Wekan - Package Updates

Package Updates

[4.106.0]

Update wekan to 9.03
Full Changelog
Add missing boardattachments API endpoint. Thanks to KhaoulaMaleh.
Fix mongodb in snap 9.01 on Ubuntu 24.04 crashes because of missing libcrypto.so.1.1. Thanks to sbaecker.
Update cards.js. Thanks to snowsky.
Fix MongoDB replicaset setup at docker-compose.yml. Thanks to C0rn3j.
Add permission checks to list width method. Thanks to Raawen-dev.
Fix UI hangs and data loss by disabling changeStreams, until there is new Meteor release that included bugfix to changeStreams. Thanks to bcook-konza and italojs.
Fix list actions popup overflow. Thanks to Raawen-dev.
Fix mycards subscription. Thanks to aminsaidane.

Package Updates

[4.107.0]

Package Updates

[4.108.0]

Package Updates

[4.109.0]

Update wekan to 9.07
Full Changelog
This release fixes the following CRITICAL SECURITY ISSUES of AvatarBleed:
Fix avatars rce. Thanks to Trung Nguyen from CyStack Security and xet7.
Fix CleanDark theme. Thanks to stegoh.
Thanks to above GitHub users for their contributions and translators for their translations.

Package Updates

[4.110.0]

Update wekan to 9.34
Move back to upstream release builds instead of source build
Full Changelog

Package Updates

[4.111.0]

Update wekan to 9.64
Full Changelog
Fixed ChecklistBleed: any authenticated user can write checklist data into a private board they are not a member of (cross-board write via collection allow rule)
Fixed ProxyBleed: Header-login IP allowlist bypass via X-Forwarded-For spoofing allows unauthenticated full account takeover (incl. admin)
Fixed TokenBleed: unauthenticated login-token minting via un-awaited auth check in POST /api/createtoken/:userId
Fixed BoardBleed: Broken access control lets any authenticated user move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)
Added card dependency "Red Strings" / PI program board
Greatly expanded board automation Rules
Added Jira import
Full right-to-left (RTL) UI for every page when an RTL language is selected
Greatly improved import from Trello to WeKan
Fixed SyncedCron crash

Package Updates

[4.112.0]

Update wekan to 9.67
Full Changelog
Updated to Meteor 3.5-rc.2.
Reworked confusing and unreliable list widths, #6409: a list now has one width instead of the old "min width / max width / automatic" trio, and it reliably persists across reloads (the render now drives the --list-width CSS variable the styles actually use, so a width no longer reverts to auto after reload).
Fixed editing the 2nd/3rd organization or team in Admin Panel People always showing the FIRST one, #6411: on /people, clicking Edit on any organization or team filled the form with the first one's values (so you could never edit the others).
Fixed REST API returning HTTP 500 with a stack trace for an invalid request, #5804: posting a comment without the required comment parameter (or to a board that does not exist) returned an HTTP 500 error page.
Fixed selecting text in a checklist closing the card, #5686: selecting the text of a checklist item and releasing the mouse outside the card detail pane closed the card.
Fixed list reordering throwing 403 Access denied for read-only members, #5462: read-only / comment-only board members could still drag-reorder lists, which fired a server write that allow/deny rejected with 403 Access denied (the list then snapped back).
Threaded comment replies: card comments gain an optional parentId; a "Reply" link links a new comment to its parent, rendered with an "in reply to" quote. Initial MVP (single-level visual threading).
Restrict board admins from editing/deleting other users' comments: new board setting restrictCommentEditing (default off). When on, only a comment's author may edit/delete it; enforced server-side via collection hooks.
Fixed OIDC/OAuth2 "Log Out" redirecting to the identity provider home page instead of back to Wekan.
Fixed boards not rendering at all (blank board view) after the mongodb/bson 7.3.0 dependency bump.

Package Updates

[4.113.0]

Update wekan to 9.70
Full Changelog
Copying a card to or from a board with no labels threw
Copying a board did not copy its webhooks, #5592
Disabled user accounts could be added to boards, #1894
Admin Panel boards report listed removed members as current members, #5122
Could not remove a deleted user from a card's members, #4847
A newly added board member was missing from the card members popup, #4965
Performance: copying a card with many checklist items took minutes (#5688)
Error when clicking the notification icon, #5325
Board "show checklists on minicard" setting had no effect, #5565
Can't edit a card's members in the UI after removing them via the REST API, #3697

Package Updates

[4.114.0]

Update wekan to 9.73
Full Changelog
Mobile UI still too large at All Boards / iPhone 12 mini, #6426: the first revert only cleaned boardsList.css, leaving the same forced "2x/3x bigger on mobile" rules in header.css and boardBody.css and the iPhone card-details body text. Those are now neutralized to normal size too. Fixed in 219ee659e.
Drag-to-scroll (dragscroll) not working on the Login, Register and All Boards pages. Fixed in 219ee659e.
Drag-to-scroll now works on every whole-page layout in both mobile and desktop modes. Fixed in 88f353dc1.
Login / Register pages not scrollable on phones. Fixed in 4a7df3745.
Fixed api.py addcustomfieldtoboard crashing on an empty settings argument. Fixed in 487cf3f96.
Sort, search and paginate the All Boards page, #5799: Added a Sort button, a board-name search box, and pagination of the board icons. Fixed in f74ccbc8f and c1da7a4a3.
Fixed (same) width for all lists, #5729: the Set width popup now has a "Same width for all lists" toggle.
Due date does not work when the language uses non-Latin (e.g. Persian/Farsi) digits, #5752: Added a normalizeDigits() helper in imports/lib/dateUtils.js.
REST API: moving a card to another list (PUT .../cards/:cardId with listId) returned HTTP 500 "fieldNames.includes is not a function", #6423. Fixed in 69c899f1f.
Notification emails were sent in English despite the user's language setting, #5875. Fixed in 22f996903.

Package Updates

[4.115.0]

Update wekan to 9.77
Full Changelog
ScannerBleed: shell injection (RCE) via a malicious upload filename in the external antivirus scanner command path (GHSA-x3xm-pxrv-jg7p, CWE-78 OS Command Injection).
DnsBleed SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (GHSA-66m2-4wfr-c45p, CWE-918).
ExcelBleed broken access control in the Excel-export REST route lets any authenticated user export any private board (GHSA-mwq8-ccpm-r533, CWE-862 / CWE-639).
Fix notification emails linked to /b/undefined/board/<cardId> instead of the real board
Fix thousands of unsolicited empty "Default" swimlanes created on some boards
Reduce card flicker on drag by only writing changed fields on a card move
Fix DEFAULT_AUTHENTICATION_METHOD env var ignored, and Admin Panel Layout save hanging
Fix #5808: linking a card to another linked card made both cards inaccessible
Fix the "Board not found" flicker (stale-while-revalidate for the client board cache)
Update to Meteor 3.5.

Package Updates

[4.116.0]

Package Updates

[4.117.0]

Update wekan to 9.80
Full Changelog
Admin Panel Domains table: pagination, column sort and search (like the Board Table view): The Admin Panel > People > Domains table loaded every domain (aggregated from all users) into the browser at once, with a fixed order and no search. It now behaves like the Board Table view: the server aggregates the domains and returns only one small page, so the whole list is never sent to the browser. You can order by the Domain or Users column (click the header to toggle ascending / descending, with a / indicator) and filter with a search box; prev/next controls page through the results. The search + sort + slice runs in the new pure, unit-tested models/lib/domainTablePage.js behind a new getDomainsWithUserCountsPage admin method (server/models/users.js), and the domainGeneral template (client/components/settings/peopleBody.{jade,js,css}) is now self-contained and fetches only the current page. Covered by tests/domainTablePage.test.cjs. Thanks to xet7.
Verified and added a regression test for the board-invitation email language: Confirmed that a board-invitation email is localised in the existing recipient's own profile language, or when the invitee is a new account created by the invite in the inviter's profile language, defaulting to en (en.i18n.json) when none is set. The behaviour was already correct; the language choice is now extracted into the pure, unit-tested models/lib/inviteEmailLanguage.js used by inviteUserToBoard, and locked in by tests/inviteEmailLanguage.test.cjs. Thanks to xet7.
Linked-card minicard now shows the cover image of the real card: A linked card (created by "Link card to this card") on one board did not show the cover image of the real card it points at on another board, even though the card's other fields did. A linked card is only a placeholder its real content lives on the card at linkedId and every other minicard getter resolves through the real card (getTitle/getReceived/getDue/), but the cover helpers read this.coverId directly, and a linked card has no coverId of its own. The real card's cover attachment is already published to the linking board (see the "linked cards" / "attachments for linked cards" children of the board publication), so this was purely a client-side resolution gap. Card.cover() and the minicard cover() helper now resolve the cover id through the real card via the pure, unit-tested models/lib/linkedCardCover.js; normal cards are unaffected. Covered by tests/linkedCardCover.test.cjs. Thanks to 32Dexter and xet7.
Fix date-picker calendar stays fully visible when opened low on a scrolled page: Opening a date field (due/start/end date, or a date custom field) low on the screen showed the calendar popup extending past the visible area, and because the pop-over is position: absolute (document coordinates) scrolling to reach it moved the calendar along with the page, so the full calendar could never be seen (the workaround was to close it, drag the field to the center and reopen). Popup._getOffset computed the space above/below the opener and the clamped top from the opener's DOCUMENT offset mixed with the VIEWPORT height, ignoring the page scroll, so on a scrolled page the anchored popup landed outside the visible viewport. The geometry now runs in viewport coordinates (subtracting the page scroll) and clamps the popup fully within the visible viewport, then converts back to document coordinates for the absolute style; when the page is not scrolled the output is unchanged. Extracted the math into the pure, unit-tested client/lib/popupOffset.js, used by client/lib/popup.js. Covered by tests/popupOffset.test.cjs. Thanks to MarcusDger and xet7.

Package Updates

[4.118.0]

Package Updates

[4.119.0]

Package Updates

[4.120.0]

Update wekan to 9.84
Full Changelog
Fix scheduled backup cron init crashing at server startup on Meteor 3
Snap: show the correct writable path for parallel installs in backup instructions
Fix flaky server-side Mocha i18n test (TAPi18n .loadLanguage)
Fix rebuild-all.yml s390x build; add bundled FerretDB v1 for ppc64le, s390x, riscv64 and to the Docker image
Snap: choose MongoDB or FerretDB v1 with "snap set wekan database=ferretdb"; FerretDB default for new installs; disable mongosh telemetry
Admin Panel / Version: show database type, version, commit, storage engine and reactivity mode
Fix #6445: dynamic-import chunks 404 under a sub-path (duplicated build-chunks/build-chunks/)
Lazy card loading for very large boards: CARDS_LOADING=all|lazy + Admin Panel / Features
Admin Panel / Attachments: migrate text data between MongoDB and FerretDB v1 (SQLite), both directions
Admin Panel / Attachments / Backup: scheduled backups streamed to storage, restore + list

Package Updates

[4.121.0]

Update wekan to 9.87
Full Changelog
Normal users cannot move cards between swimlanes: in the swimlanes view the .js-swimlanes sortable which also carries moving a card from one swimlane to another was disabled for every non-admin (!isBoardAdmin()), even though its own comment said it should be disabled only for non-members. So ordinary board members could move a card within a swimlane but not between swimlanes, and could not reorder swimlanes. Now it is disabled only for users without write access (!canModifyCard(): comment-only, worker, read-only), so board members can move cards between swimlanes again.

Package Updates

[4.122.0]

Update wekan to 9.89
Full Changelog
SortBleed: a low-privilege (comment-only / read-only) board member could escalate to board admin and take over a private board via the board sort collection-allow rule
Added docs about new Sandstorm WeKan. Thanks to xet7.
Sandstorm build: fixed "not writing through dangling symlink" that failed the sandstorm.yml workflow at sandstorm-src/build-deps.sh step [3/7]. Thanks to xet7.
Sandstorm build: write the signing keyring to the path meteor-spk pack actually reads. Thanks to xet7.
Sandstorm .spk: trim it back toward Cloudflare's 100 MB upload limit. Thanks to xet7.
Sandstorm .spk: don't crash the grain when capnp.node can't load on Node 24. Thanks to xet7.
Sandstorm .spk: fix server-boot crashes from stale globals (Users, HTTP) in sandstorm.js. Thanks to xet7.
Sandstorm .spk: open All Boards (not sign-in) and keep the grain URL in sync. Thanks to xet7.
Avatars and original members now travel with a board (export/import), from every identity source.
Update Sandstorm WeKan info. Part 1, Part 2, Part 3. Thanks to xet7.

Package Updates

[4.123.0]

Update wekan to 9.91
Full Changelog
MimeBleed: file-upload MIME-type validation bypass stored XSS on deployments without the file binary
Admin Panel / Features / Security: import/export privacy controls. Six new optional toggles govern how boards and user data cross the WeKan boundary:
Admin Panel / Features / Security: new optional "Always show all code as plain text" toggle. When enabled, rich text is never rendered as markdown or HTML the entire source is shown as escaped plain text in every rich text field (board and card titles, descriptions, comments, checklists, etc.)
Admin Panel / Features: new optional "Render links as plain text" security toggle. When enabled, all links both markdown links like [label](url) and raw HTML <a href> tags are always shown as plain, non-clickable text in every rich text field
Outgoing webhooks / notifications: include the card description (#5143).
Sandstorm: the WeKan Admin Panel is now always available in a migrated grain, not just a freshly created one.
Admin Panel / Version: show the MongoDB storage engine even with per-database credentials (no more "unknown").
Admin Panel / Features / Security: "Always show all code as plain text" did not take effect (links stayed clickable, code stayed rendered).
i18n: several languages fell back to English (or clobbered another language) because a browser language string did not map to the right translation file.

Package Updates

[4.124.0]

Update wekan to 9.95
Full Changelog
FerretDB: WeKan did not work after migrating to FerretDB every logged-in browser was logged out again and the database CPU was pinned at 100% (#6457, server/accounts-resume-login.js, server/imports.js). Meteor's accounts-base "resume" login handler projects one array element with the positional operator ({fields: {'services.resume.loginTokens.$': 1}}), and FerretDB rejects that find with "Executor error during find command :: caused by :: positional operator '.$' couldn't find a matching element in the array" (code 51246). Thanks to markusst1982 and xet7.
Snap: the database setting is now authoritative, with a snap run wekan.database mongodb|ferretdb command and no-downtime handling of a failed migration (snap-src/bin/wekan-database, snap-src/bin/wekan-control, snap-src/bin/mongodb-control, snap-src/bin/ferretdb-control, snap-src/bin/migration-control, snap-src/bin/migration-pending). Thanks to xet7.
Snap: new snap run wekan.migrate command to force a fresh MongoDB FerretDB migration (snap-src/bin/wekan-force-migrate, registered in snapcraft.yaml). Thanks to xet7.
Snap: new maintenance mode (snap run wekan.maintenance on|off) so you can run MongoDB OR FerretDB by hand for data access (snap-src/bin/wekan-maintenance, snap-src/bin/wekan-maintenance-page.mjs, and the DB control scripts). Thanks to xet7.
Snap: WeKan never started on a running MongoDB, looping "MongoDB not ready yet, retrying in 5 seconds..." forever, on any server with less than ~34 GB RAM (#6454, snap-src/bin/mongodb-control, snap-src/bin/migration-control). Thanks to xet7.
Snap: the MongoDB 6/7 FerretDB importer now resolves the correct driver and matches the MongoDB 3.2 importer's safety and dashboard (releases/migrate-mongodb-to-ferretdb.mjs). Thanks to xet7.
Snap: after a MongoDB FerretDB migration, FerretDB never started and WeKan was stuck on "MongoDB not ready yet, retrying..." (snap-src/bin/migration-control). Thanks to xet7.
Snap: WeKan now starts its database itself on startup instead of waiting forever for a stopped one (snap-src/bin/wekan-control). Thanks to xet7.
Snap: WeKan never starts an EMPTY FerretDB while data still lives in MongoDB (snap-src/bin/wekan-control). Thanks to xet7.
Snap: db-eval could not load the MongoDB driver, so EVERY database readiness check silently failed (snap-src/bin/db-eval.mjs; also migrate-schema-v843.mjs, migrate-gridfs-to-fs.mjs). Thanks to xet7.

Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.

Cloudron Forum

Wekan - Package Updates