docs: record the merged security hardening in the gap and parity docs

.github/workflows/actions.lock

@@ -1,57 +0,0 @@
-# This file is machine-generated by `gh actions-lock`.
-# Do not edit by hand; run `gh actions-lock` to update.
-# Docs: https://gh.io/actions-lockfile
-version: 'v0.0.3'
-workflows:
-    '.github/workflows/ci.yml': []
-    '.github/workflows/freebsd.yml': []
-    '.github/workflows/house-rules.yml': []
-    '.github/workflows/lockfile.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'step-security/harden-runner@v2.22.4'
-    '.github/workflows/nix.yml': []
-    '.github/workflows/packaging-lint.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'step-security/harden-runner@v2.22.4'
-    '.github/workflows/printing.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'step-security/dtolnay-rust-toolchain@v1.0.0'
-        - 'step-security/harden-runner@v2.22.4'
-        - 'step-security/rust-cache@v2.9.2'
-        - 'storytold/craft-common-actions@main'
-    '.github/workflows/release.yml': []
-    '.github/workflows/sonarcloud.yml': []
-    '.github/workflows/windows-arm64.yml': []
-dependencies:
-    'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
-        ref: 'v7.0.1'
-        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
-        owner_id: 44036562
-        repo_id: 197814629
-    'actions/checkout@v7.0.1':
-        ref: 'v7.0.1'
-        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
-        owner_id: 44036562
-        repo_id: 197814629
-    'step-security/dtolnay-rust-toolchain@v1.0.0':
-        ref: 'v1.0.0'
-        commit: 'sha1-8dd607977d06adf4ed49b190381e74c17a9dd25f'
-        owner_id: 88700172
-        repo_id: 1249865941
-    'step-security/harden-runner@v2.22.4':
-        ref: 'v2.22.4'
-        commit: 'sha1-1d88384fd173af6ecb012dfd0264a306b711241a'
-        owner_id: 88700172
-        repo_id: 422287306
-    'step-security/rust-cache@v2.9.2':
-        ref: 'v2.9.2'
-        commit: 'sha1-8871c8ba063416da7c32246932ea6ae08700453e'
-        owner_id: 88700172
-        repo_id: 822636713
-    'storytold/craft-common-actions@main':
-        ref: 'main'
-        commit: 'sha1-293de72429d3ed5d9fa92aded5e500544c0fa28f'
-        owner_id: 76897702
-        repo_id: 1414429108
-        uses:
-            - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'

.github/workflows/lockfile.yml

@@ -1,34 +0,0 @@
-name: Lockfile
-
-# Fails when .github/workflows/actions.lock is out of sync with the workflows, or when a locked pin
-# no longer verifies upstream, so a moved tag cannot slip a different commit into a run.
-# Docs: https://gh.io/actions-lockfile
-on:
-  pull_request:
-  push:
-    branches: [main]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  GH_TOKEN: ${{ github.token }}
-
-jobs:
-  lockfile:
-    name: Lockfile is in sync
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
-        with:
-          egress-policy: audit
-      - uses: actions/checkout@v7.0.1
-        with:
-          persist-credentials: false
-      - name: Install gh-actions-lock
-        run: gh extension install github/gh-actions-lock --pin v0.4.1
-      - name: Verify the lockfile
-        run: gh actions-lock --verify

.github/workflows/packaging-lint.yml

@@ -28,10 +28,10 @@ jobs:
     runs-on: windows-latest
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install the pinned packaging toolchain

.github/workflows/printing.yml

@@ -43,10 +43,10 @@ jobs:
       CARGO_INCREMENTAL: '0'
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -81,13 +81,13 @@ jobs:
             pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcursor-dev libxrandr-dev \
             libxi-dev libgtk-3-dev libfontconfig1-dev libfreetype-dev libvulkan1 mesa-vulkan-drivers
 
-      - uses: step-security/dtolnay-rust-toolchain@v1.0.0
+      - uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
         with:
           toolchain: stable
           components: rustfmt, clippy
           targets: wasm32-unknown-unknown
 
-      - uses: step-security/rust-cache@v2.9.2
+      - uses: step-security/rust-cache@8871c8ba063416da7c32246932ea6ae08700453e # v2.9.2
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}
 

.github/workflows/release.yml

@@ -1,10 +1,6 @@
 name: Release
 
 on:
-  # A nightly dry run on main: every release build except macOS, nothing signed or released
-  # (craft-common-actions release.yml `dry-run`). Finds release-only breakage before release day.
-  schedule:
-    - cron: "0 3 * * *"
   push:
     branches: [release]
   workflow_dispatch:
@@ -37,7 +33,6 @@ jobs:
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/release.yml@main
     with:
-      dry-run: ${{ github.event_name == 'schedule' }}
       app-name: wordcraft
       app-title: WordCraft
       craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83

docs/target-app-parity.md

@@ -1,6 +1,6 @@
 # WordCraft parity with Microsoft Word
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-30 · **Change:** trivial (Equations: `\int` + Space leaves ∫ waiting for its limits, `_a^b` then Space builds them, and the operand typed next goes inside, observed in Word for Windows on #4938, #4917; no percentage change; previously trivial: Tables row: Table Properties applies to the selected rows, columns and cells, #4857; no percentage change); previously trivial (Tables row: tables nest 18 deep at most, so a .json save reads back, #3618); previously trivial (Tables row: Table Properties applies to the selected rows, columns and cells, #4857; no percentage change); previously trivial (Recipient labels continue across product-sized sheets instead of stopping after the first sheet (#4880)); previously trivial (Insert Table of Figures lists any caption label, #3013; previously trivial: Performance row: typing no longer starts render threads on every repaint, #3027; previously trivial: shapes inserted in a row are all kept, #2019; previously trivial: East Asian typography: `w:eastAsianLayout` kept on save, not laid out; previously trivial: Ink to Shape recognises arrows; previously trivial: Windows Magnifier follows the caret onto a new line, #1119; previously trivial: table border drags with Ctrl and Alt, from the left edge and of selected cells, #711; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously trivial: all 12 bibliography styles, #383; previously trivial: formatting revisions landed, #41; previously trivial: Draw Table and Eraser landed, #303; previously minor: readiness table with hours per audience; full number back to the additive weighted sum, 60%; mainstream and essentials numbers added; alpha gate checked; previously major: full re-measure against Word for Mac 16.113.4; replaces the parity tables that lived in ROADMAP.md) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-11 · **Change:** trivial (Stability row: security hardening recorded); previously trivial (Equations: `\int` + Space leaves ∫ waiting for its limits, `_a^b` then Space builds them, and the operand typed next goes inside, observed in Word for Windows on #4938, #4917; no percentage change; previously trivial: Tables row: Table Properties applies to the selected rows, columns and cells, #4857; no percentage change); previously trivial (Tables row: tables nest 18 deep at most, so a .json save reads back, #3618); previously trivial (Tables row: Table Properties applies to the selected rows, columns and cells, #4857; no percentage change); previously trivial (Recipient labels continue across product-sized sheets instead of stopping after the first sheet (#4880)); previously trivial (Insert Table of Figures lists any caption label, #3013; previously trivial: Performance row: typing no longer starts render threads on every repaint, #3027; previously trivial: shapes inserted in a row are all kept, #2019; previously trivial: East Asian typography: `w:eastAsianLayout` kept on save, not laid out; previously trivial: Ink to Shape recognises arrows; previously trivial: Windows Magnifier follows the caret onto a new line, #1119; previously trivial: table border drags with Ctrl and Alt, from the left edge and of selected cells, #711; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously trivial: all 12 bibliography styles, #383; previously trivial: formatting revisions landed, #41; previously trivial: Draw Table and Eraser landed, #303; previously minor: readiness table with hours per audience; full number back to the additive weighted sum, 60%; mainstream and essentials numbers added; alpha gate checked; previously major: full re-measure against Word for Mac 16.113.4; replaces the parity tables that lived in ROADMAP.md) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
 
 The authoritative assessment of how close WordCraft is to Microsoft Word. [`ROADMAP.md`](../ROADMAP.md)
 summarizes it; [`gaps.md`](gaps.md) itemizes every shortfall; the deep checklists are
@@ -253,6 +253,7 @@ can be used without committing Word output.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-11 | trivial | Stability row: merged security hardening bounds hostile input and per-item scans across importers, exporters, fonts, pictures and layout (Read Aloud citations, proofing runs and the decimal-tab look-ahead use binary search or one pass instead of a scan per item (#5335, #5344, #5343); see gaps.md); the open crash and freeze reports are unchanged; percentages unchanged |
 | 2026-10-26 | trivial | View › Window across the native windows (#322): View catalog 26/29 → 29/29; View row text only, percentages unchanged |
 | 2026-10-30 | trivial | Equations: `\int`, `\sum` and the other n-ary operators typed with AutoCorrect wait for their limits: `_x^y` then Space gives the operator its limits, Space alone builds it without, and the operand typed next goes inside it; any character that can't continue `\name` corrects it (`\int_0^1`); observed in Word for Windows on #4938 (#4917); no percentage change |
 | 2026-10-30 | trivial | Tables row: tables nest 18 deep at most, so a `.json` save or AutoRecover snapshot reads back, rich content in the deepest cell included (it was 24, which a `.json` save could not reopen); the .docx reader and writer still keep 24 (#3618); no percentage change |

sonar-project.properties

@@ -4,14 +4,6 @@ sonar.organization=storytold
 # S4790 (weak hash): SHA-1 is a start-key and "SHA1/1K" checksum algorithm that ODF package
 # encryption (ODF 1.3 Part 2 §4.16) names, and older office suites wrote it. It is needed to open
 # those files, not chosen for new security: WordCraft writes a SHA-256 start key and checksum.
-sonar.issue.ignore.multicriteria=odt_sha1,gha-lockfile
+sonar.issue.ignore.multicriteria=odt_sha1
 sonar.issue.ignore.multicriteria.odt_sha1.ruleKey=rust:S4790
 sonar.issue.ignore.multicriteria.odt_sha1.resourceKey=crates/formats/src/odt/crypt.rs
-
-# githubactions:S7637 asks for every action to be pinned to a commit SHA. A workflow covered by
-# .github/workflows/actions.lock runs the commit the lockfile records, so its tag refs are pinned
-# and the lockfile covers the actions those actions use too. Sonar does not read lockfiles yet, so
-# the rule flags the tag refs anyway:
-# https://community.sonarsource.com/t/githubactions-s7637-false-positives-for-actions-pinned-through-native-actions-lock/190814
-sonar.issue.ignore.multicriteria.gha-lockfile.ruleKey=githubactions:S7637
-sonar.issue.ignore.multicriteria.gha-lockfile.resourceKey=.github/workflows/**