From 93abe599f936ee2338e49f0b52d77b4bb6beb582 Mon Sep 17 00:00:00 2001
From: SkateSpots <skatespots>
Date: Mon, 26 Oct 2026 12:31:47 +0700
Subject: [PATCH] a11y: label the language trigger + settings icon; record
 security/menu audit

- aria-label on the language dropdown trigger (flag-only) and the header
  settings icon (title-only) so screen readers announce them.
- AGENTS: final security scan (audit 35->13, zod 4/nostrify 0.50, APK manifest
  and CSP verified) + menu/a11y conclusions.
---
 AGENTS.md                         | 20 ++++++++++++++++++++
 src/components/LanguageToggle.tsx |  2 ++
 src/components/Layout.tsx         |  2 +-
 3 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/AGENTS.md b/AGENTS.md
index e2b5cd6..c2f496f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2342,6 +2342,26 @@ Rules:
   On **failure** the job restores the lockfile and schedules a retry in **~3 days**
   (a failed run no longer burns the whole 20-day window); every notification now
   includes the **OSV total** ("N packages affected by M known vulnerabilities").
+  **Final security scan (2026-10-26):** researched the app-relevant advisories and
+  fixed them — **zod 3.25 → 4.6.7** (only `AppProvider` imports zod; no
+  zod-3-isms, zero TS changes) plus **@nostrify/nostrify 0.50.5 /
+  @nostrify/react 0.2.31 / @nostrify/types 0.36.9** (0.50 moved to zod 4), and the
+  safe `npm audit fix` transitives (react-router 6.30.6, dompurify 3.4.17,
+  lodash 4.18.1, @modelcontextprotocol/sdk 1.32.2). **npm audit: 35 → 13** (2
+  critical, 1 high). Remaining: **vitest/tinypool** (dev-only, fix = vitest 5
+  major), **xlsx** (no fix; we only *write* XLSX — parse CVEs don't apply),
+  **react-router** open-redirect (moderate; fix = v7 major — revisit), and
+  build-only tailwind/postcss/capacitor-cli. APK manifest is minimal
+  (INTERNET + coarse/fine location); `network_security_config` permits cleartext
+  **loopback only** (Citrine); CSP is strong (`default-src 'none'`, no
+  `unsafe-eval`, `object-src 'none'`, `frame-ancestors 'none'`); no tracked
+  secrets; the only `dangerouslySetInnerHTML` is shadcn's chart CSS-vars (static,
+  not user input). **Menu/a11y pass (same date):** added `aria-label`s to the
+  language trigger and the header settings icon (they had only `title`/a flag);
+  the desktop nav's `max-w-[1700px]` + `overflow-x-auto scrollbar-hide` +
+  `whitespace-nowrap` keeps the trailing **More** reachable, the mobile bottom
+  nav + burger append the full catalog, dropdowns have max-height + internal
+  scroll, and interactive targets meet the 44px rule. No other menu bugs found.
 
 ### Community relay — self-hosted Newlay (2026-10-12)
 
diff --git a/src/components/LanguageToggle.tsx b/src/components/LanguageToggle.tsx
index 34f554b..7ca9f31 100644
--- a/src/components/LanguageToggle.tsx
+++ b/src/components/LanguageToggle.tsx
@@ -125,6 +125,8 @@ export function LanguageToggle({ compact = false, inline = false, className, var
         <Button
           variant={variant}
           size={compact ? 'icon' : 'default'}
+          aria-label={t('settings.selectLanguage')}
+          title={t('settings.selectLanguage')}
           className={cn(
             'gap-2',
             compact ? 'w-10 h-10' : 'px-3',
diff --git a/src/components/Layout.tsx b/src/components/Layout.tsx
index 41563e9..2985fb3 100644
--- a/src/components/Layout.tsx
+++ b/src/components/Layout.tsx
@@ -773,7 +773,7 @@ export function Layout({ children, noPadding }: LayoutProps) {
               </Link>
             )}
             <Link to="/settings">
-              <Button variant="ghost" size="icon" title={t('nav.settings')}>
+              <Button variant="ghost" size="icon" title={t('nav.settings')} aria-label={t('nav.settings')}>
                 <Settings className="h-5 w-5" />
               </Button>
             </Link>