Wekan - Package Updates

Package Updates

[4.109.0]

Update wekan to 9.07
Full Changelog
This release fixes the following CRITICAL SECURITY ISSUES of AvatarBleed:
Fix avatars rce. Thanks to Trung Nguyen from CyStack Security and xet7.
Fix CleanDark theme. Thanks to stegoh.
Thanks to above GitHub users for their contributions and translators for their translations.

Package Updates

[4.110.0]

Update wekan to 9.34
Move back to upstream release builds instead of source build
Full Changelog

Package Updates

[4.111.0]

Update wekan to 9.64
Full Changelog
Fixed ChecklistBleed: any authenticated user can write checklist data into a private board they are not a member of (cross-board write via collection allow rule)
Fixed ProxyBleed: Header-login IP allowlist bypass via X-Forwarded-For spoofing allows unauthenticated full account takeover (incl. admin)
Fixed TokenBleed: unauthenticated login-token minting via un-awaited auth check in POST /api/createtoken/:userId
Fixed BoardBleed: Broken access control lets any authenticated user move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)
Added card dependency "Red Strings" / PI program board
Greatly expanded board automation Rules
Added Jira import
Full right-to-left (RTL) UI for every page when an RTL language is selected
Greatly improved import from Trello to WeKan
Fixed SyncedCron crash

Package Updates

[4.112.0]

Update wekan to 9.67
Full Changelog
Updated to Meteor 3.5-rc.2.
Reworked confusing and unreliable list widths, #6409: a list now has one width instead of the old "min width / max width / automatic" trio, and it reliably persists across reloads (the render now drives the --list-width CSS variable the styles actually use, so a width no longer reverts to auto after reload).
Fixed editing the 2nd/3rd organization or team in Admin Panel People always showing the FIRST one, #6411: on /people, clicking Edit on any organization or team filled the form with the first one's values (so you could never edit the others).
Fixed REST API returning HTTP 500 with a stack trace for an invalid request, #5804: posting a comment without the required comment parameter (or to a board that does not exist) returned an HTTP 500 error page.
Fixed selecting text in a checklist closing the card, #5686: selecting the text of a checklist item and releasing the mouse outside the card detail pane closed the card.
Fixed list reordering throwing 403 Access denied for read-only members, #5462: read-only / comment-only board members could still drag-reorder lists, which fired a server write that allow/deny rejected with 403 Access denied (the list then snapped back).
Threaded comment replies: card comments gain an optional parentId; a "Reply" link links a new comment to its parent, rendered with an "in reply to" quote. Initial MVP (single-level visual threading).
Restrict board admins from editing/deleting other users' comments: new board setting restrictCommentEditing (default off). When on, only a comment's author may edit/delete it; enforced server-side via collection hooks.
Fixed OIDC/OAuth2 "Log Out" redirecting to the identity provider home page instead of back to Wekan.
Fixed boards not rendering at all (blank board view) after the mongodb/bson 7.3.0 dependency bump.

Package Updates

[4.113.0]

Update wekan to 9.70
Full Changelog
Copying a card to or from a board with no labels threw
Copying a board did not copy its webhooks, #5592
Disabled user accounts could be added to boards, #1894
Admin Panel boards report listed removed members as current members, #5122
Could not remove a deleted user from a card's members, #4847
A newly added board member was missing from the card members popup, #4965
Performance: copying a card with many checklist items took minutes (#5688)
Error when clicking the notification icon, #5325
Board "show checklists on minicard" setting had no effect, #5565
Can't edit a card's members in the UI after removing them via the REST API, #3697

Package Updates

[4.114.0]

Update wekan to 9.73
Full Changelog
Mobile UI still too large at All Boards / iPhone 12 mini, #6426: the first revert only cleaned boardsList.css, leaving the same forced "2x/3x bigger on mobile" rules in header.css and boardBody.css and the iPhone card-details body text. Those are now neutralized to normal size too. Fixed in 219ee659e.
Drag-to-scroll (dragscroll) not working on the Login, Register and All Boards pages. Fixed in 219ee659e.
Drag-to-scroll now works on every whole-page layout in both mobile and desktop modes. Fixed in 88f353dc1.
Login / Register pages not scrollable on phones. Fixed in 4a7df3745.
Fixed api.py addcustomfieldtoboard crashing on an empty settings argument. Fixed in 487cf3f96.
Sort, search and paginate the All Boards page, #5799: Added a Sort button, a board-name search box, and pagination of the board icons. Fixed in f74ccbc8f and c1da7a4a3.
Fixed (same) width for all lists, #5729: the Set width popup now has a "Same width for all lists" toggle.
Due date does not work when the language uses non-Latin (e.g. Persian/Farsi) digits, #5752: Added a normalizeDigits() helper in imports/lib/dateUtils.js.
REST API: moving a card to another list (PUT .../cards/:cardId with listId) returned HTTP 500 "fieldNames.includes is not a function", #6423. Fixed in 69c899f1f.
Notification emails were sent in English despite the user's language setting, #5875. Fixed in 22f996903.

Package Updates

[4.115.0]

Update wekan to 9.77
Full Changelog
ScannerBleed: shell injection (RCE) via a malicious upload filename in the external antivirus scanner command path (GHSA-x3xm-pxrv-jg7p, CWE-78 OS Command Injection).
DnsBleed SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (GHSA-66m2-4wfr-c45p, CWE-918).
ExcelBleed broken access control in the Excel-export REST route lets any authenticated user export any private board (GHSA-mwq8-ccpm-r533, CWE-862 / CWE-639).
Fix notification emails linked to /b/undefined/board/<cardId> instead of the real board
Fix thousands of unsolicited empty "Default" swimlanes created on some boards
Reduce card flicker on drag by only writing changed fields on a card move
Fix DEFAULT_AUTHENTICATION_METHOD env var ignored, and Admin Panel Layout save hanging
Fix #5808: linking a card to another linked card made both cards inaccessible
Fix the "Board not found" flicker (stale-while-revalidate for the client board cache)
Update to Meteor 3.5.

Package Updates

[4.116.0]

Package Updates

[4.117.0]

Update wekan to 9.80
Full Changelog
Admin Panel Domains table: pagination, column sort and search (like the Board Table view): The Admin Panel > People > Domains table loaded every domain (aggregated from all users) into the browser at once, with a fixed order and no search. It now behaves like the Board Table view: the server aggregates the domains and returns only one small page, so the whole list is never sent to the browser. You can order by the Domain or Users column (click the header to toggle ascending / descending, with a / indicator) and filter with a search box; prev/next controls page through the results. The search + sort + slice runs in the new pure, unit-tested models/lib/domainTablePage.js behind a new getDomainsWithUserCountsPage admin method (server/models/users.js), and the domainGeneral template (client/components/settings/peopleBody.{jade,js,css}) is now self-contained and fetches only the current page. Covered by tests/domainTablePage.test.cjs. Thanks to xet7.
Verified and added a regression test for the board-invitation email language: Confirmed that a board-invitation email is localised in the existing recipient's own profile language, or when the invitee is a new account created by the invite in the inviter's profile language, defaulting to en (en.i18n.json) when none is set. The behaviour was already correct; the language choice is now extracted into the pure, unit-tested models/lib/inviteEmailLanguage.js used by inviteUserToBoard, and locked in by tests/inviteEmailLanguage.test.cjs. Thanks to xet7.
Linked-card minicard now shows the cover image of the real card: A linked card (created by "Link card to this card") on one board did not show the cover image of the real card it points at on another board, even though the card's other fields did. A linked card is only a placeholder its real content lives on the card at linkedId and every other minicard getter resolves through the real card (getTitle/getReceived/getDue/), but the cover helpers read this.coverId directly, and a linked card has no coverId of its own. The real card's cover attachment is already published to the linking board (see the "linked cards" / "attachments for linked cards" children of the board publication), so this was purely a client-side resolution gap. Card.cover() and the minicard cover() helper now resolve the cover id through the real card via the pure, unit-tested models/lib/linkedCardCover.js; normal cards are unaffected. Covered by tests/linkedCardCover.test.cjs. Thanks to 32Dexter and xet7.
Fix date-picker calendar stays fully visible when opened low on a scrolled page: Opening a date field (due/start/end date, or a date custom field) low on the screen showed the calendar popup extending past the visible area, and because the pop-over is position: absolute (document coordinates) scrolling to reach it moved the calendar along with the page, so the full calendar could never be seen (the workaround was to close it, drag the field to the center and reopen). Popup._getOffset computed the space above/below the opener and the clamped top from the opener's DOCUMENT offset mixed with the VIEWPORT height, ignoring the page scroll, so on a scrolled page the anchored popup landed outside the visible viewport. The geometry now runs in viewport coordinates (subtracting the page scroll) and clamps the popup fully within the visible viewport, then converts back to document coordinates for the absolute style; when the page is not scrolled the output is unchanged. Extracted the math into the pure, unit-tested client/lib/popupOffset.js, used by client/lib/popup.js. Covered by tests/popupOffset.test.cjs. Thanks to MarcusDger and xet7.

Package Updates

[4.118.0]

Package Updates

[4.119.0]

Package Updates

[4.120.0]

Update wekan to 9.84
Full Changelog
Fix scheduled backup cron init crashing at server startup on Meteor 3
Snap: show the correct writable path for parallel installs in backup instructions
Fix flaky server-side Mocha i18n test (TAPi18n .loadLanguage)
Fix rebuild-all.yml s390x build; add bundled FerretDB v1 for ppc64le, s390x, riscv64 and to the Docker image
Snap: choose MongoDB or FerretDB v1 with "snap set wekan database=ferretdb"; FerretDB default for new installs; disable mongosh telemetry
Admin Panel / Version: show database type, version, commit, storage engine and reactivity mode
Fix #6445: dynamic-import chunks 404 under a sub-path (duplicated build-chunks/build-chunks/)
Lazy card loading for very large boards: CARDS_LOADING=all|lazy + Admin Panel / Features
Admin Panel / Attachments: migrate text data between MongoDB and FerretDB v1 (SQLite), both directions
Admin Panel / Attachments / Backup: scheduled backups streamed to storage, restore + list

Package Updates

[4.121.0]

Update wekan to 9.87
Full Changelog
Normal users cannot move cards between swimlanes: in the swimlanes view the .js-swimlanes sortable which also carries moving a card from one swimlane to another was disabled for every non-admin (!isBoardAdmin()), even though its own comment said it should be disabled only for non-members. So ordinary board members could move a card within a swimlane but not between swimlanes, and could not reorder swimlanes. Now it is disabled only for users without write access (!canModifyCard(): comment-only, worker, read-only), so board members can move cards between swimlanes again.

Package Updates

[4.122.0]

Update wekan to 9.89
Full Changelog
SortBleed: a low-privilege (comment-only / read-only) board member could escalate to board admin and take over a private board via the board sort collection-allow rule
Added docs about new Sandstorm WeKan. Thanks to xet7.
Sandstorm build: fixed "not writing through dangling symlink" that failed the sandstorm.yml workflow at sandstorm-src/build-deps.sh step [3/7]. Thanks to xet7.
Sandstorm build: write the signing keyring to the path meteor-spk pack actually reads. Thanks to xet7.
Sandstorm .spk: trim it back toward Cloudflare's 100 MB upload limit. Thanks to xet7.
Sandstorm .spk: don't crash the grain when capnp.node can't load on Node 24. Thanks to xet7.
Sandstorm .spk: fix server-boot crashes from stale globals (Users, HTTP) in sandstorm.js. Thanks to xet7.
Sandstorm .spk: open All Boards (not sign-in) and keep the grain URL in sync. Thanks to xet7.
Avatars and original members now travel with a board (export/import), from every identity source.
Update Sandstorm WeKan info. Part 1, Part 2, Part 3. Thanks to xet7.

Package Updates

[4.123.0]

Update wekan to 9.91
Full Changelog
MimeBleed: file-upload MIME-type validation bypass stored XSS on deployments without the file binary
Admin Panel / Features / Security: import/export privacy controls. Six new optional toggles govern how boards and user data cross the WeKan boundary:
Admin Panel / Features / Security: new optional "Always show all code as plain text" toggle. When enabled, rich text is never rendered as markdown or HTML the entire source is shown as escaped plain text in every rich text field (board and card titles, descriptions, comments, checklists, etc.)
Admin Panel / Features: new optional "Render links as plain text" security toggle. When enabled, all links both markdown links like [label](url) and raw HTML <a href> tags are always shown as plain, non-clickable text in every rich text field
Outgoing webhooks / notifications: include the card description (#5143).
Sandstorm: the WeKan Admin Panel is now always available in a migrated grain, not just a freshly created one.
Admin Panel / Version: show the MongoDB storage engine even with per-database credentials (no more "unknown").
Admin Panel / Features / Security: "Always show all code as plain text" did not take effect (links stayed clickable, code stayed rendered).
i18n: several languages fell back to English (or clobbered another language) because a browser language string did not map to the right translation file.

Package Updates

[4.124.0]

Update wekan to 9.95
Full Changelog
FerretDB: WeKan did not work after migrating to FerretDB every logged-in browser was logged out again and the database CPU was pinned at 100% (#6457, server/accounts-resume-login.js, server/imports.js). Meteor's accounts-base "resume" login handler projects one array element with the positional operator ({fields: {'services.resume.loginTokens.$': 1}}), and FerretDB rejects that find with "Executor error during find command :: caused by :: positional operator '.$' couldn't find a matching element in the array" (code 51246). Thanks to markusst1982 and xet7.
Snap: the database setting is now authoritative, with a snap run wekan.database mongodb|ferretdb command and no-downtime handling of a failed migration (snap-src/bin/wekan-database, snap-src/bin/wekan-control, snap-src/bin/mongodb-control, snap-src/bin/ferretdb-control, snap-src/bin/migration-control, snap-src/bin/migration-pending). Thanks to xet7.
Snap: new snap run wekan.migrate command to force a fresh MongoDB FerretDB migration (snap-src/bin/wekan-force-migrate, registered in snapcraft.yaml). Thanks to xet7.
Snap: new maintenance mode (snap run wekan.maintenance on|off) so you can run MongoDB OR FerretDB by hand for data access (snap-src/bin/wekan-maintenance, snap-src/bin/wekan-maintenance-page.mjs, and the DB control scripts). Thanks to xet7.
Snap: WeKan never started on a running MongoDB, looping "MongoDB not ready yet, retrying in 5 seconds..." forever, on any server with less than ~34 GB RAM (#6454, snap-src/bin/mongodb-control, snap-src/bin/migration-control). Thanks to xet7.
Snap: the MongoDB 6/7 FerretDB importer now resolves the correct driver and matches the MongoDB 3.2 importer's safety and dashboard (releases/migrate-mongodb-to-ferretdb.mjs). Thanks to xet7.
Snap: after a MongoDB FerretDB migration, FerretDB never started and WeKan was stuck on "MongoDB not ready yet, retrying..." (snap-src/bin/migration-control). Thanks to xet7.
Snap: WeKan now starts its database itself on startup instead of waiting forever for a stopped one (snap-src/bin/wekan-control). Thanks to xet7.
Snap: WeKan never starts an EMPTY FerretDB while data still lives in MongoDB (snap-src/bin/wekan-control). Thanks to xet7.
Snap: db-eval could not load the MongoDB driver, so EVERY database readiness check silently failed (snap-src/bin/db-eval.mjs; also migrate-schema-v843.mjs, migrate-gridfs-to-fs.mjs). Thanks to xet7.

Package Updates

[4.125.0]

Update wekan to 9.96
Full Changelog
Bump websocket-driver from 0.7.4 to 0.7.5. Thanks to dependabot.
Subtasks: creating a subtask crashed with "Exception while invoking method 'addSubtaskCard'" (#6456, models/boards.js, tests/subtasksDefaultBoard.test.cjs). Thanks to sjohnen and xet7.
GUI: the "More" menu of cards was completely empty, so cards could not be deleted from it (#6459, npm-packages/meteor-jade-loader/lib/vendor/htmljs.js, client/components/lists/listHeader.jade). Thanks to thku and xet7.
Cards: the "You have an unsaved description" warning could never be cleared by saving (#6455, reincarnation of #1287, client/components/cards/cardDetails.js, client/components/cards/cardDescription.js). Thanks to C0rn3j and xet7.
Comments: a comment being written was lost when the card was closed or a click landed outside the card (#5547, client/components/activities/comments.js). Thanks to Finnlife, webenefits and xet7.
Attachments: deleting an attachment could log a client-side "Removed nonexistent document" exception even though the delete succeeded (#5282, client/components/cards/attachments.js). Thanks to lupuszr and xet7.
Rules: the "move card to top/bottom" actions did nothing (#6472, server/rulesHelper.js, client/components/rules/actions/boardActions.js, client/components/rules/rulesImportExport.js, server/rulesButton.js, models/lists.js). Thanks to jmb26240 and xet7.
GUI: desktop density regressions from the v7.98v8.18 mobile UI work (#6465, client/components/main/layouts.css, client/components/cards/cardDetails.css, client/components/main/header.css, client/components/settings/peopleBody.jade, client/components/settings/settingBody.css, client/components/boards/boardHeader.jade). Thanks to Mintyt, csonkaoszimt, micha141076 and xet7.
LDAP: group search filters were double-escaped and broke group filtering (#6460, MR #6469, packages/wekan-ldap/server/ldap.js). Thanks to ChristianMa97.
LDAP: enabling org/team sync made every LDAP login fail with 'forbidden' (#6461, MR #6470, packages/wekan-ldap/server/loginHandler.js, packages/wekan-ldap/server/sync.js). Thanks to ChristianMa97 and xet7.

Package Updates

[4.126.0]

Update wekan to 9.99
Full Changelog
Updated Sandstorm Backup docs. Thanks to robertdahlem and xet7.
WeKan has been translated to 154 languages. Thanks to xet7.
Member menu / Change Color global theme override, visible swatches, applies everywhere, no Save button (#5778, docs/Theme/Theme.md).
Member Settings / Font pick an installed UI font, size and text colors (part of #4759).
Soft delete + Undo/Redo + change-History deleting is reversible, and moves can be undone (#1023, #6478, docs/Features/Undo/Undo.md).
Home board set a board that opens automatically after login (#2220).
Add List moved from a standing column to a per-list header button (#6465).
Denser default layout: thinner lists, board tiles and card dock; taller-looking minicards (#6465).
Confirmation dialogs work again clicking any .js-confirm button (e.g. "Remove Member") did nothing because Popup.afterConfirm() stashed the pending action on the Blaze data context (#6479). Thanks to mueschel (report) and xet7.
FerretDB (bundled) #6476 crash-loop root cause fixed, and label/title/date filters pushed down to SQLite (#6476).

Package Updates

[4.127.0]

Update wekan to 10.04
Full Changelog
Safe filename handling everywhere: attachment and avatar names are always shown clean URL-decoded, normalized to generally-used characters, invisible/control/bidi characters removed and HTML/JS/XML markup stripped.
CPU-usage monitor + governor + Admin Panel / Problems / CPU usage report: watch system-wide CPU, record only the START and END of each sustained high-CPU period with what WeKan/FerretDB were doing.
Fix RedirectBleed: avatar localization validated only the original host and then followed redirects with native fetch, so a public avatar URL could 302 to a loopback/private/metadata address (SSRF).

Package Updates

[4.128.0]

Update wekan to 10.08
Full Changelog
Verified that list widths on public boards (#5659) are fixed: uncustomized lists render the one shared default width for logged-out public-board visitors and members alike, board-wide widths apply to everyone, and anonymous viewers customize via localStorage. The listWidthDefaults.test.cjs regression test existed but was never wired into npm run test:unit:node, so it did not run; it is now wired in so the fix stays verified.
Files admin report follow-up: made the filesReport helpers defensive so a throwing data helper can no longer blank the whole report, and corrected the v10.07 changelog claim the report still does not list its attachments in the Playwright test, which points at the attachmentsList publication returning no rows and is still under investigation.
Fix: the Statistics board view never rendered. statsView.jade / .js / .css were not imported anywhere in the client build, so the statsView Blaze template was never registered switching a board to the Statistics view left the board canvas empty (the header still showed "Statistics", which only reflects the saved board view). The three files are now imported alongside the other board views, so the view renders its board counts and time summary.
Fix: on phones the All Boards list grew to the full height of all its boards instead of staying a bounded, scrollable region, so boards below the fold were clipped by the surrounding overflow:hidden and could not be reached. Two leftover .board-list.mobile-view rules (min-height: 100vh and a phantom ::after) re-introduced the exact bug an earlier fix removed elsewhere; removing them lets the bounded height take effect and the two-column list scrolls.
Files admin report (Admin Panel / Reports / Files): read the underlying reactive Attachments.collection instead of the ostrio FilesCollection wrapper, whose FilesCursor does not reliably re-run in a Blaze helper.
Fix: force changeStreams out of the reactivity order for FerretDB on all platforms, not only the snap. FerretDB v1 does not implement MongoDB change streams, so a $changeStream aggregate returns "not implemented" and Meteor busy-loops retrying it (high FerretDB CPU, cards not opening). The snap fix already stripped changeStreams from METEOR_REACTIVITY_ORDER; the same strip is now applied to the remaining FerretDB run-paths the standalone FerretDB release start-wekan.sh, the FerretDB Docker image wekan-entrypoint.sh, and the Windows start-wekan.bat so changeStreams can never enter the order however it was passed in (OpLog + polling only). The Docker compose files already hardcode safe values, and the real-MongoDB start-wekan.sh / start-wekan.bat are unchanged (#6492, #6493, #6480).
Fix: FerretDB high CPU and cards not opening FerretDB v1 does not implement MongoDB change streams, but the snap default reactivity order put changeStreams first, so Meteor issued $changeStream aggregates that FerretDB rejected thousands of times per second (a busy-loop pinning FerretDB CPU at 100-390% the "aggregate=" that dominated the operations summary and starving board/card loading so cards would not open). The snap now forces changeStreams out of the reactivity order for FerretDB (oplog + polling only); real MongoDB is unchanged (#6492, #6493, #6480).
Fix: switching the board view now persists the setBoardView method did not await the profile write, so the client reloaded before it was saved (and a rejected write was invisible), making view switching (e.g. to the new Statistics view) unreliable; and All Boards on phones now lays the board icons out as a real 2-column CSS grid so at least 2 show per row, where the earlier float rule did not (#6488).

Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.

Cloudron Forum

Wekan - Package Updates