+  "password-length-first-login": "أول تسجيل دخول",
+  "password-length-last-login": "آخر تسجيل دخول",
+  "password-length-login-count": "عدد مرات تسجيل الدخول",
+  "password-length-fixed": "تم الإصلاح",
+  "password-length-filter-short": "كلمة مرور قصيرة جدًا",
+  "password-length-filter-fixed": "تم الإصلاح إلى كلمة مرور بطول كافٍ",
+  "password-length-filter-all": "الكل",
+  "password-min-length": "الحد الأدنى لطول كلمة المرور",
+  "password-min-length-description": "يُدرَج أدناه تسجيل الدخول بكلمة مرور أقصر. ولا يُرفض تسجيل الدخول أبدًا بسبب ذلك.",
+  "password-min-length-enforce": "فرض الحد الأدنى للطول",
+  "password-min-length-enforce-description": "تُرفض كلمة المرور الجديدة الأقصر، ويجب على الحساب الذي يسجّل الدخول بكلمة مرور أقصر تغييرها قبل أي شيء آخر. يؤدي تغييرها إلى تسجيل خروج جميع جلسات الحساب. كلمات مرور LDAP وOAuth2 وOIDC وSAML وCAS وSandstorm تخص مزوّديها، ولا يتم فحصها.",
+  "password-length-saved": "تم الحفظ.",
+  "password-length-from-environment": "هناك قيمة مضبوطة في بيئة الخادم سارية المفعول؛ الحفظ هنا يتجاوزها.",
+  "password-change-required-title": "غيّر كلمة المرور",
+  "password-change-required-text": "يتطلب هذا الموقع الآن كلمات مرور لا تقل عن __min__ حرفًا، وكلمة مرورك أقصر. اختر كلمة أطول للمتابعة. بعد ذلك يتم تسجيل خروج جميع جلسات حسابك، وتسجّل الدخول مرة أخرى بكلمة المرور الجديدة.",
+  "password-same-as-username": "يجب ألا تكون كلمة المرور هي اسم المستخدم أو عنوان البريد الإلكتروني.",
   "if-you-already-have-an-account": "إذا كان لديك حساب بالفعل",
   "register": "تسجيل",
   "forgot-password": "نسيت كلمة المرور",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "نافذة الإخفاق (بالثواني)",
   "accounts-lockout-settings-updated": "تم تحديث إعدادات الحماية من القوة الغاشمة",
   "accounts-lockout-locked-users": "المستخدمون المقفلون",
+  "admin-audit-log": "سجل التدقيق",
+  "admin-audit-log-info": "ما قام به مديرو الموقع: تغييرات المستخدمين وتسجيل الدخول والتخزين والنسخ الاحتياطي، الأحدث أولاً. لا تُسجَّل كلمات المرور والأسرار أبدًا. يُحتفَظ به لمدة سنة.",
+  "admin-audit-log-when": "الوقت",
+  "admin-audit-log-who": "المدير",
+  "admin-audit-log-action": "الإجراء",
+  "admin-audit-log-details": "التفاصيل",
+  "admin-audit-log-empty": "لم يُسجَّل شيء بعد.",
   "accounts-lockout-locked-users-info": "المستخدمون المقفلون حالياً بسبب عدد كبير جداً من محاولات تسجيل الدخول الفاشلة",
   "accounts-lockout-no-locked-users": "لا يوجد حالياً مستخدمون مقفلون",
   "accounts-lockout-failed-attempts": "المحاولات الفاشلة",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "تخزين كائنات متوافق مع S3: AWS S3، MinIO، Cloudflare R2، Backblaze B2، Wasabi، DigitalOcean Spaces وغيرها.",
   "s3-force-path-style": "فرض روابط بنمط المسار (path-style)",
   "s3-force-path-style-description": "مطلوب لـ MinIO ومعظم الخوادم المتوافقة مع S3 غير التابعة لـ AWS.",
+  "s3-sse": "التشفير من جانب الخادم",
+  "s3-sse-none": "لم يُطلب أي تشفير (الإعداد الافتراضي للحاوية)",
+  "s3-sse-description": "يشفّر S3 كل مرفق وصورة رمزية ونسخة احتياطية يكتبها WeKan، ويفك تشفيرها لـ WeKan عند قراءتها.",
+  "s3-sse-kms-key-id": "معرّف مفتاح KMS لـ SSE-KMS (فارغ = المفتاح الافتراضي للحساب)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "تخزين Microsoft Azure Blob.",
   "azure-account-name": "اسم الحساب",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "امسح رمز QR هذا باستخدام تطبيق مصادقة (مثل Google Authenticator أو Authy)، ثم أدخل الرمز المكوّن من 6 أرقام الظاهر للتأكيد.",
   "twoFactorAuth-manual-entry": "أو أدخل هذا الرمز يدويًا: ",
   "twoFactorAuth-confirm": "تأكيد وتفعيل",
+  "two-factor-required-title": "إعداد المصادقة الثنائية",
+  "two-factor-required-text": "يتطلب هذا الموقع المصادقة الثنائية لحسابك. قم بإعدادها للمتابعة.",
   "twoFactorCode-prompt": "أدخل رمز المصادقة المكوّن من 6 أرقام",
   "twoFactorCode-submit": "تحقق",
   "twoFactorCode-cancel": "إلغاء",

imports/i18n/data/ar-EG.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "السرعة",
   "progress": "التقدّم",
   "password-again": "كلمة المرور (مرة أخرى)",
+  "password-pwned": "ظهرت كلمة المرور هذه في تسريب بيانات. اختر كلمة مرور أخرى.",
+  "password-too-short": "يجب ألا يقل طول كلمة المرور عن __min__ حرفًا.",
+  "password-length-report-title": "طول كلمة المرور",
+  "password-length-report-desc": "الحسابات التي سجّلت الدخول بكلمة مرور أقصر من الحد الأدنى للطول. المتصفح وحده يعرف طول كلمة المرور، لذا فهو يُبلغ عن الكلمة القصيرة بعد تسجيل الدخول؛ ولا تغادره كلمة المرور ولا طولها أبدًا. «تم الإصلاح» هو وقت تغيير كلمة مرور الحساب - والحساب الذي يسجّل الدخول بكلمة مرور قصيرة مرة أخرى يُعرض مجددًا على أنه قصير جدًا.",
+  "password-length-no-results": "لا توجد حسابات هنا.",
+  "password-length-first-login": "أول تسجيل دخول",
+  "password-length-last-login": "آخر تسجيل دخول",
+  "password-length-login-count": "عدد مرات تسجيل الدخول",
+  "password-length-fixed": "تم الإصلاح",
+  "password-length-filter-short": "كلمة مرور قصيرة جدًا",
+  "password-length-filter-fixed": "تم الإصلاح إلى كلمة مرور بطول كافٍ",
+  "password-length-filter-all": "الكل",
+  "password-min-length": "الحد الأدنى لطول كلمة المرور",
+  "password-min-length-description": "يُدرَج أدناه تسجيل الدخول بكلمة مرور أقصر. ولا يُرفض تسجيل الدخول أبدًا بسبب ذلك.",
+  "password-min-length-enforce": "فرض الحد الأدنى للطول",
+  "password-min-length-enforce-description": "تُرفض كلمة المرور الجديدة الأقصر، ويجب على الحساب الذي يسجّل الدخول بكلمة مرور أقصر تغييرها قبل أي شيء آخر. يؤدي تغييرها إلى تسجيل خروج جميع جلسات الحساب. كلمات مرور LDAP وOAuth2 وOIDC وSAML وCAS وSandstorm تخص مزوّديها، ولا يتم فحصها.",
+  "password-length-saved": "تم الحفظ.",
+  "password-length-from-environment": "هناك قيمة مضبوطة في بيئة الخادم سارية المفعول؛ الحفظ هنا يتجاوزها.",
+  "password-change-required-title": "غيّر كلمة المرور",
+  "password-change-required-text": "يتطلب هذا الموقع الآن كلمات مرور لا تقل عن __min__ حرفًا، وكلمة مرورك أقصر. اختر كلمة أطول للمتابعة. بعد ذلك يتم تسجيل خروج جميع جلسات حسابك، وتسجّل الدخول مرة أخرى بكلمة المرور الجديدة.",
+  "password-same-as-username": "يجب ألا تكون كلمة المرور هي اسم المستخدم أو عنوان البريد الإلكتروني.",
   "if-you-already-have-an-account": "إذا كان لديك حساب بالفعل",
   "register": "تسجيل",
   "forgot-password": "نسيت كلمة المرور",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "نافذة الإخفاق (بالثواني)",
   "accounts-lockout-settings-updated": "تم تحديث إعدادات الحماية من القوة الغاشمة",
   "accounts-lockout-locked-users": "المستخدمون المقفلون",
+  "admin-audit-log": "سجل التدقيق",
+  "admin-audit-log-info": "ما قام به مديرو الموقع: تغييرات المستخدمين وتسجيل الدخول والتخزين والنسخ الاحتياطي، الأحدث أولاً. لا تُسجَّل كلمات المرور والأسرار أبدًا. يُحتفَظ به لمدة سنة.",
+  "admin-audit-log-when": "الوقت",
+  "admin-audit-log-who": "المدير",
+  "admin-audit-log-action": "الإجراء",
+  "admin-audit-log-details": "التفاصيل",
+  "admin-audit-log-empty": "لم يُسجَّل شيء بعد.",
   "accounts-lockout-locked-users-info": "المستخدمون المقفلون حالياً بسبب عدد كبير جداً من محاولات تسجيل الدخول الفاشلة",
   "accounts-lockout-no-locked-users": "لا يوجد حالياً مستخدمون مقفلون",
   "accounts-lockout-failed-attempts": "المحاولات الفاشلة",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "تخزين كائنات متوافق مع S3: AWS S3، MinIO، Cloudflare R2، Backblaze B2، Wasabi، DigitalOcean Spaces وغيرها.",
   "s3-force-path-style": "فرض روابط بنمط المسار (path-style)",
   "s3-force-path-style-description": "مطلوب لـ MinIO ومعظم الخوادم المتوافقة مع S3 غير التابعة لـ AWS.",
+  "s3-sse": "التشفير من جانب الخادم",
+  "s3-sse-none": "لم يُطلب أي تشفير (الإعداد الافتراضي للحاوية)",
+  "s3-sse-description": "يشفّر S3 كل مرفق وصورة رمزية ونسخة احتياطية يكتبها WeKan، ويفك تشفيرها لـ WeKan عند قراءتها.",
+  "s3-sse-kms-key-id": "معرّف مفتاح KMS لـ SSE-KMS (فارغ = المفتاح الافتراضي للحساب)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "تخزين Microsoft Azure Blob.",
   "azure-account-name": "اسم الحساب",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "امسح رمز QR هذا باستخدام تطبيق مصادقة (مثل Google Authenticator أو Authy)، ثم أدخل الرمز المكوّن من 6 أرقام الظاهر للتأكيد.",
   "twoFactorAuth-manual-entry": "أو أدخل هذا الرمز يدويًا: ",
   "twoFactorAuth-confirm": "تأكيد وتفعيل",
+  "two-factor-required-title": "إعداد المصادقة الثنائية",
+  "two-factor-required-text": "يتطلب هذا الموقع المصادقة الثنائية لحسابك. قم بإعدادها للمتابعة.",
   "twoFactorCode-prompt": "أدخل رمز المصادقة المكوّن من 6 أرقام",
   "twoFactorCode-submit": "تحقق",
   "twoFactorCode-cancel": "إلغاء",

imports/i18n/data/ar.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "السرعة",
   "progress": "التقدّم",
   "password-again": "كلمة المرور (مرة أخرى)",
+  "password-pwned": "ظهرت كلمة المرور هذه في تسريب بيانات. اختر كلمة مرور أخرى.",
+  "password-too-short": "يجب ألا يقل طول كلمة المرور عن __min__ حرفًا.",
+  "password-length-report-title": "طول كلمة المرور",
+  "password-length-report-desc": "الحسابات التي سجّلت الدخول بكلمة مرور أقصر من الحد الأدنى للطول. المتصفح وحده يعرف طول كلمة المرور، لذا فهو يُبلغ عن الكلمة القصيرة بعد تسجيل الدخول؛ ولا تغادره كلمة المرور ولا طولها أبدًا. «تم الإصلاح» هو وقت تغيير كلمة مرور الحساب - والحساب الذي يسجّل الدخول بكلمة مرور قصيرة مرة أخرى يُعرض مجددًا على أنه قصير جدًا.",
+  "password-length-no-results": "لا توجد حسابات هنا.",
+  "password-length-first-login": "أول تسجيل دخول",
+  "password-length-last-login": "آخر تسجيل دخول",
+  "password-length-login-count": "عدد مرات تسجيل الدخول",
+  "password-length-fixed": "تم الإصلاح",
+  "password-length-filter-short": "كلمة مرور قصيرة جدًا",
+  "password-length-filter-fixed": "تم الإصلاح إلى كلمة مرور بطول كافٍ",
+  "password-length-filter-all": "الكل",
+  "password-min-length": "الحد الأدنى لطول كلمة المرور",
+  "password-min-length-description": "يُدرَج أدناه تسجيل الدخول بكلمة مرور أقصر. ولا يُرفض تسجيل الدخول أبدًا بسبب ذلك.",
+  "password-min-length-enforce": "فرض الحد الأدنى للطول",
+  "password-min-length-enforce-description": "تُرفض كلمة المرور الجديدة الأقصر، ويجب على الحساب الذي يسجّل الدخول بكلمة مرور أقصر تغييرها قبل أي شيء آخر. يؤدي تغييرها إلى تسجيل خروج جميع جلسات الحساب. كلمات مرور LDAP وOAuth2 وOIDC وSAML وCAS وSandstorm تخص مزوّديها، ولا يتم فحصها.",
+  "password-length-saved": "تم الحفظ.",
+  "password-length-from-environment": "هناك قيمة مضبوطة في بيئة الخادم سارية المفعول؛ الحفظ هنا يتجاوزها.",
+  "password-change-required-title": "غيّر كلمة المرور",
+  "password-change-required-text": "يتطلب هذا الموقع الآن كلمات مرور لا تقل عن __min__ حرفًا، وكلمة مرورك أقصر. اختر كلمة أطول للمتابعة. بعد ذلك يتم تسجيل خروج جميع جلسات حسابك، وتسجّل الدخول مرة أخرى بكلمة المرور الجديدة.",
+  "password-same-as-username": "يجب ألا تكون كلمة المرور هي اسم المستخدم أو عنوان البريد الإلكتروني.",
   "if-you-already-have-an-account": "إذا كان لديك حساب بالفعل",
   "register": "تسجيل",
   "forgot-password": "نسيت كلمة المرور",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "نافذة الإخفاق (بالثواني)",
   "accounts-lockout-settings-updated": "تم تحديث إعدادات الحماية من القوة الغاشمة",
   "accounts-lockout-locked-users": "المستخدمون المقفلون",
+  "admin-audit-log": "سجل التدقيق",
+  "admin-audit-log-info": "ما قام به مديرو الموقع: تغييرات المستخدمين وتسجيل الدخول والتخزين والنسخ الاحتياطي، الأحدث أولاً. لا تُسجَّل كلمات المرور والأسرار أبدًا. يُحتفَظ به لمدة سنة.",
+  "admin-audit-log-when": "الوقت",
+  "admin-audit-log-who": "المدير",
+  "admin-audit-log-action": "الإجراء",
+  "admin-audit-log-details": "التفاصيل",
+  "admin-audit-log-empty": "لم يُسجَّل شيء بعد.",
   "accounts-lockout-locked-users-info": "المستخدمون المقفلون حالياً بسبب عدد كبير جداً من محاولات تسجيل الدخول الفاشلة",
   "accounts-lockout-no-locked-users": "لا يوجد حالياً مستخدمون مقفلون",
   "accounts-lockout-failed-attempts": "المحاولات الفاشلة",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "تخزين كائنات متوافق مع S3: AWS S3، MinIO، Cloudflare R2، Backblaze B2، Wasabi، DigitalOcean Spaces وغيرها.",
   "s3-force-path-style": "فرض روابط بنمط المسار (path-style)",
   "s3-force-path-style-description": "مطلوب لـ MinIO ومعظم الخوادم المتوافقة مع S3 غير التابعة لـ AWS.",
+  "s3-sse": "التشفير من جانب الخادم",
+  "s3-sse-none": "لم يُطلب أي تشفير (الإعداد الافتراضي للحاوية)",
+  "s3-sse-description": "يشفّر S3 كل مرفق وصورة رمزية ونسخة احتياطية يكتبها WeKan، ويفك تشفيرها لـ WeKan عند قراءتها.",
+  "s3-sse-kms-key-id": "معرّف مفتاح KMS لـ SSE-KMS (فارغ = المفتاح الافتراضي للحساب)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "تخزين Microsoft Azure Blob.",
   "azure-account-name": "اسم الحساب",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "امسح رمز QR هذا باستخدام تطبيق مصادقة (مثل Google Authenticator أو Authy)، ثم أدخل الرمز المكوّن من 6 أرقام الظاهر للتأكيد.",
   "twoFactorAuth-manual-entry": "أو أدخل هذا الرمز يدويًا: ",
   "twoFactorAuth-confirm": "تأكيد وتفعيل",
+  "two-factor-required-title": "إعداد المصادقة الثنائية",
+  "two-factor-required-text": "يتطلب هذا الموقع المصادقة الثنائية لحسابك. قم بإعدادها للمتابعة.",
   "twoFactorCode-prompt": "أدخل رمز المصادقة المكوّن من 6 أرقام",
   "twoFactorCode-submit": "تحقق",
   "twoFactorCode-cancel": "إلغاء",

imports/i18n/data/ary.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "السرعة",
   "progress": "التقدّم",
   "password-again": "كلمة المرور (مرة أخرى)",
+  "password-pwned": "هاد كلمة المرور بانت فشي تسريب ديال البيانات. ختار شي وحدة أخرى.",
+  "password-too-short": "خاص كلمة المرور يكون فيها على الأقل __min__ حروف.",
+  "password-length-report-title": "الطول ديال كلمة المرور",
+  "password-length-report-desc": "الحسابات اللي دخلات بكلمة مرور قصيرة على الطول الأدنى. غير المتصفح اللي كيعرف شحال طويلة كلمة المرور، داكشي علاش كيبلّغ على القصيرة من بعد الدخول؛ كلمة المرور والطول ديالها عمرهم ما كيخرجو منو. «تصلّح» هو الوقت اللي تبدّلات فيه كلمة المرور ديال الحساب - والحساب اللي كيدخل عاوتاني بكلمة مرور قصيرة كيبان عاوتاني قصير بزاف.",
+  "password-length-no-results": "ما كاين حتى حساب هنا.",
+  "password-length-first-login": "أول دخول",
+  "password-length-last-login": "آخر دخول",
+  "password-length-login-count": "شحال من مرة دخل",
+  "password-length-fixed": "تصلّح",
+  "password-length-filter-short": "كلمة مرور قصيرة بزاف",
+  "password-length-filter-fixed": "تصلّح لكلمة مرور طويلة بما فيه الكفاية",
+  "password-length-filter-all": "كلشي",
+  "password-min-length": "الطول الأدنى ديال كلمة المرور",
+  "password-min-length-description": "الدخول بكلمة مرور قصيرة كيتسجّل لتحت. والدخول عمرو ما كيترفض على قبلها.",
+  "password-min-length-enforce": "فرض الطول الأدنى",
+  "password-min-length-enforce-description": "كلمة المرور الجديدة القصيرة كاتترفض، والحساب اللي كيدخل بكلمة مرور قصيرة خاصو يبدّلها قبل أي حاجة أخرى. التبديل ديالها كيخرّج كاع الجلسات ديال الحساب. كلمات المرور ديال LDAP وOAuth2 وOIDC وSAML وCAS وSandstorm ديال المزوّد ديالهم، وما كاتّفحصش.",
+  "password-length-saved": "تسجّل.",
+  "password-length-from-environment": "كاينة قيمة محطوطة فالبيئة ديال السيرفر خدّامة دابا؛ التسجيل هنا كيعوّضها.",
+  "password-change-required-title": "بدّل كلمة المرور ديالك",
+  "password-change-required-text": "هاد الموقع دابا كيطلب كلمات مرور فيها على الأقل __min__ حروف، وديالك قصيرة. ختار وحدة أطول باش تكمّل. من بعد كاع الجلسات ديال الحساب ديالك كيتخرّجو، وكتدخل عاوتاني بكلمة المرور الجديدة.",
+  "password-same-as-username": "كلمة المرور ما خاصهاش تكون هي اسم المستخدم ولا عنوان البريد الإلكتروني.",
   "if-you-already-have-an-account": "إذا كان لديك حساب بالفعل",
   "register": "تسجيل",
   "forgot-password": "نسيت كلمة المرور",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "نافذة الإخفاق (بالثواني)",
   "accounts-lockout-settings-updated": "تم تحديث إعدادات الحماية من القوة الغاشمة",
   "accounts-lockout-locked-users": "المستخدمون المقفلون",
+  "admin-audit-log": "سجل التدقيق",
+  "admin-audit-log-info": "شنو دارو المسيرين ديال الموقع: التبديلات ديال المستخدمين، الدخول، التخزين والنسخ الاحتياطي، الجديد هو اللول. كلمات المرور والأسرار عمرهم ما كيتسجلو. كيتحفظ لمدة عام.",
+  "admin-audit-log-when": "إمتى",
+  "admin-audit-log-who": "المدير",
+  "admin-audit-log-action": "الإجراء",
+  "admin-audit-log-details": "التفاصيل",
+  "admin-audit-log-empty": "مازال ما تسجل والو.",
   "accounts-lockout-locked-users-info": "المستخدمون المقفلون حالياً بسبب عدد كبير جداً من محاولات تسجيل الدخول الفاشلة",
   "accounts-lockout-no-locked-users": "لا يوجد حالياً مستخدمون مقفلون",
   "accounts-lockout-failed-attempts": "المحاولات الفاشلة",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "تخزين كائنات متوافق مع S3: AWS S3، MinIO، Cloudflare R2، Backblaze B2، Wasabi، DigitalOcean Spaces وغيرها.",
   "s3-force-path-style": "فرض روابط بنمط المسار (path-style)",
   "s3-force-path-style-description": "مطلوب لـ MinIO ومعظم الخوادم المتوافقة مع S3 غير التابعة لـ AWS.",
+  "s3-sse": "التشفير من جهة الخادم",
+  "s3-sse-none": "ما مطلوب والو (الإعداد الافتراضي ديال الحاوية)",
+  "s3-sse-description": "S3 كيشفر كل مرفق، صورة رمزية ونسخة احتياطية كيكتبها WeKan، وكيفك التشفير ديالها لـ WeKan ملي كتتقرا.",
+  "s3-sse-kms-key-id": "معرف مفتاح KMS لـ SSE-KMS (خاوي = المفتاح الافتراضي ديال الحساب)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "تخزين Microsoft Azure Blob.",
   "azure-account-name": "اسم الحساب",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "امسح رمز QR هذا باستخدام تطبيق مصادقة (مثل Google Authenticator أو Authy)، ثم أدخل الرمز المكوّن من 6 أرقام الظاهر للتأكيد.",
   "twoFactorAuth-manual-entry": "أو أدخل هذا الرمز يدويًا: ",
   "twoFactorAuth-confirm": "تأكيد وتفعيل",
+  "two-factor-required-title": "وجّد المصادقة الثنائية",
+  "two-factor-required-text": "هاد الموقع كيطلب المصادقة الثنائية للحساب ديالك. وجّدها باش تكمل.",
   "twoFactorCode-prompt": "أدخل رمز المصادقة المكوّن من 6 أرقام",
   "twoFactorCode-submit": "تحقق",
   "twoFactorCode-cancel": "إلغاء",

imports/i18n/data/as.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "গতি",
   "progress": "অগ্ৰগতি",
   "password-again": "পাছৱৰ্ড (পুনৰ)",
+  "password-pwned": "এই পাছৱৰ্ডটো এটা তথ্য ফাদিলত দেখা গৈছে। আন এটা বাছনি কৰক।",
+  "password-too-short": "পাছৱৰ্ডটো অতি কমেও __min__ টা আখৰৰ হ'ব লাগিব।",
+  "password-length-report-title": "পাছৱৰ্ডৰ দৈৰ্ঘ্য",
+  "password-length-report-desc": "নিম্নতম দৈৰ্ঘ্যতকৈ চুটি পাছৱৰ্ডেৰে লগ ইন কৰা একাউণ্টসমূহ। পাছৱৰ্ড কিমান দীঘল সেয়া কেৱল ব্ৰাউজাৰেহে জানে, সেয়েহে ই লগ ইনৰ পিছত চুটি পাছৱৰ্ডৰ বিষয়ে জনায়; পাছৱৰ্ড আৰু ইয়াৰ দৈৰ্ঘ্য কেতিয়াও ব্ৰাউজাৰৰ পৰা ওলাই নাযায়। সমাধান হৈছে মানে একাউণ্টৰ পাছৱৰ্ড সলনি কৰাৰ সময় - পুনৰ চুটি পাছৱৰ্ডেৰে লগ ইন কৰা একাউণ্ট পুনৰ অতি চুটি বুলি দেখুওৱা হয়।",
+  "password-length-no-results": "ইয়াত কোনো একাউণ্ট নাই।",
+  "password-length-first-login": "প্ৰথম লগ ইন",
+  "password-length-last-login": "শেষ লগ ইন",
+  "password-length-login-count": "লগ ইন কৰাৰ সংখ্যা",
+  "password-length-fixed": "সমাধান হৈছে",
+  "password-length-filter-short": "অতি চুটি পাছৱৰ্ড",
+  "password-length-filter-fixed": "যথেষ্ট দীঘল পাছৱৰ্ডলৈ সমাধান হৈছে",
+  "password-length-filter-all": "সকলো",
+  "password-min-length": "নিম্নতম পাছৱৰ্ড দৈৰ্ঘ্য",
+  "password-min-length-description": "চুটি পাছৱৰ্ডেৰে লগ ইন কৰাটো তলত তালিকাভুক্ত কৰা হয়। ইয়াৰ বাবে লগ ইন কেতিয়াও নাকচ কৰা নহয়।",
+  "password-min-length-enforce": "নিম্নতম দৈৰ্ঘ্য বাধ্যতামূলক কৰক",
+  "password-min-length-enforce-description": "চুটি নতুন পাছৱৰ্ড নাকচ কৰা হয়, আৰু চুটি পাছৱৰ্ডেৰে লগ ইন কৰা একাউণ্টে আন যিকোনো কামৰ আগতে ইয়াক সলনি কৰিব লাগিব। ইয়াক সলনি কৰিলে একাউণ্টৰ সকলো ছেছন লগ আউট হয়। LDAP, OAuth2, OIDC, SAML, CAS আৰু Sandstorm পাছৱৰ্ডসমূহ সিহঁতৰ প্ৰদানকাৰীৰ, আৰু পৰীক্ষা কৰা নহয়।",
+  "password-length-saved": "সংৰক্ষিত।",
+  "password-length-from-environment": "ছাৰ্ভাৰৰ পৰিৱেশত ছেট কৰা এটা মান কাৰ্যকৰী হৈ আছে; ইয়াত সংৰক্ষণ কৰিলে সেয়া অগ্ৰাহ্য হয়।",
+  "password-change-required-title": "আপোনাৰ পাছৱৰ্ড সলনি কৰক",
+  "password-change-required-text": "এই চাইটে এতিয়া অতি কমেও __min__ টা আখৰৰ পাছৱৰ্ড বিচাৰে, আৰু আপোনাৰটো চুটি। আগবাঢ়িবলৈ এটা দীঘল পাছৱৰ্ড বাছক। তাৰ পিছত আপোনাৰ একাউণ্টৰ সকলো ছেছন লগ আউট হয়, আৰু আপুনি নতুন পাছৱৰ্ডেৰে পুনৰ লগ ইন কৰে।",
+  "password-same-as-username": "পাছৱৰ্ডটো ব্যৱহাৰকাৰীৰ নাম বা ইমেইল ঠিকনা হ'ব নালাগে।",
   "if-you-already-have-an-account": "যদি আপোনাৰ ইতিমধ্যে একাউণ্ট আছে",
   "register": "পঞ্জীয়ন কৰক",
   "forgot-password": "পাছৱৰ্ড পাহৰিছে",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "বিফলতাৰ সময়-খিৰিকী (ছেকেণ্ড)",
   "accounts-lockout-settings-updated": "ব্ৰুট ফ'ৰ্চ সুৰক্ষাৰ ছেটিংছ আপডেট কৰা হৈছে",
   "accounts-lockout-locked-users": "লক কৰা ব্যৱহাৰকাৰীসকল",
+  "admin-audit-log": "নিৰীক্ষণ লগ",
+  "admin-audit-log-info": "ছাইটৰ প্ৰশাসকসকলে কি কৰিছিল: ব্যৱহাৰকাৰী, লগইন, সংৰক্ষণ আৰু বেকআপৰ সলনি, শেহতীয়াখিনি প্ৰথমে। পাছৱৰ্ড আৰু গোপন তথ্য কেতিয়াও ৰেকৰ্ড কৰা নহয়। এবছৰৰ বাবে ৰখা হয়।",
+  "admin-audit-log-when": "কেতিয়া",
+  "admin-audit-log-who": "প্ৰশাসক",
+  "admin-audit-log-action": "কাৰ্য",
+  "admin-audit-log-details": "সবিশেষ",
+  "admin-audit-log-empty": "এতিয়ালৈকে একো ৰেকৰ্ড কৰা হোৱা নাই।",
   "accounts-lockout-locked-users-info": "অত্যধিক বিফল লগইন প্ৰচেষ্টাৰ বাবে বৰ্তমান লক কৰা ব্যৱহাৰকাৰীসকল",
   "accounts-lockout-no-locked-users": "বৰ্তমান কোনো লক কৰা ব্যৱহাৰকাৰী নাই",
   "accounts-lockout-failed-attempts": "বিফল প্ৰচেষ্টাসমূহ",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "S3-সামঞ্জস্যপূৰ্ণ অবজেক্ট সংৰক্ষণ: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces আৰু অন্যান্য।",
   "s3-force-path-style": "পথ-শৈলীৰ URL বাধ্যতামূলক কৰক",
   "s3-force-path-style-description": "MinIO আৰু অধিকাংশ AWS-বহিৰ্ভূত S3-সুসংগত ছাৰ্ভাৰৰ বাবে প্ৰয়োজনীয়।",
+  "s3-sse": "ছাৰ্ভাৰ-পক্ষৰ এনক্ৰিপচন",
+  "s3-sse-none": "একো অনুৰোধ কৰা হোৱা নাই (বাকেটৰ অবিকল্পিত)",
+  "s3-sse-description": "WeKan-এ লিখা প্ৰতিটো সংলগ্ন, অৱতাৰ আৰু বেকআপ S3-এ এনক্ৰিপ্ট কৰে, আৰু পঢ়োঁতে WeKan-ৰ বাবে ডিক্ৰিপ্ট কৰে।",
+  "s3-sse-kms-key-id": "SSE-KMS-ৰ বাবে KMS চাবিৰ ID (খালী = একাউণ্টৰ অবিকল্পিত চাবি)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
   "azure-account-name": "একাউণ্টৰ নাম",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "এটা প্ৰমাণীকৰণ এপৰ সৈতে এই QR ক'ডটো স্কেন কৰক (যেনে Google Authenticator, Authy), তাৰ পিছত নিশ্চিত কৰিবলৈ দেখুওৱা 6-অংকীয় ক'ডটো দিয়ক।",
   "twoFactorAuth-manual-entry": "নাইবা এই ক'ডটো হাতেৰে দিয়ক: ",
   "twoFactorAuth-confirm": "নিশ্চিত কৰক আৰু সক্ৰিয় কৰক",
+  "two-factor-required-title": "দুই-উপাদান প্ৰমাণীকৰণ ছেট আপ কৰক",
+  "two-factor-required-text": "এই ছাইটে আপোনাৰ একাউণ্টৰ বাবে দুই-উপাদান প্ৰমাণীকৰণ বিচাৰে। আগবাঢ়িবলৈ ইয়াক ছেট আপ কৰক।",
   "twoFactorCode-prompt": "আপোনাৰ 6-অংকীয় প্ৰমাণীকৰণ ক'ড দিয়ক",
   "twoFactorCode-submit": "নিশ্চিত কৰক",
   "twoFactorCode-cancel": "বাতিল কৰক",

imports/i18n/data/ast-ES.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Velocidad",
   "progress": "Progreso",
   "password-again": "Contraseña (repetir)",
+  "password-pwned": "Esta contraseña apaeció nuna filtración de datos. Escueyi otra.",
+  "password-too-short": "La contraseña tien de tener polo menos __min__ caráuteres.",
+  "password-length-report-title": "Llonxitú de la contraseña",
+  "password-length-report-desc": "Cuentes qu'aniciaron sesión con una contraseña más curtia que la llonxitú mínima. Namás el restolador sabe cuánto mide una contraseña, polo qu'informa d'una curtia dempués d'aniciar sesión; la contraseña y la so llonxitú enxamás nun salen d'él. Iguada ye cuando se camudó la contraseña de la cuenta - una cuenta qu'anicia sesión otra vegada con una contraseña curtia amuésase otra vegada como enforma curtia.",
+  "password-length-no-results": "Equí nun hai cuentes.",
+  "password-length-first-login": "Primer aniciu de sesión",
+  "password-length-last-login": "Últimu aniciu de sesión",
+  "password-length-login-count": "Vegaes qu'anició sesión",
+  "password-length-fixed": "Iguada",
+  "password-length-filter-short": "Contraseña enforma curtia",
+  "password-length-filter-fixed": "Iguada a una contraseña abondo llarga",
+  "password-length-filter-all": "Too",
+  "password-min-length": "Llonxitú mínima de la contraseña",
+  "password-min-length-description": "Aniciar sesión con una contraseña más curtia apaez llistao abaxo. Enxamás nun se refuga l'aniciu de sesión por ello.",
+  "password-min-length-enforce": "Imponer la llonxitú mínima",
+  "password-min-length-enforce-description": "Refúgase una contraseña nueva más curtia, y una cuenta qu'anicia sesión con una contraseña más curtia tien de camudala enantes de cualquier otra cosa. Camudala zarra toles sesiones de la cuenta. Les contraseñes de LDAP, OAuth2, OIDC, SAML, CAS y Sandstorm son del so fornidor y nun se comprueben.",
+  "password-length-saved": "Guardóse.",
+  "password-length-from-environment": "Ta n'efeutu un valor definíu nel entornu del sirvidor; guardar equí sobrescríbelu.",
+  "password-change-required-title": "Camuda la to contraseña",
+  "password-change-required-text": "Esti sitiu agora rique contraseñes de polo menos __min__ caráuteres, y la to ye más curtia. Escueyi una más llarga pa siguir. Dempués zárrense toles sesiones de la to cuenta, y anicies sesión otra vegada cola contraseña nueva.",
+  "password-same-as-username": "La contraseña nun pue ser el nome d'usuariu nin la direición de corréu electrónicu.",
   "if-you-already-have-an-account": "Si ja tens un compte",
   "register": "Registra't",
   "forgot-password": "Has oblidat la contrasenya",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Ventana de fallos (segundos)",
   "accounts-lockout-settings-updated": "Actualizáronse les preferencies de proteición contra ataques de fuercia bruto",
   "accounts-lockout-locked-users": "Usuarios bloquiaos",
+  "admin-audit-log": "Rexistru d'auditoría",
+  "admin-audit-log-info": "Lo que ficieron los alministradores del sitiu: cambeos d'usuarios, d'aniciu de sesión, d'almacenamientu y de copies de seguridá, primero lo más recién. Les contraseñes y los secretos enxamás se rexistren. Caltiénse un añu.",
+  "admin-audit-log-when": "Cuándo",
+  "admin-audit-log-who": "Administrador",
+  "admin-audit-log-action": "Aición",
+  "admin-audit-log-details": "Detalles",
+  "admin-audit-log-empty": "Entá nun se rexistró nada.",
   "accounts-lockout-locked-users-info": "Usuarios bloquiaos anguaño por demasiaos intentos fallíos d'aniciu de sesión",
   "accounts-lockout-no-locked-users": "Anguaño nun hai usuarios bloquiaos",
   "accounts-lockout-failed-attempts": "Intentos fallidos",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "Almacenamientu d'oxetos compatible con S3: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces y otros.",
   "s3-force-path-style": "Forzar URLs con estilu de ruta",
   "s3-force-path-style-description": "Necesariu pa MinIO y la mayoría de los sirvidores compatibles con S3 que nun son d'AWS.",
+  "s3-sse": "Cifráu nel sirvidor",
+  "s3-sse-none": "Nun se pidió nengún (el predetermináu del bucket)",
+  "s3-sse-description": "S3 cifra cada axuntu, avatar y copia de seguridá qu'escribe WeKan, y descífralo pa WeKan al lleelo.",
+  "s3-sse-kms-key-id": "ID de clave KMS pa SSE-KMS (baleru = la clave predeterminada de la cuenta)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Almacenamientu Microsoft Azure Blob.",
   "azure-account-name": "Nome de la cuenta",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Escanea esti códigu QR con una aplicación autenticadora (p. ex. Google Authenticator, Authy), y dempués introduz el códigu de 6 díxitos qu'amuesa pa confirmar.",
   "twoFactorAuth-manual-entry": "O introduz esti códigu manualmente: ",
   "twoFactorAuth-confirm": "Confirmar y Activar",
+  "two-factor-required-title": "Configura l'autenticación de dos factores",
+  "two-factor-required-text": "Esti sitiu rique l'autenticación de dos factores pa la to cuenta. Configúrala pa siguir.",
   "twoFactorCode-prompt": "Introduz el to códigu d'autenticación de 6 díxitos",
   "twoFactorCode-submit": "Verificar",
   "twoFactorCode-cancel": "Encaboxar",

imports/i18n/data/ay.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Aymar aruna: Speed",
   "progress": "Nayrar sartawi",
   "password-again": "jamasaru (again)",
+  "password-pwned": "Aka imantata aruxa mä datos lluqhsuwinwa uñstawayi. Yaqha ajlliñamawa.",
+  "password-too-short": "Imantata aruxa __min__ qillqanakat juk'ampiniwa utjañapa.",
+  "password-length-report-title": "Imantata aru jach'a",
+  "password-length-report-desc": "Jakhuwinaka, imantata aru jisk'ampimpi mantapki, juk'a jach'atxa jisk'akiwa. Navegadorakiw imantata aru qhawqha jach'achixa uk yati, ukatwa mantatat qhipat jisk'a imantata aru yatiyi; imantata aru, jach'apasa janipuniw navegadorat mistki. Askichatawa, jakhuwin imantata arupa mayjt'ayatäki uka pachawa - mayamp jisk'a imantata arumpi mantki uka jakhuwixa mayampiw sinti jisk'jam uñacht'ayasi.",
+  "password-length-no-results": "Akan janiw jakhuwinakax utjkiti.",
+  "password-length-first-login": "Nayrïr mantawi",
+  "password-length-last-login": "Qhipïr mantawi",
+  "password-length-login-count": "Qhawqha kuti mantawi",
+  "password-length-fixed": "Askichata",
+  "password-length-filter-short": "Sinti jisk'a imantata aru",
+  "password-length-filter-fixed": "Jach'a imantata aruru askichata",
+  "password-length-filter-all": "Taqpacha",
+  "password-min-length": "Imantata aru juk'a jach'a",
+  "password-min-length-description": "Jisk'ampi imantata arumpi mantawixa aka manqhan qillqatawa. Mantawixa janipuniw ukatxa jark'atäkiti.",
+  "password-min-length-enforce": "Juk'a jach'a phuqhayaña",
+  "password-min-length-enforce-description": "Machaq jisk'a imantata aruxa janiw katuqatäkiti, ukat jisk'a imantata arumpi mantki uka jakhuwixa yaqha luräwinak nayraqatxa mayjt'ayañapawa. Mayjt'ayañaxa jakhuwin taqpach sesionanakap mistuyi. LDAP, OAuth2, OIDC, SAML, CAS, Sandstorm imantata arunakaxa churirinakapankiwa, janiw uñakipatäkiti.",
+  "password-length-saved": "Imatawa.",
+  "password-length-from-environment": "Servidoran pachapan uskuta chimpuw jichhax irnaqaski; akan imañaxa ukar mayjt'ayi.",
+  "password-change-required-title": "Imantata arum mayjt'ayam",
+  "password-change-required-text": "Aka sitioxa jichhax __min__ qillqanakat juk'ampi imantata arunak mayi, jumanxa jisk'awa. Sarantañatakix juk'amp jach'a ajllim. Ukatxa jakhuwiman taqpach sesionanakapax mistuyatawa, ukat machaq imantata arumpiw mayamp mantäta.",
+  "password-same-as-username": "Imantata aruxa apnaqirin sutipa jan ukax aruskipäwi chiqapa janiw utjañapakiti.",
   "if-you-already-have-an-account": "Aymar aruna: If you already have an account",
   "register": "Qillqantasiña",
   "forgot-password": "Imantata aru armt'ata",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Failure window (segundunaka)",
   "accounts-lockout-settings-updated": "Brute force protection wakichäwinaka have been updated",
   "accounts-lockout-locked-users": "Locked apnaqirinaka",
+  "admin-audit-log": "Uñakipäwi qillqata",
+  "admin-audit-log-info": "Kuntix sitio apnaqirinakax lurapki: apnaqirinaka, mantañanaka, imañanaka ukat jark'aqawi copia mayjt'ayawinaka, machaqanakax nayraqata. Imantata arunaka ukat imantatanakax janipuniw qillqatäkiti. Mä mara imatawa.",
+  "admin-audit-log-when": "Kunawsa",
+  "admin-audit-log-who": "Apnaqañ irpiri",
+  "admin-audit-log-action": "Lurawi",
+  "admin-audit-log-details": "Qhanañchäwinaka",
+  "admin-audit-log-empty": "Janiw kunas qillqatäkiti.",
   "accounts-lockout-locked-users-info": "apnaqirinaka currently locked out tukuyañ ukaru too many jani phuqhata login yantʼawinaka",
   "accounts-lockout-no-locked-users": "There apxi currently janiwa locked apnaqirinaka",
   "accounts-lockout-failed-attempts": "jani phuqhata yantʼawinaka",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "S3 kikip yänak imaña: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces ukat yaqhanaka.",
   "s3-force-path-style": "Aymar aruna: Force path-style URLs",
   "s3-force-path-style-description": "wakisiri by MinIO ukat most non-AWS S3-compatible servers.",
+  "s3-sse": "Servidor tuqin imantaña",
+  "s3-sse-none": "Janiw mayitäkiti (bucket nayrïri)",
+  "s3-sse-description": "S3 ukax sapa chinuta, avatar ukat jark'aqawi copia WeKan qillqki ukanak imantaraki, ullañanx WeKan layku jist'arakiwa.",
+  "s3-sse-kms-key-id": "SSE-KMS layku KMS llave ID (ch'usa = cuenta nayrïri llave)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
   "azure-account-name": "Account suti",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Aka código QR ukar sarayam mä app chiqapachañataki (Google Authenticator, Authy ukhamanaka), ukat 6 jakhu código uñacht'ayatapa yatiyañataki qillqam.",
   "twoFactorAuth-manual-entry": "Jan ukax aka código amparampi qillqam: ",
   "twoFactorAuth-confirm": "Chiqapachaña ukat Apnaqaña",
+  "two-factor-required-title": "Pä Kunayman Chaqañ Chiqapachäwi wakicht'aña",
+  "two-factor-required-text": "Aka sitiox cuentamatakix Pä Kunayman Chaqañ Chiqapachäwi mayi. Sarantañatakix wakicht'am.",
   "twoFactorCode-prompt": "Jumana 6 jakhu chiqapachäwi código qillqam",
   "twoFactorCode-submit": "Chiqapachaña",
   "twoFactorCode-cancel": "Jark'aña",

imports/i18n/data/az-AZ.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Sürət",
   "progress": "Tərəqqi",
   "password-again": "Parol (yenidən)",
+  "password-pwned": "Bu parol məlumat sızmasında aşkar edilib. Başqa parol seçin.",
+  "password-too-short": "Parol ən azı __min__ simvol uzunluğunda olmalıdır.",
+  "password-length-report-title": "Parol uzunluğu",
+  "password-length-report-desc": "Minimum uzunluqdan qısa parolla daxil olan hesablar. Parolun nə qədər uzun olduğunu yalnız brauzer bilir, buna görə daxil olduqdan sonra qısa parol barədə məlumat verir; parol və onun uzunluğu heç vaxt brauzeri tərk etmir. Düzəldildi hesabın parolunun dəyişdirildiyi vaxtdır - yenidən qısa parolla daxil olan hesab yenidən çox qısa kimi göstərilir.",
+  "password-length-no-results": "Burada hesab yoxdur.",
+  "password-length-first-login": "İlk giriş",
+  "password-length-last-login": "Son giriş",
+  "password-length-login-count": "Giriş sayı",
+  "password-length-fixed": "Düzəldildi",
+  "password-length-filter-short": "Çox qısa parol",
+  "password-length-filter-fixed": "Kifayət qədər uzun parola düzəldildi",
+  "password-length-filter-all": "Hamısı",
+  "password-min-length": "Minimum parol uzunluğu",
+  "password-min-length-description": "Daha qısa parolla daxil olmaq aşağıda siyahıya alınır. Buna görə giriş heç vaxt rədd edilmir.",
+  "password-min-length-enforce": "Minimum uzunluğu tətbiq et",
+  "password-min-length-enforce-description": "Daha qısa yeni parol rədd edilir və daha qısa parolla daxil olan hesab hər şeydən əvvəl onu dəyişməlidir. Onu dəyişmək hesabın bütün sessiyalarından çıxış edir. LDAP, OAuth2, OIDC, SAML, CAS və Sandstorm parolları öz provayderlərinə aiddir və yoxlanılmır.",
+  "password-length-saved": "Saxlanıldı.",
+  "password-length-from-environment": "Serverin mühitində təyin edilmiş dəyər qüvvədədir; burada saxlamaq onu əvəz edir.",
+  "password-change-required-title": "Parolunuzu dəyişin",
+  "password-change-required-text": "Bu sayt indi ən azı __min__ simvoldan ibarət parollar tələb edir, sizinki isə daha qısadır. Davam etmək üçün daha uzun birini seçin. Sonra hesabınızın bütün sessiyalarından çıxış edilir və yeni parolla yenidən daxil olursunuz.",
+  "password-same-as-username": "Parol istifadəçi adı və ya e-poçt ünvanı olmamalıdır.",
   "if-you-already-have-an-account": "Əgər artıq hesabınız varsa",
   "register": "Qeydiyyatdan keçin",
   "forgot-password": "parol unutmusunuz",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Xəta pəncərəsi (saniyə)",
   "accounts-lockout-settings-updated": "Qəddar qüvvədən qorunma parametrləri yeniləndi",
   "accounts-lockout-locked-users": "Bağlı İstifadəçilər",
+  "admin-audit-log": "Audit jurnalı",
+  "admin-audit-log-info": "Sayt inzibatçılarının etdikləri: istifadəçi, giriş, yaddaş və ehtiyat nüsxə dəyişiklikləri, ən yenilər əvvəldə. Parollar və gizli məlumatlar heç vaxt qeydə alınmır. Bir il saxlanılır.",
+  "admin-audit-log-when": "Nə vaxt",
+  "admin-audit-log-who": "İnzibatçı",
+  "admin-audit-log-action": "Əməliyyat",
+  "admin-audit-log-details": "Təfərrüatlar",
+  "admin-audit-log-empty": "Hələ heç nə qeydə alınmayıb.",
   "accounts-lockout-locked-users-info": "İstifadəçilər çoxlu uğursuz giriş cəhdləri səbəbindən hazırda bloklanıb",
   "accounts-lockout-no-locked-users": "Hazırda kilidlənmiş istifadəçi yoxdur",
   "accounts-lockout-failed-attempts": "Uğursuz cəhdlər",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "S3 uyğun obyekt saxlaması: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces və digərləri.",
   "s3-force-path-style": "Yol tərzli URL-ləri məcbur et",
   "s3-force-path-style-description": "MinIO və əksər qeyri-AWS S3 uyğun serverləri üçün tələb olunur.",
+  "s3-sse": "Server tərəfində şifrələmə",
+  "s3-sse-none": "Tələb olunmayıb (bucket-in defolt ayarı)",
+  "s3-sse-description": "S3 WeKan-ın yazdığı hər qoşmanı, avatarı və ehtiyat nüsxəni şifrələyir və oxunduqda WeKan üçün deşifrə edir.",
+  "s3-sse-kms-key-id": "SSE-KMS üçün KMS açar ID-si (boş = hesabın defolt açarı)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob saxlancı.",
   "azure-account-name": "Hesab adı",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Bu QR kodunu doğrulama tətbiqi ilə (məsələn, Google Authenticator, Authy) skan edin, sonra təsdiqləmək üçün göstərilən 6 rəqəmli kodu daxil edin.",
   "twoFactorAuth-manual-entry": "Və ya bu kodu əl ilə daxil edin: ",
   "twoFactorAuth-confirm": "Təsdiqlə və Aktiv Et",
+  "two-factor-required-title": "İki faktorlu doğrulamanı qurun",
+  "two-factor-required-text": "Bu sayt hesabınız üçün iki faktorlu doğrulama tələb edir. Davam etmək üçün onu qurun.",
   "twoFactorCode-prompt": "6 rəqəmli doğrulama kodunuzu daxil edin",
   "twoFactorCode-submit": "Doğrula",
   "twoFactorCode-cancel": "Ləğv et",

imports/i18n/data/az-LA.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Sürət",
   "progress": "Tərəqqi",
   "password-again": "Parol (yenidən)",
+  "password-pwned": "Bu parol məlumat sızmasında aşkar edilib. Başqa parol seçin.",
+  "password-too-short": "Parol ən azı __min__ simvol uzunluğunda olmalıdır.",
+  "password-length-report-title": "Parol uzunluğu",
+  "password-length-report-desc": "Minimum uzunluqdan qısa parolla daxil olan hesablar. Parolun nə qədər uzun olduğunu yalnız brauzer bilir, buna görə daxil olduqdan sonra qısa parol barədə məlumat verir; parol və onun uzunluğu heç vaxt brauzeri tərk etmir. Düzəldildi hesabın parolunun dəyişdirildiyi vaxtdır - yenidən qısa parolla daxil olan hesab yenidən çox qısa kimi göstərilir.",
+  "password-length-no-results": "Burada hesab yoxdur.",
+  "password-length-first-login": "İlk giriş",
+  "password-length-last-login": "Son giriş",
+  "password-length-login-count": "Giriş sayı",
+  "password-length-fixed": "Düzəldildi",
+  "password-length-filter-short": "Çox qısa parol",
+  "password-length-filter-fixed": "Kifayət qədər uzun parola düzəldildi",
+  "password-length-filter-all": "Hamısı",
+  "password-min-length": "Minimum parol uzunluğu",
+  "password-min-length-description": "Daha qısa parolla daxil olmaq aşağıda siyahıya alınır. Buna görə giriş heç vaxt rədd edilmir.",
+  "password-min-length-enforce": "Minimum uzunluğu tətbiq et",
+  "password-min-length-enforce-description": "Daha qısa yeni parol rədd edilir və daha qısa parolla daxil olan hesab hər şeydən əvvəl onu dəyişməlidir. Onu dəyişmək hesabın bütün sessiyalarından çıxış edir. LDAP, OAuth2, OIDC, SAML, CAS və Sandstorm parolları öz provayderlərinə aiddir və yoxlanılmır.",
+  "password-length-saved": "Saxlanıldı.",
+  "password-length-from-environment": "Serverin mühitində təyin edilmiş dəyər qüvvədədir; burada saxlamaq onu əvəz edir.",
+  "password-change-required-title": "Parolunuzu dəyişin",
+  "password-change-required-text": "Bu sayt indi ən azı __min__ simvoldan ibarət parollar tələb edir, sizinki isə daha qısadır. Davam etmək üçün daha uzun birini seçin. Sonra hesabınızın bütün sessiyalarından çıxış edilir və yeni parolla yenidən daxil olursunuz.",
+  "password-same-as-username": "Parol istifadəçi adı və ya e-poçt ünvanı olmamalıdır.",
   "if-you-already-have-an-account": "Əgər artıq hesabınız varsa",
   "register": "Qeydiyyatdan keçin",
   "forgot-password": "parol unutmusunuz",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Xəta pəncərəsi (saniyə)",
   "accounts-lockout-settings-updated": "Qəddar qüvvədən qorunma parametrləri yeniləndi",
   "accounts-lockout-locked-users": "Bağlı İstifadəçilər",
+  "admin-audit-log": "Audit jurnalı",
+  "admin-audit-log-info": "Sayt inzibatçılarının etdikləri: istifadəçi, giriş, yaddaş və ehtiyat nüsxə dəyişiklikləri, ən yenilər əvvəldə. Parollar və gizli məlumatlar heç vaxt qeydə alınmır. Bir il saxlanılır.",
+  "admin-audit-log-when": "Nə vaxt",
+  "admin-audit-log-who": "İnzibatçı",
+  "admin-audit-log-action": "Əməliyyat",
+  "admin-audit-log-details": "Təfərrüatlar",
+  "admin-audit-log-empty": "Hələ heç nə qeydə alınmayıb.",
   "accounts-lockout-locked-users-info": "İstifadəçilər çoxlu uğursuz giriş cəhdləri səbəbindən hazırda bloklanıb",
   "accounts-lockout-no-locked-users": "Hazırda kilidlənmiş istifadəçi yoxdur",
   "accounts-lockout-failed-attempts": "Uğursuz cəhdlər",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "S3 uyğun obyekt saxlaması: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces və digərləri.",
   "s3-force-path-style": "Yol tərzli URL-ləri məcbur et",
   "s3-force-path-style-description": "MinIO və əksər qeyri-AWS S3 uyğun serverləri üçün tələb olunur.",
+  "s3-sse": "Server tərəfində şifrələmə",
+  "s3-sse-none": "Tələb olunmayıb (bucket-in defolt ayarı)",
+  "s3-sse-description": "S3 WeKan-ın yazdığı hər qoşmanı, avatarı və ehtiyat nüsxəni şifrələyir və oxunduqda WeKan üçün deşifrə edir.",
+  "s3-sse-kms-key-id": "SSE-KMS üçün KMS açar ID-si (boş = hesabın defolt açarı)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob saxlancı.",
   "azure-account-name": "Hesab adı",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Bu QR kodu autentifikasiya tətbiqi ilə skan edin (məs. Google Authenticator, Authy), sonra təsdiq üçün göstərilən 6 rəqəmli kodu daxil edin.",
   "twoFactorAuth-manual-entry": "Və ya bu kodu əl ilə daxil edin: ",
   "twoFactorAuth-confirm": "Təsdiq Et və Aktivləşdir",
+  "two-factor-required-title": "İki mərhələli doğrulamanı qurun",
+  "two-factor-required-text": "Bu sayt hesabınız üçün iki mərhələli doğrulama tələb edir. Davam etmək üçün onu qurun.",
   "twoFactorCode-prompt": "6 rəqəmli doğrulama kodunuzu daxil edin",
   "twoFactorCode-submit": "Doğrula",
   "twoFactorCode-cancel": "Ləğv et",

imports/i18n/data/az.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Sürət",
   "progress": "Tərəqqi",
   "password-again": "Parol (yenidən)",
+  "password-pwned": "Bu parol məlumat sızmasında aşkar edilib. Başqa parol seçin.",
+  "password-too-short": "Parol ən azı __min__ simvol uzunluğunda olmalıdır.",
+  "password-length-report-title": "Parol uzunluğu",
+  "password-length-report-desc": "Minimum uzunluqdan qısa parolla daxil olan hesablar. Parolun nə qədər uzun olduğunu yalnız brauzer bilir, buna görə daxil olduqdan sonra qısa parol barədə məlumat verir; parol və onun uzunluğu heç vaxt brauzeri tərk etmir. Düzəldildi hesabın parolunun dəyişdirildiyi vaxtdır - yenidən qısa parolla daxil olan hesab yenidən çox qısa kimi göstərilir.",
+  "password-length-no-results": "Burada hesab yoxdur.",
+  "password-length-first-login": "İlk giriş",
+  "password-length-last-login": "Son giriş",
+  "password-length-login-count": "Giriş sayı",
+  "password-length-fixed": "Düzəldildi",
+  "password-length-filter-short": "Çox qısa parol",
+  "password-length-filter-fixed": "Kifayət qədər uzun parola düzəldildi",
+  "password-length-filter-all": "Hamısı",
+  "password-min-length": "Minimum parol uzunluğu",
+  "password-min-length-description": "Daha qısa parolla daxil olmaq aşağıda siyahıya alınır. Buna görə giriş heç vaxt rədd edilmir.",
+  "password-min-length-enforce": "Minimum uzunluğu tətbiq et",
+  "password-min-length-enforce-description": "Daha qısa yeni parol rədd edilir və daha qısa parolla daxil olan hesab hər şeydən əvvəl onu dəyişməlidir. Onu dəyişmək hesabın bütün sessiyalarından çıxış edir. LDAP, OAuth2, OIDC, SAML, CAS və Sandstorm parolları öz provayderlərinə aiddir və yoxlanılmır.",
+  "password-length-saved": "Saxlanıldı.",
+  "password-length-from-environment": "Serverin mühitində təyin edilmiş dəyər qüvvədədir; burada saxlamaq onu əvəz edir.",
+  "password-change-required-title": "Parolunuzu dəyişin",
+  "password-change-required-text": "Bu sayt indi ən azı __min__ simvoldan ibarət parollar tələb edir, sizinki isə daha qısadır. Davam etmək üçün daha uzun birini seçin. Sonra hesabınızın bütün sessiyalarından çıxış edilir və yeni parolla yenidən daxil olursunuz.",
+  "password-same-as-username": "Parol istifadəçi adı və ya e-poçt ünvanı olmamalıdır.",
   "if-you-already-have-an-account": "Əgər artıq hesabınız varsa",
   "register": "Qeydiyyatdan keçin",
   "forgot-password": "parol unutmusunuz",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Xəta pəncərəsi (saniyə)",
   "accounts-lockout-settings-updated": "Qəddar qüvvədən qorunma parametrləri yeniləndi",
   "accounts-lockout-locked-users": "Bağlı İstifadəçilər",
+  "admin-audit-log": "Audit jurnalı",
+  "admin-audit-log-info": "Sayt inzibatçılarının etdikləri: istifadəçi, giriş, yaddaş və ehtiyat nüsxə dəyişiklikləri, ən yenilər əvvəldə. Parollar və gizli məlumatlar heç vaxt qeydə alınmır. Bir il saxlanılır.",
+  "admin-audit-log-when": "Nə vaxt",
+  "admin-audit-log-who": "İnzibatçı",
+  "admin-audit-log-action": "Əməliyyat",
+  "admin-audit-log-details": "Təfərrüatlar",
+  "admin-audit-log-empty": "Hələ heç nə qeydə alınmayıb.",
   "accounts-lockout-locked-users-info": "İstifadəçilər çoxlu uğursuz giriş cəhdləri səbəbindən hazırda bloklanıb",
   "accounts-lockout-no-locked-users": "Hazırda kilidlənmiş istifadəçi yoxdur",
   "accounts-lockout-failed-attempts": "Uğursuz cəhdlər",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "S3 uyğun obyekt saxlaması: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces və digərləri.",
   "s3-force-path-style": "Yol tərzli URL-ləri məcbur et",
   "s3-force-path-style-description": "MinIO və əksər qeyri-AWS S3 uyğun serverləri üçün tələb olunur.",
+  "s3-sse": "Server tərəfində şifrələmə",
+  "s3-sse-none": "Tələb olunmayıb (bucket-in defolt ayarı)",
+  "s3-sse-description": "S3 WeKan-ın yazdığı hər qoşmanı, avatarı və ehtiyat nüsxəni şifrələyir və oxunduqda WeKan üçün deşifrə edir.",
+  "s3-sse-kms-key-id": "SSE-KMS üçün KMS açar ID-si (boş = hesabın defolt açarı)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob saxlancı.",
   "azure-account-name": "Hesab adı",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Bu QR kodu autentifikasiya tətbiqi ilə skan edin (məs. Google Authenticator, Authy), sonra təsdiq üçün göstərilən 6 rəqəmli kodu daxil edin.",
   "twoFactorAuth-manual-entry": "Və ya bu kodu əl ilə daxil edin: ",
   "twoFactorAuth-confirm": "Təsdiq Et və Aktivləşdir",
+  "two-factor-required-title": "İki mərhələli doğrulamanı qurun",
+  "two-factor-required-text": "Bu sayt hesabınız üçün iki mərhələli doğrulama tələb edir. Davam etmək üçün onu qurun.",
   "twoFactorCode-prompt": "6 rəqəmli doğrulama kodunuzu daxil edin",
   "twoFactorCode-submit": "Doğrula",
   "twoFactorCode-cancel": "Ləğv et",

imports/i18n/data/ba.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Тиҙлек",
   "progress": "Алға китеш",
   "password-again": "Серһүҙ (ҡабат)",
+  "password-pwned": "Был серһүҙ мәғлүмәттәр ағыуында күренгән. Башҡаһын һайлағыҙ.",
+  "password-too-short": "Серһүҙ кәмендә __min__ символдан торорға тейеш.",
+  "password-length-report-title": "Серһүҙ оҙонлоғо",
+  "password-length-report-desc": "Минималь оҙонлоҡтан ҡыҫҡараҡ серһүҙ менән ингән иҫәп яҙмалары. Серһүҙҙең оҙонлоғон браузер ғына белә, шуға ла ул ингәндән һуң ҡыҫҡа серһүҙ тураһында хәбәр итә; серһүҙ һәм уның оҙонлоғо бер ҡасан да браузерҙан сыҡмай. Төҙәтелгән — иҫәп яҙмаһының серһүҙе үҙгәртелгән ваҡыт - яңынан ҡыҫҡа серһүҙ менән ингән иҫәп яҙмаһы яңынан бик ҡыҫҡа булып күрһәтелә.",
+  "password-length-no-results": "Бында иҫәп яҙмалары юҡ.",
+  "password-length-first-login": "Беренсе инеү",
+  "password-length-last-login": "Һуңғы инеү",
+  "password-length-login-count": "Инеүҙәр һаны",
+  "password-length-fixed": "Төҙәтелгән",
+  "password-length-filter-short": "Бик ҡыҫҡа серһүҙ",
+  "password-length-filter-fixed": "Етерлек оҙон серһүҙгә төҙәтелгән",
+  "password-length-filter-all": "Барыһы ла",
+  "password-min-length": "Серһүҙҙең минималь оҙонлоғо",
+  "password-min-length-description": "Ҡыҫҡараҡ серһүҙ менән инеү түбәндә күрһәтелә. Был сәбәпле инеү бер ҡасан да кире ҡағылмай.",
+  "password-min-length-enforce": "Минималь оҙонлоҡто мотлаҡ итеү",
+  "password-min-length-enforce-description": "Ҡыҫҡараҡ яңы серһүҙ кире ҡағыла, ә ҡыҫҡараҡ серһүҙ менән ингән иҫәп яҙмаһы уны барыһынан да элек үҙгәртергә тейеш. Уны үҙгәртеү иҫәп яҙмаһының бөтә сеанстарын ябып сығара. LDAP, OAuth2, OIDC, SAML, CAS һәм Sandstorm серһүҙҙәре уларҙың провайдерыныҡы, һәм тикшерелмәй.",
+  "password-length-saved": "Һаҡланды.",
+  "password-length-from-environment": "Серверҙың мөхитендә ҡуйылған ҡиммәт ғәмәлдә; бында һаҡлау уны алмаштыра.",
+  "password-change-required-title": "Серһүҙегеҙҙе үҙгәртегеҙ",
+  "password-change-required-text": "Был сайт хәҙер кәмендә __min__ символлы серһүҙҙәр талап итә, ә һеҙҙеке ҡыҫҡараҡ. Дауам итеү өсөн оҙонораҡ серһүҙ һайлағыҙ. Шунан һеҙҙең иҫәп яҙмағыҙҙың бөтә сеанстары ябыла, һәм һеҙ яңы серһүҙ менән яңынан инәһегеҙ.",
+  "password-same-as-username": "Серһүҙ ҡулланыусы исеме йәки электрон почта адресы булырға тейеш түгел.",
   "if-you-already-have-an-account": "Иҫәбегеҙ булһа",
   "register": "Теркәлеү",
   "forgot-password": "Серһүҙҙе онотҡанһығыҙмы",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Уңышһыҙлыҡ арауығы (секунд)",
   "accounts-lockout-settings-updated": "Тупаҫ көс һөжүменән һаҡлау көйләүҙәре яңыртылды",
   "accounts-lockout-locked-users": "Бикләнгән ҡулланыусылар",
+  "admin-audit-log": "Аудит журналы",
+  "admin-audit-log-info": "Сайт администраторҙары ни эшләгән: ҡулланыусы, инеү, һаҡлағыс һәм резерв күсермә үҙгәрештәре, иң яңылары башта. Серһүҙҙәр һәм серҙәр бер ҡасан да яҙылмай. Бер йыл һаҡлана.",
+  "admin-audit-log-when": "Ҡасан",
+  "admin-audit-log-who": "Администратор",
+  "admin-audit-log-action": "Ғәмәл",
+  "admin-audit-log-details": "Ентеклектәр",
+  "admin-audit-log-empty": "Әлегә бер нәмә лә яҙылмаған.",
   "accounts-lockout-locked-users-info": "Артыҡ күп уңышһыҙ инеү ынтылышы арҡаһында әлеге ваҡытта бикләнгән ҡулланыусылар",
   "accounts-lockout-no-locked-users": "Әлеге ваҡытта бикләнгән ҡулланыусылар юҡ",
   "accounts-lockout-failed-attempts": "Уңышһыҙ ынтылыштар",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "S3 менән тап килгән объект һаҡлағысы: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces һәм башҡалар.",
   "s3-force-path-style": "Юл стилендәге URL-дарҙы мәжбүри ҡулланырға",
   "s3-force-path-style-description": "MinIO һәм AWS булмаған күпселек S3-ярашлы серверҙар өсөн кәрәк.",
+  "s3-sse": "Сервер яғында шифрлау",
+  "s3-sse-none": "Һоралмаған (bucket-тың килешелгән көйләүе)",
+  "s3-sse-description": "S3 WeKan яҙған һәр ҡушымтаны, аватарҙы һәм резерв күсермәне шифрлай, ә уҡығанда WeKan өсөн шифрҙы сисә.",
+  "s3-sse-kms-key-id": "SSE-KMS өсөн KMS асҡыс ID-һы (буш = иҫәп яҙмаһының килешелгән асҡысы)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
   "azure-account-name": "Иҫәп исеме",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Был QR-кодты раҫлау ҡушымтаһы менән (мәҫәлән, Google Authenticator, Authy) сканерлағыҙ, унан раҫлау өсөн күрһәтелгән 6 цифрлы кодты индерегеҙ.",
   "twoFactorAuth-manual-entry": "Йәки был кодты ҡулдан индерегеҙ: ",
   "twoFactorAuth-confirm": "Раҫларға һәм асырға",
+  "two-factor-required-title": "Ике факторлы раҫлауҙы көйләгеҙ",
+  "two-factor-required-text": "Был сайт һеҙҙең иҫәп яҙмағыҙ өсөн ике факторлы раҫлау талап итә. Дауам итер өсөн уны көйләгеҙ.",
   "twoFactorCode-prompt": "6 цифрлы раҫлау кодыгыҙҙы индерегеҙ",
   "twoFactorCode-submit": "Тикшерергә",
   "twoFactorCode-cancel": "Кире ҡағырға",

imports/i18n/data/be.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Хуткасць",
   "progress": "Прагрэс",
   "password-again": "Пароль (яшчэ раз)",
+  "password-pwned": "Гэты пароль трапіў ва ўцечку даных. Выберыце іншы.",
+  "password-too-short": "Пароль павінен мець не менш за __min__ сімвалаў.",
+  "password-length-report-title": "Даўжыня пароля",
+  "password-length-report-desc": "Уліковыя запісы, якія ўвайшлі з паролем, карацейшым за мінімальную даўжыню. Толькі браўзер ведае, якой даўжыні пароль, таму ён паведамляе пра кароткі пасля ўваходу; пароль і яго даўжыня ніколі яго не пакідаюць. Выпраўлена — гэта калі пароль уліковага запісу быў зменены - уліковы запіс, які зноў уваходзіць з кароткім паролем, зноў паказваецца як занадта кароткі.",
+  "password-length-no-results": "Тут няма ўліковых запісаў.",
+  "password-length-first-login": "Першы ўваход",
+  "password-length-last-login": "Апошні ўваход",
+  "password-length-login-count": "Колькасць уваходаў",
+  "password-length-fixed": "Выпраўлена",
+  "password-length-filter-short": "Занадта кароткі пароль",
+  "password-length-filter-fixed": "Выпраўлена на дастаткова доўгі пароль",
+  "password-length-filter-all": "Усе",
+  "password-min-length": "Мінімальная даўжыня пароля",
+  "password-min-length-description": "Уваход з карацейшым паролем пералічваецца ніжэй. Уваход праз гэта ніколі не адхіляецца.",
+  "password-min-length-enforce": "Патрабаваць мінімальную даўжыню",
+  "password-min-length-enforce-description": "Карацейшы новы пароль адхіляецца, а ўліковы запіс, які ўваходзіць з карацейшым паролем, павінен змяніць яго перш за ўсё. Змена пароля завяршае ўсе сеансы ўліковага запісу. Паролі LDAP, OAuth2, OIDC, SAML, CAS і Sandstorm належаць іх пастаўшчыку і не правяраюцца.",
+  "password-length-saved": "Захавана.",
+  "password-length-from-environment": "Дзейнічае значэнне, зададзенае ў асяроддзі сервера; захаванне тут перавызначае яго.",
+  "password-change-required-title": "Змяніце свой пароль",
+  "password-change-required-text": "Гэты сайт цяпер патрабуе паролі даўжынёй не менш за __min__ сімвалаў, а ваш карацейшы. Выберыце даўжэйшы, каб працягнуць. Пасля гэтага ўсе сеансы вашага ўліковага запісу будуць завершаны, і вы ўвойдзеце зноў з новым паролем.",
+  "password-same-as-username": "Пароль не павінен супадаць з імем карыстальніка або адрасам электроннай пошты.",
   "if-you-already-have-an-account": "Калі ў вас ужо ёсць акаўнт",
   "register": "Зарэгістравацца",
   "forgot-password": "Забыў пароль",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Акно няўдач (секунды)",
   "accounts-lockout-settings-updated": "Налады абароны ад грубай сілы абноўлены",
   "accounts-lockout-locked-users": "Заблакіраваныя карыстальнікі",
+  "admin-audit-log": "Журнал аўдыту",
+  "admin-audit-log-info": "Што рабілі адміністратары сайта: змены карыстальнікаў, уваходу, сховішча і рэзервовых копій, спачатку найноўшыя. Паролі і сакрэты ніколі не запісваюцца. Захоўваецца адзін год.",
+  "admin-audit-log-when": "Калі",
+  "admin-audit-log-who": "Адміністратар",
+  "admin-audit-log-action": "Дзеянне",
+  "admin-audit-log-details": "Дэталі",
+  "admin-audit-log-empty": "Пакуль нічога не запісана.",
   "accounts-lockout-locked-users-info": "Карыстальнікі, у цяперашні час заблакіраваныя праз занадта шмат няўдалых спроб уваходу",
   "accounts-lockout-no-locked-users": "У цяперашні час няма заблакіраваных карыстальнікаў",
   "accounts-lockout-failed-attempts": "Няўдалыя спробы",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "S3-сумяшчальнае аб'ектнае сховішча: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces і іншыя.",
   "s3-force-path-style": "Прымусова выкарыстоўваць URL у стылі шляху",
   "s3-force-path-style-description": "Патрабуецца MinIO і большасцю не-AWS S3-сумяшчальных сервераў.",
+  "s3-sse": "Шыфраванне на баку сервера",
+  "s3-sse-none": "Не запытана (прадвызначана для бакета)",
+  "s3-sse-description": "S3 шыфруе кожнае ўкладанне, аватар і рэзервовую копію, якія запісвае WeKan, і расшыфроўвае іх для WeKan пры чытанні.",
+  "s3-sse-kms-key-id": "Ідэнтыфікатар ключа KMS для SSE-KMS (пуста = прадвызначаны ключ уліковага запісу)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Сховішча Microsoft Azure Blob.",
   "azure-account-name": "Назва акаўнта",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Скануйце гэты QR-код з дапамогай прыкладання-аўтэнтыфікатара (напрыклад, Google Authenticator, Authy), затым увядзіце паказаны 6-значны код для пацвярджэння.",
   "twoFactorAuth-manual-entry": "Або ўвядзіце гэты код уручную: ",
   "twoFactorAuth-confirm": "Пацвердзіць і ўключыць",
+  "two-factor-required-title": "Наладзьце двухфактарную аўтэнтыфікацыю",
+  "two-factor-required-text": "Гэты сайт патрабуе двухфактарную аўтэнтыфікацыю для вашага ўліковага запісу. Наладзьце яе, каб працягнуць.",
   "twoFactorCode-prompt": "Увядзіце ваш 6-значны код аўтэнтыфікацыі",
   "twoFactorCode-submit": "Праверыць",
   "twoFactorCode-cancel": "Скасаваць",

imports/i18n/data/bg.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Скорост",
   "progress": "Напредък",
   "password-again": "Парола (повторно)",
+  "password-pwned": "Тази парола е открита при изтичане на данни. Изберете друга.",
+  "password-too-short": "Паролата трябва да е дълга поне __min__ знака.",
+  "password-length-report-title": "Дължина на паролата",
+  "password-length-report-desc": "Профили, които са влезли с парола, по-къса от минималната дължина. Само браузърът знае колко дълга е паролата, затова съобщава за къса парола след влизане; паролата и дължината ѝ никога не го напускат. Поправено е моментът, в който паролата на профила е била сменена - профил, който отново влезе с къса парола, отново се показва като твърде къса.",
+  "password-length-no-results": "Няма профили тук.",
+  "password-length-first-login": "Първо влизане",
+  "password-length-last-login": "Последно влизане",
+  "password-length-login-count": "Брой влизания",
+  "password-length-fixed": "Поправено",
+  "password-length-filter-short": "Твърде къса парола",
+  "password-length-filter-fixed": "Поправено с достатъчно дълга парола",
+  "password-length-filter-all": "Всички",
+  "password-min-length": "Минимална дължина на паролата",
+  "password-min-length-description": "Влизането с по-къса парола се показва по-долу. Влизането никога не се отказва заради това.",
+  "password-min-length-enforce": "Налагане на минималната дължина",
+  "password-min-length-enforce-description": "По-къса нова парола се отхвърля, а профил, който влиза с по-къса парола, трябва да я смени преди всичко друго. Смяната ѝ излиза от всички сесии на профила. Паролите от LDAP, OAuth2, OIDC, SAML, CAS и Sandstorm са на техния доставчик и не се проверяват.",
+  "password-length-saved": "Запазено.",
+  "password-length-from-environment": "В сила е стойност, зададена в средата на сървъра; запазването тук я замества.",
+  "password-change-required-title": "Сменете паролата си",
+  "password-change-required-text": "Този сайт вече изисква пароли от поне __min__ знака, а вашата е по-къса. Изберете по-дълга, за да продължите. След това всички сесии на профила ви се прекратяват и влизате отново с новата парола.",
+  "password-same-as-username": "Паролата не трябва да бъде потребителското име или имейл адресът.",
   "if-you-already-have-an-account": "Ако вече имате акаунт",
   "register": "Регистрация",
   "forgot-password": "Забравена парола",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Период за отчитане на неуспешните опити (секунди)",
   "accounts-lockout-settings-updated": "Настройките за защита от атаки с отгатване на пароли са обновени",
   "accounts-lockout-locked-users": "Блокирани потребители",
+  "admin-audit-log": "Одитен журнал",
+  "admin-audit-log-info": "Какво са направили администраторите на сайта: промени в потребители, вход, хранилище и резервни копия, най-новите първо. Пароли и тайни никога не се записват. Пази се една година.",
+  "admin-audit-log-when": "Кога",
+  "admin-audit-log-who": "Администратор",
+  "admin-audit-log-action": "Действие",
+  "admin-audit-log-details": "Подробности",
+  "admin-audit-log-empty": "Все още няма записи.",
   "accounts-lockout-locked-users-info": "Потребители, блокирани в момента поради твърде много неуспешни опити за вход",
   "accounts-lockout-no-locked-users": "В момента няма блокирани потребители",
   "accounts-lockout-failed-attempts": "Неуспешни опити",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "S3-съвместимо обектно хранилище: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces и други.",
   "s3-force-path-style": "Наложи URL адреси в стил път (path-style)",
   "s3-force-path-style-description": "Изисква се от MinIO и повечето не-AWS S3-съвместими сървъри.",
+  "s3-sse": "Криптиране от страна на сървъра",
+  "s3-sse-none": "Не е заявено (по подразбиране за bucket-а)",
+  "s3-sse-description": "S3 криптира всеки прикачен файл, аватар и резервно копие, които WeKan записва, и ги декриптира за WeKan при четене.",
+  "s3-sse-kms-key-id": "ID на KMS ключ за SSE-KMS (празно = ключът по подразбиране на акаунта)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
   "azure-account-name": "Име на акаунта",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Сканирайте този QR код с приложение за удостоверяване (напр. Google Authenticator, Authy), след което въведете показания 6-цифрен код за потвърждение.",
   "twoFactorAuth-manual-entry": "Или въведете този код ръчно: ",
   "twoFactorAuth-confirm": "Потвърждаване и активиране",
+  "two-factor-required-title": "Настройте двуфакторно удостоверяване",
+  "two-factor-required-text": "Този сайт изисква двуфакторно удостоверяване за вашия акаунт. Настройте го, за да продължите.",
   "twoFactorCode-prompt": "Въведете вашия 6-цифрен код за удостоверяване",
   "twoFactorCode-submit": "Проверка",
   "twoFactorCode-cancel": "Отмени",

imports/i18n/data/bho.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "गति",
   "progress": "प्रगति",
   "password-again": "पासवर्ड (फेर से)",
+  "password-pwned": "ई पासवर्ड कवनो डेटा लीक में देखाई देले बा। कवनो दोसर चुनीं।",
+  "password-too-short": "पासवर्ड कम से कम __min__ अक्षर के होखे के चाहीं।",
+  "password-length-report-title": "पासवर्ड के लंबाई",
+  "password-length-report-desc": "ऊ खाता जवन न्यूनतम लंबाई से छोट पासवर्ड से साइन इन कइलें। पासवर्ड केतना लंबा बा ई खाली ब्राउजर जानेला, एही से साइन इन के बाद ऊ छोट पासवर्ड के जानकारी देला; पासवर्ड आ ओकर लंबाई कबो ओकरा से बाहर ना जाला। ठीक भइल माने जब खाता के पासवर्ड बदलल गइल - जवन खाता फेर से छोट पासवर्ड से साइन इन करी, ऊ फेर से बहुत छोट देखावल जाई।",
+  "password-length-no-results": "इहाँ कवनो खाता नइखे।",
+  "password-length-first-login": "पहिला लॉगिन",
+  "password-length-last-login": "आखिरी लॉगिन",
+  "password-length-login-count": "केतना बेर लॉगिन भइल",
+  "password-length-fixed": "ठीक भइल",
+  "password-length-filter-short": "बहुत छोट पासवर्ड",
+  "password-length-filter-fixed": "काफी लंबा पासवर्ड से ठीक भइल",
+  "password-length-filter-all": "सब",
+  "password-min-length": "न्यूनतम पासवर्ड लंबाई",
+  "password-min-length-description": "छोट पासवर्ड से साइन इन कइल नीचे सूची में देखावल जाला। एकरा चलते साइन इन कबो मना ना कइल जाला।",
+  "password-min-length-enforce": "न्यूनतम लंबाई लागू करीं",
+  "password-min-length-enforce-description": "छोट नया पासवर्ड मना कर दिहल जाला, आ जवन खाता छोट पासवर्ड से साइन इन करेला ओकरा कवनो दोसर काम से पहिले एकरा के बदले के पड़ी। एकरा के बदलला से खाता के हर सत्र से साइन आउट हो जाला। LDAP, OAuth2, OIDC, SAML, CAS आ Sandstorm के पासवर्ड ओह लोग के प्रदाता के होला, आ जाँचल ना जाला।",
+  "password-length-saved": "सहेजल गइल।",
+  "password-length-from-environment": "सर्वर के वातावरण में सेट कइल एगो मान लागू बा; इहाँ सहेजला से ऊ बदल जाला।",
+  "password-change-required-title": "आपन पासवर्ड बदलीं",
+  "password-change-required-text": "ई साइट अब कम से कम __min__ अक्षर के पासवर्ड माँगेले, आ रउआ के छोट बा। आगे बढ़े खातिर एगो लंबा पासवर्ड चुनीं। ओकरा बाद रउआ खाता के हर सत्र से साइन आउट हो जाई, आ रउआ नया पासवर्ड से फेर से साइन इन करब।",
+  "password-same-as-username": "पासवर्ड उपयोगकर्ता नाम भा ईमेल पता ना होखे के चाहीं।",
   "if-you-already-have-an-account": "अगर रउआ लगे पहिले से खाता बा",
   "register": "पंजीकरण करीं",
   "forgot-password": "पासवर्ड भुला गइनी",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "असफलता समय-सीमा (सेकंड)",
   "accounts-lockout-settings-updated": "जबरदस्ती हमला सुरक्षा सेटिंग नया कर दिहल गइल",
   "accounts-lockout-locked-users": "तालाबंद उपयोगकर्ता",
+  "admin-audit-log": "ऑडिट लॉग",
+  "admin-audit-log-info": "साइट के प्रशासक लोग का कइल: उपयोगकर्ता, लॉगिन, स्टोरेज आ बैकअप में बदलाव, सबसे नया पहिले। पासवर्ड आ गुप्त बात कबो दर्ज ना कइल जाला। एक साल ले रखल जाला।",
+  "admin-audit-log-when": "कब",
+  "admin-audit-log-who": "प्रशासक",
+  "admin-audit-log-action": "कार्रवाई",
+  "admin-audit-log-details": "विवरण",
+  "admin-audit-log-empty": "अबहीं ले कुछुओ दर्ज नइखे भइल।",
   "accounts-lockout-locked-users-info": "बहुत अधिक असफल लॉग इन कोसिस के कारण अबहीं तालाबंद उपयोगकर्ता",
   "accounts-lockout-no-locked-users": "अबहीं कवनो तालाबंद उपयोगकर्ता नइखे",
   "accounts-lockout-failed-attempts": "असफल कोसिस",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "S3-संगत ऑब्जेक्ट भंडारण: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces आ दोसर।",
   "s3-force-path-style": "पथ-जइसन URL जरूरी करीं",
   "s3-force-path-style-description": "MinIO आ अधिकतर गैर-AWS S3-संगत सर्वर खातिर जरूरी।",
+  "s3-sse": "सर्वर ओर एन्क्रिप्शन",
+  "s3-sse-none": "कुछ ना माँगल गइल (बकेट के पहिले से तय)",
+  "s3-sse-description": "WeKan जवन हर संलग्नक, अवतार आ बैकअप लिखेला, ओकरा के S3 एन्क्रिप्ट करेला, आ पढ़े घरी WeKan खातिर डिक्रिप्ट करेला।",
+  "s3-sse-kms-key-id": "SSE-KMS खातिर KMS कुंजी ID (खाली = खाता के पहिले से तय कुंजी)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
   "azure-account-name": "खाता नाँव",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "ई QR कोड के प्रमाणीकरण ऐप से स्कैन करीं (जइसे Google Authenticator, Authy), फेर पुष्टि करे खातिर देखावल 6-अंक के कोड डालीं।",
   "twoFactorAuth-manual-entry": "या ई कोड मैन्युअल रूप से डालीं: ",
   "twoFactorAuth-confirm": "पुष्टि करीं आ चालू करीं",
+  "two-factor-required-title": "दू-कारक प्रमाणीकरण सेट करीं",
+  "two-factor-required-text": "ई साइट रउरा खाता खातिर दू-कारक प्रमाणीकरण माँगेले। आगे बढ़े खातिर एकरा के सेट करीं।",
   "twoFactorCode-prompt": "अपना 6-अंक के प्रमाणीकरण कोड डालीं",
   "twoFactorCode-submit": "सत्यापित करीं",
   "twoFactorCode-cancel": "रद्द करीं",

imports/i18n/data/bi.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Spid",
   "progress": "Wok we i gohed",
   "password-again": "Sikret wod (bakegen)",
+  "password-pwned": "Paswod ia i bin kamaot long wan data we i lik. Jusum narawan.",
+  "password-too-short": "Paswod i mas gat __min__ leta o moa.",
+  "password-length-report-title": "Longfala blong paswod",
+  "password-length-report-desc": "Ol akaon we oli saen-in wetem wan paswod we i sot moa long smol longfala. Bravsa nomo i save hamas paswod i long, ale hem i ripotem wan sot paswod afta long saen-in; paswod mo longfala blong hem oli neva lego bravsa. Stretem i taem we paswod blong akaon i jenis - wan akaon we i saen-in bakegen wetem sot paswod bambae i soem bakegen se i sot tumas.",
+  "password-length-no-results": "I no gat akaon long ples ia.",
+  "password-length-first-login": "Fes login",
+  "password-length-last-login": "Las login",
+  "password-length-login-count": "Hamas taem i login",
+  "password-length-fixed": "Stretem finis",
+  "password-length-filter-short": "Paswod i sot tumas",
+  "password-length-filter-fixed": "Stretem finis long paswod we i long naf",
+  "password-length-filter-all": "Evriwan",
+  "password-min-length": "Smol longfala blong paswod",
+  "password-min-length-description": "Saen-in wetem wan sot paswod i stap long lis daon. Saen-in i neva blokem from samting ia.",
+  "password-min-length-enforce": "Mekem man i folem smol longfala",
+  "password-min-length-enforce-description": "Wan niu paswod we i sot moa bambae oli no akseptem, mo wan akaon we i saen-in wetem sot paswod i mas jenisim fastaem bifo long eni narafala samting. Taem yu jenisim, evri sesen blong akaon i aot. Ol paswod blong LDAP, OAuth2, OIDC, SAML, CAS mo Sandstorm oli blong provaeda blong olgeta, mo oli no jekem.",
+  "password-length-saved": "I sevem finis.",
+  "password-length-from-environment": "Wan valiu we oli putum long envaeronmen blong seva i wok naoia; sevem long ples ia i jenisim hem.",
+  "password-change-required-title": "Jenisim paswod blong yu",
+  "password-change-required-text": "Saet ia naoia i nidim ol paswod we i gat __min__ leta o moa, mo paswod blong yu i sot moa. Jusum wan we i long moa blong gohed. Afta, evri sesen blong akaon blong yu i aot, mo yu saen-in bakegen wetem niu paswod.",
+  "password-same-as-username": "Paswod i no save sem mak nem blong yusa o adres blong imel.",
   "if-you-already-have-an-account": "Sapos yu gat wan akaon finis",
   "register": "Rejista",
   "forgot-password": "Yu fogetem paswod",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Taem blong kaontem ol fel (seken)",
   "accounts-lockout-settings-updated": "Oli jenisim ol seting blong protektem long atak blong traem plante paswod",
   "accounts-lockout-locked-users": "Ol yusa we oli Lokem",
+  "admin-audit-log": "Odit lok",
+  "admin-audit-log-info": "Wanem ol administreta blong saet oli mekem: ol jenis long yusa, login, storej mo bekap, niuwan fastaem. Oli neva raetemdaon ol paswod mo ol sikret. Oli kipim blong wan yia.",
+  "admin-audit-log-when": "Wetaem",
+  "admin-audit-log-who": "Administreta",
+  "admin-audit-log-action": "Aksen",
+  "admin-audit-log-details": "Ol ditel",
+  "admin-audit-log-empty": "I no gat samting we oli raetemdaon yet.",
   "accounts-lockout-locked-users-info": "Ol yusa we oli lokem olgeta naoia from oli traem go insaed plante taem tumas we i no wok",
   "accounts-lockout-no-locked-users": "Naoia i no gat yusa we oli lokem",
   "accounts-lockout-failed-attempts": "Ol traem we oli fel",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "S3-compatible object storage: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces mo others.",
   "s3-force-path-style": "Fosem ol URL blong yusum fomat blong rod",
   "s3-force-path-style-description": "I mas gat blong MinIO mo plante seva we oli wok olsem S3 be oli no blong AWS.",
+  "s3-sse": "Enkripsen long saed blong seva",
+  "s3-sse-none": "I no askem wan (stamba blong baket)",
+  "s3-sse-description": "S3 i enkriptem evri samting we i joen, avata mo bekap we WeKan i raetem, mo i dekriptem bakegen blong WeKan taem i ridim.",
+  "s3-sse-kms-key-id": "KMS ki ID blong SSE-KMS (i emti = stamba ki blong akaon)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
   "azure-account-name": "Nem blong akaon",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Skanem QR kod ia wetem wan aplikesen blong pruvum (olsem Google Authenticator, Authy), biaen putum kod we i gat 6 namba we hem i soem blong pruvum.",
   "twoFactorAuth-manual-entry": "O putum kod ia wetem han blong yu: ",
   "twoFactorAuth-confirm": "Pruvum mo Statem",
+  "two-factor-required-title": "Setemap Tu-Fakta Pruvum",
+  "two-factor-required-text": "Saet ia i nidim Tu-Fakta Pruvum blong akaon blong yu. Setemap blong go hed.",
   "twoFactorCode-prompt": "Putum kod blong yu we i gat 6 namba blong pruvum",
   "twoFactorCode-submit": "Pruvum",
   "twoFactorCode-cancel": "Kanselem",

imports/i18n/data/bm.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Teliya",
   "progress": "Ɲɛtaa",
   "password-again": "Tɔgɔgundo (kokura)",
+  "password-pwned": "Gundo daɲɛ nin yera kunnafoni bɔnen dɔ kɔnɔ. Wɛrɛ sugandi.",
+  "password-too-short": "Gundo daɲɛ ka kan ka sɛbɛnni __min__ sɔrɔ a dɔgɔyalen na.",
+  "password-length-report-title": "Gundo daɲɛ janya",
+  "password-length-report-desc": "Jatebɔw minnu donna ni gundo daɲɛ ye min surunyalen don ka tɛmɛ janya dɔgɔman kan. Ɲɛgɛnɛjɛ dama de b'a dɔn gundo daɲɛ janya bɛ min bɔ, o de kosɔn a b'a fɔ ko gundo daɲɛ surun don ni donni kɛra; gundo daɲɛ n'a janya tɛ bɔ a kɔnɔ abada. Labɛnna ye waati ye min na jatebɔ gundo daɲɛ yɛlɛmana - jatebɔ min bɛ don tugun ni gundo daɲɛ surun ye, o bɛ jira tugun ko a ka surun kojugu.",
+  "password-length-no-results": "Jatebɔ si tɛ yan.",
+  "password-length-first-login": "Donni fɔlɔ",
+  "password-length-last-login": "Donni laban",
+  "password-length-login-count": "Donni hakɛ",
+  "password-length-fixed": "Labɛnna",
+  "password-length-filter-short": "Gundo daɲɛ ka surun kojugu",
+  "password-length-filter-fixed": "Labɛnna ka kɛ gundo daɲɛ jan ye",
+  "password-length-filter-all": "A bɛɛ",
+  "password-min-length": "Gundo daɲɛ janya dɔgɔman",
+  "password-min-length-description": "Donni ni gundo daɲɛ surun ye bɛ sɛbɛn duguma. Donni tɛ ban abada o kosɔn.",
+  "password-min-length-enforce": "Janya dɔgɔman labato",
+  "password-min-length-enforce-description": "Gundo daɲɛ kura surun bɛ ban, wa jatebɔ min bɛ don ni gundo daɲɛ surun ye, o ka kan k'a yɛlɛma sani fɛn wɛrɛ ka kɛ. A yɛlɛmani bɛ jatebɔ ka sesiyɔn bɛɛ bɔ. LDAP, OAuth2, OIDC, SAML, CAS ani Sandstorm gundo daɲɛw ye u dibaga ta ye, u tɛ sɛgɛsɛgɛ.",
+  "password-length-saved": "A marara.",
+  "password-length-from-environment": "Hakɛ min sigira sɛriwɛri sigida la, o bɛ baara la; ka mara yan bɛ o yɛlɛma.",
+  "password-change-required-title": "I ka gundo daɲɛ yɛlɛma",
+  "password-change-required-text": "Nin siti in bɛ gundo daɲɛ ɲini sisan minnu sɛbɛnni bɛ __min__ bɔ ka taa a fɛ, ka i ta surun. Ka taa a fɛ, gundo daɲɛ jan sugandi. O kɔ, i ka jatebɔ ka sesiyɔn bɛɛ bɛ bɔ, ka i don tugun ni gundo daɲɛ kura ye.",
+  "password-same-as-username": "Gundo daɲɛ man kan ka kɛ baarakɛla tɔgɔ ye walima imɛli sigiyɔrɔ ye.",
   "if-you-already-have-an-account": "Ni jate b'i bolo kaban",
   "register": "I tɔgɔ sɛbɛn",
   "forgot-password": "I ɲinɛna gundo daɲɛ kɔ",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Fili waati (sekɔndi)",
   "accounts-lockout-settings-updated": "Sɛnbali kojugu kama lakana labɛnniw kuraya len don",
   "accounts-lockout-locked-users": "Baarakɛla datugulenw",
+  "admin-audit-log": "Sɛgɛsɛgɛli sɛbɛn",
+  "admin-audit-log-info": "Siti ɲɛmɔgɔw ye min kɛ: baarakɛla, donni, maarali ani labɛn yɛlɛmaniw, kuraw fɔlɔ. Gundo daɲɛw ni gundow tɛ sɛbɛn abada. A bɛ mara san kelen.",
+  "admin-audit-log-when": "Tuma",
+  "admin-audit-log-who": "Ɲɛmɔgɔ",
+  "admin-audit-log-action": "Kɛwale",
+  "admin-audit-log-details": "Kunnafoniw",
+  "admin-audit-log-empty": "Foyi ma sɛbɛn fɔlɔ.",
   "accounts-lockout-locked-users-info": "Baarakɛla minnu datugulen don sisan donni lajɛli fililen caman kosɔn",
   "accounts-lockout-no-locked-users": "Baarakɛla datugulen si tɛ sisan",
   "accounts-lockout-failed-attempts": "Lajɛli fililenw",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "Fɛn marayɔrɔ min bɛ bɛn S3 ma: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces ani wɛrɛw.",
   "s3-force-path-style": "Sira cogoya URL wajibiya",
   "s3-force-path-style-description": "A wajibi don MinIO ni non-AWS S3-compatible sɛrvɛri caman ma.",
+  "s3-sse": "Jɔyɔrɔ-masina fan fɛ gundoli",
+  "s3-sse-none": "Foyi ma ɲini (bucket ka dantigɛlen)",
+  "s3-sse-description": "S3 bɛ nɔrɔlen, avatar ani labɛn o labɛn WeKan bɛ minnu sɛbɛn, olu gundo, ka u gundo bɔ WeKan ye ni u kalanna.",
+  "s3-sse-kms-key-id": "KMS kile ID SSE-KMS kama (lankolon = jatebɔsɛbɛn ka kile dantigɛlen)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
   "azure-account-name": "Jate tɔgɔ",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Ka QR nimɔrɔ in bila dannaya porogaramu kɔnɔ (i ko Google Authenticator, Authy), o kɔ ka nimɔrɔ 6 min jirala don ka daminɛ.",
   "twoFactorAuth-manual-entry": "Walima ka nin nimɔrɔ in don aw yɛrɛ bolo la: ",
   "twoFactorAuth-confirm": "Daminɛ ani ka labɛn",
+  "two-factor-required-title": "Sɛbɛnni Fila-Dannaya labɛn",
+  "two-factor-required-text": "Siti nin bɛ Sɛbɛnni Fila-Dannaya ɲini i ka jatebɔsɛbɛn kama. A labɛn walasa ka taa a fɛ.",
   "twoFactorCode-prompt": "Aw ka nimɔrɔ 6 dannaya nimɔrɔ don",
   "twoFactorCode-submit": "Daminɛ",
   "twoFactorCode-cancel": "Dabila",

imports/i18n/data/bn.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "গতি",
   "progress": "অগ্রগতি",
   "password-again": "পাসওয়ার্ড (আবার)",
+  "password-pwned": "এই পাসওয়ার্ডটি একটি ডেটা ফাঁসে পাওয়া গেছে। অন্য একটি বেছে নিন।",
+  "password-too-short": "পাসওয়ার্ডটি কমপক্ষে __min__ অক্ষরের হতে হবে।",
+  "password-length-report-title": "পাসওয়ার্ডের দৈর্ঘ্য",
+  "password-length-report-desc": "যেসব অ্যাকাউন্ট ন্যূনতম দৈর্ঘ্যের চেয়ে ছোট পাসওয়ার্ড দিয়ে সাইন ইন করেছে। পাসওয়ার্ড কত লম্বা তা কেবল ব্রাউজারই জানে, তাই সাইন ইনের পরে এটি ছোট পাসওয়ার্ডের কথা জানায়; পাসওয়ার্ড এবং তার দৈর্ঘ্য কখনো ব্রাউজার ছেড়ে যায় না। ঠিক করা হয়েছে মানে যখন অ্যাকাউন্টের পাসওয়ার্ড পরিবর্তন করা হয়েছিল - যে অ্যাকাউন্ট আবার ছোট পাসওয়ার্ড দিয়ে সাইন ইন করে, তাকে আবার খুব ছোট হিসেবে দেখানো হয়।",
+  "password-length-no-results": "এখানে কোনো অ্যাকাউন্ট নেই।",
+  "password-length-first-login": "প্রথম লগইন",
+  "password-length-last-login": "শেষ লগইন",
+  "password-length-login-count": "লগইনের সংখ্যা",
+  "password-length-fixed": "ঠিক করা হয়েছে",
+  "password-length-filter-short": "খুব ছোট পাসওয়ার্ড",
+  "password-length-filter-fixed": "যথেষ্ট লম্বা পাসওয়ার্ডে ঠিক করা হয়েছে",
+  "password-length-filter-all": "সব",
+  "password-min-length": "ন্যূনতম পাসওয়ার্ড দৈর্ঘ্য",
+  "password-min-length-description": "ছোট পাসওয়ার্ড দিয়ে সাইন ইন করা নিচে তালিকাভুক্ত হয়। এর জন্য সাইন ইন কখনো প্রত্যাখ্যান করা হয় না।",
+  "password-min-length-enforce": "ন্যূনতম দৈর্ঘ্য বাধ্যতামূলক করুন",
+  "password-min-length-enforce-description": "ছোট নতুন পাসওয়ার্ড প্রত্যাখ্যান করা হয়, এবং যে অ্যাকাউন্ট ছোট পাসওয়ার্ড দিয়ে সাইন ইন করে তাকে অন্য কিছুর আগে সেটি পরিবর্তন করতে হবে। এটি পরিবর্তন করলে অ্যাকাউন্টের প্রতিটি সেশন থেকে সাইন আউট হয়। LDAP, OAuth2, OIDC, SAML, CAS এবং Sandstorm পাসওয়ার্ডগুলো তাদের প্রদানকারীর, এবং পরীক্ষা করা হয় না।",
+  "password-length-saved": "সংরক্ষিত হয়েছে।",
+  "password-length-from-environment": "সার্ভারের পরিবেশে সেট করা একটি মান কার্যকর রয়েছে; এখানে সংরক্ষণ করলে সেটি ওভাররাইড হয়।",
+  "password-change-required-title": "আপনার পাসওয়ার্ড পরিবর্তন করুন",
+  "password-change-required-text": "এই সাইট এখন কমপক্ষে __min__ অক্ষরের পাসওয়ার্ড চায়, এবং আপনারটি ছোট। চালিয়ে যেতে একটি লম্বা পাসওয়ার্ড বেছে নিন। তারপর আপনার অ্যাকাউন্টের প্রতিটি সেশন থেকে সাইন আউট হবে, এবং আপনি নতুন পাসওয়ার্ড দিয়ে আবার সাইন ইন করবেন।",
+  "password-same-as-username": "পাসওয়ার্ডটি ব্যবহারকারীর নাম বা ইমেইল ঠিকানা হতে পারবে না।",
   "if-you-already-have-an-account": "আপনার ইতিমধ্যে অ্যাকাউন্ট থাকলে",
   "register": "নিবন্ধন",
   "forgot-password": "পাসওয়ার্ড ভুলে গেছেন",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "ব্যর্থতা গণনার সময়সীমা (সেকেন্ড)",
   "accounts-lockout-settings-updated": "ব্রুট ফোর্স সুরক্ষা সেটিংস হালনাগাদ করা হয়েছে",
   "accounts-lockout-locked-users": "লক করা ব্যবহারকারীরা",
+  "admin-audit-log": "অডিট লগ",
+  "admin-audit-log-info": "সাইট প্রশাসকেরা যা করেছেন: ব্যবহারকারী, লগইন, স্টোরেজ ও ব্যাকআপ পরিবর্তন, নতুনগুলো আগে। পাসওয়ার্ড ও গোপন তথ্য কখনো রেকর্ড করা হয় না। এক বছর রাখা হয়।",
+  "admin-audit-log-when": "কখন",
+  "admin-audit-log-who": "প্রশাসক",
+  "admin-audit-log-action": "কাজ",
+  "admin-audit-log-details": "বিবরণ",
+  "admin-audit-log-empty": "এখনও কিছু রেকর্ড করা হয়নি।",
   "accounts-lockout-locked-users-info": "অতিরিক্ত ব্যর্থ লগইন প্রচেষ্টার কারণে বর্তমানে লক থাকা ব্যবহারকারীরা",
   "accounts-lockout-no-locked-users": "বর্তমানে কোনো লক করা ব্যবহারকারী নেই",
   "accounts-lockout-failed-attempts": "ব্যর্থ প্রচেষ্টা",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "S3-সামঞ্জস্যপূর্ণ অবজেক্ট সংরক্ষণ: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces এবং অন্যান্য।",
   "s3-force-path-style": "পাথ-স্টাইল URL বাধ্যতামূলক করুন",
   "s3-force-path-style-description": "MinIO এবং অধিকাংশ non-AWS S3-সামঞ্জস্যপূর্ণ সার্ভারের জন্য এটি প্রয়োজন।",
+  "s3-sse": "সার্ভার-সাইড এনক্রিপশন",
+  "s3-sse-none": "কিছুই অনুরোধ করা হয়নি (বাকেটের পূর্বনির্ধারিত)",
+  "s3-sse-description": "WeKan যে প্রতিটি সংযুক্তি, অবতার ও ব্যাকআপ লেখে S3 তা এনক্রিপ্ট করে, এবং পড়ার সময় WeKan-এর জন্য ডিক্রিপ্ট করে।",
+  "s3-sse-kms-key-id": "SSE-KMS-এর জন্য KMS কী আইডি (ফাঁকা = অ্যাকাউন্টের পূর্বনির্ধারিত কী)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
   "azure-account-name": "অ্যাকাউন্টের নাম",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "একটি অথেন্টিকেটর অ্যাপ (যেমন Google Authenticator, Authy) দিয়ে এই QR কোডটি স্ক্যান করুন, তারপর নিশ্চিত করতে প্রদর্শিত ৬-সংখ্যার কোডটি লিখুন।",
   "twoFactorAuth-manual-entry": "অথবা এই কোডটি ম্যানুয়ালি লিখুন: ",
   "twoFactorAuth-confirm": "নিশ্চিত করুন এবং সক্রিয় করুন",
+  "two-factor-required-title": "দ্বি-স্তর প্রমাণীকরণ সেট আপ করুন",
+  "two-factor-required-text": "এই সাইটে আপনার অ্যাকাউন্টের জন্য দ্বি-স্তর প্রমাণীকরণ প্রয়োজন। চালিয়ে যেতে এটি সেট আপ করুন।",
   "twoFactorCode-prompt": "আপনার ৬-সংখ্যার প্রমাণীকরণ কোড লিখুন",
   "twoFactorCode-submit": "যাচাই করুন",
   "twoFactorCode-cancel": "বাতিল",

imports/i18n/data/bo.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "མགྱོགས་ཚད།",
   "progress": "ཡར་རྒྱས།",
   "password-again": "གསང་ཚིག་ (ཡང་བསྐྱར་)",
+  "password-pwned": "གསང་ཨང་འདི་གནས་ཚུལ་ཕྱིར་ཐོན་ཞིག་ནང་མཐོང་ཡོད། གཞན་ཞིག་འདེམས།",
+  "password-too-short": "གསང་ཨང་ལ་ཉུང་མཐར་ཡིག་འབྲུ་ __min__ ཡོད་དགོས།",
+  "password-length-report-title": "གསང་ཨང་གི་རིང་ཚད།",
+  "password-length-report-desc": "རིང་ཚད་ཉུང་མཐའ་ལས་ཐུང་བའི་གསང་ཨང་གིས་ཐོ་འཇུག་བྱས་པའི་རྩིས་ཐོ། གསང་ཨང་ག་ཚོད་རིང་བ་ནི་བཤར་ཆས་ཁོ་ནས་ཤེས། དེར་བརྟེན་ཐོ་འཇུག་རྗེས་གསང་ཨང་ཐུང་བའི་སྐོར་སྙན་ཞུ་བྱེད། གསང་ཨང་དང་དེའི་རིང་ཚད་ནམ་ཡང་བཤར་ཆས་ནས་ཕྱིར་མི་འགྲོ། བཅོས་ཟིན་ཞེས་པ་ནི་རྩིས་ཐོའི་གསང་ཨང་བརྗེས་པའི་དུས་ཡིན། - ཡང་བསྐྱར་གསང་ཨང་ཐུང་བས་ཐོ་འཇུག་བྱེད་པའི་རྩིས་ཐོ་ནི་ཡང་བསྐྱར་ཧ་ཅང་ཐུང་བ་ལྟར་སྟོན།",
+  "password-length-no-results": "འདིར་རྩིས་ཐོ་མེད།",
+  "password-length-first-login": "ཐོ་འཇུག་ཐོག་མ།",
+  "password-length-last-login": "ཐོ་འཇུག་མཐའ་མ།",
+  "password-length-login-count": "ཐོ་འཇུག་བྱས་པའི་ཐེངས་གྲངས།",
+  "password-length-fixed": "བཅོས་ཟིན།",
+  "password-length-filter-short": "གསང་ཨང་ཧ་ཅང་ཐུང་བ།",
+  "password-length-filter-fixed": "འདང་ངེས་པའི་རིང་བའི་གསང་ཨང་དུ་བཅོས་ཟིན།",
+  "password-length-filter-all": "ཚང་མ།",
+  "password-min-length": "གསང་ཨང་གི་རིང་ཚད་ཉུང་མཐའ།",
+  "password-min-length-description": "གསང་ཨང་ཐུང་བས་ཐོ་འཇུག་བྱས་པ་འོག་ཏུ་ཐོ་འགོད་བྱེད། དེའི་རྒྱུ་མཚན་གྱིས་ཐོ་འཇུག་ནམ་ཡང་བཀག་འགོག་མི་བྱེད།",
+  "password-min-length-enforce": "རིང་ཚད་ཉུང་མཐའ་བཙན་འགེལ་བྱེད།",
+  "password-min-length-enforce-description": "གསང་ཨང་གསར་པ་ཐུང་བ་ཁས་མི་ལེན། གསང་ཨང་ཐུང་བས་ཐོ་འཇུག་བྱེད་པའི་རྩིས་ཐོས་གཞན་གང་ཡང་མ་བྱས་གོང་དེ་བརྗེ་དགོས། དེ་བརྗེས་ན་རྩིས་ཐོའི་ཐེངས་ཚང་མ་ཕྱིར་འཐེན་འགྱུར། LDAP, OAuth2, OIDC, SAML, CAS དང་ Sandstorm གི་གསང་ཨང་ནི་དེ་དག་གི་མཁོ་སྤྲོད་པའི་ཡིན་པས་ཞིབ་བཤེར་མི་བྱེད།",
+  "password-length-saved": "ཉར་ཚགས་བྱས་ཟིན།",
+  "password-length-from-environment": "ཞབས་ཞུ་འཕྲུལ་ཆས་ཀྱི་ཁོར་ཡུག་ནང་བཀོད་པའི་གྲངས་ཐང་ཞིག་ནུས་པ་ལྡན། འདིར་ཉར་ཚགས་བྱས་ན་དེ་ཚབ་བྱེད།",
+  "password-change-required-title": "ཁྱེད་ཀྱི་གསང་ཨང་བརྗེ་བ།",
+  "password-change-required-text": "དྲ་ཚིགས་འདིས་ད་ལྟ་གསང་ཨང་ལ་ཉུང་མཐར་ཡིག་འབྲུ་ __min__ དགོས་ལ། ཁྱེད་ཀྱི་དེ་ཐུང་། མུ་མཐུད་པར་རིང་བ་ཞིག་འདེམས་རོགས། དེ་ནས་ཁྱེད་ཀྱི་རྩིས་ཐོའི་ཐེངས་ཚང་མ་ཕྱིར་འཐེན་འགྱུར་ཞིང་། གསང་ཨང་གསར་པས་ཡང་བསྐྱར་ཐོ་འཇུག་བྱེད།",
+  "password-same-as-username": "གསང་ཨང་དེ་བེད་སྤྱོད་མཁན་གྱི་མིང་ངམ་གློག་འཕྲིན་ཁ་བྱང་ཡིན་མི་ཆོག",
   "if-you-already-have-an-account": "ཁྱེད་ལ་སྔོན་ནས་རྩིས་ཐོ་ཡོད་ན།",
   "register": "ཐོ་འགོད།",
   "forgot-password": "གསང་ཨང་བརྗེད་སོང་།",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "ཕམ་ཉེས་དུས་ཡུན་ (སྐར་ཆ་)",
   "accounts-lockout-settings-updated": "བཙན་འཛུལ་འགོག་སྲུང་སྒྲིག་འགོད་གསར་བཅོས་བྱས།",
   "accounts-lockout-locked-users": "བཀག་པའི་སྤྱོད་མཁན།",
+  "admin-audit-log": "ཞིབ་བཤེར་ཟིན་ཐོ།",
+  "admin-audit-log-info": "དྲ་ཚིགས་དོ་དམ་པས་བྱས་པ། བེད་སྤྱོད་མཁན། ནང་འཛུལ། ཉར་ཚགས། གྲབས་ཉར་བཅས་ཀྱི་འགྱུར་བ། གསར་ཤོས་སྔོན་ལ། གསང་ཨང་དང་གསང་བ་ནམ་ཡང་ཐོ་འགོད་མི་བྱེད། ལོ་གཅིག་ཉར་ཚགས་བྱེད།",
+  "admin-audit-log-when": "དུས་ནམ།",
+  "admin-audit-log-who": "དོ་དམ་པ།",
+  "admin-audit-log-action": "བྱ་བ།",
+  "admin-audit-log-details": "ཞིབ་ཕྲ།",
+  "admin-audit-log-empty": "ད་དུང་ཅི་ཡང་ཐོ་འགོད་བྱས་མེད།",
   "accounts-lockout-locked-users-info": "ནང་འཛུལ་ཚོད་ལྟ་ཕམ་པ་མང་དྲགས་པས་ད་ལྟ་བཀག་པའི་སྤྱོད་མཁན།",
   "accounts-lockout-no-locked-users": "ད་ལྟ་བཀག་པའི་སྤྱོད་མཁན་མེད།",
   "accounts-lockout-failed-attempts": "ཕམ་པའི་ཚོད་ལྟ།",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "S3 དང་མཐུན་པའི་དངོས་པོ་ཉར་ཚགས། AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces སོགས།",
   "s3-force-path-style": "ལམ་ལུགས་ཀྱི URL བཙན་སྤྱོད།",
   "s3-force-path-style-description": "MinIO དང་ AWS མིན་པའི S3 མཐུན་འགྱུར་ཞབས་ཞུ་མང་ཆེ་བར་དགོས།",
+  "s3-sse": "ཞབས་ཞུ་ཆས་ཕྱོགས་ཀྱི་གསང་སྦས།",
+  "s3-sse-none": "རེ་ཞུ་མེད། (bucket ཡི་སྔོན་སྒྲིག)",
+  "s3-sse-description": "WeKan གྱིས་འབྲི་བའི་མཉམ་སྦྱར་དང་། མགོ་པར། གྲབས་ཉར་ཚང་མ་ S3 ཡིས་གསང་སྦས་བྱེད་ཅིང་། ཀློག་སྐབས་ WeKan ཆེད་གསང་སྦས་གྲོལ་གྱི་ཡོད།",
+  "s3-sse-kms-key-id": "SSE-KMS ཆེད་ཀྱི་ KMS ལྡེ་མིག་ ID (སྟོང་པ = རྩིས་ཁྲའི་སྔོན་སྒྲིག་ལྡེ་མིག)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
   "azure-account-name": "རྩིས་ཐོའི་མིང་།",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "ཁས་ལེན་ཡོ་བྱད་ (དཔེར་ན Google Authenticator, Authy) ཐོག QR ཨང་རྟགས་འདི་ཀློག་བཤེར་བྱོས་ལ ངེས་གཏན་ཆེད་སྟོན་པའི་ཨང་གྲངས་ 6 ཨང་རྟགས་བཅུག་རོགས།",
   "twoFactorAuth-manual-entry": "ཡང་ན་ཨང་རྟགས་འདི་ལག་ཐོག་ནས་བཅུག: ",
   "twoFactorAuth-confirm": "ངེས་གཏན་དང་ཡོད་པར་བཟོ།",
+  "two-factor-required-title": "རྐྱེན་གཉིས་ཀྱི་ཁས་ལེན་སྒྲིག་འགོད།",
+  "two-factor-required-text": "དྲ་ཚིགས་འདིས་ཁྱེད་ཀྱི་རྩིས་ཁྲར་རྐྱེན་གཉིས་ཀྱི་ཁས་ལེན་དགོས། མུ་མཐུད་པར་དེ་སྒྲིག་འགོད་གནང་།",
   "twoFactorCode-prompt": "ཁྱེད་ཀྱི་ཨང་གྲངས་ 6 ཁས་ལེན་ཨང་རྟགས་བཅུག་རོགས།",
   "twoFactorCode-submit": "ཞིབ་བཤེར།",
   "twoFactorCode-cancel": "འདོར་བ།",

imports/i18n/data/br.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Tizhder",
   "progress": "Progres",
   "password-again": "Ger-tremen (adarre)",
+  "password-pwned": "Ar ger-tremen-mañ a zo bet gwelet en ul laeradenn roadennoù. Dibabit unan all.",
+  "password-too-short": "Ret eo d'ar ger-tremen bezañ __min__ arouezenn da nebeutañ.",
+  "password-length-report-title": "Hirder ar ger-tremen",
+  "password-length-report-desc": "Kontoù o deus kevreet gant ur ger-tremen berroc'h eget an hirder bihanañ. N'eus nemet ar merdeer a oar pegen hir eo ur ger-tremen, setu e kemenn ur ger-tremen berr goude bezañ kevreet; ar ger-tremen hag e hirder ne guitaont biskoazh anezhañ. Reizhet eo pa'z eo bet kemmet ger-tremen ar gont - ur gont a gevre en-dro gant ur ger-tremen berr a vez diskouezet en-dro evel re verr.",
+  "password-length-no-results": "Kont ebet amañ.",
+  "password-length-first-login": "Kevreadenn gentañ",
+  "password-length-last-login": "Kevreadenn ziwezhañ",
+  "password-length-login-count": "Niver a gevreadennoù",
+  "password-length-fixed": "Reizhet",
+  "password-length-filter-short": "Ger-tremen re verr",
+  "password-length-filter-fixed": "Reizhet gant ur ger-tremen hir a-walc'h",
+  "password-length-filter-all": "Pep tra",
+  "password-min-length": "Hirder bihanañ ar ger-tremen",
+  "password-min-length-description": "Kevreañ gant ur ger-tremen berroc'h a vez listennet amañ dindan. Ne vez morse nac'het ar gevreadenn evit se.",
+  "password-min-length-enforce": "Rediañ an hirder bihanañ",
+  "password-min-length-enforce-description": "Nac'het e vez ur ger-tremen nevez berroc'h, ha ret eo d'ur gont a gevre gant ur ger-tremen berroc'h e gemmañ a-raok pep tra all. E gemmañ a zigevre holl zalc'hoù ar gont. Gerioù-tremen LDAP, OAuth2, OIDC, SAML, CAS ha Sandstorm a zo d'o fourchaser, ha ne vezont ket gwiriet.",
+  "password-length-saved": "Enrollet.",
+  "password-length-from-environment": "Ur werzh termenet e endro ar servijer a zo e talvoud; enrollañ amañ a erlec'h anezhi.",
+  "password-change-required-title": "Kemmañ ho ker-tremen",
+  "password-change-required-text": "Al lec'hienn-mañ a c'houlenn bremañ gerioù-tremen gant __min__ arouezenn da nebeutañ, ha berroc'h eo hini ho kont. Dibabit unan hiroc'h evit kenderc'hel. Neuze e vo digevreet holl zalc'hoù ho kont, hag e kevreoc'h en-dro gant ar ger-tremen nevez.",
+  "password-same-as-username": "Ar ger-tremen ne c'hall ket bezañ an anv implijer pe ar chomlec'h postel.",
   "if-you-already-have-an-account": "Ma’z eus ur gont ganeoc’h dija",
   "register": "Enregistrer",
   "forgot-password": "Ger-tremen ankouaet",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Prantad kontañ ar c’hwitadennoù (eilennoù)",
   "accounts-lockout-settings-updated": "Hizivaet eo bet an arventennoù gwareziñ ouzh an nerzh kriz",
   "accounts-lockout-locked-users": "Implijerien stanket",
+  "admin-audit-log": "Marilh aodit",
+  "admin-audit-log-info": "Ar pezh o deus graet merourien al lec'hienn: kemmoù implijerien, kevreañ, stokañ ha gwaredadennoù, ar re nevesañ da gentañ. Gerioù-tremen ha sekredoù n'int biskoazh enrollet. Miret e vez e-pad ur bloaz.",
+  "admin-audit-log-when": "Pegoulz",
+  "admin-audit-log-who": "Merour",
+  "admin-audit-log-action": "Ober",
+  "admin-audit-log-details": "Munudoù",
+  "admin-audit-log-empty": "Netra enrollet c'hoazh.",
   "accounts-lockout-locked-users-info": "Implijerien stanket bremañ abalamour da re a daolioù kennaskañ c’hwitet",
   "accounts-lockout-no-locked-users": "N’eus implijer stanket ebet evit ar mare",
   "accounts-lockout-failed-attempts": "Taolioù kennaskañ c’hwitet",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "Kadaviñ objedoù keverlec'h S3: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces ha re all.",
   "s3-force-path-style": "Bountañ war an URLoù mod-treug",
   "s3-force-path-style-description": "Rekis gant MinIO hag an darn vrasañ eus ar servijerien keverlec'h S3 nann-AWS.",
+  "s3-sse": "Enrinegañ war-du ar servijer",
+  "s3-sse-none": "Netra goulennet (dre ziouer ar bucket)",
+  "s3-sse-description": "S3 a enrineg pep stagadenn, avatar ha gwaredadenn a skriv WeKan, hag o dienrineg evit WeKan pa vezont lennet.",
+  "s3-sse-kms-key-id": "ID an alc'hwez KMS evit SSE-KMS (goullo = alc'hwez dre ziouer ar gont)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Kadaviñ Microsoft Azure Blob.",
   "azure-account-name": "Anv ar gont",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Krwitit ar c'hod QR-mañ gant un arload gwiriañ (d.sk. Google Authenticator, Authy), enankit neuze ar c'hod 6 sifr a ziskouez evit kadarnaat.",
   "twoFactorAuth-manual-entry": "Pe enankit ar c'hod-mañ gant an dorn: ",
   "twoFactorAuth-confirm": "Kadarnaat ha Gweredekaat",
+  "two-factor-required-title": "Kefluniañ ar wiriekadur daou-fakter",
+  "two-factor-required-text": "Al lec'hienn-mañ a c'houlenn ar wiriekadur daou-fakter evit ho kont. Kefluniit anezhañ evit kenderc'hel.",
   "twoFactorCode-prompt": "Enankit ho kod gwiriañ 6 sifr",
   "twoFactorCode-submit": "Gwiriañ",
   "twoFactorCode-cancel": "Nullañ",

imports/i18n/data/bs.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Brzina",
   "progress": "Napredak",
   "password-again": "Lozinka (ponovo)",
+  "password-pwned": "Ova lozinka se pojavila u curenju podataka. Odaberite drugu.",
+  "password-too-short": "Lozinka mora imati najmanje __min__ znakova.",
+  "password-length-report-title": "Dužina lozinke",
+  "password-length-report-desc": "Računi koji su se prijavili lozinkom kraćom od minimalne dužine. Samo preglednik zna koliko je lozinka duga, pa nakon prijave prijavljuje kratku; lozinka i njena dužina ga nikada ne napuštaju. Popravljeno je kada je lozinka računa promijenjena - račun koji se ponovo prijavi kratkom lozinkom ponovo se prikazuje kao prekratak.",
+  "password-length-no-results": "Ovdje nema računa.",
+  "password-length-first-login": "Prva prijava",
+  "password-length-last-login": "Posljednja prijava",
+  "password-length-login-count": "Broj prijava",
+  "password-length-fixed": "Popravljeno",
+  "password-length-filter-short": "Prekratka lozinka",
+  "password-length-filter-fixed": "Popravljeno na dovoljno dugu lozinku",
+  "password-length-filter-all": "Sve",
+  "password-min-length": "Minimalna dužina lozinke",
+  "password-min-length-description": "Prijava kraćom lozinkom navedena je ispod. Prijava se zbog toga nikada ne odbija.",
+  "password-min-length-enforce": "Nametni minimalnu dužinu",
+  "password-min-length-enforce-description": "Kraća nova lozinka se odbija, a račun koji se prijavi kraćom lozinkom mora je promijeniti prije bilo čega drugog. Njena promjena odjavljuje svaku sesiju računa. LDAP, OAuth2, OIDC, SAML, CAS i Sandstorm lozinke pripadaju njihovom pružaocu i ne provjeravaju se.",
+  "password-length-saved": "Sačuvano.",
+  "password-length-from-environment": "Na snazi je vrijednost postavljena u okruženju servera; čuvanje ovdje je zamjenjuje.",
+  "password-change-required-title": "Promijenite svoju lozinku",
+  "password-change-required-text": "Ova stranica sada zahtijeva lozinke od najmanje __min__ znakova, a vaša je kraća. Odaberite dužu da nastavite. Tada se svaka sesija vašeg računa odjavljuje, a vi se ponovo prijavljujete novom lozinkom.",
+  "password-same-as-username": "Lozinka ne smije biti korisničko ime niti adresa e-pošte.",
   "if-you-already-have-an-account": "Ako već imate račun",
   "register": "Registruj se",
   "forgot-password": "Zaboravljena lozinka",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Vremenski okvir neuspjelih pokušaja (sekunde)",
   "accounts-lockout-settings-updated": "Postavke zaštite od napada grubom silom su ažurirane",
   "accounts-lockout-locked-users": "Zaključani korisnici",
+  "admin-audit-log": "Dnevnik revizije",
+  "admin-audit-log-info": "Šta su radili administratori stranice: promjene korisnika, prijava, pohrane i sigurnosnih kopija, najnovije prvo. Lozinke i tajne se nikad ne bilježe. Čuva se godinu dana.",
+  "admin-audit-log-when": "Kada",
+  "admin-audit-log-who": "Upravitelj",
+  "admin-audit-log-action": "Radnja",
+  "admin-audit-log-details": "Detalji",
+  "admin-audit-log-empty": "Još ništa nije zabilježeno.",
   "accounts-lockout-locked-users-info": "Korisnici trenutno zaključani zbog previše neuspjelih pokušaja prijave",
   "accounts-lockout-no-locked-users": "Trenutno nema zaključanih korisnika",
   "accounts-lockout-failed-attempts": "Neuspjeli pokušaji",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "Objektno pohranjivanje kompatibilno s S3: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces i drugi.",
   "s3-force-path-style": "Prisili URL-ove u stilu putanje",
   "s3-force-path-style-description": "Potrebno za MinIO i većinu servera kompatibilnih s S3 koji nisu AWS.",
+  "s3-sse": "Šifriranje na strani servera",
+  "s3-sse-none": "Ništa nije zatraženo (zadana postavka bucketa)",
+  "s3-sse-description": "S3 šifrira svaki prilog, avatar i sigurnosnu kopiju koje WeKan zapiše, i dešifrira ih za WeKan pri čitanju.",
+  "s3-sse-kms-key-id": "ID KMS ključa za SSE-KMS (prazno = zadani ključ računa)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
   "azure-account-name": "Naziv računa",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Skenirajte ovaj QR kod aplikacijom za autentifikaciju (npr. Google Authenticator, Authy), a zatim unesite prikazani šestocifreni kod da potvrdite.",
   "twoFactorAuth-manual-entry": "Ili ručno unesite ovaj kod: ",
   "twoFactorAuth-confirm": "Potvrdi i omogući",
+  "two-factor-required-title": "Postavite dvofaktorsku autentifikaciju",
+  "two-factor-required-text": "Ova stranica zahtijeva dvofaktorsku autentifikaciju za vaš račun. Postavite je da biste nastavili.",
   "twoFactorCode-prompt": "Unesite svoj šestocifreni kod za autentifikaciju",
   "twoFactorCode-submit": "Proveri",
   "twoFactorCode-cancel": "Otkaži",

imports/i18n/data/bua.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Хурдан",
   "progress": "Ябаса",
   "password-again": "Нюуса үгэ (дахин)",
+  "password-pwned": "Энэ нюуса үгэ мэдээсэлэй алдагдалда харагдаһан байна. Ондоо нюуса үгэ шэлэгты.",
+  "password-too-short": "Нюуса үгэ хамгийн багаар __min__ тэмдэгтэй байха ёһотой.",
+  "password-length-report-title": "Нюуса үгын урта",
+  "password-length-report-desc": "Хамгийн багань уртаһаа богони нюуса үгөөр нэбтэрһэн дансанууд. Нюуса үгын хэр урта байһые зүгөөр браузер мэдэнэ, тиимэһээ нэбтэрһэнэй һүүлдэ богони нюуса үгэ тухай мэдээсэнэ; нюуса үгэ болон тэрэнэй урта хэзээшье браузерһаа гарадаггүй. Заһагдаһан гэдэг хадаа дансын нюуса үгэ һэлгэгдэһэн саг - дахин богони нюуса үгөөр нэбтэрдэг данс дахин хэтэ богони гэжэ харуулагдана.",
+  "password-length-no-results": "Энээндэ данс үгы.",
+  "password-length-first-login": "Түрүүшын нэбтэрхэ",
+  "password-length-last-login": "Һүүлшын нэбтэрхэ",
+  "password-length-login-count": "Нэбтэрһэн тоо",
+  "password-length-fixed": "Заһагдаһан",
+  "password-length-filter-short": "Хэтэ богони нюуса үгэ",
+  "password-length-filter-fixed": "Хүрэлсэтэй урта нюуса үгэдэ заһагдаһан",
+  "password-length-filter-all": "Бүгэдэ",
+  "password-min-length": "Нюуса үгын хамгийн багань урта",
+  "password-min-length-description": "Богони нюуса үгөөр нэбтэрхэ доро жагсаагдана. Тэрэнэй түлөө нэбтэрхые хэзээшье буруушаадаггүй.",
+  "password-min-length-enforce": "Хамгийн багань уртые заабал болгохо",
+  "password-min-length-enforce-description": "Богони шэнэ нюуса үгые буруушаана, богони нюуса үгөөр нэбтэрдэг данс бусад юумэнэй урда тэрээнээ һэлгэхэ ёһотой. Тэрээнээ һэлгэхэдэ дансын бүхы сесси гарана. LDAP, OAuth2, OIDC, SAML, CAS болон Sandstorm нюуса үгэнүүд өөһэдынгөө үйлсэлэгшын юм, шалгагдадаггүй.",
+  "password-length-saved": "Хадагалагдаба.",
+  "password-length-from-environment": "Серверэй орондо табигдаһан утга хүсэндөө байна; энээндэ хадагалха хадаа тэрээниие һэлгэнэ.",
+  "password-change-required-title": "Нюуса үгөө һэлгэгты",
+  "password-change-required-text": "Энэ сайт мүнөө хамгийн багаар __min__ тэмдэгтэй нюуса үгэ эрэнэ, харин таниие богони. Үргэлжэлүүлхын тула уртатай нюуса үгэ шэлэгты. Тиигээд таны дансын бүхы сесси гарана, та шэнэ нюуса үгөөр дахин нэбтэрхэт.",
+  "password-same-as-username": "Нюуса үгэ хэрэглэгшын нэрэ гү, али сахим захидалай хаяг байха ёһогүй.",
   "if-you-already-have-an-account": "Хэрбээ та бүридхэлтэй һаа",
   "register": "Бүридхүүлхэ",
   "forgot-password": "Нюуса үгэеэ мартаа гүт",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Бүтэсэгүй туршалтын хугацаа (секунда)",
   "accounts-lockout-settings-updated": "Хүсоор тааха добтолгоһоо хамгаалгын тохируулганууд шэнэлэгдэбэ",
   "accounts-lockout-locked-users": "Хаалтатай хэрэглэгчэд",
+  "admin-audit-log": "Шалгалтын дэбтэр",
+  "admin-audit-log-info": "Сайтын захирагшад юу хэһэн: хэрэглэгшэ, оролго, хадагалалга болон нөөсэ хуулгын хубилалтанууд, эгээл шэнэнь түрүүн. Нюуса үгэнүүд болон нюусанууд хэзээшье бэшэгдэдэггүй. Нэгэ жэл хадагалагдана.",
+  "admin-audit-log-when": "Хэзээ",
+  "admin-audit-log-who": "Захирагша",
+  "admin-audit-log-action": "Үйлэ",
+  "admin-audit-log-details": "Дэлгэрэнгы",
+  "admin-audit-log-empty": "Одоохондоо юушье бэшэгдээгүй.",
   "accounts-lockout-locked-users-info": "Олон бүтэсэгүй нэбтэрэлгын туршалтаһаа боложо мүнөө хаалтатай хэрэглэгчэд",
   "accounts-lockout-no-locked-users": "Мүнөө хаалтатай хэрэглэгчэд үгы",
   "accounts-lockout-failed-attempts": "Бүтэсэгүй туршалтанууд",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "S3-тай таарама объект хадагалалга: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces болон бусад.",
   "s3-force-path-style": "Замай маягай URL албадхаха",
   "s3-force-path-style-description": "MinIO ба AWS бэшэ ехэнхи S3-таараха сервернүүдтэ хэрэгтэй.",
+  "s3-sse": "Сервер талын шифрлэлгэ",
+  "s3-sse-none": "Гуйгдаагүй (bucket-эй үндэһэн тохиргоо)",
+  "s3-sse-description": "S3 WeKan-ай бэшэдэг хабсаргалта, аватар, нөөсэ хуулга бүхэниие шифрлэжэ, уншахада WeKan-да тайлажа үгэдэг.",
+  "s3-sse-kms-key-id": "SSE-KMS-дэ KMS түлхюурэй ID (хооһон = дансын үндэһэн түлхюур)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
   "azure-account-name": "Бүридхэлэй нэрэ",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Энэ QR-кодые баталгаажуулгын аппагаар (Google Authenticator, Authy г.м.) уншуулаад, удаань харуулагдаhан 6 тооной кодые баталгаажуулхаяа оруулагты.",
   "twoFactorAuth-manual-entry": "Али болбол энэ кодые гараараа оруулагты: ",
   "twoFactorAuth-confirm": "Баталгаажуулха ба hэргээхэ",
+  "two-factor-required-title": "Хоёр-фактортой баталгаажуулга тохирхо",
+  "two-factor-required-text": "Энэ сайт таанай дансада хоёр-фактортой баталгаажуулга эрилдэг. Үргэлжэлүүлхын тула тохируулагты.",
   "twoFactorCode-prompt": "6 тооной баталгаажуулгын кодоо оруулагты",
   "twoFactorCode-submit": "Баталгаажуулха",
   "twoFactorCode-cancel": "Болюулха",

imports/i18n/data/ca.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Velocitat",
   "progress": "Progrés",
   "password-again": "Repeteix la contrasenya",
+  "password-pwned": "Aquesta contrasenya ha aparegut en una filtració de dades. Tria'n una altra.",
+  "password-too-short": "La contrasenya ha de tenir com a mínim __min__ caràcters.",
+  "password-length-report-title": "Longitud de la contrasenya",
+  "password-length-report-desc": "Comptes que han iniciat la sessió amb una contrasenya més curta que la longitud mínima. Només el navegador sap com de llarga és una contrasenya, així que n'informa d'una de curta després d'iniciar la sessió; la contrasenya i la seva longitud no en surten mai. Corregit és quan es va canviar la contrasenya del compte - un compte que torna a iniciar la sessió amb una contrasenya curta es torna a mostrar com a massa curta.",
+  "password-length-no-results": "Aquí no hi ha cap compte.",
+  "password-length-first-login": "Primer inici de sessió",
+  "password-length-last-login": "Últim inici de sessió",
+  "password-length-login-count": "Vegades que ha iniciat la sessió",
+  "password-length-fixed": "Corregit",
+  "password-length-filter-short": "Contrasenya massa curta",
+  "password-length-filter-fixed": "Corregit a una contrasenya prou llarga",
+  "password-length-filter-all": "Tots",
+  "password-min-length": "Longitud mínima de la contrasenya",
+  "password-min-length-description": "Iniciar la sessió amb una contrasenya més curta es llista a continuació. Mai no es denega l'inici de sessió per això.",
+  "password-min-length-enforce": "Imposa la longitud mínima",
+  "password-min-length-enforce-description": "Es rebutja una contrasenya nova més curta, i un compte que inicia la sessió amb una contrasenya més curta l'ha de canviar abans de res més. Canviar-la tanca totes les sessions del compte. Les contrasenyes de LDAP, OAuth2, OIDC, SAML, CAS i Sandstorm són del seu proveïdor i no es comproven.",
+  "password-length-saved": "S'ha desat.",
+  "password-length-from-environment": "Hi ha en vigor un valor establert a l'entorn del servidor; desar aquí el substitueix.",
+  "password-change-required-title": "Canvieu la contrasenya",
+  "password-change-required-text": "Aquest lloc ara requereix contrasenyes d'almenys __min__ caràcters, i la vostra és més curta. Trieu-ne una de més llarga per continuar. Després es tancaran totes les sessions del vostre compte, i tornareu a iniciar la sessió amb la contrasenya nova.",
+  "password-same-as-username": "La contrasenya no pot ser el nom d'usuari ni l'adreça de correu electrònic.",
   "if-you-already-have-an-account": "Si ja tens un compte",
   "register": "Registra't",
   "forgot-password": "Has oblidat la contrasenya",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Finestra d'errors (segons)",
   "accounts-lockout-settings-updated": "S'ha actualitzat la configuració de la protecció contra força bruta",
   "accounts-lockout-locked-users": "Usuaris bloquejats",
+  "admin-audit-log": "Registre d'auditoria",
+  "admin-audit-log-info": "Què han fet els administradors del lloc: canvis d'usuaris, d'inici de sessió, d'emmagatzematge i de còpies de seguretat, els més recents primer. Les contrasenyes i els secrets no es registren mai. Es conserva durant un any.",
+  "admin-audit-log-when": "Quan",
+  "admin-audit-log-who": "Administrador",
+  "admin-audit-log-action": "Acció",
+  "admin-audit-log-details": "Detalls",
+  "admin-audit-log-empty": "Encara no s'ha registrat res.",
   "accounts-lockout-locked-users-info": "Usuaris actualment bloquejats per massa intents d'inici de sessió fallits",
   "accounts-lockout-no-locked-users": "Actualment no hi ha usuaris bloquejats",
   "accounts-lockout-failed-attempts": "Intents fallits",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "Emmagatzematge d'objectes compatible amb S3: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces i altres.",
   "s3-force-path-style": "Força els URL d'estil de camí",
   "s3-force-path-style-description": "Requerit per MinIO i la majoria de servidors compatibles amb S3 que no són d'AWS.",
+  "s3-sse": "Xifratge al costat del servidor",
+  "s3-sse-none": "Cap sol·licitat (el valor per defecte del bucket)",
+  "s3-sse-description": "S3 xifra cada adjunt, avatar i còpia de seguretat que escriu WeKan, i el desxifra per a WeKan quan es llegeix.",
+  "s3-sse-kms-key-id": "ID de la clau KMS per a SSE-KMS (buit = la clau per defecte del compte)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
   "azure-account-name": "Nom del compte",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Escanegeu aquest codi QR amb una aplicació d'autenticació (p. ex. Google Authenticator, Authy) i després introduïu el codi de 6 dígits mostrat per confirmar.",
   "twoFactorAuth-manual-entry": "O introduïu aquest codi manualment: ",
   "twoFactorAuth-confirm": "Confirma i activa",
+  "two-factor-required-title": "Configura l'autenticació de dos factors",
+  "two-factor-required-text": "Aquest lloc requereix l'autenticació de dos factors per al teu compte. Configura-la per continuar.",
   "twoFactorCode-prompt": "Introduïu el vostre codi d'autenticació de 6 dígits",
   "twoFactorCode-submit": "Verifica",
   "twoFactorCode-cancel": "Cancel·la",

imports/i18n/data/ca@valencia.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Velocitat",
   "progress": "Progrés",
   "password-again": "Repeteix la contrasenya",
+  "password-pwned": "Aquesta contrasenya ha aparegut en una filtració de dades. Trieu-ne una altra.",
+  "password-too-short": "La contrasenya ha de tindre almenys __min__ caràcters.",
+  "password-length-report-title": "Longitud de la contrasenya",
+  "password-length-report-desc": "Comptes que han iniciat la sessió amb una contrasenya més curta que la longitud mínima. Només el navegador sap com de llarga és una contrasenya, així que n'informa d'una de curta després d'iniciar la sessió; la contrasenya i la seua longitud no n'ixen mai. Corregit és quan es va canviar la contrasenya del compte - un compte que torna a iniciar la sessió amb una contrasenya curta es torna a mostrar com a massa curta.",
+  "password-length-no-results": "Ací no hi ha cap compte.",
+  "password-length-first-login": "Primer inici de sessió",
+  "password-length-last-login": "Últim inici de sessió",
+  "password-length-login-count": "Voltes que ha iniciat la sessió",
+  "password-length-fixed": "Corregit",
+  "password-length-filter-short": "Contrasenya massa curta",
+  "password-length-filter-fixed": "Corregit a una contrasenya prou llarga",
+  "password-length-filter-all": "Tots",
+  "password-min-length": "Longitud mínima de la contrasenya",
+  "password-min-length-description": "Iniciar la sessió amb una contrasenya més curta es llista a continuació. Mai no es denega l'inici de sessió per això.",
+  "password-min-length-enforce": "Imposa la longitud mínima",
+  "password-min-length-enforce-description": "Es rebutja una contrasenya nova més curta, i un compte que inicia la sessió amb una contrasenya més curta l'ha de canviar abans de res més. Canviar-la tanca totes les sessions del compte. Les contrasenyes de LDAP, OAuth2, OIDC, SAML, CAS i Sandstorm són del seu proveïdor i no es comproven.",
+  "password-length-saved": "S'ha desat.",
+  "password-length-from-environment": "Hi ha en vigor un valor establit a l'entorn del servidor; desar ací el substituïx.",
+  "password-change-required-title": "Canvieu la contrasenya",
+  "password-change-required-text": "Este lloc ara requerix contrasenyes d'almenys __min__ caràcters, i la vostra és més curta. Trieu-ne una de més llarga per a continuar. Després es tancaran totes les sessions del vostre compte, i tornareu a iniciar la sessió amb la contrasenya nova.",
+  "password-same-as-username": "La contrasenya no pot ser el nom d'usuari ni l'adreça de correu electrònic.",
   "if-you-already-have-an-account": "Si ja tens un compte",
   "register": "Registra't",
   "forgot-password": "Has oblidat la contrasenya",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Finestra d'errors (segons)",
   "accounts-lockout-settings-updated": "S'ha actualitzat la configuració de la protecció contra força bruta",
   "accounts-lockout-locked-users": "Usuaris bloquejats",
+  "admin-audit-log": "Registre d'auditoria",
+  "admin-audit-log-info": "Què han fet els administradors del lloc: canvis d'usuaris, d'inici de sessió, d'emmagatzematge i de còpies de seguretat, primer els més recents. Les contrasenyes i els secrets no es registren mai. Es conserva durant un any.",
+  "admin-audit-log-when": "Quan",
+  "admin-audit-log-who": "Administrador",
+  "admin-audit-log-action": "Acció",
+  "admin-audit-log-details": "Detalls",
+  "admin-audit-log-empty": "Encara no s'ha registrat res.",
   "accounts-lockout-locked-users-info": "Usuaris actualment bloquejats per massa intents d'inici de sessió fallits",
   "accounts-lockout-no-locked-users": "Actualment no hi ha usuaris bloquejats",
   "accounts-lockout-failed-attempts": "Intents fallits",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "Emmagatzematge d'objectes compatible amb S3: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces i altres.",
   "s3-force-path-style": "Força els URL d'estil de camí",
   "s3-force-path-style-description": "Requerit per MinIO i la majoria de servidors compatibles amb S3 que no són d'AWS.",
+  "s3-sse": "Xifratge al costat del servidor",
+  "s3-sse-none": "No se'n sol·licita cap (el predeterminat del bucket)",
+  "s3-sse-description": "S3 xifra cada adjunt, avatar i còpia de seguretat que escriu WeKan, i el desxifra per a WeKan quan es llig.",
+  "s3-sse-kms-key-id": "ID de la clau KMS per a SSE-KMS (buit = la clau predeterminada del compte)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
   "azure-account-name": "Nom del compte",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Escanegeu aquest codi QR amb una aplicació d'autenticació (p. ex. Google Authenticator, Authy) i després introduïu el codi de 6 dígits mostrat per confirmar.",
   "twoFactorAuth-manual-entry": "O introduïu aquest codi manualment: ",
   "twoFactorAuth-confirm": "Confirma i activa",
+  "two-factor-required-title": "Configureu l'autenticació de dos factors",
+  "two-factor-required-text": "Aquest lloc requereix l'autenticació de dos factors per al vostre compte. Configureu-la per a continuar.",
   "twoFactorCode-prompt": "Introduïu el vostre codi d'autenticació de 6 dígits",
   "twoFactorCode-submit": "Verifica",
   "twoFactorCode-cancel": "Cancel·la",

imports/i18n/data/ca_ES.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Velocitat",
   "progress": "Progrés",
   "password-again": "Repeteix la contrasenya",
+  "password-pwned": "Aquesta contrasenya ha aparegut en una filtració de dades. Tria'n una altra.",
+  "password-too-short": "La contrasenya ha de tenir com a mínim __min__ caràcters.",
+  "password-length-report-title": "Longitud de la contrasenya",
+  "password-length-report-desc": "Comptes que han iniciat la sessió amb una contrasenya més curta que la longitud mínima. Només el navegador sap com de llarga és una contrasenya, així que n'informa d'una de curta després d'iniciar la sessió; la contrasenya i la seva longitud no en surten mai. Corregit és quan es va canviar la contrasenya del compte - un compte que torna a iniciar la sessió amb una contrasenya curta es torna a mostrar com a massa curta.",
+  "password-length-no-results": "Aquí no hi ha cap compte.",
+  "password-length-first-login": "Primer inici de sessió",
+  "password-length-last-login": "Últim inici de sessió",
+  "password-length-login-count": "Vegades que ha iniciat la sessió",
+  "password-length-fixed": "Corregit",
+  "password-length-filter-short": "Contrasenya massa curta",
+  "password-length-filter-fixed": "Corregit a una contrasenya prou llarga",
+  "password-length-filter-all": "Tots",
+  "password-min-length": "Longitud mínima de la contrasenya",
+  "password-min-length-description": "Iniciar la sessió amb una contrasenya més curta es llista a continuació. Mai no es denega l'inici de sessió per això.",
+  "password-min-length-enforce": "Imposa la longitud mínima",
+  "password-min-length-enforce-description": "Es rebutja una contrasenya nova més curta, i un compte que inicia la sessió amb una contrasenya més curta l'ha de canviar abans de res més. Canviar-la tanca totes les sessions del compte. Les contrasenyes de LDAP, OAuth2, OIDC, SAML, CAS i Sandstorm són del seu proveïdor i no es comproven.",
+  "password-length-saved": "S'ha desat.",
+  "password-length-from-environment": "Hi ha en vigor un valor establert a l'entorn del servidor; desar aquí el substitueix.",
+  "password-change-required-title": "Canvieu la contrasenya",
+  "password-change-required-text": "Aquest lloc ara requereix contrasenyes d'almenys __min__ caràcters, i la vostra és més curta. Trieu-ne una de més llarga per continuar. Després es tancaran totes les sessions del vostre compte, i tornareu a iniciar la sessió amb la contrasenya nova.",
+  "password-same-as-username": "La contrasenya no pot ser el nom d'usuari ni l'adreça de correu electrònic.",
   "if-you-already-have-an-account": "Si ja tens un compte",
   "register": "Registra't",
   "forgot-password": "Has oblidat la contrasenya",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Finestra d'errors (segons)",
   "accounts-lockout-settings-updated": "S'ha actualitzat la configuració de la protecció contra força bruta",
   "accounts-lockout-locked-users": "Usuaris bloquejats",
+  "admin-audit-log": "Registre d'auditoria",
+  "admin-audit-log-info": "Què han fet els administradors del lloc: canvis d'usuaris, d'inici de sessió, d'emmagatzematge i de còpies de seguretat, els més recents primer. Les contrasenyes i els secrets no es registren mai. Es conserva durant un any.",
+  "admin-audit-log-when": "Quan",
+  "admin-audit-log-who": "Administrador",
+  "admin-audit-log-action": "Acció",
+  "admin-audit-log-details": "Detalls",
+  "admin-audit-log-empty": "Encara no s'ha registrat res.",
   "accounts-lockout-locked-users-info": "Usuaris actualment bloquejats per massa intents d'inici de sessió fallits",
   "accounts-lockout-no-locked-users": "Actualment no hi ha usuaris bloquejats",
   "accounts-lockout-failed-attempts": "Intents fallits",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "Emmagatzematge d'objectes compatible amb S3: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces i altres.",
   "s3-force-path-style": "Força els URL d'estil de camí",
   "s3-force-path-style-description": "Requerit per MinIO i la majoria de servidors compatibles amb S3 que no són d'AWS.",
+  "s3-sse": "Xifratge al costat del servidor",
+  "s3-sse-none": "Cap sol·licitat (el valor per defecte del bucket)",
+  "s3-sse-description": "S3 xifra cada adjunt, avatar i còpia de seguretat que escriu WeKan, i el desxifra per a WeKan quan es llegeix.",
+  "s3-sse-kms-key-id": "ID de la clau KMS per a SSE-KMS (buit = la clau per defecte del compte)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
   "azure-account-name": "Nom del compte",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Escanegeu aquest codi QR amb una aplicació d'autenticació (p. ex. Google Authenticator, Authy) i després introduïu el codi de 6 dígits mostrat per confirmar.",
   "twoFactorAuth-manual-entry": "O introduïu aquest codi manualment: ",
   "twoFactorAuth-confirm": "Confirma i activa",
+  "two-factor-required-title": "Configura l'autenticació de dos factors",
+  "two-factor-required-text": "Aquest lloc requereix l'autenticació de dos factors per al teu compte. Configura-la per continuar.",
   "twoFactorCode-prompt": "Introduïu el vostre codi d'autenticació de 6 dígits",
   "twoFactorCode-submit": "Verifica",
   "twoFactorCode-cancel": "Cancel·la",

imports/i18n/data/chr.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "ᎤᏟ ᎢᏯᏗᏍᎩ",
   "progress": "ᎢᎬᏱ ᎠᏫᏒ",
   "password-again": "ᎤᏕᎵᏛ ᎪᏪᎵ (ᏔᎵᏁ)",
+  "password-pwned": "ᎯᎠ ᎦᎵᏍᎦᏂ ᎧᏁᏬᏍᏗ ᎤᏓᏂᏴᏒ ᏗᎪᏪᎵ ᎠᏰᎵ ᎤᎾᏄᎪᏤ. ᏅᏩᏓᎴ ᏑᏰᏍᎨᏍᏗ.",
+  "password-too-short": "ᎦᎵᏍᎦᏂ ᎧᏁᏬᏍᏗ __min__ ᏗᎪᏪᎶᏗ ᎢᎦᎢ ᎨᏎᏍᏗ.",
+  "password-length-report-title": "ᎦᎵᏍᎦᏂ ᎧᏁᏬᏍᏗ ᎦᏅᎯᏛ",
+  "password-length-report-desc": "ᏗᎪᏪᎵᏙᏗ ᎤᏴᏍᏗ ᎤᏍᏗ ᎦᎵᏍᎦᏂ ᎧᏁᏬᏍᏗ ᎬᏗ. ᎠᏓᏩᏛᏍᎩ ᎤᏩᏒ ᎠᎦᏔᎲ ᎢᎦᏛ ᎦᏅᎯᏛ ᎦᎵᏍᎦᏂ ᎧᏁᏬᏍᏗ; ᎦᎵᏍᎦᏂ ᎧᏁᏬᏍᏗ ᎠᎴ ᎦᏅᎯᏛ ᎥᏝ ᎢᎸᎯᏳ ᏳᏄᎪᎢ. ᎣᏍᏛ ᎢᎬᏁᎸ ᎦᎵᏍᎦᏂ ᎧᏁᏬᏍᏗ ᎤᏁᏟᏴᏒ ᎨᏒᎢ - ᎤᏍᏗ ᎦᎵᏍᎦᏂ ᎧᏁᏬᏍᏗ ᏔᎵᏁ ᎤᏴᏍᏗ ᏔᎵᏁ ᎤᏍᏗ ᎢᎦᎵᏍᏙᏗ.",
+  "password-length-no-results": "ᎥᏝ ᏗᎪᏪᎵᏙᏗ ᎠᏂ.",
+  "password-length-first-login": "ᎢᎬᏱ ᎤᏴᏍᏗ",
+  "password-length-last-login": "ᎤᎵᏍᏆᎸᏗ ᎤᏴᏍᏗ",
+  "password-length-login-count": "ᎢᎳᏪ ᎤᏴᏍᏗ",
+  "password-length-fixed": "ᎣᏍᏛ ᎢᎬᏁᎸ",
+  "password-length-filter-short": "ᎤᏍᏗ ᎦᎵᏍᎦᏂ ᎧᏁᏬᏍᏗ",
+  "password-length-filter-fixed": "ᎣᏍᏛ ᎢᎬᏁᎸ ᎦᏅᎯᏛ ᎦᎵᏍᎦᏂ ᎧᏁᏬᏍᏗ",
+  "password-length-filter-all": "ᏂᎦᏛ",
+  "password-min-length": "ᎤᏍᏗᎩᏛ ᎦᎵᏍᎦᏂ ᎧᏁᏬᏍᏗ ᎦᏅᎯᏛ",
+  "password-min-length-description": "ᎤᏴᏍᏗ ᎤᏍᏗ ᎦᎵᏍᎦᏂ ᎧᏁᏬᏍᏗ ᎬᏗ ᎡᎳᏗ ᏕᎪᏪᎸ. ᎤᏴᏍᏗ ᎥᏝ ᎢᎸᎯᏳ ᏳᏲᎢᏍᏗ.",
+  "password-min-length-enforce": "ᎤᏍᏗᎩᏛ ᎦᏅᎯᏛ ᎠᏎ ᎢᎬᏛᏁᏗ",
+  "password-min-length-enforce-description": "ᎢᏤ ᎤᏍᏗ ᎦᎵᏍᎦᏂ ᎧᏁᏬᏍᏗ ᎥᏝ ᏰᎵ, ᎠᎴ ᎪᏪᎵᏙᏗ ᎤᏴᏍᏗ ᎤᏍᏗ ᎦᎵᏍᎦᏂ ᎧᏁᏬᏍᏗ ᎬᏗ ᎠᏎ ᎤᏁᏟᏴᏍᏗ ᎢᎬᏱ. ᎤᏁᏟᏴᏍᏗ ᏂᎦᏛ ᎪᏪᎵᏙᏗ ᎤᏄᎪᎢᏍᏗ. LDAP, OAuth2, OIDC, SAML, CAS ᎠᎴ Sandstorm ᎦᎵᏍᎦᏂ ᎧᏁᏬᏍᏗ ᎤᏅᏒ ᎤᎾᏤᎵ, ᎥᏝ ᏱᏓᏛᏛᎲᏍᎪ.",
+  "password-length-saved": "ᎠᏍᏆᏂᎪᏔᏅ.",
+  "password-length-from-environment": "ᎦᏙ ᎠᏓᏁᏗ ᎤᏁᏟᏴᏒ ᏗᎦᏙᏗ ᎦᎾᏄᎪᏫᏍᎩ ᎤᏓᏁᎸ; ᎠᏂ ᎯᏍᏆᏂᎪᏓ ᎤᏁᏟᏴᏍᏗ ᎾᏍᎩ.",
+  "password-change-required-title": "ᎦᎵᏍᎦᏂ ᎧᏁᏬᏍᏗ ᎯᏁᏟᏴᏓ",
+  "password-change-required-text": "ᎯᎠ ᎠᏓᏁᏗ ᎪᎯ ᎤᏚᎵᏍᎪ ᎦᎵᏍᎦᏂ ᎧᏁᏬᏍᏗ __min__ ᏗᎪᏪᎶᏗ ᎢᎦᎢ, ᎠᎴ ᏣᏤᎵ ᎤᏍᏗ. ᎦᏅᎯᏛ ᏣᏑᏰᏍᏗ ᏣᎵᏍᏓᏴᏗ. ᎿᏉ ᏂᎦᏛ ᏣᏤᎵ ᎪᏪᎵᏙᏗ ᎤᏄᎪᎢᏍᏗ, ᎠᎴ ᏔᎵᏁ ᏣᏴᏍᏗ ᎢᏤ ᎦᎵᏍᎦᏂ ᎧᏁᏬᏍᏗ ᎬᏗ.",
+  "password-same-as-username": "ᎦᎵᏍᎦᏂ ᎧᏁᏬᏍᏗ ᎥᏝ ᎤᏬᏢᏗ ᏚᏙᎥ ᎠᎴ ᏗᎦᎵᏦᏙᏗ ᏚᏙᎥ ᏱᎨᏎᏍᏗ.",
   "if-you-already-have-an-account": "ᎦᏳᎳ ᎠᏎᎸ ᏱᏣᎭ",
   "register": "ᎠᏓᏙᎥᏍᏙᏗ",
   "forgot-password": "ᎦᎵᏍᎦᏂ ᎧᏁᏬᏍᏗ ᎡᏣᏅᏔᏅ",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "ᎤᏍᎦᏅᏨ ᎢᎪᎯᏓ (ᏗᎧᏔᏬᏍᏔᏅ)",
   "accounts-lockout-settings-updated": "ᎤᎵᏂᎩᏛ ᎠᏴᎯᎲ ᎠᏍᏆᏂᎪᏙᏗ ᏗᎧᎿᏩᏛᏍᏗ ᏗᏁᏟᏴᏍᏔᏅ",
   "accounts-lockout-locked-users": "ᎠᏍᏚᏅ ᎬᏗᏍᎩ",
+  "admin-audit-log": "ᎠᎦᏔᎲᏍᎩ ᎪᏪᎵ",
+  "admin-audit-log-info": "ᎠᏓᏘᏂᏙᎯ ᏄᎾᏛᏁᎸ: ᎤᏬᏢᏗ, ᎾᏂᏴᏍᏗ, ᎠᏍᏆᏂᎪᏙᏗ ᎠᎴ ᎤᏠᏯᏍᏗ ᏧᏁᏟᏴᏒ, ᎢᏤ ᎢᎬᏱ. ᎦᎵᏍᎦᏂ ᏗᎧᏁᏬᏍᏗ ᎠᎴ ᎤᏕᎵᏒ ᎥᏝ ᎢᎸᎯᏳ ᏯᏂᏃᏪᎳ. ᏌᏊ ᎤᏕᏘᏴᏌᏗᏒ ᏗᏍᏆᏂᎪᏙᏗ.",
+  "admin-audit-log-when": "ᎢᏳᏃ",
+  "admin-audit-log-who": "ᎠᏓᏘᏂᏙᎯ",
+  "admin-audit-log-action": "ᏚᎸᏫᏍᏓᏁᎸ",
+  "admin-audit-log-details": "ᎤᏍᏗ ᎧᏃᎮᏓ",
+  "admin-audit-log-empty": "ᎥᏝ ᎪᎱᏍᏗ ᎠᏏ ᏯᏃᏪᎳ.",
   "accounts-lockout-locked-users-info": "ᎪᎯ ᎠᏍᏚᏅ ᎬᏗᏍᎩ ᎤᏂᏣᏘ ᎤᏍᎦᏅᏨ ᎠᏴᎯᎲ ᎤᏁᎬ",
   "accounts-lockout-no-locked-users": "ᎪᎯ ᎠᏍᏚᏅ ᎬᏗᏍᎩ Ꮭ ᎠᏁᎭ",
   "accounts-lockout-failed-attempts": "ᎤᏍᎦᏅᏨ ᎤᏁᎬ",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "S3 ᏚᏓᏟᎶᏍᏗ ᏗᏍᏆᏂᎪᏙᏗ: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces ᎠᎴ ᏅᏩᏓᎴ.",
   "s3-force-path-style": "Path-style URLs ᎠᏎ ᏗᎬᏔᏂᏓᏍᏗ",
   "s3-force-path-style-description": "MinIO ᎠᎴ ᎤᏂᏣᏘ non-AWS S3-compatible ᎠᏯᏙᎯᎯ ᎠᏎ ᎠᏂᏔᏲᎯᎭ.",
+  "s3-sse": "ᎦᎵᏍᎦᏂ ᎦᏁᏟᏴᏍᏗ ᎠᏍᏆᏂᎪᏙᏗ ᏗᏓᏁᎸ",
+  "s3-sse-none": "ᎥᏝ ᏳᏔᏲᎸ (S3 ᎤᎵᏍᏈᏗ ᎤᏙᎯᏳ)",
+  "s3-sse-description": "S3 ᎦᎵᏍᎦᏂ ᎦᏁᏟᏴᏍᎦ ᏂᎦᏛ ᎦᏚᏓᎳ, ᎤᏟᎶᏍᏙᏗ ᎠᎴ ᎤᏠᏯᏍᏗ WeKan ᎠᏬᏪᎶᏗᏍᎬ, ᎠᎴ ᎠᏁᏟᏴᏍᎦ WeKan ᎤᎬᏩᎳ ᎦᎪᎵᏰᏍᎬ.",
+  "s3-sse-kms-key-id": "KMS ᏗᏍᏚᎢᏍᏗ ID SSE-KMS ᎤᎬᏩᎳ (ᎥᏝ ᎪᎱᏍᏗ = ᎠᏂ ᎤᏙᎯᏳ ᏗᏍᏚᎢᏍᏗ)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
   "azure-account-name": "ᎠᏎᎸ ᎤᏙᎥ",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "ᎯᎦᏘᏯ QR ᎦᏙᎬ ᎦᏂᏓᏅᏗᏱ ᎢᏳᏓᏗᎴᎥᏍᎬ ᏔᏗᏜ (ᏄᏍᏛᎾ Google Authenticator, Authy), ᎿᏉ ᏗᏰᎸ 6-ᎠᏰᎵ ᎦᏙᎬ ᎦᏂᏓᏅᏗᏱ ᎠᏓᏙᏢᏒ.",
   "twoFactorAuth-manual-entry": "ᎠᎴ ᎯᎦᏘᏯ ᏙᎯᏗ ᎠᏗᏢᏗᏍᏗ: ",
   "twoFactorAuth-confirm": "ᎠᏓᏙᏢᏒ ᎠᎴ ᎠᏛᏗᏍᏗ",
+  "two-factor-required-title": "ᏔᎵ-ᏄᏓᎴᏒ ᎪᎯᏳᏗᏱ ᎯᏛᏗᏍᎨᏍᏗ",
+  "two-factor-required-text": "ᎯᎠ ᎠᏓᏁᎸ ᏔᎵ-ᏄᏓᎴᏒ ᎪᎯᏳᏗᏱ ᎤᏚᎵᏍᎪ ᏣᏤᎵ ᎠᏂ. ᎯᏛᏗᏍᎨᏍᏗ ᎤᎵᏰᏅᏍᏗ ᏱᏣᏚᎵ.",
   "twoFactorCode-prompt": "ᎯᏯᏙᎯᏎᎮᏍᏗ 6-ᎠᏰᎵ ᎦᏙᎬ",
   "twoFactorCode-submit": "ᎠᏓᏙᏢᏒ",
   "twoFactorCode-cancel": "ᎡᏗᏲᏍᏗ",

imports/i18n/data/ckb.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "خێرایی",
   "progress": "پێشکەوتن",
   "password-again": "وشەی نهێنی (دووبارە)",
+  "password-pwned": "ئەم وشەی نهێنییە لە دزەکردنی زانیارییەکاندا دەرکەوتووە. یەکێکی تر هەڵبژێرە.",
+  "password-too-short": "وشەی نهێنی دەبێت لانیکەم __min__ پیت بێت.",
+  "password-length-report-title": "درێژیی وشەی نهێنی",
+  "password-length-report-desc": "ئەو هەژمارانەی بە وشەی نهێنییەکی کورتتر لە کەمترین درێژی چوونەتە ژوورەوە. تەنها وێبگەڕەکە دەزانێت وشەی نهێنی چەند درێژە، بۆیە دوای چوونەژوورەوە ڕاپۆرتی وشەی نهێنی کورت دەدات؛ وشەی نهێنی و درێژییەکەی هەرگیز لێی دەرناچن. چاککراو ئەو کاتەیە کە وشەی نهێنی هەژمارەکە گۆڕدرا - هەژمارێک کە دووبارە بە وشەی نهێنی کورت بچێتە ژوورەوە دووبارە وەک زۆر کورت پیشان دەدرێت.",
+  "password-length-no-results": "هیچ هەژمارێک لێرە نییە.",
+  "password-length-first-login": "یەکەم چوونەژوورەوە",
+  "password-length-last-login": "دوایین چوونەژوورەوە",
+  "password-length-login-count": "ژمارەی چوونەژوورەوەکان",
+  "password-length-fixed": "چاککراو",
+  "password-length-filter-short": "وشەی نهێنی زۆر کورت",
+  "password-length-filter-fixed": "چاککراو بۆ وشەی نهێنی بە ئەندازەی پێویست درێژ",
+  "password-length-filter-all": "هەموو",
+  "password-min-length": "کەمترین درێژیی وشەی نهێنی",
+  "password-min-length-description": "چوونەژوورەوە بە وشەی نهێنی کورتتر لە خوارەوە لیست دەکرێت. چوونەژوورەوە هەرگیز لەبەر ئەوە ڕەت ناکرێتەوە.",
+  "password-min-length-enforce": "سەپاندنی کەمترین درێژی",
+  "password-min-length-enforce-description": "وشەی نهێنی نوێی کورتتر ڕەت دەکرێتەوە، و هەژمارێک کە بە وشەی نهێنی کورتتر دەچێتە ژوورەوە دەبێت پێش هەر شتێکی تر بیگۆڕێت. گۆڕینی هەموو دانیشتنەکانی هەژمارەکە دەردەکات. وشە نهێنییەکانی LDAP، OAuth2، OIDC، SAML، CAS و Sandstorm هی دابینکەرەکەیانن، و پشکنینیان بۆ ناکرێت.",
+  "password-length-saved": "پاشەکەوت کرا.",
+  "password-length-from-environment": "بەهایەک کە لە ژینگەی ڕاژەکار دانراوە لە کاردایە؛ پاشەکەوتکردن لێرە جێگەی دەگرێتەوە.",
+  "password-change-required-title": "وشەی نهێنییەکەت بگۆڕە",
+  "password-change-required-text": "ئەم ماڵپەڕە ئێستا وشەی نهێنی بە لانیکەم __min__ پیت داوا دەکات، و هی تۆ کورتترە. بۆ بەردەوامبوون یەکێکی درێژتر هەڵبژێرە. پاشان هەموو دانیشتنەکانی هەژمارەکەت دەردەکرێن، و دووبارە بە وشەی نهێنی نوێ دەچیتە ژوورەوە.",
+  "password-same-as-username": "وشەی نهێنی نابێت ناوی بەکارهێنەر یان ناونیشانی ئیمەیل بێت.",
   "if-you-already-have-an-account": "ئەگەر پێشتر هەژمارت هەیە",
   "register": "تۆمارکردن",
   "forgot-password": "وشەی نهێنیت لەبیرچووە",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "پەنجەرەی شکست (چرکە)",
   "accounts-lockout-settings-updated": "ڕێکخستنەکانی پاراستن لە هێرشی بەهێز نوێ کرانەوە",
   "accounts-lockout-locked-users": "بەکارهێنەرە قوفڵکراوەکان",
+  "admin-audit-log": "تۆماری وردبینی",
+  "admin-audit-log-info": "ئەوەی بەڕێوەبەرانی ماڵپەڕ کردوویانە: گۆڕانکارییەکانی بەکارهێنەر، چوونەژوورەوە، بیرگە و پاشەکەوت، نوێترینەکان سەرەتا. وشە نهێنییەکان و زانیارییە نهێنییەکان هەرگیز تۆمار ناکرێن. بۆ ماوەی ساڵێک دەهێڵرێتەوە.",
+  "admin-audit-log-when": "کات",
+  "admin-audit-log-who": "بەڕێوەبەر",
+  "admin-audit-log-action": "کردار",
+  "admin-audit-log-details": "وردەکارییەکان",
+  "admin-audit-log-empty": "هێشتا هیچ تۆمار نەکراوە.",
   "accounts-lockout-locked-users-info": "ئەو بەکارهێنەرانەی ئێستا بەهۆی زۆربوونی هەوڵی شکستخواردووی چوونەژوورەوە قوفڵ کراون",
   "accounts-lockout-no-locked-users": "لە ئێستادا هیچ بەکارهێنەرێکی قوفڵکراو نییە",
   "accounts-lockout-failed-attempts": "هەوڵە شکستخواردووەکان",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "هەڵگرتنی ئۆبجێکتی گونجاو لەگەڵ S3: AWS S3، MinIO، Cloudflare R2، Backblaze B2، Wasabi، DigitalOcean Spaces و هی تر.",
   "s3-force-path-style": "URLی شێوازی ڕێڕەو ناچار بکە",
   "s3-force-path-style-description": "لە MinIO و زۆربەی ڕاژەکارە S3-گونجاوەکانی نا-AWS پێویستە.",
+  "s3-sse": "کۆدکردنی لای ڕاژەکار",
+  "s3-sse-none": "هیچ داوا نەکراوە (بنەڕەتی سەتڵەکە)",
+  "s3-sse-description": "S3 هەموو هاوپێچ و وێنۆچکە و پاشەکەوتێک کە WeKan دەینووسێت کۆد دەکات، و لە کاتی خوێندنەوەدا بۆ WeKan کۆدەکەی دەکاتەوە.",
+  "s3-sse-kms-key-id": "ناسنامەی کلیلی KMS بۆ SSE-KMS (بەتاڵ = کلیلی بنەڕەتی هەژمارەکە)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
   "azure-account-name": "ناوی هەژمار",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "ئەم کۆدی QR بە ئەپێکی پشتڕاستکردنەوە سکان بکە (بۆ نموونە Google Authenticator، Authy)، پاشان بۆ دڵنیابوون کۆدی 6 ژمارەیی پیشاندراو بنووسە.",
   "twoFactorAuth-manual-entry": "یان ئەم کۆدە بە دەست بنووسە: ",
   "twoFactorAuth-confirm": "پشتڕاستی بکەوە و چالاکی بکە",
+  "two-factor-required-title": "پشتڕاستکردنەوەی دوو هەنگاوی ڕێکبخە",
+  "two-factor-required-text": "ئەم ماڵپەڕە پشتڕاستکردنەوەی دوو هەنگاوی بۆ هەژمارەکەت پێویست دەکات. بۆ بەردەوامبوون ڕێکی بخە.",
   "twoFactorCode-prompt": "کۆدی پشتڕاستکردنەوەی 6 ژمارەییت بنووسە",
   "twoFactorCode-submit": "پشتڕاستبکەوە",
   "twoFactorCode-cancel": "هەڵوەشاندنەوە",

imports/i18n/data/cmn.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "速度",
   "progress": "进步",
   "password-again": "密码（再次）",
+  "password-pwned": "此密码曾出现在数据泄露中。请另选一个。",
+  "password-too-short": "密码长度至少为 __min__ 个字符。",
+  "password-length-report-title": "密码长度",
+  "password-length-report-desc": "使用短于最小长度的密码登录的账户。只有浏览器知道密码有多长，因此它会在登录后报告过短的密码；密码及其长度永远不会离开浏览器。“已修复”是指账户密码被更改的时间——再次使用短密码登录的账户会再次显示为过短。",
+  "password-length-no-results": "这里没有账户。",
+  "password-length-first-login": "首次登录",
+  "password-length-last-login": "最后登录",
+  "password-length-login-count": "登录次数",
+  "password-length-fixed": "已修复",
+  "password-length-filter-short": "密码过短",
+  "password-length-filter-fixed": "已修复为足够长的密码",
+  "password-length-filter-all": "全部",
+  "password-min-length": "最小密码长度",
+  "password-min-length-description": "使用较短密码登录的情况会列在下方。登录永远不会因此被拒绝。",
+  "password-min-length-enforce": "强制执行最小长度",
+  "password-min-length-enforce-description": "较短的新密码会被拒绝，使用较短密码登录的账户必须先更改密码才能进行其他操作。更改密码会注销该账户的所有会话。LDAP、OAuth2、OIDC、SAML、CAS 和 Sandstorm 的密码属于其提供方，不会被检查。",
+  "password-length-saved": "已保存。",
+  "password-length-from-environment": "服务器环境中设置的值正在生效；在此保存将覆盖它。",
+  "password-change-required-title": "更改您的密码",
+  "password-change-required-text": "本站现在要求密码至少为 __min__ 个字符，而您的密码较短。请选择更长的密码以继续。之后您账户的所有会话都会被注销，您需要使用新密码重新登录。",
+  "password-same-as-username": "密码不得与用户名或电子邮件地址相同。",
   "if-you-already-have-an-account": "如果您已经有帐户",
   "register": "登记",
   "forgot-password": "忘记密码",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "失败窗口（秒）",
   "accounts-lockout-settings-updated": "暴力破解保护设置已更新",
   "accounts-lockout-locked-users": "锁定用户",
+  "admin-audit-log": "审计日志",
+  "admin-audit-log-info": "站点管理员的操作：用户、登录、存储和备份的更改，最新的在前。从不记录密码和机密信息。保留一年。",
+  "admin-audit-log-when": "时间",
+  "admin-audit-log-who": "管理员",
+  "admin-audit-log-action": "操作",
+  "admin-audit-log-details": "详情",
+  "admin-audit-log-empty": "尚无记录。",
   "accounts-lockout-locked-users-info": "由于登录尝试失败次数过多，用户当前被锁定",
   "accounts-lockout-no-locked-users": "目前没有锁定用户",
   "accounts-lockout-failed-attempts": "失败的尝试",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "S3 兼容对象存储：AWS S3、MinIO、Cloudflare R2、Backblaze B2、Wasabi、DigitalOcean Spaces 等。",
   "s3-force-path-style": "强制使用 path-style URL",
   "s3-force-path-style-description": "MinIO 和大多数非 AWS 的 S3 兼容服务器需要此选项。",
+  "s3-sse": "服务器端加密",
+  "s3-sse-none": "未请求（使用存储桶的默认设置）",
+  "s3-sse-description": "S3 会加密 WeKan 写入的每个附件、头像和备份，并在读取时为 WeKan 解密。",
+  "s3-sse-kms-key-id": "SSE-KMS 的 KMS 密钥 ID（留空 = 账户的默认密钥）",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob 存储服务。",
   "azure-account-name": "账户名称",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "使用身份验证器应用（例如 Google Authenticator、Authy）扫描此二维码，然后输入显示的6位代码以确认。",
   "twoFactorAuth-manual-entry": "或手动输入此代码：",
   "twoFactorAuth-confirm": "确认并启用",
+  "two-factor-required-title": "设置双重身份验证",
+  "two-factor-required-text": "本站要求您的账户启用双重身份验证。请完成设置以继续。",
   "twoFactorCode-prompt": "请输入您的6位身份验证代码",
   "twoFactorCode-submit": "验证",
   "twoFactorCode-cancel": "取消",

imports/i18n/data/co.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Velocità",
   "progress": "Avanzamentu",
   "password-again": "Parolla d’intrata (di novu)",
+  "password-pwned": "Sta parolla d'intrata hè apparsa in una fuga di dati. Sceglitene un'altra.",
+  "password-too-short": "A parolla d'intrata deve avè almenu __min__ caratteri.",
+  "password-length-report-title": "Lunghezza di a parolla d'intrata",
+  "password-length-report-desc": "Conti chì si sò cunnessi cù una parolla d'intrata più corta chè a lunghezza minima. Solu u navigatore sà quantu hè longa una parolla d'intrata, allora ne signala una corta dopu à a cunnessione; a parolla d'intrata è a so lunghezza ùn ne escenu mai. Currettu hè quandu a parolla d'intrata di u contu hè stata cambiata - un contu chì si cunnette torna cù una parolla d'intrata corta hè mustratu torna cum'è troppu cortu.",
+  "password-length-no-results": "Nisun contu quì.",
+  "password-length-first-login": "Prima cunnessione",
+  "password-length-last-login": "Ultima cunnessione",
+  "password-length-login-count": "Volte cunnessu",
+  "password-length-fixed": "Currettu",
+  "password-length-filter-short": "Parolla d'intrata troppu corta",
+  "password-length-filter-fixed": "Currettu cù una parolla d'intrata abbastanza longa",
+  "password-length-filter-all": "Tutti",
+  "password-min-length": "Lunghezza minima di a parolla d'intrata",
+  "password-min-length-description": "E cunnessione cù una parolla d'intrata più corta sò listate quì sottu. A cunnessione ùn hè mai ricusata per quessa.",
+  "password-min-length-enforce": "Impone a lunghezza minima",
+  "password-min-length-enforce-description": "Una nova parolla d'intrata più corta hè ricusata, è un contu chì si cunnette cù una parolla d'intrata più corta a deve cambià nanzu à ogni altra cosa. Cambiàla scunnette ogni sessione di u contu. E parolle d'intrata LDAP, OAuth2, OIDC, SAML, CAS è Sandstorm sò di u so furnitore, è ùn sò micca verificate.",
+  "password-length-saved": "Arregistratu.",
+  "password-length-from-environment": "Un valore definitu in l'ambiente di u servitore hè in vigore; arregistrà quì u rimpiazza.",
+  "password-change-required-title": "Cambiate a vostra parolla d'intrata",
+  "password-change-required-text": "Stu situ richiede avà parolle d'intrata di almenu __min__ caratteri, è a vostra hè più corta. Sceglite ne una più longa per cuntinuà. Dopu ogni sessione di u vostru contu hè scunnessa, è vi cunnettite torna cù a nova parolla d'intrata.",
+  "password-same-as-username": "A parolla d'intrata ùn deve micca esse u nome d'utilizatore nè l'indirizzu di posta elettronica.",
   "if-you-already-have-an-account": "S’è vo avete digià un contu",
   "register": "Registrassi",
   "forgot-password": "Parolla d'intrata scurdata",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Intervallu di i fiaschi (seconde)",
   "accounts-lockout-settings-updated": "I parametri di prutezzione contr’à a forza bruta sò stati aghjurnati",
   "accounts-lockout-locked-users": "Utilizatori bluccati",
+  "admin-audit-log": "Registru d'audit",
+  "admin-audit-log-info": "Ciò chì l'amministratori di u situ anu fattu: cambiamenti d'utilizatori, di cunnessione, d'almacenamentu è di copie di sicurità, i più recenti prima. E parolle d'intrata è i sicreti ùn sò mai registrati. Cunservatu per un annu.",
+  "admin-audit-log-when": "Quandu",
+  "admin-audit-log-who": "Amministratore",
+  "admin-audit-log-action": "Azzione",
+  "admin-audit-log-details": "Ditaglii",
+  "admin-audit-log-empty": "Nunda registratu ancu.",
   "accounts-lockout-locked-users-info": "Utilizatori attualmente bluccati per via di troppi tentativi di cunnessione fiascati",
   "accounts-lockout-no-locked-users": "Ùn ci hè attualmente nisun utilizatore bluccatu",
   "accounts-lockout-failed-attempts": "Tentativi fiascati",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "Almacenamentu d’ogetti cumpatibile cù S3: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces è altri.",
   "s3-force-path-style": "Impone URL di tipu percorsu",
   "s3-force-path-style-description": "Richiestu da MinIO è da a maiò parte di i servori cumpatibili cù S3 chì ùn sò micca AWS.",
+  "s3-sse": "Cifratura da u latu di u servitore",
+  "s3-sse-none": "Nisuna dumandata (u predefinitu di u bucket)",
+  "s3-sse-description": "S3 cifra ogni alligatu, avatar è copia di sicurità chì WeKan scrive, è a decifra per WeKan à a lettura.",
+  "s3-sse-kms-key-id": "ID di a chjave KMS per SSE-KMS (viotu = a chjave predefinita di u contu)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
   "azure-account-name": "Nome di u contu",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Scannerizate stu codice QR cù un'applicazione d'autentificazione (per esempiu Google Authenticator, Authy), poi entrate u codice à 6 cifre affissatu per cunfirmà.",
   "twoFactorAuth-manual-entry": "O entrate stu codice manualmente: ",
   "twoFactorAuth-confirm": "Cunfirmà è attivà",
+  "two-factor-required-title": "Cunfigurate l'autentificazione à dui fattori",
+  "two-factor-required-text": "Stu situ richiede l'autentificazione à dui fattori per u vostru contu. Cunfiguratela per cuntinuà.",
   "twoFactorCode-prompt": "Entrate u vostru codice d'autentificazione à 6 cifre",
   "twoFactorCode-submit": "Verificà",
   "twoFactorCode-cancel": "Annullà",

imports/i18n/data/cs-CZ.i18n.json

@@ -2586,6 +2586,27 @@
   "speed": "Rychlost",
   "progress": "Průběh",
   "password-again": "Heslo (znovu)",
+  "password-pwned": "Toto heslo se objevilo v úniku dat. Zvolte jiné.",
+  "password-too-short": "Heslo musí mít alespoň __min__ znaků.",
+  "password-length-report-title": "Délka hesla",
+  "password-length-report-desc": "Účty, které se přihlásily heslem kratším, než je minimální délka. Jen prohlížeč ví, jak dlouhé heslo je, proto po přihlášení nahlásí krátké heslo; heslo ani jeho délka ho nikdy neopustí. Opraveno znamená, kdy bylo heslo účtu změněno - účet, který se znovu přihlásí krátkým heslem, se znovu zobrazí jako příliš krátký.",
+  "password-length-no-results": "Žádné účty.",
+  "password-length-first-login": "První přihlášení",
+  "password-length-last-login": "Poslední přihlášení",
+  "password-length-login-count": "Počet přihlášení",
+  "password-length-fixed": "Opraveno",
+  "password-length-filter-short": "Příliš krátké heslo",
+  "password-length-filter-fixed": "Opraveno na dostatečně dlouhé heslo",
+  "password-length-filter-all": "Vše",
+  "password-min-length": "Minimální délka hesla",
+  "password-min-length-description": "Přihlášení kratším heslem je uvedeno níže. Přihlášení se kvůli tomu nikdy neodmítá.",
+  "password-min-length-enforce": "Vynutit minimální délku",
+  "password-min-length-enforce-description": "Kratší nové heslo je odmítnuto a účet, který se přihlásí kratším heslem, ho musí změnit dříve než cokoli jiného. Jeho změna odhlásí všechny relace účtu. Hesla LDAP, OAuth2, OIDC, SAML, CAS a Sandstorm patří jejich poskytovateli a nekontrolují se.",
+  "password-length-saved": "Uloženo.",
+  "password-length-from-environment": "Platí hodnota nastavená v prostředí serveru; uložení zde ji přepíše.",
+  "password-change-required-title": "Změňte své heslo",
+  "password-change-required-text": "Tento web nyní vyžaduje hesla o délce alespoň __min__ znaků a vaše je kratší. Pro pokračování zvolte delší. Poté budou všechny relace vašeho účtu odhlášeny a znovu se přihlásíte novým heslem.",
+  "password-same-as-username": "Heslo nesmí být uživatelské jméno ani e-mailová adresa.",
   "if-you-already-have-an-account": "Pokud již máte účet",
   "register": "Registrovat",
   "forgot-password": "Zapomenuté heslo",
@@ -2661,6 +2682,13 @@
   "accounts-lockout-failure-window": "Okno selhání (sekundy)",
   "accounts-lockout-settings-updated": "Nastavení ochrany proti útoku hrubou silou bylo aktualizováno",
   "accounts-lockout-locked-users": "Uzamčení uživatelé",
+  "admin-audit-log": "Auditní protokol",
+  "admin-audit-log-info": "Co dělali správci webu: změny uživatelů, přihlašování, úložiště a záloh, od nejnovějších. Hesla a tajné údaje se nikdy nezaznamenávají. Uchovává se jeden rok.",
+  "admin-audit-log-when": "Kdy",
+  "admin-audit-log-who": "Administrátor",
+  "admin-audit-log-action": "Akce",
+  "admin-audit-log-details": "Podrobnosti",
+  "admin-audit-log-empty": "Zatím nic nezaznamenáno.",
   "accounts-lockout-locked-users-info": "Uživatelé aktuálně uzamčení kvůli příliš mnoha neúspěšným pokusům o přihlášení",
   "accounts-lockout-no-locked-users": "Momentálně nejsou žádní uzamčení uživatelé",
   "accounts-lockout-failed-attempts": "Neúspěšné pokusy",
@@ -2738,6 +2766,10 @@
   "s3-minio-storage-description": "Objektové úložiště kompatibilní s S3: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces a další.",
   "s3-force-path-style": "Vynutit URL ve stylu cesty",
   "s3-force-path-style-description": "Vyžadováno MinIO a většinou serverů kompatibilních s S3, které nejsou od AWS.",
+  "s3-sse": "Šifrování na straně serveru",
+  "s3-sse-none": "Nevyžádáno (výchozí nastavení bucketu)",
+  "s3-sse-description": "S3 šifruje každou přílohu, avatar a zálohu, kterou WeKan zapíše, a při čtení ji pro WeKan dešifruje.",
+  "s3-sse-kms-key-id": "ID klíče KMS pro SSE-KMS (prázdné = výchozí klíč účtu)",
   "azure-blob-storage": "Azure Blob Storage",
   "azure-blob-storage-description": "Microsoft Azure Blob Storage.",
   "azure-account-name": "Název účtu",
@@ -3255,6 +3287,8 @@
   "twoFactorAuth-scan-instructions": "Naskenujte tento QR kód ověřovací aplikací (např. Google Authenticator, Authy) a poté potvrďte zadáním zobrazeného 6místného kódu.",
   "twoFactorAuth-manual-entry": "Nebo zadejte tento kód ručně: ",
   "twoFactorAuth-confirm": "Potvrdit a povolit",
+  "two-factor-required-title": "Nastavte dvoufaktorové ověřování",
+  "two-factor-required-text": "Tento web vyžaduje pro váš účet dvoufaktorové ověřování. Pro pokračování jej nastavte.",
   "twoFactorCode-prompt": "Zadejte svůj 6místný ověřovací kód",
   "twoFactorCode-submit": "Ověřit",
   "twoFactorCode-cancel": "Zrušit",