Build: Update sign tool installation command in workflow

Cannot pin to a specific version since it is perpetually a "pre-release".
Merge pull request #21978 from theo-vt/document_transaction
2026-03-18 14:41:41 -05:00 · 2026-03-18 18:37:38 +01:00 · 2026-03-18 17:10:27 +00:00 · 2026-03-18 11:15:45 -05:00 · 2026-03-18 16:05:33 +01:00 · 2026-03-18 07:36:12 -05:00
5059 changed files with 692116 additions and 380971 deletions
@@ -0,0 +1,92 @@
+name: Report a Problem
+description: Have you found something that does not work well, is too hard to do or is missing altogether? Please create a Problem Report.
+labels: ["Status: Needs triage","Status: Needs confirmation"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to fill out this problem report! Please [search](https://github.com/FreeCAD/FreeCAD/issues) if a similar issue already exists and check out [how to report issues](https://github.com/FreeCAD/FreeCAD?tab=readme-ov-file#reporting-issues). By submitting this issue, you agree to follow our [Code of Conduct](https://github.com/FreeCAD/FreeCAD/blob/main/CODE_OF_CONDUCT.md).
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Problem description
+      description: Describe the problem and how it impacts user experience, workflow, maintainability or performance. You can attach images or log files by clicking this area to highlight it and then dragging files in. To attach a FCStd file, ZIP it first.
+      placeholder: Describe your problem briefly.
+    validations:
+      required: true
+
+  - type: dropdown
+    id: wb
+    attributes:
+      label: Workbench affected?
+      options:
+        - Assembly
+        - BIM
+        - CAM
+        - Core (App, Gui,...)
+        - Draft
+        - FEM
+        - Material
+        - Measurement
+        - Mesh
+        - Part
+        - Part Design
+        - Sketcher
+        - Spreadsheet
+        - TechDraw
+        - Other (specify in description)
+
+  - type: textarea
+    id: steps_to_reproduce
+    attributes:
+      label: Steps to reproduce
+      description: If the problem appears to be a bug with the current functionality, provide a test case or recipe that reliably reproduces the issue. Ideally [record a macro](https://wiki.freecad.org/Std_DlgMacroRecord) and attach it. Please also add an example file as ZIP.
+      placeholder: |
+        Drag an example file as ZIP into this textbox to attach it.
+
+        Steps to reproduce the behavior:
+        1. Open my example file
+        2. Go to '...'
+        3. Click on '...'
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected_behavior
+    attributes:
+      label: Expected behavior
+      description: A clear and concise description of what you expected to happen when following the provided steps above.
+      placeholder: What is the expected behavior?
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual_behavior
+    attributes:
+      label: Actual behavior
+      description: A clear and concise description of what actually happens. If applicable, add screenshots to help explain the problem.
+      placeholder: What is actually happening? You can add screenshorts or videos by dragging them into this textbox.
+    validations:
+      required: true
+
+  - type: textarea
+    id: dev_version
+    attributes:
+      label: Development version About Info (in Safe Mode)
+      description: Download the latest weekly [development release](https://github.com/FreeCAD/FreeCAD/releases) and try reproducing the issue in safe mode (Help → Restart in Safe Mode). Use the [About FreeCAD](https://wiki.freecad.org/About) dialog to copy your full version information and paste it here.
+      placeholder: |
+        1. Download the latest weekly development version (link above).
+        2. Make sure to run in Safe Mode (Help -> Restart in Safe Mode) to exclude interference from 3rd party addons.
+        3. If the issue is still reproducible, open the About FreeCAD dialog and copy the full version info here.
+      render: shell
+    validations:
+      required: true
+
+  - type: textarea
+    id: good_version
+    attributes:
+      label: Last known good version (optional)
+      description: If this is a regression, paste the [About FreeCAD](https://wiki.freecad.org/About) info from the last known working version.
+      placeholder: If the problem did not exist in a previous version, paste the About FreeCAD info from that version here.
+      render: shell
@@ -0,0 +1,103 @@
+name: Report a Code Quality Issue
+description: Report problems related to code structure, maintainability, performance, correctness, or technical debt that do not directly affect end-user behavior.
+labels: ["Status: Needs triage", "Status: Needs confirmation", "Type: Code Quality"]
+type: "Code Quality"
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to help improve FreeCAD's code quality!
+
+        > [!NOTE]
+        > This form is intended **only for code quality issues**, such as:
+        > - Architectural or design problems
+        > - Maintainability or readability issues
+        > - Performance or scalability concerns
+        > - Incorrect abstractions, layering violations, or technical debt
+        >
+        > If the issue affects user-visible behavior, workflows, or UI, please use the regular **Report Problem** form instead.
+
+        Please [search existing issues](https://github.com/FreeCAD/FreeCAD/issues) before submitting.
+        By submitting this issue, you agree to follow our [Code of Conduct](https://github.com/FreeCAD/FreeCAD/blob/main/CODE_OF_CONDUCT.md).
+
+  - type: dropdown
+    id: wb
+    attributes:
+      label: Area / Workbench affected
+      description: Select the primary area affected by the code quality issue.
+      options:
+        - Assembly
+        - BIM
+        - CAM
+        - Core (App, Gui, Base, ...)
+        - Draft
+        - FEM
+        - Material
+        - Measurement
+        - Mesh
+        - Part
+        - Part Design
+        - Sketcher
+        - Spreadsheet
+        - TechDraw
+        - Build system / CI
+        - Documentation
+        - Other (specify below)
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Problem description
+      description: |
+        Describe the code quality issue clearly.
+        Focus on *why* the current implementation is problematic (e.g. maintainability, performance, correctness, extensibility).
+        Reference files, classes, functions, or modules where applicable.
+      placeholder: |
+        Example:
+        - Class X violates dependency rules by including Y
+        - Function Z mixes responsibilities and is hard to reason about
+        - Algorithm has unnecessary complexity or poor performance characteristics
+    validations:
+      required: true
+
+  - type: textarea
+    id: impact
+    attributes:
+      label: Impact
+      description: |
+        Explain the practical impact of this issue.
+        For example: increased maintenance cost, higher bug risk, performance degradation, difficulty extending functionality, or CI/build issues.
+      placeholder: Describe how this affects the codebase long-term.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposed_solution
+    attributes:
+      label: Suggested improvement (optional)
+      description: |
+        If you have ideas on how to address the issue, outline them here.
+        This can include refactoring suggestions, alternative designs, or references to best practices.
+      placeholder: Optional — leave empty if unsure.
+
+  - type: textarea
+    id: references
+    attributes:
+      label: References / evidence
+      description: |
+        Add relevant references such as:
+        - File paths or code snippets
+        - Related issues or pull requests
+        - Benchmarks, logs, or static analysis results
+      placeholder: Links, snippets, or related issues.
+
+  - type: textarea
+    id: dev_version
+    attributes:
+      label: Development version (if relevant)
+      description: |
+        If the issue is version-specific or recently introduced, paste the output from the
+        **About FreeCAD** dialog of a development build.
+        Otherwise, this can be left empty.
+      placeholder: Paste About FreeCAD information here.
+      render: shell
@@ -1,73 +0,0 @@
-name: Report a Problem
-description: Have you found something that does not work well, is too hard to do or is missing altogether? Please create a Problem Report.
-labels: ["Status: Needs triage","Status: Needs confirmation"]
-body:
-  - type: checkboxes
-    id: existing_issue
-    attributes:
-      label: Is there an existing issue for this?
-      description: Please [search](https://github.com/FreeCAD/FreeCAD/issues) to see if a similar issue already exists for the problem you encountered.
-      options:
-      - label: I have searched the existing issues
-        required: true
-  - type: textarea
-    id: description
-    attributes:
-      label: Problem description
-      description: Describe the problem and how it impacts user experience, workflow, maintainability or speed of the code. If the problem appears to be a bug with the current functionality, provide as test case or recipe that reproduces the error. Ideally record a macro and attach it.
-      placeholder: Description of the problem
-    validations:
-      required: true
-  - type: textarea
-    id: full_version
-    attributes:
-      label: Full version info
-      description: Please use the About FreeCAD dialog to copy your full version information and paste it here. Try reproducing the issue by restarting FreeCAD in safe mode too.
-      render: shell
-    validations:
-      required: true
-  - type: dropdown
-    id: wb
-    attributes:
-      label: Subproject(s) affected?
-      options:
-        - Addon Manager
-        - Assembly
-        - BIM
-        - CAM
-        - Core
-        - Draft
-        - Expressions
-        - FEM
-        - File formats
-        - Material
-        - Measurement
-        - Mesh
-        - OpenSCAD
-        - Part
-        - PartDesign
-        - Project Tools & Websites
-        - Sketcher
-        - Spreadsheet
-        - TechDraw
-        - Other (specify in description)
-  - type: textarea
-    id: anything_else
-    attributes:
-      label: Anything else?
-      description: |
-        Links? References? Anything that will give us more context about the issue you are encountering!
-        If there is a discussion about the problem on the forum, provide link(s) here.
-        You can upload or copy your macro here to speed up the diagnosis and debugging.
-
-        Tip: You can attach images or log files by clicking this area to highlight it and then dragging files in. To attach a FCStd file, ZIP it first (GitHub won't recognize the extension otherwise).
-    validations:
-      required: false
-  - type: checkboxes
-    id: terms
-    attributes:
-      label: Code of Conduct
-      description: By submitting this issue, you agree to follow our [Code of Conduct](https://github.com/FreeCAD/FreeCAD/blob/main/CODE_OF_CONDUCT.md)
-      options:
-        - label: I agree to follow this project's Code of Conduct
-          required: true
@@ -58,7 +58,7 @@ jobs:
      logdir: /tmp/log/
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

@@ -108,7 +108,7 @@ jobs:
          done
      - name: Upload logs
        if: always()
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ github.job }}-Logs
          path: |
@@ -26,14 +26,21 @@

 name: FreeCAD master CI

-on: [workflow_dispatch, push, pull_request, merge_group]
+on:
+  workflow_dispatch: ~
+  push:
+    branches:
+      - main
+      - releases/**
+  pull_request: ~
+  merge_group: ~
+

 concurrency:
  group: FC-CI-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

 jobs:
-
  Prepare:
    uses: ./.github/workflows/sub_prepare.yml
    with:
@@ -47,18 +54,21 @@ jobs:

  Ubuntu:
    needs: [Prepare]
+    if: "!startsWith(github.head_ref, 'refs/heads/backport-')"
    uses: ./.github/workflows/sub_buildUbuntu.yml
    with:
      artifactBasename: Ubuntu-${{ github.run_id }}

  Windows:
    needs: [Prepare]
+    if: "!startsWith(github.head_ref, 'refs/heads/backport-')"
    uses: ./.github/workflows/sub_buildWindows.yml
    with:
      artifactBasename: Windows-${{ github.run_id }}

  Lint:
    needs: [Prepare]
+    if: "!startsWith(github.head_ref, 'refs/heads/backport-')"
    uses: ./.github/workflows/sub_lint.yml
    with:
      artifactBasename: Lint-${{ github.run_id }}
@@ -68,6 +68,12 @@ runs:
          testCommand: ${{ inputs.builddir }}/tests/Gui_tests_run --gtest_output=json:${{ inputs.reportdir }}gui_gtest_results.json
          testLogFile: ${{ inputs.reportdir }}gui_gtest_test_log.txt
          testName: Gui
+      - name: C++ Qt tests
+        id: qttests
+        uses: ./.github/workflows/actions/runCPPTests/runQtTests
+        with:
+          builddir: ${{ inputs.builddir }}
+          testLogFile: ${{ inputs.reportdir }}qt_ctest_log.txt
      - name: C++ Material tests
        id: material
        uses: ./.github/workflows/actions/runCPPTests/runSingleTest
@@ -0,0 +1,55 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+# SPDX-FileNotice: Part of the FreeCAD project.
+
+name: runQtTests
+description: "Run all QtTest-based C++ tests (those labelled 'Qt' in CTest), generate log and report"
+
+inputs:
+  builddir:
+    description: "Build directory containing CTestTestfile.cmake"
+    required: true
+  testLogFile:
+    description: "Path for the command-line output of the tests"
+    required: true
+outputs:
+  reportText:
+    description: "Report text"
+    value: ${{ steps.report.outputs.reportText }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Run Qt tests via CTest
+      shell: bash -l {0}
+      env:
+        BUILD_DIR: ${{ inputs.builddir }}
+        TEST_LOG_FILE: ${{ inputs.testLogFile }}
+      run: |
+        set -o pipefail
+        ctest --test-dir "$BUILD_DIR" -L Qt --output-on-failure | tee -a "$TEST_LOG_FILE"
+    - name: Parse test results
+      if: always()
+      id: report
+      shell: bash -l {0}
+      env:
+        TEST_LOG_FILE: ${{ inputs.testLogFile }}
+      run: |
+        result=$(grep -E "(Test #|tests passed|tests failed|Total Test time)" "$TEST_LOG_FILE" || true)
+        if grep -qE "[1-9][0-9]* tests failed" "$TEST_LOG_FILE"
+        then
+          reportText="<details><summary>:fire: QtTest C++ tests failed</summary>\n"
+        else
+          reportText="<details><summary>:heavy_check_mark: QtTest C++ tests succeeded</summary>\n"
+        fi
+        reportText+="\n"
+        reportText+="Results\n"
+        reportText+="\n"
+        reportText+='```\n'
+        reportText+="$result\n"
+        reportText+='```\n'
+        reportText+="</details>\n"
+        reportText+="\n"
+        echo "reportText<<EOD" >> $GITHUB_OUTPUT
+        echo -e "$reportText" >> $GITHUB_OUTPUT
+        echo "EOD" >> $GITHUB_OUTPUT
+        echo -e "$reportText"
@@ -0,0 +1,62 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+# SPDX-FileNotice: Part of the FreeCAD project.
+
+name: runSingleQtTest
+description: "Run a single QtTest-based C++ test executable, generate log and report"
+
+inputs:
+  testCommand:
+    description: "Test executable path"
+    required: true
+  testLogFile:
+    description: "Path for the command-line output of the tests"
+    required: true
+  testName:
+    description: "A descriptive name for the test suite"
+    required: true
+outputs:
+  reportText:
+    description: "Report text"
+    value: ${{ steps.report.outputs.reportText }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Run QtTest tests
+      shell: bash -l {0}
+      env:
+        QT_QPA_PLATFORM: offscreen
+        TEST_COMMAND: ${{ inputs.testCommand }}
+        TEST_LOG_FILE: ${{ inputs.testLogFile }}
+      run: |
+        set -o pipefail
+        $TEST_COMMAND | tee -a "$TEST_LOG_FILE"
+    - name: Parse test results
+      if: always()
+      id: report
+      shell: bash -l {0}
+      env:
+        TEST_LOG_FILE: ${{ inputs.testLogFile }}
+        TEST_NAME: ${{ inputs.testName }}
+      run: |
+        # This bonkers sed regex is to try to find the start and end of the QtTest output block, which is not really
+        # designed to be machine-readable. Why did they have to choose asterisks?!?!
+        result=$(sed -n '/^\*\*\*\*\*\*\*\*\* Start/,/^\*\*\*\*\*\*\*\*\* Finished/p' "$TEST_LOG_FILE" || true)
+        if grep -qE "^FAIL!" "$TEST_LOG_FILE"
+        then
+          reportText="<details><summary>:fire: QtTest C++ test suite '${TEST_NAME}' failed</summary>\n"
+        else
+          reportText="<details><summary>:heavy_check_mark: QtTest C++ test suite '${TEST_NAME}' succeeded</summary>\n"
+        fi
+        reportText+="\n"
+        reportText+="Results\n"
+        reportText+="\n"
+        reportText+='```\n'
+        reportText+="$result\n"
+        reportText+='```\n'
+        reportText+="</details>\n"
+        reportText+="\n"
+        echo "reportText<<EOD" >> $GITHUB_OUTPUT
+        echo -e "$reportText" >> $GITHUB_OUTPUT
+        echo "EOD" >> $GITHUB_OUTPUT
+        echo -e "$reportText"
@@ -21,23 +21,23 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: '🧹 Tag & close stale unconfirmed bugs'
        id: stale_issues
-        uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
+        uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          days-before-issue-stale: 60
+          days-before-issue-stale: 90
          days-before-issue-close: 14
          days-before-pr-stale: -1
          days-before-pr-close: -1
-          operations-per-run: 100  # max num of ops per run
+          operations-per-run: 200  # max num of ops per run
          stale-issue-label: 'Status: Stale'
          close-issue-label: 'Status: Auto-closing'
-          exempt-issue-labels: 'Status: Confirmed,Priority: High,Priority: Critical,Blocker,Type: Feature,no-auto-close'
+          exempt-issue-labels: 'Status: Confirmed,Priority: High,Priority: Critical,Blocker,Type: Feature,no-auto-close,3rd party: OCC'
          remove-stale-when-updated: true
          ascending: true
          stale-issue-message: |
@@ -53,7 +53,7 @@ jobs:

      - name: '🧹 Close stale requested feedback issues'
        id: awaiting_issues
-        uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
+        uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          days-before-issue-stale: 20
@@ -80,17 +80,17 @@ jobs:

      - name: '🧹 Tag & close inactive issues'
        id: inactive_issues
-        uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
+        uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          days-before-issue-stale: 190
          days-before-issue-close: 60
          days-before-pr-stale: -1
          days-before-pr-close: -1
-          operations-per-run: 50  # max num of ops per run
+          operations-per-run: 100  # max num of ops per run
          stale-issue-label: 'Status: Stale'
          close-issue-label: 'Status: Auto-closing'
-          exempt-issue-labels: 'Priority: High,Priority: Critical,Blocker,Type: Feature,no-auto-close'
+          exempt-issue-labels: 'Priority: High,Priority: Critical,Blocker,Type: Feature,no-auto-close,3rd party: OCC'
          remove-stale-when-updated: true
          ascending: true
          stale-issue-message: |
@@ -110,7 +110,7 @@ jobs:

      - name: '🧹 Tag & close inactive PRs'
        id: inactive_pr
-        uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
+        uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          days-before-issue-stale: -1
@@ -28,13 +28,15 @@ jobs:
      )
    steps:
      - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          token: ${{ secrets.GH_TOKEN_FOR_CI_RUNNERS }}

      - name: Create backport pull requests
-        uses: korthout/backport-action@d07416681cab29bf2661702f925f020aaa962997 # v3.4.1
+        uses: korthout/backport-action@01619ebc9a6e3f6820274221b9956b3e7365000a # v4.1.0
        with:
          # Inputs documented here: https://github.com/korthout/backport-action?tab=readme-ov-file#inputs
-          github_token: ${{ github.token }}
+          github_token: ${{ secrets.GH_TOKEN_FOR_CI_RUNNERS }}
          github_workspace: ${{ github.workspace }}

          # permit PRs with merge commits to be backported
@@ -0,0 +1,277 @@
+name: Build Release
+on:
+  release:
+    types: [created]
+  schedule:
+   - cron: "0 0 * * 3"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  actions: write
+
+concurrency:
+  group: build-release-${{ github.event_name }}
+  cancel-in-progress: true
+
+jobs:
+  upload_src:
+    runs-on: ubuntu-latest
+    outputs:
+      build_tag: ${{ steps.get_tag.outputs.build_tag }}
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout source
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 2
+          fetch-tags: true
+          submodules: 'recursive'
+
+      - name: Get tag and create release if weekly
+        id: get_tag
+        shell: bash -l {0}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if [ "${{ github.event_name }}" = "release" ]; then
+            export BUILD_TAG="${{ github.event.release.tag_name }}"
+          else
+            export BUILD_TAG=weekly-$(date "+%Y.%m.%d")
+            gh release create ${BUILD_TAG} --title "Development Build ${BUILD_TAG}" \
+                                           -F .github/workflows/weekly-build-notes.md \
+                                           --prerelease || \
+            gh release view ${BUILD_TAG} > /dev/null  # fail if it doesn't exist
+          fi
+          echo "BUILD_TAG=${BUILD_TAG}" >> "$GITHUB_ENV"
+          echo "build_tag=${BUILD_TAG}" >> "$GITHUB_OUTPUT"
+
+      - name: Trigger notes updater workflow (only for weekly)
+        if: startsWith(steps.get_tag.outputs.build_tag, 'weekly-')
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+        env:
+          WEEKLY_TAG: ${{ steps.get_tag.outputs.build_tag }}
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo  = context.repo.repo;
+
+            // Reusable/dispatchable updater workflow file in .github/workflows/
+            const workflow_id = 'weekly-compare-link.yml';
+
+            // Use the default branch so the workflow file is available
+            const ref = (context.payload?.repository?.default_branch) || 'main';
+            const current_tag = process.env.WEEKLY_TAG || '';
+
+            await github.rest.actions.createWorkflowDispatch({
+              owner, repo, workflow_id, ref,
+              inputs: { current_tag }
+            });
+
+            core.info(`Dispatched ${workflow_id} on ${ref} with current_tag='${current_tag}'.`)
+
+      - name: Upload Source
+        id: upload_source
+        shell: bash -l {0}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          python3 package/scripts/write_version_info.py ../freecad_version.txt
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git config user.name 'github-actions[bot]'
+          git apply package/disable_git_info.patch
+          git commit -a -m "Disable git info write to Version.h"
+          git archive HEAD -o freecad_source_${BUILD_TAG}.tar
+          git submodule foreach --recursive \
+            "git archive HEAD --prefix=\$path/ -o \$sha1.tar && \
+             tar -A -f \$toplevel/freecad_source_${BUILD_TAG}.tar \$sha1.tar && \
+             rm \$sha1.tar"
+          gzip freecad_source_${BUILD_TAG}.tar
+          sha256sum freecad_source_${BUILD_TAG}.tar.gz > freecad_source_${BUILD_TAG}.tar.gz-SHA256.txt
+          gh release upload --clobber ${BUILD_TAG} "freecad_source_${BUILD_TAG}.tar.gz" "freecad_source_${BUILD_TAG}.tar.gz-SHA256.txt"
+
+  build:
+    needs: upload_src
+    strategy:
+      matrix:
+        include:
+          - { target: linux-64, os: ubuntu-22.04 }
+          - { target: linux-arm64, os: ubuntu-22.04-arm }
+          - { target: osx-64, os: macos-15-intel, deploy_target: "10.13" }
+          - { target: osx-arm64, os: macos-latest, deploy_target: "11.0" }
+          - { target: osx-arm64, os: macos-latest, deploy_target: "15.0" }
+          - { target: win-64, os: windows-latest }
+      fail-fast: false
+
+    runs-on: ${{ matrix.os }}
+    environment: weekly-build
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        with:
+          egress-policy: audit
+
+      # prevent running out of disk space on Ubuntu runners.
+      - name: Maximize build space
+        if: runner.os == 'Linux'
+        uses: AdityaGarg8/remove-unwanted-software@90e01b21170618765a73370fcc3abbd1684a7793 # v5
+        with:
+          verbose: 'true'
+          remove-android: 'true'      # (frees ~9 GB)
+          remove-cached-tools: 'true' # (frees ~8.3 GB)
+
+      - name: Set platform environment variables
+        shell: bash -l {0}
+        env:
+          OPERATING_SYSTEM: ${{ runner.os }}
+        run: |
+          if [[ $OPERATING_SYSTEM == 'Windows' ]]; then
+            echo 'PIXI_CACHE_DIR=D:\rattler' >> "$GITHUB_ENV"
+            echo 'RATTLER_CACHE_DIR=D:\rattler' >> "$GITHUB_ENV"
+          fi
+
+      - name: Checkout source
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 2
+          fetch-tags: true
+          submodules: 'recursive'
+
+      - uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e # v0.9.4
+        with:
+          pixi-version: v0.59.0
+          cache: false
+
+      - name: Install the Apple certificate and provisioning profile
+        id: macos_get_cert
+        if: runner.os == 'macOS'
+        env:
+          APP_SPECIFIC_PASSWORD: ${{ secrets.APP_SPECIFIC_PASSWORD }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
+          BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }}
+          DEVELOPER_TEAM_ID: ${{ secrets.DEVELOPER_TEAM_ID }}
+          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
+        run: |
+          if [ -z "$BUILD_CERTIFICATE_BASE64" ]; then
+            echo "has_cert=false" >> $GITHUB_OUTPUT
+            echo "No certificate avalable... skipping" && exit 0
+          else
+            echo "has_cert=true" >> $GITHUB_OUTPUT
+          fi
+          # create variables
+          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
+          PP_PATH=$RUNNER_TEMP/FreeCAD_bundle.provisionprofile
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+
+          export KEYCHAIN_PASSWORD=$(openssl rand -base64 8)
+
+          # import certificate and provisioning profile from secrets
+          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
+          echo -n "$BUILD_PROVISION_PROFILE_BASE64" | base64 --decode -o $PP_PATH
+
+          # create temporary keychain
+          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+
+          # import certificate to keychain
+          security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
+          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security list-keychain -d user -s $KEYCHAIN_PATH
+
+          # apply provisioning profile
+          mkdir -p ~/Library/Provisioning\ Profiles
+          cp $PP_PATH ~/Library/Provisioning\ Profiles
+
+          xcrun notarytool store-credentials "FreeCAD" --keychain "$KEYCHAIN_PATH" --apple-id "${APPLE_ID}" --password "${APP_SPECIFIC_PASSWORD}" --team-id "${DEVELOPER_TEAM_ID}"
+
+      - name: Setup .NET 10 SDK
+        if: runner.os == 'Windows'
+        uses: actions/setup-dotnet@baa11fbfe1d6520db94683bd5c7a3818018e4309 # v5.1.0
+        with:
+          dotnet-version: '10.0.103'
+
+      - name: Install sign tool
+        if: runner.os == 'Windows'
+        run: |
+          # NOTE: The sign tool is ONLY available as a prerelease package, they never issue real releases.
+          dotnet tool install --global --prerelease sign
+          echo "$env:USERPROFILE\.dotnet\tools" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+          dotnet --info
+          sign --version
+
+      - name: Build packages
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TARGET_PLATFORM: ${{ matrix.target }}
+          BUILD_TAG: ${{ needs.upload_src.outputs.build_tag }}
+        run: |
+          set -euo pipefail
+          if [[ "${{ runner.os }}" == "macOS" ]]; then
+            export MACOS_DEPLOYMENT_TARGET="${{ matrix.deploy_target }}"
+          fi
+          python3 package/scripts/write_version_info.py ../freecad_version.txt
+          cd package/rattler-build
+          pixi install
+
+      - name: Azure login for Windows build code signing
+        id: azure_login
+        if: runner.os == 'Windows'
+        continue-on-error: true
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
+        with:
+          creds: '{"clientId":"${{ secrets.AZURE_CLIENT_ID }}","clientSecret":"${{ secrets.AZURE_CLIENT_SECRET }}","subscriptionId":"${{ secrets.AZURE_SUBSCRIPTION_ID }}","tenantId":"${{ secrets.AZURE_TENANT_ID }}"}'
+
+      - name: Release packages with optional code-signing on Windows and macOS
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TARGET_PLATFORM: ${{ matrix.target }}
+          MAKE_INSTALLER: "true"
+          UPLOAD_RELEASE: "true"
+          BUILD_TAG: ${{ needs.upload_src.outputs.build_tag }}
+        run: |
+          set -euo pipefail
+
+          export MACOS_SIGN_RELEASE=0
+          export WINDOWS_SIGN_RELEASE=0
+
+          case "${RUNNER_OS}" in
+            Windows)
+              export WINDOWS_SIGN_RELEASE="${{ steps.azure_login.outcome }}"
+              export WINDOWS_AZURE_ENDPOINT="${{ vars.AZURE_TRUSTED_SIGNING_ENDPOINT }}"
+              export WINDOWS_AZURE_CERTIFICATE_PROFILE="${{ vars.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE }}"
+              export WINDOWS_AZURE_SIGNING_ACCOUNT="${{ vars.AZURE_TRUSTED_SIGNING_ACCOUNT }}"
+
+              # For good measure, normalize the azure_login result to 1 or 0
+              if [[ "${WINDOWS_SIGN_RELEASE:-}" == "success" ]]; then
+                export WINDOWS_SIGN_RELEASE=1
+              else
+                export WINDOWS_SIGN_RELEASE=0
+              fi
+              ;;
+
+            macOS)
+              export MACOS_SIGN_RELEASE="${{ steps.macos_get_cert.outputs.has_cert }}"
+              export MACOS_SIGNING_KEY_ID="${{ secrets.SIGNING_KEY_ID }}"
+              export MACOS_DEPLOYMENT_TARGET="${{ matrix.deploy_target }}"
+              ;;
+          esac
+
+          cd package/rattler-build
+          pixi run -e package create_bundle
+
+      ## Needed if running on a self-hosted runner:
+      # - name: Clean up keychain and provisioning profile
+      #   if: ${{ always() }}
+      #   run: |
+      #     security delete-keychain $RUNNER_TEMP/app-signing.keychain-db
+      #     rm ~/Library/MobileDevice/Provisioning\ Profiles/build_pp.mobileprovision
@@ -64,12 +64,12 @@ jobs:
        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
    steps:
    - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
      with:
        egress-policy: audit

    - name: Checkout repository
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        fetch-depth: 2
        submodules: recursive
@@ -68,7 +68,7 @@ jobs:
        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
    steps:
    - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
      with:
        egress-policy: audit

@@ -84,7 +84,7 @@ jobs:
        remove-docker-images: 'true' # (frees ~3.2 GB)

    - name: Checkout repository
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        fetch-depth: 2
        submodules: recursive
@@ -156,7 +156,7 @@ jobs:
        sarif_file: sarif-results/cpp.sarif

    - name: Upload loc as a Build Artifact
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v7.0.0
      with:
        name: sarif-results
        path: sarif-results
@@ -17,11 +17,11 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: 'Checkout Repository'
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4
+        uses: actions/dependency-review-action@05fe4576374b728f0c523d6a13d64c25081e0803 # v4
@@ -8,7 +8,10 @@ on:

 jobs:
  trigger-copr-build:
+    environment: fedora-daily
    env:
+      copr_login: ${{ secrets.COPR_LOGIN }}
+      copr_username: ${{ secrets.COPR_USERNAME }}
      copr_token: ${{ secrets.COPR_TOKEN }}
    runs-on: ubuntu-latest
    container: quay.io/packit/packit
@@ -16,9 +19,15 @@ jobs:
    - name: setup copr token
      run: |
        mkdir -p ~/.config
-        echo "$copr_token" > ~/.config/copr
+        echo \
+        "[copr-cli]
+        login = $copr_login
+        username = $copr_username
+        token = $copr_token
+        copr_url = https://copr.fedorainfracloud.org
+        " > ~/.config/copr
    - name: checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
      with:
        submodules: recursive
        fetch-depth: 500
@@ -10,9 +10,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          fetch-depth: 0
+          token: ${{ secrets.GH_TOKEN_FOR_CROWDIN_SYNC }}

      - name: Install Qt ≥ 6.8
        uses: jurplel/install-qt-action@d325aaf2a8baeeda41ad0b5d39f84a6af9bcf005
@@ -24,7 +25,7 @@ jobs:
          arch: "linux_gcc_64"

      - name: Setup Python & dependencies
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
        with:
          python-version: "3.13"
      - name: Install Python packages
@@ -45,8 +46,8 @@ jobs:

      - name: Commit changes
        run: |
-          git config --global user.name "github-actions"
-          git config --global user.email "github-actions@github.com"
+          git config --global user.name "freecad-gh-actions-translation-bot"
+          git config --global user.email "freecad-gh-actions-translation-bot@github.com"
          git add src
          git commit -m "Update translations from Crowdin" || echo "No changes to commit"

@@ -56,12 +57,11 @@ jobs:
          git push origin update-crowdin-translations --force

      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0
        with:
          branch: update-crowdin-translations
          title: "Update translations from Crowdin"
          body: "Automatic Crowdin update."
-          labels: "translations, automated"
          token: ${{ secrets.GH_TOKEN_FOR_CROWDIN_SYNC }}
          delete-branch: true
          add-paths: |
@@ -17,7 +17,7 @@ jobs:
    steps:

    - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
      with:
        egress-policy: audit

@@ -35,7 +35,7 @@ jobs:
        echo "last_month=$first_day..$last_day" >> "$GITHUB_ENV"

    - name: Run issue-metrics tool
-      uses: github/issue-metrics@637a24e71b78bc10881e61972b19ea9ff736e14a # v3.25.2
+      uses: github/issue-metrics@6a35322ff89cee3e1a594d282c27eb34bffa9174 # v4.1.1
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        SEARCH_QUERY: 'repo:FreeCAD/FreeCAD is:issue created:${{ env.last_month }}'
@@ -21,7 +21,7 @@ jobs:

    steps:
    - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
      with:
        egress-policy: audit

@@ -10,7 +10,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          fetch-depth: 0
          ref: releases/FreeCAD-1-1
@@ -25,7 +25,7 @@ jobs:
          arch: "linux_gcc_64"

      - name: Setup Python & dependencies
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
        with:
          python-version: "3.13"
      - name: Install Python packages
@@ -36,12 +36,12 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: "Checkout code"
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

@@ -68,7 +68,7 @@ jobs:
      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
      # format to the repository Actions tab.
      - name: "Upload artifact"
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: SARIF file
          path: results.sarif
@@ -75,7 +75,7 @@ jobs:

    steps:
    - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
      with:
        egress-policy: audit

@@ -91,7 +91,7 @@ jobs:
        fi

    - name: Checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Add GCC Problem Matcher
      if: runner.os == 'Linux'
@@ -116,7 +116,7 @@ jobs:
        mkdir -p ${{ env.reportdir }}
        echo "reportFile=${{ env.reportfilename }}" >> $GITHUB_OUTPUT

-    - uses: prefix-dev/setup-pixi@82d477f15f3a381dbcc8adc1206ce643fe110fb7 # v0.9.3
+    - uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e # v0.9.4
      with:
        pixi-version: v0.59.0
        cache: false
@@ -124,7 +124,7 @@ jobs:
    - name: Restore Compiler Cache
      id: cache-restore
      if: always()
-      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
      with:
        path: ${{ env.CCACHE_DIR }}
        key: FC-${{ env.cacheKey }}-${{ github.ref }}-${{ github.run_id }}
@@ -209,14 +209,14 @@ jobs:
    - name: Save Compiler Cache
      id: cache-save
      if: always()
-      uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
      with:
        path: ${{ env.CCACHE_DIR }}
        key: FC-${{ env.cacheKey }}-${{ github.ref }}-${{ github.run_id }}

    - name: Upload logs
      if: always()
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
      with:
        name: ${{ inputs.artifactBasename }}-${{ matrix.os }}-Logs
        path: |
@@ -225,7 +225,7 @@ jobs:

    - name: Upload report
      if: always()
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
      with:
        name: ${{ env.reportfilename }}
        path: |
@@ -22,9 +22,9 @@
 # ***************************************************************************

 # This is a build and test workflow for CI of FreeCAD.
-# This workflow aims at building and testing FreeCAD on Ubuntu 22.04 using GCC.
+# This workflow aims at building and testing FreeCAD on Ubuntu 24.04 using GCC.

-name: Build Ubuntu 22.04
+name: Build Ubuntu 24.04

 on:
  workflow_call:
@@ -47,7 +47,7 @@ on:
 jobs:

  Build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    continue-on-error: ${{ inputs.allowedToFail }}
    env:
      CCACHE_COMPILERCHECK: "%compiler% -dumpfullversion -dumpversion" # default:mtime
@@ -77,12 +77,12 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: Checking out source code
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: true

@@ -94,7 +94,7 @@ jobs:
          sudo apt-get update -y -qq
          sudo apt-get install -y -qq python3-pip
          python3 -m pip install --upgrade pip
-          python3 -m pip install ifcopenshell==0.8.2
+          python3 -m pip install ifcopenshell==0.8.2 --break-system-packages

      - name: Make needed directories, files and initializations
        id: Init
@@ -116,7 +116,7 @@ jobs:
      - name: Restore Compiler Cache
        id: cache-restore
        if: always()
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        with:
          path: ${{ env.CCACHE_DIR }}
          key: FC-${{ steps.genCacheKey.outputs.cacheKey }}-${{ github.ref }}-${{ github.run_id }}
@@ -131,7 +131,7 @@ jobs:
          ccache -p

      - name: Install cmake
-        uses: jwlawson/actions-setup-cmake@802fa1a2c4e212495c05bf94dba2704a92a472be # v2.0.2
+        uses: jwlawson/actions-setup-cmake@3a6cbe35ba64df7ca70c51365c4aff65db9a9037 # v2.1.1
        with:
          cmake-version: '3.31.6'

@@ -216,14 +216,14 @@ jobs:
      - name: Save Compiler Cache
        id: cache-save
        if: always()
-        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        with:
          path: ${{ env.CCACHE_DIR }}
          key: FC-${{ steps.genCacheKey.outputs.cacheKey }}-${{ github.ref }}-${{ github.run_id }}

      - name: Upload logs
        if: always()
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ inputs.artifactBasename }}-Logs
          path: |
@@ -232,7 +232,7 @@ jobs:

      - name: Upload report
        if: always()
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ env.reportfilename }}
          path: |
@@ -24,15 +24,27 @@

 name: Build Windows
 on:
+  workflow_dispatch:
+    inputs:
+      artifactBasename:
+        description: "Base name for artifact"
+        required: false
+        type: string
+        default: "FreeCAD"
+      allowedToFail:
+        description: "whether a failed build is allowed"
+        required: false
+        type: boolean
+        default: false
  workflow_call:
    inputs:
      artifactBasename:
-        type: string
        required: true
+        type: string
      allowedToFail:
+        required: false
        default: false
        type: boolean
-        required: false
    outputs:
      reportFile:
        value: ${{ jobs.Build.outputs.reportFile }}
@@ -66,12 +78,12 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: Checking out source code
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: true

@@ -99,7 +111,7 @@ jobs:
      - name: Restore compiler cache
        id: cache-restore
        if: always()
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        with:
          path: ${{ env.CCACHE_DIR }}
          key: FC-${{ env.cacheKey }}-${{ github.ref }}-${{ github.run_id }}
@@ -114,7 +126,7 @@ jobs:
          . $env:ccachebindir\ccache -p

      - name: Install cmake
-        uses: jwlawson/actions-setup-cmake@802fa1a2c4e212495c05bf94dba2704a92a472be # v2.0.2
+        uses: jwlawson/actions-setup-cmake@3a6cbe35ba64df7ca70c51365c4aff65db9a9037 # v2.1.1
        with:
          cmake-version: '3.31.6'

@@ -157,14 +169,14 @@ jobs:
      - name: Save Compiler Cache
        id: cache-save
        if: always()
-        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        with:
          path: ${{ env.CCACHE_DIR }}
          key: FC-${{ env.cacheKey }}-${{ github.ref }}-${{ github.run_id }}

      - name: Upload logs
        if: always()
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ inputs.artifactBasename }}-Logs
          path: |
@@ -198,12 +198,12 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: Check out code
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: true

@@ -355,7 +355,7 @@ jobs:

      - name: Upload logs and fixes
        if: always()
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ inputs.artifactBasename }}-Logs
          path: |
@@ -364,7 +364,7 @@ jobs:

      - name: Upload report
        if: always()
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ env.reportfilename }}
          path: |
@@ -81,7 +81,7 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

@@ -94,7 +94,7 @@ jobs:
          touch ${{ env.logdir }}changedFiles.lst ${{ env.logdir }}changedCppFiles.lst ${{ env.logdir }}changedPythonFiles.lst
          echo "reportFile=${{ env.reportfilename }}" >> $GITHUB_OUTPUT
      - name: Check out code
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: true
      - name: Determine base and head SHA in case of PR
@@ -180,14 +180,14 @@ jobs:
          echo "" >> $GITHUB_OUTPUT
      - name: Upload logs
        if: always()
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ inputs.artifactBasename }}-Logs
          path: |
            ${{ env.logdir }}
      - name: Upload report
        if: always()
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ env.reportfilename }}
          path: |
@@ -1,170 +0,0 @@
-name: Weekly Build
-on:
-  schedule:
-   - cron: "0 0 * * 3"
-  workflow_dispatch:
-
-permissions:
-  contents: write
-
-jobs:
-  tag_build:
-    runs-on: ubuntu-latest
-    outputs:
-      build_tag: ${{ steps.tag_build.outputs.build_tag }}
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
-        with:
-          egress-policy: audit
-
-      - name: Checkout Source
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          fetch-depth: 2
-          fetch-tags: true
-          submodules: 'recursive'
-
-      - name: Tag Build
-        id: tag_build
-        shell: bash -l {0}
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          export BUILD_TAG=weekly-$(date "+%Y.%m.%d")
-          echo "BUILD_TAG=${BUILD_TAG}" >> "$GITHUB_ENV"
-          echo "build_tag=${BUILD_TAG}" >> "$GITHUB_OUTPUT"
-          gh release create ${BUILD_TAG} --title "Development Build ${BUILD_TAG}" -F .github/workflows/weekly-build-notes.md --prerelease || true
-
-      - name: Upload Source
-        id: upload_source
-        shell: bash -l {0}
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          python3 package/rattler-build/scripts/make_version_file.py ../freecad_version.txt
-          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
-          git config user.name 'github-actions[bot]'
-          git apply package/rattler-build/scripts/disable_git_info.patch
-          git commit -a -m "Disable git info write to Version.h"
-          git archive HEAD -o freecad_source_${BUILD_TAG}.tar
-          git submodule foreach --recursive \
-            "git archive HEAD --prefix=\$path/ -o \$sha1.tar && \
-             tar -A -f \$toplevel/freecad_source_${BUILD_TAG}.tar \$sha1.tar && \
-             rm \$sha1.tar"
-          gzip freecad_source_${BUILD_TAG}.tar
-          sha256sum freecad_source_${BUILD_TAG}.tar.gz > freecad_source_${BUILD_TAG}.tar.gz-SHA256.txt
-          gh release upload --clobber ${BUILD_TAG} "freecad_source_${BUILD_TAG}.tar.gz" "freecad_source_${BUILD_TAG}.tar.gz-SHA256.txt"
-
-  build:
-    needs: tag_build
-    strategy:
-      matrix:
-        include:
-          - { target: linux-64, os: ubuntu-22.04 }
-          - { target: linux-arm64, os: ubuntu-22.04-arm }
-          - { target: osx-64, os: macos-15-intel }
-          - { target: osx-arm64, os: macos-latest }
-          - { target: win-64, os: windows-latest }
-      fail-fast: false
-
-    runs-on: ${{ matrix.os }}
-    environment: weekly-build
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
-        with:
-          egress-policy: audit
-
-      # prevent running out of disk space on Ubuntu runners.
-      - name: Maximize build space
-        if: runner.os == 'Linux'
-        uses: AdityaGarg8/remove-unwanted-software@90e01b21170618765a73370fcc3abbd1684a7793 # v5
-        with:
-          verbose: 'true'
-          remove-android: 'true'      # (frees ~9 GB)
-          remove-cached-tools: 'true' # (frees ~8.3 GB)
-
-      - name: Set Platform Environment Variables
-        shell: bash -l {0}
-        env:
-          BUILD_TAG: ${{ needs.tag_build.outputs.build_tag }}
-          OPERATING_SYSTEM: ${{ runner.os }}
-        run: |
-          echo "BUILD_TAG=${BUILD_TAG}" >> "$GITHUB_ENV"
-          if [[ $OPERATING_SYSTEM == 'Windows' ]]; then
-            echo 'PIXI_CACHE_DIR=D:\rattler' >> "$GITHUB_ENV"
-            echo 'RATTLER_CACHE_DIR=D:\rattler' >> "$GITHUB_ENV"
-          fi
-
-      - name: Checkout Source
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          fetch-depth: 2
-          fetch-tags: true
-          submodules: 'recursive'
-
-      - uses: prefix-dev/setup-pixi@82d477f15f3a381dbcc8adc1206ce643fe110fb7 # v0.9.3
-        with:
-          pixi-version: v0.59.0
-          cache: false
-
-      - name: Install the Apple certificate and provisioning profile
-        if: runner.os == 'macOS'
-        env:
-          APP_SPECIFIC_PASSWORD: ${{ secrets.APP_SPECIFIC_PASSWORD }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
-          BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }}
-          DEVELOPER_TEAM_ID: ${{ secrets.DEVELOPER_TEAM_ID }}
-          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
-          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
-        run: |
-          # create variables
-          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
-          PP_PATH=$RUNNER_TEMP/FreeCAD_Weekly.provisionprofile
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-
-          export KEYCHAIN_PASSWORD=$(openssl rand -base64 8)
-
-          # import certificate and provisioning profile from secrets
-          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
-          echo -n "$BUILD_PROVISION_PROFILE_BASE64" | base64 --decode -o $PP_PATH
-
-          # create temporary keychain
-          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-
-          # import certificate to keychain
-          security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
-          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          security list-keychain -d user -s $KEYCHAIN_PATH
-
-          # apply provisioning profile
-          mkdir -p ~/Library/Provisioning\ Profiles
-          cp $PP_PATH ~/Library/Provisioning\ Profiles
-
-          xcrun notarytool store-credentials "FreeCAD" --keychain "$KEYCHAIN_PATH" --apple-id "${APPLE_ID}" --password "${APP_SPECIFIC_PASSWORD}" --team-id "${DEVELOPER_TEAM_ID}"
-
-      - name: Build and Release Packages
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          SIGNING_KEY_ID: ${{ secrets.SIGNING_KEY_ID }}
-          SIGN_RELEASE: "true"
-          TARGET_PLATFORM: ${{ matrix.target }}
-          UPLOAD_RELEASE: "true"
-        run: |
-          python3 package/rattler-build/scripts/make_version_file.py ../freecad_version.txt
-          git apply package/rattler-build/scripts/disable_git_info.patch
-          cd package/rattler-build
-          pixi install
-          pixi run -e package create_bundle
-
-      ## Needed if running on a self-hosted runner:
-      # - name: Clean up keychain and provisioning profile
-      #   if: ${{ always() }}
-      #   run: |
-      #     security delete-keychain $RUNNER_TEMP/app-signing.keychain-db
-      #     rm ~/Library/MobileDevice/Provisioning\ Profiles/build_pp.mobileprovision
@@ -54,7 +54,7 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

@@ -62,7 +62,7 @@ jobs:
        run: |
          mkdir -p ${{ env.artifactsDownloadDir }}
      - name: Download artifacts
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: ${{ env.artifactsDownloadDir }}
      - name: Save input data to file
@@ -119,7 +119,7 @@ jobs:
          cat report.md >> $GITHUB_STEP_SUMMARY
      - name: Delete used artifacts
        continue-on-error: true
-        uses: geekyeggo/delete-artifact@f275313e70c08f6120db482d7a6b98377786765b # v5.1.0
+        uses: geekyeggo/delete-artifact@176a747ab7e287e3ff4787bf8a148716375ca118 # v6.0.0
        with:
          name: |
            ${{ env.usedArtifacts }}
@@ -1,6 +1,7 @@
 > [!IMPORTANT]
 > Bleeding edge FreeCAD development builds for testing bugfixes, regressions, and recently implemented features. Do not use in a production environment.

+**Changes since last weekly:** <!--DIFF_LINK-->

 ### How-to use

@@ -8,7 +9,7 @@
 2. Unpack the bundle to any folder on your system
 3. Launch the application
    - **Windows**
-    Run `\bin\FreeCAD.exe` in the extracted directory
+    Run `\FreeCAD.exe` in the extracted directory
    - **macOS**
    Launch `/FreeCAD.app` in the extracted directory
    - **Linux**
@@ -0,0 +1,140 @@
+name: Weekly compare link to release notes
+
+on:
+  release:
+    types: [published]   # run automatically when a (pre-)release is published
+  workflow_dispatch:      # allow manual runs too
+    inputs:
+      current_tag:
+        description: "Weekly tag (e.g., weekly-2026.01.07). Leave empty to auto-detect latest weekly pre-release."
+        required: false
+      dry_run:
+        description: "Only compute; do not update the release body."
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: write        # required to PATCH the release body
+
+jobs:
+  update-notes:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Inject compare link into weekly release notes
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+        env:
+          # Pass manual inputs via env for convenience
+          CURRENT_TAG: ${{ github.event.inputs.current_tag }}
+          DRY_RUN: ${{ github.event.inputs.dry_run }}
+          PLACEHOLDER: "<!--DIFF_LINK-->"
+        with:
+          script: |
+            // Updates the current weekly release notes with a compare link to the previous weekly.
+            // Works for both release-published events and manual (workflow_dispatch) runs.
+            const owner = context.repo.owner;
+            const repo  = context.repo.repo;
+
+            const rx = /^weekly-(\d{4})\.(\d{2})\.(\d{2})$/;
+
+            // Determine currentTag:
+            // 1) Manual input via workflow_dispatch (env.CURRENT_TAG)
+            // 2) Tag from release event payload
+            // 3) Fallback: newest weekly pre-release
+            let currentTag = process.env.CURRENT_TAG || (context.payload?.release?.tag_name) || null;
+
+            async function detectLatestWeeklyTag() {
+              const releases = await github.paginate(github.rest.repos.listReleases, { owner, repo, per_page: 100 });
+              const cand = releases.find(r => r.prerelease && typeof r.tag_name === 'string' && rx.test(r.tag_name));
+              return cand?.tag_name || null;
+            }
+
+            if (!currentTag) {
+              currentTag = await detectLatestWeeklyTag();
+            }
+
+            if (!currentTag || !rx.test(currentTag)) {
+              core.info(`No weekly tag detected or tag format mismatch ('${currentTag}'). Skipping.`);
+              return;
+            }
+
+            // Resolve the current release object
+            let curRel;
+            try {
+              const { data } = await github.rest.repos.getReleaseByTag({ owner, repo, tag: currentTag });
+              curRel = data;
+            } catch (e) {
+              core.setFailed(`No release for tag ${currentTag}: ${e.message}`);
+              return;
+            }
+
+            // If event is a normal release (not pre-release), skip automatically-run case;
+            // but allow manual override (manual runs can patch any weekly tag).
+            const isManual = context.eventName === 'workflow_dispatch';
+            if (!isManual && !curRel.prerelease) {
+              core.info('Current release is not a pre-release; skipping (auto run).');
+              return;
+            }
+
+            // Helpers
+            const toPrevWeeklyTag = (tag) => {
+              const [, y, m, d] = tag.match(rx);
+              const dt = new Date(Date.UTC(+y, +m - 1, +d));
+              const prev = new Date(dt.getTime() - 7 * 24 * 3600 * 1000); // minus 7 days
+              const iso = prev.toISOString().slice(0, 10); // YYYY-MM-DD
+              return `weekly-${iso.replace(/-/g, '.')}`;   // weekly-YYYY.MM.DD
+            };
+            const ymdKey = (t) => t.replace(rx, '$1$2$3'); // YYYYMMDD
+
+            async function tagExists(tag) {
+              try {
+                await github.rest.git.getRef({ owner, repo, ref: `tags/${tag}` });
+                return true;
+              } catch {
+                return false;
+              }
+            }
+
+            // Compute previous weekly deterministically, then fall back if needed
+            let prevTag = toPrevWeeklyTag(currentTag);
+            if (!(await tagExists(prevTag))) {
+              core.info(`Computed previous tag ${prevTag} not found; scanning older weeklies...`);
+              const releases = await github.paginate(github.rest.repos.listReleases, { owner, repo, per_page: 100 });
+              const curKey = ymdKey(currentTag);
+              const older = releases
+                .filter(r => r.prerelease && typeof r.tag_name === 'string' && rx.test(r.tag_name))
+                .map(r => ({ tag: r.tag_name, key: ymdKey(r.tag_name) }))
+                .filter(x => x.key < curKey)
+                .sort((a, b) => b.key.localeCompare(a.key)); // newest older first
+              if (!older.length) {
+                core.info('No older weekly found; nothing to do.');
+                return;
+              }
+              prevTag = older[0].tag;
+            }
+
+            const compareUrl = `https://github.com/${owner}/${repo}/compare/${prevTag}...${currentTag}`;
+            const head = `**Changes since last weekly (${prevTag} → ${currentTag}):**\n${compareUrl}\n`;
+
+            if (process.env.DRY_RUN === 'true') {
+              core.info(`[DRY RUN] Would update release ${currentTag} with: ${compareUrl}`);
+              return;
+            }
+
+            // Idempotent body update
+            let body = curRel.body || '';
+            if (body.includes(compareUrl)) {
+              core.info('Compare URL already present; done.');
+              return;
+            }
+            const placeholder = process.env.PLACEHOLDER || '<!--DIFF_LINK-->';
+            if (body.includes(placeholder)) {
+              body = body.replace(placeholder, compareUrl);
+            } else if (/\*\*Changes since last weekly:/i.test(body)) {
+              body = body.replace(/\*\*Changes since last weekly:[^\n]*\n?/i, head + '\n');
+            } else {
+              body += (body.endsWith('\n') ? '\n' : '\n\n') + head;
+            }
+
+            await github.rest.repos.updateRelease({ owner, repo, release_id: curRel.id, body });
+            core.info(`Release notes updated with compare link: ${compareUrl}`);
@@ -1,59 +1,60 @@
 # file types to ignore
 .*
-!/.packit.yaml
+!*.gitattributes
+!*.gitignore
 !/.clang-format
 !/.clang-tidy
 !/.git-blame-ignore-revs
 !/.gitattributes
+!/.github/
 !/.gitignore
 !/.gitmodules
+!/.packit.yaml
 !/.pre-commit-config.yaml
 !/.pylintrc
-!/.github/
 !/contrib/.vscode/
-!*.gitattributes
-!*.gitignore
+*.clangd
 *.DS_Store
-*.pyc
-*.obj
-*.lib
-*.pch
-*.vcproj
-*.kdev4
-*.exp
 *.dep
+*.exp
+*.kdev4
+*.lib
 *.manifest
 *.o
+*.obj
 *.orig
 *.output
+*.pch
+*.pyc
+*.vcproj
 # Ignore .db files created by Qt Designer when editing .ui files
 *.db
-qrc_*.cpp
-BuildLog.htm
-cmake_install.cmake
-*~
-CMakeFiles/
 *qrc.depends
-ui_*.h
-moc_*.cpp
-Makefile
+*~
+BuildLog.htm
 CMakeCache.txt
+CMakeFiles/
 CMakeLists.txt.user
+Makefile
+cmake_install.cmake
 config.h
 install_manifest.txt
-/bin/
+moc_*.cpp
+qrc_*.cpp
+ui_*.h
+/.vscode/
 /ALL_BUILD.dir/
-/doc/
-/lib/
 /Mod/
 /ZERO_CHECK.dir/
-/build/
+/bin/
 /build-*/
+/build/
 /cmake-build*/
-/src/Tools/offlinedoc/localwiki/
-/src/Tools/offlinedoc/*.txt
 /conda/environment.yml
-/.vscode/
+/doc/
+/lib/
+/src/Tools/offlinedoc/*.txt
+/src/Tools/offlinedoc/localwiki/
 OpenSCAD_rc.py
 tags
 /CMakeUserPresets.json
@@ -63,10 +64,10 @@ compile_commands.json
 *.sublime-workspace

 # crowdin file
+files_to_translate.txt
 src/Tools/freecad.zip
 tsupdate_stderr.log
 tsupdate_stdout.log
-files_to_translate.txt
 # pixi environments
-.pixi
 *.egg-info
+.pixi
@@ -3,7 +3,7 @@ files_to_sync:
    - .packit.yaml
 actions:
  post-upstream-clone:
-    - bash -c 'BUILD_TAG=dev /usr/bin/python3 package/rattler-build/scripts/make_version_file.py freecad_version.txt'
+    - bash -c '/usr/bin/python3 package/scripts/write_version_info.py freecad_version.txt'
    - rm -f freecad-sources.tar.gz
  changelog-entry:
    - bash -c 'git log --no-merges --pretty="format:- %s (%an)" $(git describe --tags --abbrev=0 )..HEAD -- |sed 's/%/%%/g''
@@ -46,6 +46,7 @@ exclude: |
        src/App/ExpressionParser.tab.h|
        src/App/ExpressionParser.y|
        src/App/lex.ExpressionParser.c|
+        src/Doc/ThirdPartyLibraries.html.cmake|
        src/Gui/3Dconnexion/navlib|
        src/Gui/QSint|
        src/Gui/Quarter|
@@ -82,15 +82,11 @@ persistent=yes

 # Minimum Python version to use for version dependent checks. Will default to
 # the version used to run pylint.
-py-version=3.8
+py-version=3.10

 # Discover python modules and packages in the file system subtree.
 recursive=no

-# When enabled, pylint would attempt to guess common misconfiguration and emit
-# user-friendly hints instead of false-positive error messages.
-suggestion-mode=yes
-
 # Allow loading of arbitrary C extensions. Extensions are imported into the
 # active Python interpreter and may run arbitrary code.
 unsafe-load-any-extension=no
@@ -402,7 +398,7 @@ indent-after-paren=4
 indent-string='    '

 # Maximum number of characters on a single line.
-max-line-length=100
+max-line-length=120

 # Maximum number of lines in a module.
 max-module-lines=1000
@@ -55,6 +55,7 @@ set(PACKAGE_VERSION_MINOR "2")
 set(PACKAGE_VERSION_PATCH "0") # number of patch release (e.g. "4" for the 0.18.4 release)
 set(PACKAGE_VERSION_SUFFIX "dev") # either "dev" for development snapshot or "" (empty string)
 set(PACKAGE_BUILD_VERSION "0") # used when the same FreeCAD version will be re-released (for example using an updated LibPack)
+string(TIMESTAMP PACKAGE_COPYRIGHT_YEAR "%Y")

 set(PACKAGE_VERSION "${PACKAGE_VERSION_MAJOR}.${PACKAGE_VERSION_MINOR}.${PACKAGE_VERSION_PATCH}")
 set(PACKAGE_STRING "${PROJECT_NAME} ${PACKAGE_VERSION}")
@@ -94,8 +95,11 @@ if(NOT FREECAD_LIBPACK_USE OR FREECAD_LIBPACK_CHECKFILE_CLBUNDLER OR FREECAD_LIB
    endif(BUILD_GUI)
    SetupSalomeSMESH()
    if (BUILD_FEM_NETGEN)
-        find_package(NETGEN)
-    endif(BUILD_FEM_NETGEN)
+        set(NETGEN_DEFINITIONS -DNO_PARALLEL_THREADS -DOCCGEOMETRY)
+        if (NOT FREECAD_USE_EXTERNAL_SMESH)
+            find_package(NETGEN REQUIRED)
+        endif()
+    endif()
    # not needed at the moment
    #find_package(OpenCV REQUIRED)
    SetupSwig()
@@ -115,6 +119,10 @@ if(NOT FREECAD_LIBPACK_USE OR FREECAD_LIBPACK_CHECKFILE_CLBUNDLER OR FREECAD_LIB

    # SetupCoin3D can overwrite find_package(Boost) output so keep this after.
    SetupBoost()
+
+    if(BUILD_BIM)
+        SetupLark()
+    endif()
 endif()

 if(BUILD_VR)
@@ -71,10 +71,6 @@
            "type": "BOOL",
            "value": "ON"
          },
-          "BUILD_REVERSEENGINEERING": {
-            "type": "BOOL",
-            "value": "OFF"
-          },
          "ENABLE_DEVELOPER_TESTS": {
            "type": "BOOL",
            "value": "ON"
@@ -62,7 +62,9 @@ The FreeCAD Contribution Process is expressed here with the following specific g
    1. the PR description MUST contain proper attribution as the first line, for example: "This is work of XYZ cherry-picked from <link>";
    2. all commits MUST have proper authorship, i.e. be authored by the original author and committed by the author of the PR;
    3. if changes to cherry-picked commits are necessary they SHOULD be done as follow-up commits. If it is not possible to do so, then the modified commits MUST contain a `Co-Authored-By` trailer in their commit message.
-14. A “Valid PR” is one which satisfies the above requirements.
+14. Contributions must meet existing quality standards. Raw AI output is not accepted under any circumstances. AI may be used only as an assistive tool; in all cases, the resulting content must be reviewed, validated, and justifiable by the contributor. The contributor should be able to explain design and code decisions, answer reviewers’ questions, and ensure that AI use does not waste reviewers’ time during review. That being said, the use of AI is not recommended under any circumstances or in any manner.
+15. The contributor provides reasonable assurance that the contribution does not infringe third-party copyrights or license terms.
+16. A “Valid PR” is one which satisfies the above requirements.

 ## 6. Process

@@ -56,14 +56,8 @@ Other options are described on the [wiki Download page](https://wiki.freecad.org
 Compiling
 ---------

-FreeCAD requires several dependencies to correctly compile for development and
-production builds. The following pages contain updated build instructions for
-their respective platforms:
-
- [Linux](https://wiki.freecad.org/Compile_on_Linux)
- [Windows](https://wiki.freecad.org/Compile_on_Windows)
- [macOS](https://wiki.freecad.org/Compile_on_MacOS)
- [MinGW](https://wiki.freecad.org/Compile_on_MinGW)
+See the [Developers Handbook – Getting Started](https://freecad.github.io/DevelopersHandbook/gettingstarted/)
+for build instructions.


 Reporting Issues
@@ -0,0 +1,53 @@
+# - Find the lark library
+# This module finds if lark is installed, and sets the following variables
+# indicating where it is.
+#
+#  LARK_FOUND            - was lark found
+#  LARK_VERSION          - the version of lark found as a string
+#  LARK_VERSION_MAJOR    - the major version number of lark
+#  LARK_VERSION_MINOR    - the minor version number of lark
+#  LARK_VERSION_PATCH    - the patch version number of lark
+
+include(FindPackageHandleStandardArgs)
+
+if(Python3_EXECUTABLE)
+    message(STATUS "FindLark: Using Python3_EXECUTABLE = ${Python3_EXECUTABLE}")
+
+    # try to import lark into Python interpreter
+    execute_process(
+        COMMAND "${Python3_EXECUTABLE}" "-c"
+        "import lark; print(lark.__version__)"
+        RESULT_VARIABLE _LARK_SEARCH_SUCCESS
+        OUTPUT_VARIABLE LARK_VERSION
+        ERROR_VARIABLE _LARK_ERROR_VALUE
+        OUTPUT_STRIP_TRAILING_WHITESPACE
+    )
+
+    message(DEBUG "FindLark: Result = ${_LARK_SEARCH_SUCCESS}")
+    message(DEBUG "FindLark: Version = ${LARK_VERSION}")
+    message(DEBUG "FindLark: Error = ${_LARK_ERROR_VALUE}")
+
+    if(_LARK_SEARCH_SUCCESS MATCHES 0)
+        # extract version components
+        string(REGEX REPLACE "\\." ";" _LARK_VERSION_LIST ${LARK_VERSION})
+        list(LENGTH _LARK_VERSION_LIST _LARK_VERSION_LIST_LEN)
+        if(_LARK_VERSION_LIST_LEN GREATER_EQUAL 1)
+            list(GET _LARK_VERSION_LIST 0 LARK_VERSION_MAJOR)
+        endif()
+        if(_LARK_VERSION_LIST_LEN GREATER_EQUAL 2)
+            list(GET _LARK_VERSION_LIST 1 LARK_VERSION_MINOR)
+        endif()
+        if(_LARK_VERSION_LIST_LEN GREATER_EQUAL 3)
+            list(GET _LARK_VERSION_LIST 2 LARK_VERSION_PATCH)
+        endif()
+    else()
+        message(STATUS "The BIM workbench requires the lark python package / module to be installed")
+    endif()
+else()
+    message(STATUS "FindLark: Python3_EXECUTABLE not set")
+endif()
+
+find_package_handle_standard_args(LARK
+    REQUIRED_VARS LARK_VERSION
+    VERSION_VAR LARK_VERSION
+)
@@ -13,19 +13,15 @@
 # See also: http://git.salome-platform.org/gitweb/?p=NETGENPLUGIN_SRC.git;a=summary


-find_package(Netgen CONFIG)
+find_package(Netgen CONFIG QUIET)
 IF (Netgen_FOUND)
    set(NGLIB_INCLUDE_DIR ${NETGEN_INCLUDE_DIRS})
    set(NGLIB_LIBRARIES nglib)
-    set(NETGEN_DEFINITIONS -DNO_PARALLEL_THREADS -DOCCGEOMETRY)
    # for external smesh only the following two variables are needed:
    set(NETGEN_FOUND True)
    set(NETGEN_INCLUDE_DIRS ${NETGEN_INCLUDE_DIRS})
-
 ELSE ()

-    SET(NETGEN_DEFINITIONS -DNO_PARALLEL_THREADS -DOCCGEOMETRY)
-
    IF (WIN32)
        FIND_PATH(NGLIB_INCLUDE_DIR NAMES nglib.h PATHS ${NETGEN_INCLUDEDIR})
        SET(NETGEN_LIBS nglib mesh occ interface)
@@ -147,3 +143,8 @@ IF (Netgen_FOUND)
    MESSAGE(STATUS "Found NETGEN version ${NETGEN_VERSION_MAJOR}.${NETGEN_VERSION_MINOR}, calculated: ${NETGEN_VERSION_C}")
    LIST(APPEND NETGEN_DEFINITIONS -DNETGEN_VERSION=${NETGEN_VERSION_C})
 ENDIF ()
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(NETGEN
+    REQUIRED_VARS NGLIB_INCLUDE_DIR NGLIB_LIBRARIES NETGEN_INCLUDE_DIRS 
+    VERSION_VAR NETGEN_VERSION)
@@ -1,7 +1,11 @@
-# The Qt for Python project officially recommends using pip to install PySide, so we expect to find PySide in the
-# site-packages directory. The library will be called "PySide6.abi3.*", and there will be an "include" directory inside
-# the site-packages/PySide6. Over time some distros may provide custom versions, so we also support using a more normal
-# cMake find_package() call
+# The Qt for Python project officially recommends using pip to install PySide,
+# so we expect to find PySide in the site-packages directory.
+# The library will be called "PySide6.abi3.*", and there will
+# be an "include" directory inside the site-packages/PySide6.
+# Over time some distros may provide custom versions, so we also support
+# using a more normal cMake find_package() call
+
+include(FindPackageHandleStandardArgs)

 find_package(PySide6 CONFIG QUIET)

@@ -9,12 +13,40 @@ if(NOT PySide6_FOUND)
    find_pip_package(PySide6)
 endif()

-if(NOT PySide6_INCLUDE_DIRS AND TARGET PySide6::pyside6)
-    get_property(PySide6_INCLUDE_DIRS TARGET PySide6::pyside6 PROPERTY INTERFACE_INCLUDE_DIRECTORIES)
-endif()
+if(PySide6_FOUND)
+    # verify PySide6 version matches Qt6 version (major.minor)
+    if(PySide6_VERSION AND Qt6_VERSION)
+        string(REGEX MATCH "^([0-9]+)\\.([0-9]+)" _qt6_major_minor "${Qt6_VERSION}")
+        string(REGEX MATCH "^([0-9]+)\\.([0-9]+)" _pyside6_major_minor "${PySide6_VERSION}")

-# Also provide the old-style variables so we don't have to update everything yet
-if (PySide6_FOUND)
+        message(STATUS "Qt version: ${Qt6_VERSION}")
+        message(STATUS "PySide version: ${PySide6_VERSION}")
+
+        if(NOT _qt6_major_minor STREQUAL _pyside6_major_minor)
+            message(FATAL_ERROR
+" --------------------------------------------------------
+ Qt/PySide version mismatch!
+ cmake found Qt: ${Qt6_VERSION}
+ cmake found PySide: ${PySide6_VERSION}
+ major.minor versions of Qt and PySide must match to avoid errors.
+ Ensure CMAKE_PREFIX_PATH points to matching Qt and PySide6 installations.
+ --------------------------------------------------------"
+            )
+        endif()
+
+        message(STATUS "PySide/Qt version check passed (${_pyside6_major_minor})")
+    endif()
+
+    if(NOT PySide6_INCLUDE_DIRS AND TARGET PySide6::pyside6)
+        get_property(PySide6_INCLUDE_DIRS TARGET PySide6::pyside6 PROPERTY INTERFACE_INCLUDE_DIRECTORIES)
+    endif()
+
+    find_package_handle_standard_args(PySide6
+        REQUIRED_VARS PySide6_INCLUDE_DIRS
+        VERSION_VAR PySide6_VERSION
+    )
+
+    # Also provide the old-style variables so we don't have to update everything yet
    set(PYSIDE_INCLUDE_DIR ${PySide6_INCLUDE_DIRS})
    set(PYSIDE_LIBRARY ${PySide6_LIBRARIES})
    set(PYSIDE_FOUND TRUE)
@@ -3,11 +3,11 @@
 # PYSIDE_RCC_EXECUTABLE - Location of PYSIDE6RCC executable
 # PYSIDE_TOOLS_FOUND - PYSIDE6 utilities found.

-if (TARGET Qt6::uic)
+if(TARGET Qt6::uic)
    get_target_property(PYSIDE6_UIC_EXECUTABLE Qt6::uic LOCATION)
    set(UICOPTIONS "--generator=python")
 endif()
-if (TARGET Qt6::rcc)
+if(TARGET Qt6::rcc)
    get_target_property(PYSIDE6_RCC_EXECUTABLE Qt6::rcc LOCATION)
    set(RCCOPTIONS "--generator=python" "--compress-algo=zlib" "--compress=1")
 endif()
@@ -18,15 +18,15 @@ set(PySideTools_VERSION 6)

 if(PYSIDE_RCC_EXECUTABLE AND PYSIDE_UIC_EXECUTABLE)
    set(PYSIDE_TOOLS_FOUND TRUE)
-    if (NOT PYSIDE6Tools_FIND_QUIETLY)
+    if(NOT PYSIDE6Tools_FIND_QUIETLY)
        message(STATUS "Found PYSIDE6 tools: ${PYSIDE_UIC_EXECUTABLE}, ${PYSIDE_RCC_EXECUTABLE}")
-    endif ()
+    endif()
 else()
    if(PYSIDE6Tools_FIND_REQUIRED)
        message(FATAL_ERROR "PYSIDE6 tools could not be found, but are required.")
    else()
-        if (NOT PYSIDE6Tools_FIND_QUIETLY)
+        if(NOT PYSIDE6Tools_FIND_QUIETLY)
            message(STATUS "PYSIDE6 tools: not found.")
-        endif ()
+        endif()
    endif()
 endif()
@@ -10,14 +10,14 @@ if(NOT Shiboken6_FOUND)
    endif()
    if(NOT Shiboken6_INCLUDE_DIR)
        find_pip_package(Shiboken6)
-        if (Shiboken6_FOUND)
+        if(Shiboken6_FOUND)
            set(SHIBOKEN_LIBRARY ${Shiboken6_LIBRARIES})
            set(SHIBOKEN_MAJOR_VERSION 6)
            set(SHIBOKEN_FOUND ON)
        endif()
        # The include directory we actually want is part of shiboken6-generator
        find_pip_package(shiboken6_generator)
-        if (shiboken6_generator_FOUND)
+        if(shiboken6_generator_FOUND)
            set(SHIBOKEN_INCLUDE_DIR ${shiboken6_generator_INCLUDE_DIRS})
        endif()
    endif()
@@ -221,6 +221,9 @@ macro(PrintFinalReport)
    conditional(fmt fmt_FOUND "Sources downloaded to ${fmt_SOURCE_DIR}" "${fmt_VERSION}")
    conditional(yaml-cpp yaml-cpp_FOUND "not found" "${yaml-cpp_VERSION}")
    conditional(Vtk VTK_FOUND "not found" ${VTK_VERSION})
+    if(BUILD_BIM)
+        conditional(Lark LARK_FOUND "not found" "${LARK_VERSION}")
+    endif()

    section_end()

@@ -7,6 +7,22 @@ macro(SetupFreetype)
            message("===============================================================\n"
                    "FreeType2 not found. Part module will lack of makeWireString().\n"
                    "===============================================================\n")
+        else()
+            # find_package(harfbuzz CONFIG) fails on windows
+            # lets do it the complicated way instead.
+            find_path(HARFBUZZ_INCLUDE_DIR hb.h PATH_SUFFIXES harfbuzz)
+            find_library(HARFBUZZ_LIBRARY NAMES harfbuzz)
+            if(HARFBUZZ_INCLUDE_DIR AND HARFBUZZ_LIBRARY)
+                if(NOT TARGET harfbuzz::harfbuzz)
+                    add_library(harfbuzz::harfbuzz UNKNOWN IMPORTED)
+                    set_target_properties(harfbuzz::harfbuzz PROPERTIES
+                        IMPORTED_LOCATION "${HARFBUZZ_LIBRARY}"
+                        INTERFACE_INCLUDE_DIRECTORIES "${HARFBUZZ_INCLUDE_DIR}"
+                    )
+                endif()
+            else()
+                message(FATAL_ERROR "HarfBuzz not found")
+            endif()
        endif(NOT FREETYPE_FOUND)
    endif(FREECAD_USE_FREETYPE)

@@ -0,0 +1,7 @@
+macro(SetupLark)
+    # ------------------------------ Lark ------------------------------
+
+    find_package(LARK MODULE REQUIRED)
+    message(STATUS "Found Lark: version ${LARK_VERSION}")
+
+endmacro()
@@ -103,20 +103,33 @@ macro(SetupSalomeSMESH)
                    set(HDF5_VARIANT "hdf5-serial")
                else()
                    message(STATUS "We guess that libmed was built using hdf5-openmpi version")
-                    set(HDF5_VARIANT "hdf5-openmpi")
+                    set(HDF5_VARIANT "hdf5-openmpi;hdf5_openmpi")
                    set(HDF5_PREFER_PARALLEL TRUE) # if pkg-config fails, find_package(HDF5) needs this
                endif()
-                pkg_search_module(HDF5 ${HDF5_VARIANT})
-                if(NOT HDF5_FOUND)
+                pkg_search_module(PCHDF5 ${HDF5_VARIANT})
+                if(NOT PCHDF5_FOUND)
                    find_package(HDF5 REQUIRED)
                else()
-                    add_compile_options(${HDF5_CFLAGS})
-                    link_directories(${HDF5_LIBRARY_DIRS})
-                    link_libraries(${HDF5_LIBRARIES})
-                endif()
-                check_include_file_cxx(hdf5.h HDF5_FOUND)
-                if(NOT HDF5_FOUND)
-                    message( FATAL_ERROR "hdf5.h was not found.")
+                    add_compile_options(${PCHDF5_CFLAGS})
+                    link_directories(${PCHDF5_LIBRARY_DIRS})
+                    link_libraries(${PCHDF5_LIBRARIES})
+
+                    # workaround to define include dir from PCHDF5_CFLAGS (pkg-config PCHDF5_INCLUDEDIR is only filled since hdf5 1.14.6)
+                    set(hdf5_include_path "")
+                    foreach(flag IN LISTS PCHDF5_CFLAGS)
+                        if(flag MATCHES "^-I")
+                            string(REGEX REPLACE "^-I[ ]*" "" flag "${flag}")
+                            list(APPEND hdf5_include_path "${flag}")
+                        endif()
+                    endforeach()
+
+                    set(_save_INC CMAKE_REQUIRED_INCLUDES)
+                    set(CMAKE_REQUIRED_INCLUDES ${hdf5_include_path})
+                    check_include_file_cxx(hdf5.h HDF5_HEAD_FOUND)
+                    set(CMAKE_REQUIRED_INCLUDES ${_save_INC})
+                    if(NOT HDF5_HEAD_FOUND)
+                        message( FATAL_ERROR "hdf5.h was not found (tested pkg-config ${HDF5_VARIANT}, suggested header location was '${hdf5_include_path}').")
+                    endif()
                endif()

                # Med Fichier can require MPI
@@ -7,7 +7,7 @@ macro(SetupShibokenAndPyside)
    if(DEFINED MACPORTS_PREFIX)
        find_package(Shiboken REQUIRED HINTS "${PYTHON_LIBRARY_DIR}/cmake")
        find_package(PySide REQUIRED HINTS "${PYTHON_LIBRARY_DIR}/cmake")
-    endif(DEFINED MACPORTS_PREFIX)
+    endif()

    if(FREECAD_QT_MAJOR_VERSION EQUAL 5)
        set(SHIBOKEN_MAJOR_VERSION 2)
@@ -21,16 +21,16 @@ macro(SetupShibokenAndPyside)
    # Shiboken2Config.cmake may explicitly set CMAKE_BUILD_TYPE to Release which causes
    # CMake to fail to create Makefiles for a debug build.
    # So as a workaround we save and restore the value after checking for Shiboken2.
-    set (SAVE_BUILD_TYPE ${CMAKE_BUILD_TYPE})
+    set(SAVE_BUILD_TYPE ${CMAKE_BUILD_TYPE})
    find_package(Shiboken${SHIBOKEN_MAJOR_VERSION} QUIET)
-    set (CMAKE_BUILD_TYPE ${SAVE_BUILD_TYPE})
-    if (Shiboken${SHIBOKEN_MAJOR_VERSION}_FOUND)
+    set(CMAKE_BUILD_TYPE ${SAVE_BUILD_TYPE})
+    if(Shiboken${SHIBOKEN_MAJOR_VERSION}_FOUND)
        # Shiboken config file was found but it may use the wrong Python version
        # Try to get the matching config suffix and repeat finding the package
        set(SHIBOKEN_PATTERN .cpython-${Python3_VERSION_MAJOR}${Python3_VERSION_MINOR})

        file(GLOB SHIBOKEN_CONFIG "${Shiboken${SHIBOKEN_MAJOR_VERSION}_DIR}/Shiboken${SHIBOKEN_MAJOR_VERSION}Config${SHIBOKEN_PATTERN}*.cmake")
-        if (SHIBOKEN_CONFIG)
+        if(SHIBOKEN_CONFIG)
            get_filename_component(SHIBOKEN_CONFIG_SUFFIX ${SHIBOKEN_CONFIG} NAME)
            string(SUBSTRING ${SHIBOKEN_CONFIG_SUFFIX} 15 -1 SHIBOKEN_CONFIG_SUFFIX)
            string(REPLACE ".cmake" "" PYTHON_CONFIG_SUFFIX ${SHIBOKEN_CONFIG_SUFFIX})
@@ -47,11 +47,11 @@ macro(SetupShibokenAndPyside)
    # to dance to be compatible with the old (<5.12) and the new versions (>=5.12)
    if(NOT SHIBOKEN_INCLUDE_DIR AND TARGET Shiboken${SHIBOKEN_MAJOR_VERSION}::libshiboken)
        get_property(SHIBOKEN_INCLUDE_DIR TARGET Shiboken${SHIBOKEN_MAJOR_VERSION}::libshiboken PROPERTY INTERFACE_INCLUDE_DIRECTORIES)
-    endif(NOT SHIBOKEN_INCLUDE_DIR AND TARGET Shiboken${SHIBOKEN_MAJOR_VERSION}::libshiboken)
+    endif()

    if(NOT SHIBOKEN_INCLUDE_DIR)
        find_pip_package(Shiboken${SHIBOKEN_MAJOR_VERSION})
-        if (Shiboken${SHIBOKEN_MAJOR_VERSION}_FOUND)
+        if(Shiboken${SHIBOKEN_MAJOR_VERSION}_FOUND)
            set(SHIBOKEN_INCLUDE_DIR ${Shiboken${SHIBOKEN_MAJOR_VERSION}_INCLUDE_DIRS})
            set(SHIBOKEN_LIBRARY ${Shiboken${SHIBOKEN_MAJOR_VERSION}_LIBRARIES})
        endif()
@@ -63,11 +63,11 @@ macro(SetupShibokenAndPyside)
        # Our internal FindPySide6.cmake file already provides these for PySide6
        if(NOT PYSIDE_INCLUDE_DIR AND TARGET PySide${PYSIDE_MAJOR_VERSION}::pyside${PYSIDE_MAJOR_VERSION})
            get_property(PYSIDE_INCLUDE_DIR TARGET PySide${PYSIDE_MAJOR_VERSION}::pyside${PYSIDE_MAJOR_VERSION} PROPERTY INTERFACE_INCLUDE_DIRECTORIES)
-        endif(NOT PYSIDE_INCLUDE_DIR AND TARGET PySide${PYSIDE_MAJOR_VERSION}::pyside${PYSIDE_MAJOR_VERSION})
+        endif()

        if(NOT PYSIDE_INCLUDE_DIR)
            find_pip_package(PySide${PYSIDE_MAJOR_VERSION})
-            if (PySide${PYSIDE_MAJOR_VERSION}_FOUND)
+            if(PySide${PYSIDE_MAJOR_VERSION}_FOUND)
                set(PYSIDE_INCLUDE_DIR ${PySide${PYSIDE_MAJOR_VERSION}_INCLUDE_DIRS})
                set(PYSIDE_LIBRARY ${PySide${PYSIDE_MAJOR_VERSION}_LIBRARIES})
            endif()
@@ -175,22 +175,22 @@ macro(SetupShibokenAndPyside)
        message(STATUS "PySide ${PySide_VERSION} Python module found at ${PRINT_OUTPUT}.\n")
    endif()

-endmacro(SetupShibokenAndPyside)
+endmacro()


-MACRO(PYSIDE_WRAP_RC outfiles)
-  if (NOT PYSIDE_RCC_EXECUTABLE)
+macro(PYSIDE_WRAP_RC outfiles)
+  if(NOT PYSIDE_RCC_EXECUTABLE)
    message(FATAL_ERROR "Qt rcc is required for generating ${ARGN}")
  endif()
-  FOREACH(it ${ARGN})
-    GET_FILENAME_COMPONENT(outfile ${it} NAME_WE)
-    GET_FILENAME_COMPONENT(infile ${it} ABSOLUTE)
-    SET(outfile "${CMAKE_CURRENT_BINARY_DIR}/${outfile}_rc.py")
+  foreach(it ${ARGN})
+    get_filename_component(outfile ${it} NAME_WE)
+    get_filename_component(infile ${it} ABSOLUTE)
+    set(outfile "${CMAKE_CURRENT_BINARY_DIR}/${outfile}_rc.py")
    #ADD_CUSTOM_TARGET(${it} ALL
    #  DEPENDS ${outfile}
    #)
    if(WIN32 OR APPLE)
-        ADD_CUSTOM_COMMAND(OUTPUT ${outfile}
+        add_custom_command(OUTPUT ${outfile}
          COMMAND ${PYSIDE_RCC_EXECUTABLE} ${RCCOPTIONS} ${infile} -o ${outfile}
          MAIN_DEPENDENCY ${infile}
        )
@@ -198,7 +198,7 @@ MACRO(PYSIDE_WRAP_RC outfiles)
        # Especially on Open Build Service we don't want changing date like
        # pyside-rcc generates in comments at beginning, which is why
        # we follow the tool command with in-place sed.
-        ADD_CUSTOM_COMMAND(OUTPUT "${outfile}"
+        add_custom_command(OUTPUT "${outfile}"
          COMMAND "${PYSIDE_RCC_EXECUTABLE}" ${RCCOPTIONS} "${infile}" ${PY_ATTRIBUTE} -o "${outfile}"
          # The line below sometimes catches unwanted lines too - but there is no date in the file
          # anymore with Qt5 RCC, so commenting it out for now...
@@ -207,5 +207,5 @@ MACRO(PYSIDE_WRAP_RC outfiles)
        )
    endif()
    list(APPEND ${outfiles} ${outfile})
-  ENDFOREACH(it)
-ENDMACRO (PYSIDE_WRAP_RC)
+  endforeach()
+endmacro()
@@ -1,12 +1,160 @@
 macro(SetupSwig)
-# -------------------------------- Swig ----------------------------------

-    find_package(SWIG)
+#-------------------------------- Swig ----------------------------------

-    if (NOT SWIG_FOUND)
-        message("=====================================================\n"
-                "SWIG not found, will not build SWIG binding for pivy.\n"
-                "=====================================================\n")
-    endif(NOT SWIG_FOUND)
+# force cmake to re-search for SWIG when CMAKE_PREFIX_PATH changes
+unset(SWIG_EXECUTABLE CACHE)
+unset(SWIG_DIR CACHE)
+unset(SWIG_VERSION CACHE)
+unset(SWIG_FOUND CACHE)

-endmacro(SetupSwig)
+if(BUILD_SKETCHER)
+    # SWIG is required for sketcher WB (use QUIET to provide custom error message)
+    find_package(SWIG QUIET)
+
+    if(NOT SWIG_FOUND)
+        message(FATAL_ERROR
+                "-----------------------------------------------------\n"
+                "SWIG not found, swig & pivy required for sketcher WB.\n"
+                "-----------------------------------------------------\n")
+        # do not continue with check if swig not found
+        return()
+    endif()
+
+    # check swig/pivy runtime compatibility
+    message(STATUS "checking SWIG/Pivy runtime compatibility...")
+
+    # get SWIG's runtime version using -external-runtime flag
+    execute_process(
+        COMMAND ${SWIG_EXECUTABLE} -python -external-runtime "${CMAKE_BINARY_DIR}/swig_runtime_check.h"
+        RESULT_VARIABLE SWIG_EXTERNAL_RUNTIME_RESULT
+        ERROR_VARIABLE SWIG_EXTERNAL_RUNTIME_ERROR
+        ERROR_QUIET
+    )
+    # NOTE: only print the below output if using `cmake --log-level=DEBUG`
+    message(DEBUG "SWIG external-runtime result: ${SWIG_EXTERNAL_RUNTIME_RESULT}")
+    message(DEBUG "SWIG external-runtime error: ${SWIG_EXTERNAL_RUNTIME_ERROR}")
+
+    message(STATUS "Looking for: ${CMAKE_BINARY_DIR}/swig_runtime_check.h")
+    if(EXISTS "${CMAKE_BINARY_DIR}/swig_runtime_check.h")
+        message(STATUS "File exists: YES")
+    else()
+        message(STATUS "File exists: NO")
+    endif()
+
+    if(EXISTS "${CMAKE_BINARY_DIR}/swig_runtime_check.h")
+        file(STRINGS "${CMAKE_BINARY_DIR}/swig_runtime_check.h"
+            SWIG_RUNTIME_VERSION_LINE
+            REGEX "^#define SWIG_RUNTIME_VERSION")
+
+        message(STATUS "SWIG_RUNTIME_VERSION_LINE: ${SWIG_RUNTIME_VERSION_LINE}")
+
+        if(SWIG_RUNTIME_VERSION_LINE)
+            # extract the version number (it's in quotes: "5")
+            string(REGEX MATCH "\"([0-9]+)\"" _ "${SWIG_RUNTIME_VERSION_LINE}")
+            set(SWIG_RUNTIME_VERSION "${CMAKE_MATCH_1}")
+            message(STATUS "Extracted SWIG_RUNTIME_VERSION: ${SWIG_RUNTIME_VERSION}")
+        endif()
+
+        file(REMOVE "${CMAKE_BINARY_DIR}/swig_runtime_check.h")
+    else()
+        message(STATUS "swig_runtime_check.h not found!")
+    endif()
+
+    # extract pivy's SWIG runtime version from the compiled module
+    # NOTE: python code can not be indented
+    set(PYTHON_CHECK_PIVY_RUNTIME [=[
+import sys
+import os
+import re
+
+try:
+    import pivy
+    pivy_dir = os.path.dirname(pivy.__file__)
+    print(f'DEBUG:pivy_dir={pivy_dir}', file=sys.stderr)
+    print(f'DEBUG:files={os.listdir(pivy_dir)}', file=sys.stderr)
+
+    pivy_path = None
+
+    # Look for _coin module with any extension (.so on Unix, .pyd on Windows)
+    for f in os.listdir(pivy_dir):
+        print(f'DEBUG:checking={f}', file=sys.stderr)
+        if f.startswith('_coin') and (f.endswith('.so') or f.endswith('.pyd')):
+            pivy_path = os.path.join(pivy_dir, f)
+            break
+
+    print(f'DEBUG:pivy_path={pivy_path}', file=sys.stderr)
+
+    if pivy_path and os.path.exists(pivy_path):
+        with open(pivy_path, 'rb') as f:
+            content = f.read().decode('latin-1', errors='ignore')
+
+        print(f'DEBUG:content_len={len(content)}', file=sys.stderr)
+
+        # Use regex to find swig_runtime_data followed by a number
+        match = re.search(r'swig_runtime_data(\d+)', content)
+        print(f'DEBUG:match={match}', file=sys.stderr)
+        if match:
+            print(match.group(1))
+
+except ImportError as e:
+    print(f'DEBUG:import_error={e}', file=sys.stderr)
+    print('ERROR_IMPORT')
+except Exception as e:
+    print(f'DEBUG:exception={e}', file=sys.stderr)
+]=])
+
+execute_process(
+    COMMAND ${Python3_EXECUTABLE} -c "${PYTHON_CHECK_PIVY_RUNTIME}"
+    OUTPUT_VARIABLE PIVY_RUNTIME_VERSION
+    OUTPUT_STRIP_TRAILING_WHITESPACE
+    ERROR_VARIABLE PIVY_DEBUG_OUTPUT
+    TIMEOUT 10
+)
+
+message(DEBUG "Pivy debug output: ${PIVY_DEBUG_OUTPUT}")
+
+    # Handle errors and compare versions
+    if(PIVY_RUNTIME_VERSION STREQUAL "ERROR_IMPORT")
+        message(WARNING
+            "Could not import pivy to check SWIG compatibility.\n"
+            "Proceeding without SWIG version check."
+        )
+    elseif(SWIG_RUNTIME_VERSION AND PIVY_RUNTIME_VERSION)
+        if(NOT SWIG_RUNTIME_VERSION STREQUAL PIVY_RUNTIME_VERSION)
+            message(FATAL_ERROR
+" --------------------------------------------------------
+ 
+ SWIG / PIVY RUNTIME VERSION MISMATCH DETECTED!
+ 
+ SWIG runtime API version: ${SWIG_RUNTIME_VERSION}
+ Pivy runtime API version: ${PIVY_RUNTIME_VERSION}
+  
+ These must match for compatibility.
+ This will cause runtime errors: 'No SWIG wrapped library loaded'
+  
+ swig v4.4.x is not compatible with pivy built with swig <=4.3.x
+  
+ FIX: Install a SWIG version that uses runtime ${PIVY_RUNTIME_VERSION}
+ or rebuild Pivy with your current SWIG ${SWIG_VERSION}.
+ 
+--------------------------------------------------------"
+            )
+        else()
+            message(STATUS "SWIG/Pivy runtime compatibility: PASSED")
+            message(STATUS "swig runtime API version: ${SWIG_RUNTIME_VERSION}")
+            message(STATUS "pivy runtime API version: ${PIVY_RUNTIME_VERSION}")
+            message(STATUS "swig binary version building freecad: ${SWIG_VERSION}")
+        endif()
+    else()
+        if(NOT SWIG_RUNTIME_VERSION)
+            message(WARNING "Could not determine SWIG runtime version")
+        endif()
+        if(NOT PIVY_RUNTIME_VERSION)
+            message(WARNING "Could not determine Pivy runtime version")
+        endif()
+        message(WARNING "Proceeding without SWIG/Pivy compatibility check.")
+    endif()
+endif()
+
+endmacro()
@@ -0,0 +1,5 @@
+*.exe
+*-SHA256.txt
+MSVCRedist
+FreeCAD
+version.nsh
@@ -0,0 +1,47 @@
+del /S *_d.*
+del /S *_debug.*
+del /S *.pyc
+del /S *.pdb
+del /S boost*-gd-*.dll
+cd bin
+del assistant.exe
+del Coin4d.dll
+del designer.exe
+del freetyped.dll
+del libcrypto-3d.dll
+del libEGLd.dll
+del libGLESv2d.dll
+del libssl-3d.dll
+del linguist.exe
+del qdoc.exe
+del Qt6Concurrentd.dll
+del Qt6Cored.dll
+del Qt6DBusd.dll
+del Qt6DesignerComponentsd.dll
+del Qt6Designerd.dll
+del Qt6Guid.dll
+del Qt6Helpd.dll
+del Qt6LabsAnimationd.dll
+del Qt6LabsFolderListModeld.dll
+del Qt6LabsPlatformd.dll
+del Qt6LabsSettingsd.dll
+del Qt6LabsSharedImaged.dll
+del Qt6LabsWavefrontMeshd.dll
+del Qt6MultimediaWidgetsd.dll
+del Qt6Multimediad.dll
+del Qt6Networkd.dll
+del Qt6OpenGLWidgetsd.dll
+del Qt6OpenGLd.dll
+del Qt6PrintSupportd.dll
+del Qt6SpatialAudiod.dll
+del Qt6Sqld.dll
+del Qt6SvgWidgetsd.dll
+del Qt6Svgd.dll
+del Qt6Testd.dll
+del Qt6UiToolsd.dll
+del Qt6Widgetsd.dll
+del Qt6Xmld.dll
+del QtWebEngineProcessd.exe
+del Quarter1d.dll
+del xerces-c_3_2D.dll
+del zlibd.dll
@@ -5,7 +5,7 @@
 \pard\nowidctlpar\hyphpar0\sa140\sl276\slmult1\par
 \pard\nowidctlpar\hyphpar0\sl276\slmult1\b\fs28 Third-party libraries licenses\b0\fs24\par
 \pard\nowidctlpar\hyphpar0\sa140\sl276\slmult1\par
-\pard\nowidctlpar\hyphpar0\sl276\slmult1\fs18 The different libraries used in FreeCAD and their respective licenses are described on the\line\fs24{\field{\*\fldinst{HYPERLINK "https://www.freecadweb.org/wiki/Third_Party_Libraries" }}{\fldrslt{\cf2\ul\fs18 Third Party Libraries wiki page}}}\cf0\ulnone\f0\fs18 .\fs24\par
+\pard\nowidctlpar\hyphpar0\sl276\slmult1\fs18 The different libraries used in FreeCAD and their respective licenses are described on the\line\fs24{\field{\*\fldinst{HYPERLINK "https://www.freecad.org/wiki/Third_Party_Libraries" }}{\fldrslt{\cf2\ul\fs18 Third Party Libraries wiki page}}}\cf0\ulnone\f0\fs18 .\fs24\par
 \par
 \pard\noline\nowidctlpar\hyphpar0\sa283\fs12\par
 \pard\nowidctlpar\hyphpar0\sl276\slmult1\b\fs18 GNU LIBRARY GENERAL PUBLIC LICENSE\b0\fs24\par
@@ -81,4 +81,5 @@
 \pard\nowidctlpar\hyphpar0\sb240\sa180\sl276\slmult1\b\fs24 3D Mouse Support\b0\par
 \pard\nowidctlpar\hyphpar0\sb180\sa180\sl276\slmult1\fs18 Development tools and related technology provided under license from 3Dconnexion.(c) 1992 - 2012 3Dconnexion. All rights reserved\fs12\par
 }
-
+
+
@@ -1,7 +1,7 @@
 # Creating a Windows installer for FreeCAD

 These are instructions for building an NSIS-based installer for FreeCAD. They were designed for FreeCAD 0.21 and later,
-and presume that you have cloned a copy of FreeCAD's source code, and therefore have the directory *src/WindowsInstaller*.
+and presume that you have cloned a copy of FreeCAD's source code, and therefore have the directory *package/WindowsInstaller*.

 ## Install NSIS
 To set up your system for building an NSIS installer:
@@ -15,16 +15,13 @@ To set up your system for building an NSIS installer:
 4. Download and install the nsProcess plugin from https://nsis.sourceforge.io/NsProcess_plugin -- you will need the version that supports Unicode, so make sure to follow the appropriate instructions on their site to install that one (as of this writing it involves manually copying and renaming the plugin DLL file).

 ## Build the installer
-Next, update the installer settings for the current version of FreeCAD. Starting from the *src/WindowsInstaller* folder in the FreeCAD source tree:
-1. Set the appropriate version strings for the release you are creating. These are used to construct the filename of the installer, among other things. If you have to upload a new version of the installer for the exact same release of FreeCAD, increment `APP_VERSION BUILD` as needed.
-```
-!define APP_VERSION_MAJOR 0
-!define APP_VERSION_MINOR 21
-!define APP_VERSION_REVISION 0
+Next, update the installer settings for the current version of FreeCAD. Starting from the *package/WindowsInstaller* folder in the FreeCAD source tree:
+1. Set the appropriate version strings for the release you are creating. These are used to construct the filename of the installer, among other things. If you have to upload a new version of the installer for the exact same release of FreeCAD, increment `APP_VERSION BUILD` as needed. The main version numbers are dynamically obtained by calling `freecadcmd.exe`.
+```nsis
 !define APP_VERSION_EMERGENCY "RC1"
 !define APP_VERSION_BUILD 1
 ```
-2. Within the folder *src/WindowsInstaller*, create a new folder called MSVCRedist and copy the following files from your MSVC installation into it:
+2. If the installer will be made from a LibPack build create a new folder called MSVCRedist within the folder *package/WindowsInstaller* and copy the following files from your MSVC installation into it:
 ```
 vcruntime140.dll
 concrt140.dll
@@ -33,28 +30,38 @@ vcamp140.dll
 vccorlib140.dll
 vcomp140.dll
 ```
-3. Open the file *Settings.nsh* with a text editor (both jEdit and Visual Studio Code are good editors for NSIS files). Edit the following paths to correspond to your system: `FILES_FREECAD` corresponds to your installation directory (e.g. `CMAKE_INSTALL_PREFIX` if you self-compiled) and `FILES_DEPS` is the folder you created with the MSVC redistributable files in it.
-```
-!define FILES_FREECAD "C:\FreeCAD\Installer\FreeCAD"
-!define FILES_DEPS "C:\FreeCAD\Installer\MSVCRedist"
+3. If required open the file *Settings.nsh* with a text editor (both jEdit and Visual Studio Code are good editors for NSIS files). Edit the following paths to correspond to your system: `FILES_FREECAD` corresponds to your installation directory (e.g. `CMAKE_INSTALL_PREFIX` if you self-compiled), `FILES_THUMBS` is the directory where the thumbnailer dll is located and `FILES_DEPS` is the folder you created with the MSVC redistributable files in it. `FILES_DEPS` is not needed if the installer is created from a conda bundle so it is not set by default. These can be set via /D argument for `makensis.exe` or by editing *Settings.nsh*.
+```nsis
+!ifndef FILES_FREECAD
+    !define FILES_FREECAD "${__FILEDIR__}\FreeCAD"
+!endif
+!ifndef FILES_THUMBS
+    !define FILES_THUMBS "${__FILEDIR__}\thumbnail"
+!endif
+
+#!define FILES_DEPS "${__FILEDIR__}\MSVC_Redist"
 ```
 4. Ensure the FreeCAD files are in place. Here you have two options:
   * If you are working from an already-compiled version of FreeCAD provided to you by an outside source: in this case, simply ensure that `FILES_FREECAD` is set to the directory containing those files.
   * If you compiled FreeCAD on your own as described [here](https://wiki.freecad.org/Compile_on_Windows) (and using the Install option outlined there). Then:
-       * Open the file *Settings.nsh* as described in step 3. above and set there</br>
-        `!define FILES_FREECAD` to the folder you specified as `CMAKE_INSTALL_PREFIX`
-       * Copy into that folder the file *Delete.bat* that is part of the installer
+       * Copy into the installation folder the file *Delete.bat* that is part of the installer
       * open a command line in Windows and change to the folder
-       * run the comamand</br>
+       * run the command</br>
        `Delete.bat`
       * (These steps assure that the installer only contains files users need. Moreover it assures that the
       overall files size is below 2 GB and we can use the most compact compression for the installer.)
 5. Right-click on the file *FreeCAD-installer.nsi* and choose **Compile NSIS script**
-   to compile the installer.
+   to compile the installer. You can also run from command line to specify some settings
+```cmd
+%your_nsis_path%\makensis.exe /D'FILES_FREECAD="D:\some\path\FreeCAD"' /D'FILES_DEPS="${__FILEDIR__}\MSVC_Redist" /D'ExeFile="my-FreeCAD-installer.exe"' FreeCAD-installer.nsi
+```


-NOTE: For test builds of the installer you can turn off the compression. This speeds up
+NOTE: For test builds of the installer you can turn off compression. This speeds up
 the build time for the installer a lot but increases its file size. The compression
-is turned off by uncommenting the line</br>
+is turned off by commenting the line</br>
 `SetCompressor /SOLID lzma`</br>
-in the file *Settings.nsh*.
+in the file *Settings.nsh* or by defining `FC_TEST_BUILD` in command line
+```cmd
+%your_nsis_path%\makensis.exe [OPTIONS] /DFC_TEST_BUILD FreeCAD-installer.nsi
+```
@@ -0,0 +1,58 @@
+/*
+
+Settings for FreeCAD installer
+
+These typically need to be modified for each FreeCAD release
+
+*/
+
+# Make the installer as small as possible
+# Using /SOLID is usually better for file size but it can't be used if the original size is
+# more than 2GB, if building with /SOLID fails try disabling it
+# comment this or use /DFC_TEST_BUILD command line option for testing builds since it will reduce
+# the time to create an installer a lot at the cost of a much greater file size.
+# So assure it is active for release builds!
+!ifndef FC_TEST_BUILD
+    SetCompressor /SOLID lzma
+!endif
+
+#--------------------------------
+# File locations
+# !!! you may need to adjust them to the folders in your Windows system !!!
+# can be specified with /D command line argument to makensis.exe
+!ifndef FILES_FREECAD
+    !define FILES_FREECAD "${__FILEDIR__}\FreeCAD"
+!endif
+!ifndef FILES_THUMBS
+    !define FILES_THUMBS "${__FILEDIR__}\thumbnail"
+!endif
+
+# msvc redistributables location is required for LibPack builds but not conda
+# when using a LibPack build set the redistributables directory location here
+# or with /D command line argument to makensis.exe
+#!define FILES_DEPS "${__FILEDIR__}\MSVCRedist"
+
+#--------------------------------
+# get version info from freecadcmd
+!system "${FILES_FREECAD}\bin\freecadcmd.exe --safe-mode $\"${__FILEDIR__}\write_version_nsh.py$\"" = 0
+!include "${__FILEDIR__}\version.nsh"
+!delfile "${__FILEDIR__}\version.nsh"
+
+!define APP_VERSION_EMERGENCY "" # use "1" for an emergency release of FreeCAD otherwise ""
+	# alternatively you can use APP_VERSION_EMERGENCY for a custom suffix of the version number
+!define APP_EMERGENCY_DOT "" # use "." for an emergency release of FreeCAD otherwise ""
+!define APP_VERSION_BUILD 1 # Start with 1 for the installer releases of each version
+
+!define APP_VERSION "${APP_VERSION_MAJOR}.${APP_VERSION_MINOR}.${APP_VERSION_PATCH}${APP_EMERGENCY_DOT}${APP_VERSION_EMERGENCY}" # Version to display
+
+#--------------------------------
+# Installer file name
+# Typical names for the release are "FreeCAD-020-Installer-1.exe" etc.
+
+!ifndef ExeFile
+    !define ExeFile "${APP_NAME}_${APP_VERSION_MAJOR}.${APP_VERSION_MINOR}.${APP_VERSION_PATCH}${APP_VERSION_EMERGENCY}-Windows-x86_64-installer-${APP_VERSION_BUILD}.exe"
+!endif
+
+#--------------------------------
+# installer bit type - FreeCAD is only provided as 64bit build
+!define MULTIUSER_USE_PROGRAMFILES64
@@ -1 +1,2 @@
 signtool.exe sign /f FCweborg.pfx /p FreeCADIsCool /fd sha512 /tr http://timestamp.digicert.com /td sha512 /v %1
+certutil -hashfile %1 SHA256 > %1-SHA256.txt
@@ -13,13 +13,13 @@ Configuration and variables of FreeCAD installer
 # Names and version

 !define APP_NAME "FreeCAD"
-!define APP_VERSION_NUMBER "${APP_VERSION_MAJOR}.${APP_VERSION_MINOR}.${APP_VERSION_REVISION}.${APP_VERSION_BUILD}"
+!define APP_VERSION_NUMBER "${APP_VERSION_MAJOR}.${APP_VERSION_MINOR}.${APP_VERSION_PATCH}.${APP_VERSION_BUILD}"
 # For the proposed install folder we use the scheme "FreeCAD 0.18" 
 # however for the Registry, we need the scheme "FreeCAD 0.18.x" in order
 # to check if it is exactly this version (to support side-by-side installations)
 !define APP_SERIES_NAME "${APP_VERSION_MAJOR}.${APP_VERSION_MINOR}"
-!define APP_SERIES_KEY "${APP_VERSION_MAJOR}${APP_VERSION_MINOR}${APP_VERSION_REVISION}${APP_VERSION_EMERGENCY}"
-!define APP_SERIES_KEY2 "${APP_VERSION_MAJOR}.${APP_VERSION_MINOR}.${APP_VERSION_REVISION}${APP_EMERGENCY_DOT}${APP_VERSION_EMERGENCY}"
+!define APP_SERIES_KEY "${APP_VERSION_MAJOR}${APP_VERSION_MINOR}${APP_VERSION_PATCH}${APP_VERSION_EMERGENCY}"
+!define APP_SERIES_KEY2 "${APP_VERSION_MAJOR}.${APP_VERSION_MINOR}.${APP_VERSION_PATCH}${APP_EMERGENCY_DOT}${APP_VERSION_EMERGENCY}"
 !define APP_DIR_REGKEY "Software\Microsoft\Windows\CurrentVersion\App Paths\${APP_NAME}.exe"
 !define APP_DIR "${APP_NAME} ${APP_SERIES_NAME}"
 # Fixme: FC should use different preferences folder for every release
@@ -60,7 +60,7 @@ Configuration and variables of FreeCAD installer

 !define SETUP_ICON "icons\FreeCAD.ico"
 !define SETUP_HEADERIMAGE "graphics\header.bmp"
-!define SETUP_WIZARDIMAGE "graphics\orange.bmp"
+!define SETUP_WIZARDIMAGE "graphics\banner.bmp"
 !define SETUP_UNINSTALLER "Uninstall-${APP_NAME}.exe"
 !define SETUP_UNINSTALLER_KEY "${APP_NAME}${APP_SERIES_KEY}"

@@ -92,7 +92,7 @@ BrandingText " "

 VIProductVersion "${APP_VERSION_NUMBER}"
 VIAddVersionKey /LANG=${LANG_ENGLISH} "ProductName" "${APP_NAME}"
-VIAddVersionKey /LANG=${LANG_ENGLISH} "ProductVersion" "${APP_DIR}.${APP_VERSION_REVISION}"
+VIAddVersionKey /LANG=${LANG_ENGLISH} "ProductVersion" "${APP_DIR}.${APP_VERSION_PATCH}"
 VIAddVersionKey /LANG=${LANG_ENGLISH} "FileDescription" "${APP_INFO}"
 VIAddVersionKey /LANG=${LANG_ENGLISH} "FileVersion" "${APP_VERSION}"
 VIAddVersionKey /LANG=${LANG_ENGLISH} "LegalCopyright" "${APP_COPYRIGHT}"
@@ -50,7 +50,7 @@ Function PostMultiUserPageInit

  # check if there is an existing FreeCAD installation of the same FreeCAD series
  # we usually don't release more than 10 versions so with 20 we are safe to check if a newer version is installed
-  IntOp $4 ${APP_VERSION_REVISION} + 20
+  IntOp $4 ${APP_VERSION_PATCH} + 20
  ${for} $5 0 $4
   ReadRegStr $0 SHCTX "Software\Microsoft\Windows\CurrentVersion\Uninstall\${APP_NAME}${APP_VERSION_MAJOR}${APP_VERSION_MINOR}$5" "DisplayVersion"
   # also check for an emergency release
@@ -110,7 +110,8 @@ Function .onInit
  ${orif} $R0 == "5.1" # XP
  ${orif} $R0 == "5.2" # 2003
  ${orif} $R0 == "6.0" # Vista
-    MessageBox MB_OK|MB_ICONSTOP "${APP_NAME} ${APP_VERSION} requires Windows 7 or newer." /SD IDOK
+  ${orif} $R0 == "6.1" # 7
+    MessageBox MB_OK|MB_ICONSTOP "${APP_NAME} ${APP_VERSION} requires Windows 8 or newer." /SD IDOK
    Quit
  ${endif}
  
@@ -130,7 +131,7 @@ Function .onInit
  # plugin must be unloaded
  ${nsProcess::Unload}
  
-  # initialize the multi-uder installer UI
+  # initialize the multi-user installer UI
  !insertmacro MULTIUSER_INIT

  # this can be reset to "true" in section SecDesktop
@@ -18,8 +18,8 @@
 # and returns the number of the character in the FindStr where the SearchStr was found (Pointer)
 # if nothing was found or the search is impossible the Pointer is set to -1
 
- StrLen $R2 ${SearchStr}
- StrLen $R4 ${FindStr}
+ StrLen $R2 "${SearchStr}"
+ StrLen $R4 "${FindStr}"
 StrCpy $R5 0
 ${if} $R2 == 0
 ${orif} $R4 == 0
@@ -27,8 +27,8 @@
 ${endif}
 IntCmp $R4 $R2 loopA NotFound
 loopA:
-  StrCpy $R3 ${FindStr} $R2 $R5
-  StrCmp $R3 ${SearchStr} Found
+  StrCpy $R3 "${FindStr}" $R2 $R5
+  StrCmp $R3 "${SearchStr}" Found
  IntOp $R5 $R5 + 1
  IntCmp $R4 $R5 loopA NotFound
  Goto loopA
@@ -7,7 +7,7 @@ Language: English

 ${LangFileString} TEXT_INSTALL_CURRENTUSER "(Installed for Current User)"

-${LangFileString} TEXT_WELCOME "This wizard will guide you through the installation of $(^NameDA), $\r$\n\
+${LangFileString} TEXT_WELCOME "This wizard will guide you through the installation of $(^NameDA). $\r$\n\
 				$\r$\n\
 				$_CLICK"

@@ -64,7 +64,8 @@ ${LangFileString} SecUnPreferencesDescription 'Deletes FreeCAD$\'s configuration
 						$AppSuff\$\r$\n\
 						${APP_DIR_USERDATA}$\")$\r$\n\
 						for you or for all users (if you are admin).'
-${LangFileString} DialogUnPreferences 'You chose to delete the FreeCADs user configuration.$\r$\n\
-						This will also delete all installed FreeCAD addons.$\r$\n\
-						Do you agree with this?'
+${LangFileString} DialogUnPreferences 'You chose to delete the FreeCAD user configuration.$\r$\n\
+						This will also delete all installed FreeCAD addons, and will affect the$\r$\n\
+						preferences for all versions of FreeCAD.$\r$\n\
+						Are you sure you want to proceed?'
 ${LangFileString} SecUnProgramFilesDescription "Uninstall FreeCAD and all of its components."
--- a/Show More
+++ b/Show More