Wekan - Package Updates

[Package Updates]

[4.126.0]

• Update wekan to 9.99
• Full Changelog
• Updated Sandstorm Backup docs. Thanks to robertdahlem and xet7.
• WeKan has been translated to 154 languages. Thanks to xet7.
• Member menu / Change Color global theme override, visible swatches, applies everywhere, no Save button (#5778, docs/Theme/Theme.md).
• Member Settings / Font pick an installed UI font, size and text colors (part of #4759).
• Soft delete + Undo/Redo + change-History deleting is reversible, and moves can be undone (#1023, #6478, docs/Features/Undo/Undo.md).
• Home board set a board that opens automatically after login (#2220).
• Add List moved from a standing column to a per-list header button (#6465).
• Denser default layout: thinner lists, board tiles and card dock; taller-looking minicards (#6465).
• Confirmation dialogs work again clicking any .js-confirm button (e.g. "Remove Member") did nothing because Popup.afterConfirm() stashed the pending action on the Blaze data context (#6479). Thanks to mueschel (report) and xet7.
• FerretDB (bundled) #6476 crash-loop root cause fixed, and label/title/date filters pushed down to SQLite (#6476).

[Package Updates]

[4.127.0]

• Update wekan to 10.04
• Full Changelog
• Safe filename handling everywhere: attachment and avatar names are always shown clean URL-decoded, normalized to generally-used characters, invisible/control/bidi characters removed and HTML/JS/XML markup stripped.
• CPU-usage monitor + governor + Admin Panel / Problems / CPU usage report: watch system-wide CPU, record only the START and END of each sustained high-CPU period with what WeKan/FerretDB were doing.
• Fix RedirectBleed: avatar localization validated only the original host and then followed redirects with native fetch, so a public avatar URL could 302 to a loopback/private/metadata address (SSRF).

[Package Updates]

[4.128.0]

• Update wekan to 10.08
• Full Changelog
• Verified that list widths on public boards (#5659) are fixed: uncustomized lists render the one shared default width for logged-out public-board visitors and members alike, board-wide widths apply to everyone, and anonymous viewers customize via localStorage. The listWidthDefaults.test.cjs regression test existed but was never wired into npm run test:unit:node, so it did not run; it is now wired in so the fix stays verified.
• Files admin report follow-up: made the filesReport helpers defensive so a throwing data helper can no longer blank the whole report, and corrected the v10.07 changelog claim the report still does not list its attachments in the Playwright test, which points at the attachmentsList publication returning no rows and is still under investigation.
• Fix: the Statistics board view never rendered. statsView.jade / .js / .css were not imported anywhere in the client build, so the statsView Blaze template was never registered switching a board to the Statistics view left the board canvas empty (the header still showed "Statistics", which only reflects the saved board view). The three files are now imported alongside the other board views, so the view renders its board counts and time summary.
• Fix: on phones the All Boards list grew to the full height of all its boards instead of staying a bounded, scrollable region, so boards below the fold were clipped by the surrounding overflow:hidden and could not be reached. Two leftover .board-list.mobile-view rules (min-height: 100vh and a phantom ::after) re-introduced the exact bug an earlier fix removed elsewhere; removing them lets the bounded height take effect and the two-column list scrolls.
• Files admin report (Admin Panel / Reports / Files): read the underlying reactive Attachments.collection instead of the ostrio FilesCollection wrapper, whose FilesCursor does not reliably re-run in a Blaze helper.
• Fix: force changeStreams out of the reactivity order for FerretDB on all platforms, not only the snap. FerretDB v1 does not implement MongoDB change streams, so a $changeStream aggregate returns "not implemented" and Meteor busy-loops retrying it (high FerretDB CPU, cards not opening). The snap fix already stripped changeStreams from METEOR_REACTIVITY_ORDER; the same strip is now applied to the remaining FerretDB run-paths the standalone FerretDB release start-wekan.sh, the FerretDB Docker image wekan-entrypoint.sh, and the Windows start-wekan.bat so changeStreams can never enter the order however it was passed in (OpLog + polling only). The Docker compose files already hardcode safe values, and the real-MongoDB start-wekan.sh / start-wekan.bat are unchanged (#6492, #6493, #6480).
• Fix: FerretDB high CPU and cards not opening FerretDB v1 does not implement MongoDB change streams, but the snap default reactivity order put changeStreams first, so Meteor issued $changeStream aggregates that FerretDB rejected thousands of times per second (a busy-loop pinning FerretDB CPU at 100-390% the "aggregate=" that dominated the operations summary and starving board/card loading so cards would not open). The snap now forces changeStreams out of the reactivity order for FerretDB (oplog + polling only); real MongoDB is unchanged (#6492, #6493, #6480).
• Fix: switching the board view now persists the setBoardView method did not await the profile write, so the client reloaded before it was saved (and a rejected write was invisible), making view switching (e.g. to the new Statistics view) unreliable; and All Boards on phones now lays the board icons out as a real 2-column CSS grid so at least 2 show per row, where the earlier float rule did not (#6488).

[Package Updates]

[4.129.0]

• Update wekan to 10.11
• Full Changelog
• Fix: FerretDB high CPU that continued even with no clients connected (#6498).
• Fix: on Sandstorm, the browser error that a page "can not be displayed embedded in another page" after a grain's first-launch data migration.
• The recovery maintenance page now works the same on ALL FerretDB v1 platforms (#6492).
• Fix: high FerretDB CPU (300%+, even idle) from a bloated or corrupt simulated OpLog (#6492).
• Safety measures against SQLite corruption/bloat (#6492).
• Automatic recovery/remediation for the SQLite text data, with an Admin Panel / Problems / Recovery report (#6492).
• While a data recovery is in progress, WeKan now shows a full-page maintenance spinner instead of errors or half-loaded data (#6492).
• Fix: on the phone All Boards layout, board titles were cut off the right edge and workspace names were hard-cut in the narrow menu.
• Fix: on phone-sized touch screens the All Boards page put the board icons BELOW the left menu and search bar.
• Fix: the Files admin report (Admin Panel / Reports / Files) was stuck on the loading spinner and never listed its files.

[Package Updates]

[4.130.0]

• Update wekan to 10.27
• Full Changelog
• Fix #6508: two crashes in the import "map users later" workflow in clicking a searched user and saving an imported user (commit)
• Fix #6507: on a fresh install the Admin panel would not open, the title bar sometimes failed to load or showed "You are not authorized to view this page" (commit)
• Fix boards that loaded their lists/columns but never their CARDS on FerretDB v1 (SQLite) (commit)
• Fix #6506: board import shows the "map members" step again, and unmapped members become virtual users instead of the importer (commit)
• ExportBleed: stored XSS in HTML board exports through a card-title second parse fixed by building the modal with DOM nodes (commit)
• Admin Panel / Problems "Status" overview + snap run wekan.problems (commit)
• FerretDB high CPU: run FerretDB standalone (no OpLog) by default (commit)
• Card links keep working after the card is moved to another board (commit)
• SpliceBleed: incomplete multi-character sanitization when stripping exploit markup from a filename fixed by applying removals repeatedly until the string stops changing (commit)
• Fix: cards not opening clicking a card did nothing (#6493) (commit)

[Package Updates]

[4.131.0]

• Update wekan to 10.33
• Full Changelog
• Added anupamme of OrbisAI Security to Hall of Shame: Fake AI.
• List header card count is now scoped to the swimlane it is shown in, so a shared list no longer shows the whole-list count over an empty second swimlane (the "5 Cards" header above a swimlane with no cards). A shared list one whose swimlaneId is empty, the pre-per-swimlane-lists layout renders under every swimlane, but cardsCount() counted by the list's OWN swimlaneId (''), giving the whole-list total in every swimlane while the cards rendered below were correctly swimlane-scoped. It now takes the container swimlane id (the same ../../_id the card body already uses) and counts that swimlane's cards, matching what is rendered; list.cards() and the lazy (#6480) server count both already scope by that id, including first-swimlane shared/orphaned surfacing.
• Re-attach mouse drag-scrolling (dragscroll) when a board's swimlanes/lists render or change, so lower swimlanes stay reachable by dragging. @wekanteam/dragscroll attaches its mouse handlers per element in reset(), but the board's reset autorun only depended on the touch/permission reads not the swimlanes/lists so when they rendered AFTER onRendered (adaptive lazy card loading, the on-open data-repair adding a default swimlane, or a board switch that reuses the template instance without re-firing onRendered) the new .dragscroll containers never got mouse handlers: dragging no longer scrolled and, with the vertical scrollbar hidden, only the top swimlane was reachable (touch still worked via the document-delegated dragscrollTouch). The autorun now reads the board view + swimlanes + lists, so reset() re-runs and re-attaches when the rendered containers change.
• Fix #6512 for OAuth / OIDC logins: after "Login with Google" (or any redirect-style social login) the user is now sent to All Boards instead of being left on the sign-in route showing only the language selector until a manual reload. The earlier #6512 fix covered only the password/register flow (onSubmitHook); OAuth logins do not go through it, so a client Accounts.onLogin handler (fires for every login method after Meteor.userId() is set) now navigates home when still on an auth route guarded so an auto-login on a deep-linked board URL is not redirected away.
• [Fix #6511 and #6514 (and the v10.3010.31 Docker / Sandstorm / production "board maintenance spinner", missing top user/settings bar, and login-form-not-rendering reports): the whole client broke with Uncaught Error: ES Modules may not assign module.exports or exports.* followed by Error: No such template: swimlane / notifications / boardButtons.](https://github.com/wekan/wekan/commit/e62c77575297319cb967b031bafa91421424abe9)
• Snap: run the bundled FerretDB v1 against an EXTERNAL PostgreSQL / MySQL / SAP HANA server instead of the embedded SQLite backend. Two new snap settings snap set wekan wekan-ferretdb-handler=postgresql|mysql|hana and wekan-ferretdb-url= point FerretDB at a database you run; the default stays the zero-dependency sqlite backend, so existing installs are unchanged.
• Fix #6508 (follow-up): the board member popup now shows "Remap User" for an imported (placeholder) member. The action is gated on the member's authenticationMethod === 'imported', but the board publication shipped board members' user docs without authenticationMethod, so the field was undefined on the client and the action never appeared..
• Fix #6511: a board showed NO cards, with Error: Bad index in range.removeMember: 0 in the console. The card list is a Blaze {{#each}} over a LIMITED, ordered reactive cursor sorted by { sort: 1 }, which has TIES when several cards share the same sort value (or due date, etc.) their order is non-deterministic across observe/poll cycles, so Meteor's ordered diff computes an out-of-range index and the #each throws, rendering no cards (and cascading into the undefined.remove() teardown error). A unique _id tiebreaker is now appended to the card-list sort (client cursor and server window), making the order deterministic.
• Opening a card no longer takes ~40 seconds on FerretDB v1 (SQLite). A card's attachments are looked up with the dotted key {'meta.cardId': ...}, which the bundled FerretDB dropped from the WHERE (it skipped any dotted-path key), so it full-scanned the whole attachments collection with a per-row decode on every poll while a card was open slow card content and high idle CPU.
• Activity feed pushes down on FerretDB: the comment-only feed selected activities with a top-level $and, which FerretDB v1 (SQLite) does not push down, so the activities collection was full-scanned on every poll (slow board/card history on a big board). The scope and activityType are now at the top level exactly equivalent, and both push down to the index.

[Package Updates]

[4.132.0]

• Update wekan to 10.37
• Full Changelog
• Copying a board works again (POST /api/boards/:boardId/copy). swimlane.copy(), which runs on the server, called the SYNCHRONOUS getDefaultSwimline() on the source board to detect its default swimlane; for a board with no pickable swimlane that getter self-heals via a synchronous Swimlanes.upsert(), which Meteor 3 rejects on the server (update is not available on the server. Please use updateAsync() instead.), so the whole copy threw.
• Admin Panel Problems Summary now has a Repair button for "Broken cards N".
• Admin Panel Problems CPU usage now shows the CURRENT CPU usage between the page title and the Search box.
• Admin Panel Problems no longer shows a finished board-repair as still running, nor counts informational CPU rows as "new problems".
• "Map to existing user" for an imported (virtual) member now searches every user instead of listing only board members.
• Admin Panel report styles were never loaded, so every report's prev/next pagination button rendered with a black background.
• Six Meteor methods threw Did not check() all arguments during call to '<method>'
• Drag handles: the "Show desktop drag handles" toggle now works on touch screens, the card body pans the board when handles are on, the handle is finger-sized on touch, and tab order no longer jumps to invisible controls.
• Upgrading no longer grows a spurious "Restored Items" column full of cards that look empty but are not.
• Removed the cron migration subsystem: it never ran and had no UI, yet every logged-in client paid for it.

[Package Updates]

[4.133.0]

• Update wekan to 10.40
• Full Changelog
• ZipBleed: arbitrary file write when restoring a backup archive (zip-slip). Thanks to xet7.
• GHSA-3gcg-g6rf-w2rx: an invalid authToken on a board export endpoint crashed the server. Thanks to laijunyue for the coordinated disclosure, and xet7.
• Multitenancy: one WeKan server for many domains, with Organizations as the tenants. Thanks to xet7.
• Clicking a card closes the one that was open, and keeping many open is a per-user setting. Thanks to mimZD and xet7.
• A subscription with no board id took the server down; it is answered, not fatal. Thanks to xet7.
• The right sidebar starts below the header, in both modes. Thanks to xet7.
• All Boards on a phone: the board list scrolls to its last board. Thanks to mimZD and xet7.
• The password field is back on the Sign In and Register pages. Thanks to xet7.
• A finished MongoDB FerretDB migration on Snap no longer leaves WeKan on 503. Upgrading from 6.09. Thanks to S0QR2 and xet7.
• Admin Panel / People / People showed nothing at all no table, no search box, no pager. Thanks to xet7.

[Package Updates]

[4.134.0]

• Update wekan to 10.41
• Full Changelog
• A removed DDP session no longer crashes the server on its 101st message. Thanks to bluetopaz1204, Nissulya and xet7.
• One icon set: Font Awesome, and the Grey Icons feature is removed. Thanks to xet7.
• "Run ALL tests" now runs all the tests, in build.sh and in build.bat. Thanks to xet7.

[Package Updates]

[4.135.0]

• Update wekan to 10.44
• Full Changelog
• Tests menu runs every database this CPU can, and checks they answer the same. Thanks to xet7.
• The database tests run on their own ports, beside whatever else is running. Thanks to xet7.
• A Docker Compose file for every FerretDB v1 backend, generated from one source. Thanks to xet7.
• Admin Panel reports show the whole instance, not the admin's own boards. Thanks to xet7.
• The admin lists paginate honestly: one page of ten rows, index-backed. Thanks to xet7.
• Every popup had 10px of empty space above it that nothing asked for. Thanks to xet7.
• The board bar centers its items, and the hamburger sits where its space middles. Thanks to xet7.
• Every upload threw in getFileStrategy, so no new file was mime-checked. Thanks to xet7.
• Migrated images show in the card view again. Thanks to S0QR2 and xet7.
• A test pins that a per-tenant admin sees no report data. Thanks to xet7.

[Package Updates]

[4.136.0]

• Update wekan to 10.51
• Full Changelog
• One release now publishes all three snaps: wekan, wekan-ondra and wekan-gantt-gpl. Thanks to xet7.
• The variant sync renames the snap in both snapcraft files, not just one. Thanks to xet7.
• The variant Docker images are published by hand, by retagging the released image. Thanks to xet7.
• A credential the release cannot read is not the Snap Store refusing it. Thanks to xet7.
• Every maintainer script in releases/ is now a menu entry in build.sh and build.bat. Thanks to xet7.
• Twelve one-line wrapper scripts became commands, and both menus gained a command line. Thanks to xet7.
• The Windows zip was never broken: a matched file was reported as missing, because of SIGPIPE. Thanks to xet7.
• The card-drag test measured the board's edge auto-scroll, which is a feature. Thanks to xet7.
• Release jobs now say what actually failed: no snap, no evidence hidden, no wrong secret blamed. Thanks to xet7.

[Package Updates]

[4.137.0]

• Update wekan to 10.53
• Full Changelog