CodeQL alerts #439 and #440 found that the translation merge and English- regression report interpolated Git revisions and locale paths into shell command strings. The supported pull path supplied a snapshot directory and did not reach these commands, but standalone use could interpret shell metacharacters from a contributor-controlled locale filename.

Both scripts now invoke Git directly with separate arguments and consume its changed-file list with NUL delimiters. Positive coverage retains normal translation restoration and regression reporting; negative coverage uses a locale filename containing shell syntax and proves neither script executes it.

Lazy card loading kept each sorted, limited window as a one-time snapshot to avoid a FerretDB cursor hang. The snapshot rendered initially, but later card edits and cross-list moves did not publish changes to an already-open board, so the browser showed stale cards until a forced reload.

Each window now observes its unrestricted indexed selector and fetches a new bounded snapshot only when a matching card changes. It diffs that snapshot and publishes additions, field changes and removals without overlapping refreshes; the problematic limited live cursor remains unused. Unit coverage checks every diff outcome, including removed fields and unchanged cards, and a forced-lazy browser scenario checks a remote title edit and cross-list move without reload.

The s390x, riscv64 and other Launchpad jobs previously downloaded bundles whose dependencies had already been rebuilt and pruned for their target architecture, deleted that completed dependency tree, installed an npm build toolchain and repeated the entire installation through the build-farm proxy.

Snap assembly now uses the no-op plugin, retains the prepared dependency tree and omits the unnecessary compiler and npm packages. Both maintained base definitions also select LZO instead of the slower default XZ compression for the large final SquashFS, trading a larger download for faster packing and cold startup. Regression coverage pins the prebuilt-bundle boundary, the absent npm commands and build packages, and the compression choice.