@@ -31,3 +31,14 @@ updates:
       patterns:
         - "react"
         - "react-dom"
+    # All @docusaurus/* packages must have the same version (otherwise the website build fails)
+    docusaurus:
+      patterns:
+        - "@docusaurus/*"
+- package-ecosystem: "github-actions"
+  directory: "/"
+  schedule:
+    interval: weekly
+  target-branch: main
+  commit-message:
+    prefix: "Dependency (dependabot/github-actions):"
@@ -1,29 +1,19 @@
-pull_request_rules:  
-  - name: automatic merge for pull request based on label and ci success
+pull_request_rules:
+  - name: automatic merge for LGTM label and bot pull requests based on ci success
     conditions:
-      - label~=LGTM$
-      - check-success=continuous-integration/appveyor/pr
-    actions:
-      merge:
-        method: squash
-  - name: automatic merge for Dependabot pull requests based on ci success
-    conditions:
-      - author=dependabot[bot]
-      - check-success=continuous-integration/appveyor/pr
-    actions:
-      merge:
-        method: squash
-  - name: automatic merge for Transifex pull requests based on ci success
-    conditions:
-      - author=transifex-integration[bot]
-      - check-success=continuous-integration/appveyor/pr
-    actions:
-      merge:
-        method: squash
-  - name: automatic merge for ImgBot pull requests based on ci success
-    conditions:
-      - author=imgbot[bot]
+      - base=main
+      - or:
+        - label~=LGTM$
+        - author=dependabot[bot]
+        - author=transifex-integration[bot]
+        - author=imgbot[bot]
+      # Major updates can break at runtime even if the build succeeds - they are merged manually after testing
+      - dependabot-update-type!=version-update:semver-major
       - check-success=continuous-integration/appveyor/pr
+      # Website changes (e.g. Dependabot npm updates) also need a successful website build
+      - or:
+        - -files~=^(Website/|\.github/workflows/deploy_website\.yml$)
+        - check-success=Build Website
     actions:
       merge:
         method: squash
@@ -2,44 +2,54 @@ name: "CodeQL"
 
 on:
   workflow_dispatch:
-  #push:
-  #  branches: [ "main", "stable-*" ]
-  #pull_request:
-  #  branches: [ "main", "stable-*" ]
   schedule:
     - cron: '38 21 * * 6'
 
 jobs:
   analyze:
-    name: Analyze    
-    runs-on: ${{ 'windows-latest' }}
-    timeout-minutes: ${{ 360 }}
+    name: Analyze (${{ matrix.language }})
+    runs-on: ${{ matrix.runs-on }}
+    timeout-minutes: 120
     permissions:
-      # required for all workflows
+      contents: read
       security-events: write
 
     strategy:
       fail-fast: false
       matrix:
-        language: [ 'csharp', 'javascript-typescript' ]        
+        include:
+          # C# is built (WPF, Windows only) for the most precise results.
+          - language: csharp
+            build-mode: autobuild
+            runs-on: windows-latest
+          - language: javascript-typescript
+            build-mode: none
+            runs-on: ubuntu-latest
+          # GitHub Actions workflows (e.g. pull_request_target, permissions).
+          - language: actions
+            build-mode: none
+            runs-on: ubuntu-latest
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
       with:
         submodules: 'true'
 
-    # Initializes the CodeQL tools for scanning.
+    # The C# autobuild needs the SDK from Source/global.json (the runner image may only have an older one)
+    - name: Setup .NET
+      if: matrix.language == 'csharp'
+      uses: actions/setup-dotnet@v6
+      with:
+        global-json-file: Source/global.json
+
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
-        
-    # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+        build-mode: ${{ matrix.build-mode }}
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v4
       with:
-        category: "/language:${{matrix.language}}"
+        category: "/language:${{ matrix.language }}"
@@ -12,37 +12,34 @@ on:
       - '.github/workflows/deploy_website.yml'
       - 'Website/**'
   pull_request:
+    paths:
+      - '.github/workflows/deploy_website.yml'
+      - 'Website/**'
+
+# Runs that deploy (main, release, manual) run one after the other incl. the build, so the last triggered run also
+# deploys last (e.g. a release build isn't overwritten by an older main build). Outdated PR runs are cancelled.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || 'deploy' }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  build-and-deploy-website:
-    name: "Build and Deploy Website"
+  build-website:
+    name: "Build Website"
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || 'deploy' }}
+      contents: read
     defaults:
       run:
         working-directory: Website
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 22
-        
-      - name: Get yarn cache
-        id: yarn-cache
-        run: echo "YARN_CACHE_DIR=$(yarn cache dir)" >> "${GITHUB_OUTPUT}"
-
-      - name: Cache dependencies
-        uses: actions/cache@v4
-        with:
-          path: ${{ steps.yarn-cache.outputs.YARN_CACHE_DIR }}
-          key: ${{ runner.os }}-Website-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-Website-
+          cache: yarn
+          cache-dependency-path: Website/yarn.lock
 
       - name: Install dependencies
         run: yarn install --frozen-lockfile
@@ -53,9 +50,33 @@ jobs:
           # Used by scripts/fetch-release-data.mjs to raise the GitHub API rate limit.
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Upload website
+        uses: actions/upload-artifact@v7
+        if: github.event_name == 'release' || (github.event_name != 'pull_request' && github.ref == 'refs/heads/main')
+        with:
+          name: website
+          path: Website/build
+          # Keep .well-known/ and .nojekyll (hidden files are skipped by default).
+          include-hidden-files: true
+          retention-days: 1
+
+  # Separate job, so only the deployment gets write access (not the build with its npm dependencies).
+  deploy-website:
+    name: "Deploy Website"
+    needs: build-website
+    if: github.event_name == 'release' || (github.event_name != 'pull_request' && github.ref == 'refs/heads/main')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Download website
+        uses: actions/download-artifact@v8
+        with:
+          name: website
+          path: build
+
       - name: Deploy to GitHub Pages
         uses: peaceiris/actions-gh-pages@v4
-        if: github.event_name == 'release' || (github.event_name != 'pull_request' && github.ref == 'refs/heads/main')
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
-          publish_dir: ./Website/build
+          publish_dir: ./build
@@ -14,7 +14,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Assign label
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             await github.rest.issues.addLabels({
 
@@ -14,7 +14,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Assign milestone
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const milestones = await github.rest.issues.listMilestones({
 
@@ -183,45 +183,53 @@ The website is deployed to GitHub Pages at: https://borntoberoot.net/NETworkMana
 
 **Primary Build System**: AppVeyor (configuration in `appveyor.yml`)
 - Builds on the Visual Studio 2022 image
-- Installs the .NET SDK version from `Source/global.json`
+- Installs the .NET SDK version from `Source/global.json` (skipped if the image already has it)
 - Restores NuGet packages
-- Builds the Release configuration for x64 and ARM64 (setup, portable and archive per architecture)
+- Builds the Release configuration: x64 for branches and PRs, x64 and ARM64 for tags (setup, portable and archive per
+  architecture, only for tags). PRs only build the application (`NETworkManager.csproj`) unless they change
+  `Source/NETworkManager.Setup/`, branches and tags the setup (`NETworkManager.Setup.wixproj`)
+- Runs the unit tests (`Source/NETworkManager.Tests`, `dotnet test --project`)
+- Branches with an open PR are only built as PR (`skip_branch_with_pr`)
+- Ends successfully without building if only docs / website / repository files changed (`Website/`, `.github/`,
+  `.claude/`, `Images/`, `Chocolatey/`, `WinGet/`, `Tests/Environments/`, `*.md`, `LICENSE`), so Mergify still gets a
+  green status. Tags are always built. Branch builds (e.g. `main`) only see the last commit, so they are only skipped
+  for squash merges of a PR (subject ends with `(#1234)`); direct pushes are always built
 - Version format: `yyyy.M.d.0` (date-based)
 - Artifacts are signed via [SignPath.io](https://signpath.io/)
 - Released to GitHub Releases
 
 **GitHub Actions Workflows**:
 - **CodeQL Analysis** (`.github/workflows/codeql.yml`):
   - Automated security scanning
-  - Analyzes C# and JavaScript/TypeScript code
+  - Analyzes C# (autobuild on Windows), JavaScript/TypeScript and GitHub Actions workflows (Linux)
   - Runs weekly and on-demand via workflow_dispatch
 
 - **Website Deployment** (`.github/workflows/deploy_website.yml`):
   - Builds and deploys Docusaurus website to GitHub Pages
-  - Triggers on changes to `Website/` directory
+  - Triggers on changes to `Website/` directory (push to `main` and PRs) and on published releases
   - Uses Node.js 22 with yarn for build
+  - Uses Docusaurus Faster (`@docusaurus/faster`, Rspack / SWC) for faster builds; all `@docusaurus/*` packages must have
+    the same version (Dependabot updates them as a group)
+  - Build and deploy are separate jobs, only the deploy job (`main` / release) has write access
 
 - **Label / Milestone** (`.github/workflows/label.yml`, `.github/workflows/milestone.yml`):
   - Label PRs from Dependabot, Transifex and ImgBot as dependencies
   - Assign the next-release milestone to PRs from bots and the maintainer
 
 **Automation & Bots**:
 - **Dependabot** (`.github/dependabot.yml`):
-  - Weekly updates for NuGet packages, .NET SDK, and npm packages
+  - Weekly updates for NuGet packages, .NET SDK, npm packages and GitHub Actions
   - Automatic PR creation for dependency updates
 
 - **Mergify** (`.github/mergify.yml`):
   - Auto-merges PRs with `LGTM` label after AppVeyor CI passes
-  - Auto-merges Dependabot, Transifex, and ImgBot PRs after CI success
+  - Auto-merges Dependabot (except major updates, they are merged manually after testing), Transifex, and ImgBot PRs
+    after CI success
+  - PRs that change `Website/` (or the website workflow) also need a successful `Build Website` check
 
 - **Transifex Integration** (`.github/transifex.yml`):
   - Automated translation synchronization
   - Syncs RESX files between GitHub and Transifex
-  
-- **Stale Bot** (`.github/stale.yml`):
-  - Marks issues inactive for 30 days as stale
-  - Closes stale issues after 7 days
-  - Excludes bugs, feature requests, documentation and code-cleanup issues
 
 ## Contributing Areas
 
@@ -307,6 +315,7 @@ The website is deployed to GitHub Pages at: https://borntoberoot.net/NETworkMana
 ## Testing Strategy
 
 - **Manual Testing**: Primary testing approach (test environments in `Tests/Environments/`)
+- **Unit Tests**: xUnit tests in `Source/NETworkManager.Tests`, run by AppVeyor CI
 - **Build Verification**: AppVeyor CI ensures builds succeed
 - **Windows only**: The application only builds and runs on Windows (WPF, Windows SDK, CsWinRT). Changes made
   on other platforms can't be compiled and must be verified on Windows
@@ -357,7 +366,6 @@ The website is deployed to GitHub Pages at: https://borntoberoot.net/NETworkMana
 - **`.github/dependabot.yml`**: Dependabot configuration
 - **`.github/mergify.yml`**: Mergify auto-merge configuration
 - **`.github/transifex.yml`**: Transifex translation sync configuration
-- **`.github/stale.yml`**: Stale issue bot configuration
 - **`.gitmodules`**: Git submodule configuration (Dragablz)
 - **`Website/docusaurus.config.js`**: Documentation site configuration
 - **`Website/docs/changelog/next-release.md`**: Changelog of the upcoming release
 
@@ -46,6 +46,11 @@
         <PackageReference Include="Microsoft.Windows.CsWinRT" Version="2.3.1" />
         <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
         <PackageReference Include="Microsoft.PowerShell.SDK" Version="7.6.7" />
+        <!-- Microsoft.PowerShell.SDK pulls in 10.0.10 of these packages, which has known vulnerabilities (NuGet audit
+             NU1902 / NU1903). The application uses the copies of the Windows Desktop runtime anyway, but referencing the
+             patched versions keeps the dependency graph clean. Can be removed once the PowerShell SDK references them. -->
+        <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.14" />
+        <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.14" />
 
     </ItemGroup>
 
 
@@ -374,7 +374,7 @@ Release date: **xx.xx.2026**
 ## Dependencies, Refactoring & Documentation
 
 - Code cleanup & refactoring
-- Dependabot updates the NuGet packages again (no updates since February 2025). The Windows SDK version is now set via `TargetPlatformVersion` instead of in the target framework (`net10.0-windows10.0.22621.0` → `net10.0-windows`), which Dependabot can't handle ([dependabot-core#13278](https://github.com/dependabot/dependabot-core/issues/13278)). The build output moved from `bin\...\net10.0-windows10.0.22621.0\` to `bin\...\net10.0-windows\`.
+- Dependabot updates the NuGet packages again (no updates since February 2025). The Windows SDK version is now set via `TargetPlatformVersion` instead of in the target framework (`net10.0-windows10.0.22621.0` → `net10.0-windows`), which Dependabot can't handle ([dependabot-core#13278](https://github.com/dependabot/dependabot-core/issues/13278)). The build output moved from `bin\...\net10.0-windows10.0.22621.0\` to `bin\...\net10.0-windows\`. [1ce8310](https://github.com/BornToBeRoot/NETworkManager/commit/1ce8310a876f0d5bf87d0b2e098bcb22d15dd5a9)
 - Context menus of lists (results, profiles, settings) get the view model in XAML instead of when they are opened. Their items, and menu items that are created outside of a menu (e.g. the extra items of the profile context menu), no longer cause XAML binding errors every time a list is filled, which hid real binding errors.
 - Converted the **IP Scanner** and **Port Scanner** engines from `Parallel.ForEach` with blocking calls to genuinely asynchronous `Parallel.ForEachAsync`, removing the risk of exhausting the application's ThreadPool at high concurrency settings. [#3564](https://github.com/BornToBeRoot/NETworkManager/pull/3564)
 - The TCP port probe (**IP Scanner**, **Port Scanner**) and the NetBIOS request (**IP Scanner**) report a refused connection, a timeout or no answer as result instead of throwing an exception for each of them (thousands per scan). Faster, and the application no longer lags while scanning with a debugger attached. [#3653](https://github.com/BornToBeRoot/NETworkManager/pull/3653)
@@ -384,5 +384,6 @@ Release date: **xx.xx.2026**
 - Input histories (e.g. hosts, domains, ports) are updated in place instead of being cleared and refilled, which avoids clearing the text of the input field and unnecessary updates. [#3644](https://github.com/BornToBeRoot/NETworkManager/pull/3644)
 - Added a unit test project (xUnit) with tests for the run command parser and the history lists. [#3644](https://github.com/BornToBeRoot/NETworkManager/pull/3644)
 - Reworked the GitHub issue templates as forms (bug report, feature request, question) that ask for the relevant information (e.g. affected feature, version, installation, Windows version, log), with links to the documentation, discussions, translations and security advisories. Simplified the pull request template and removed the Copilot summary section. [#3660](https://github.com/BornToBeRoot/NETworkManager/pull/3660)
+- Faster CI: AppVeyor no longer builds a branch a second time when a PR is open, skips changes that only affect the documentation / website, builds ARM64 only for releases and now runs the unit tests. The website is only built for PRs that change it and builds about 3x faster (Docusaurus Faster). Dependabot also updates the GitHub Actions, and CodeQL also scans the workflows. Website changes are only merged automatically if the website builds. Dependabot major updates are no longer merged automatically. Removed the stale bot. [#3675](https://github.com/BornToBeRoot/NETworkManager/pull/3675)
 - Language files updated via [#transifex](https://github.com/BornToBeRoot/NETworkManager/pulls?q=author%3Aapp%2Ftransifex-integration)
 - Dependencies updated via [#dependabot](https://github.com/BornToBeRoot/NETworkManager/pulls?q=author%3Aapp%2Fdependabot)