[4.131.0]
Update wekan to 10.33
Full Changelog
Added anupamme of OrbisAI Security to Hall of Shame: Fake AI.
List header card count is now scoped to the swimlane it is shown in, so a shared list no longer shows the whole-list count over an empty second swimlane (the "5 Cards" header above a swimlane with no cards). A shared list one whose swimlaneId is empty, the pre-per-swimlane-lists layout renders under every swimlane, but cardsCount() counted by the list's OWN swimlaneId (''), giving the whole-list total in every swimlane while the cards rendered below were correctly swimlane-scoped. It now takes the container swimlane id (the same ../../_id the card body already uses) and counts that swimlane's cards, matching what is rendered; list.cards() and the lazy (#6480) server count both already scope by that id, including first-swimlane shared/orphaned surfacing.
Re-attach mouse drag-scrolling (dragscroll) when a board's swimlanes/lists render or change, so lower swimlanes stay reachable by dragging. @wekanteam/dragscroll attaches its mouse handlers per element in reset(), but the board's reset autorun only depended on the touch/permission reads not the swimlanes/lists so when they rendered AFTER onRendered (adaptive lazy card loading, the on-open data-repair adding a default swimlane, or a board switch that reuses the template instance without re-firing onRendered) the new .dragscroll containers never got mouse handlers: dragging no longer scrolled and, with the vertical scrollbar hidden, only the top swimlane was reachable (touch still worked via the document-delegated dragscrollTouch). The autorun now reads the board view + swimlanes + lists, so reset() re-runs and re-attaches when the rendered containers change.
Fix #6512 for OAuth / OIDC logins: after "Login with Google" (or any redirect-style social login) the user is now sent to All Boards instead of being left on the sign-in route showing only the language selector until a manual reload. The earlier #6512 fix covered only the password/register flow (onSubmitHook); OAuth logins do not go through it, so a client Accounts.onLogin handler (fires for every login method after Meteor.userId() is set) now navigates home when still on an auth route guarded so an auto-login on a deep-linked board URL is not redirected away.
[Fix #6511 and #6514 (and the v10.3010.31 Docker / Sandstorm / production "board maintenance spinner", missing top user/settings bar, and login-form-not-rendering reports): the whole client broke with Uncaught Error: ES Modules may not assign module.exports or exports.* followed by Error: No such template: swimlane / notifications / boardButtons.](https://github.com/wekan/wekan/commit/e62c77575297319cb967b031bafa91421424abe9)
Snap: run the bundled FerretDB v1 against an EXTERNAL PostgreSQL / MySQL / SAP HANA server instead of the embedded SQLite backend. Two new snap settings snap set wekan wekan-ferretdb-handler=postgresql|mysql|hana and wekan-ferretdb-url= point FerretDB at a database you run; the default stays the zero-dependency sqlite backend, so existing installs are unchanged.
Fix #6508 (follow-up): the board member popup now shows "Remap User" for an imported (placeholder) member. The action is gated on the member's authenticationMethod === 'imported', but the board publication shipped board members' user docs without authenticationMethod, so the field was undefined on the client and the action never appeared..
Fix #6511: a board showed NO cards, with Error: Bad index in range.removeMember: 0 in the console. The card list is a Blaze {{#each}} over a LIMITED, ordered reactive cursor sorted by { sort: 1 }, which has TIES when several cards share the same sort value (or due date, etc.) their order is non-deterministic across observe/poll cycles, so Meteor's ordered diff computes an out-of-range index and the #each throws, rendering no cards (and cascading into the undefined.remove() teardown error). A unique _id tiebreaker is now appended to the card-list sort (client cursor and server window), making the order deterministic.
Opening a card no longer takes ~40 seconds on FerretDB v1 (SQLite). A card's attachments are looked up with the dotted key {'meta.cardId': ...}, which the bundled FerretDB dropped from the WHERE (it skipped any dotted-path key), so it full-scanned the whole attachments collection with a per-row decode on every poll while a card was open slow card content and high idle CPU.
Activity feed pushes down on FerretDB: the comment-only feed selected activities with a top-level $and, which FerretDB v1 (SQLite) does not push down, so the activities collection was full-scanned on every poll (slow board/card history on a big board). The scope and activityType are now at the top level exactly equivalent, and both push down to the index.
