Wekan - Package Updates

[Package Updates]

[4.131.0]

• Update wekan to 10.33
• Full Changelog
• Added anupamme of OrbisAI Security to Hall of Shame: Fake AI.
• List header card count is now scoped to the swimlane it is shown in, so a shared list no longer shows the whole-list count over an empty second swimlane (the "5 Cards" header above a swimlane with no cards). A shared list one whose swimlaneId is empty, the pre-per-swimlane-lists layout renders under every swimlane, but cardsCount() counted by the list's OWN swimlaneId (''), giving the whole-list total in every swimlane while the cards rendered below were correctly swimlane-scoped. It now takes the container swimlane id (the same ../../_id the card body already uses) and counts that swimlane's cards, matching what is rendered; list.cards() and the lazy (#6480) server count both already scope by that id, including first-swimlane shared/orphaned surfacing.
• Re-attach mouse drag-scrolling (dragscroll) when a board's swimlanes/lists render or change, so lower swimlanes stay reachable by dragging. @wekanteam/dragscroll attaches its mouse handlers per element in reset(), but the board's reset autorun only depended on the touch/permission reads not the swimlanes/lists so when they rendered AFTER onRendered (adaptive lazy card loading, the on-open data-repair adding a default swimlane, or a board switch that reuses the template instance without re-firing onRendered) the new .dragscroll containers never got mouse handlers: dragging no longer scrolled and, with the vertical scrollbar hidden, only the top swimlane was reachable (touch still worked via the document-delegated dragscrollTouch). The autorun now reads the board view + swimlanes + lists, so reset() re-runs and re-attaches when the rendered containers change.
• Fix #6512 for OAuth / OIDC logins: after "Login with Google" (or any redirect-style social login) the user is now sent to All Boards instead of being left on the sign-in route showing only the language selector until a manual reload. The earlier #6512 fix covered only the password/register flow (onSubmitHook); OAuth logins do not go through it, so a client Accounts.onLogin handler (fires for every login method after Meteor.userId() is set) now navigates home when still on an auth route guarded so an auto-login on a deep-linked board URL is not redirected away.
• [Fix #6511 and #6514 (and the v10.3010.31 Docker / Sandstorm / production "board maintenance spinner", missing top user/settings bar, and login-form-not-rendering reports): the whole client broke with Uncaught Error: ES Modules may not assign module.exports or exports.* followed by Error: No such template: swimlane / notifications / boardButtons.](https://github.com/wekan/wekan/commit/e62c77575297319cb967b031bafa91421424abe9)
• Snap: run the bundled FerretDB v1 against an EXTERNAL PostgreSQL / MySQL / SAP HANA server instead of the embedded SQLite backend. Two new snap settings snap set wekan wekan-ferretdb-handler=postgresql|mysql|hana and wekan-ferretdb-url= point FerretDB at a database you run; the default stays the zero-dependency sqlite backend, so existing installs are unchanged.
• Fix #6508 (follow-up): the board member popup now shows "Remap User" for an imported (placeholder) member. The action is gated on the member's authenticationMethod === 'imported', but the board publication shipped board members' user docs without authenticationMethod, so the field was undefined on the client and the action never appeared..
• Fix #6511: a board showed NO cards, with Error: Bad index in range.removeMember: 0 in the console. The card list is a Blaze {{#each}} over a LIMITED, ordered reactive cursor sorted by { sort: 1 }, which has TIES when several cards share the same sort value (or due date, etc.) their order is non-deterministic across observe/poll cycles, so Meteor's ordered diff computes an out-of-range index and the #each throws, rendering no cards (and cascading into the undefined.remove() teardown error). A unique _id tiebreaker is now appended to the card-list sort (client cursor and server window), making the order deterministic.
• Opening a card no longer takes ~40 seconds on FerretDB v1 (SQLite). A card's attachments are looked up with the dotted key {'meta.cardId': ...}, which the bundled FerretDB dropped from the WHERE (it skipped any dotted-path key), so it full-scanned the whole attachments collection with a per-row decode on every poll while a card was open slow card content and high idle CPU.
• Activity feed pushes down on FerretDB: the comment-only feed selected activities with a top-level $and, which FerretDB v1 (SQLite) does not push down, so the activities collection was full-scanned on every poll (slow board/card history on a big board). The scope and activityType are now at the top level exactly equivalent, and both push down to the index.

[Package Updates]

[4.132.0]

• Update wekan to 10.37
• Full Changelog
• Copying a board works again (POST /api/boards/:boardId/copy). swimlane.copy(), which runs on the server, called the SYNCHRONOUS getDefaultSwimline() on the source board to detect its default swimlane; for a board with no pickable swimlane that getter self-heals via a synchronous Swimlanes.upsert(), which Meteor 3 rejects on the server (update is not available on the server. Please use updateAsync() instead.), so the whole copy threw.
• Admin Panel Problems Summary now has a Repair button for "Broken cards N".
• Admin Panel Problems CPU usage now shows the CURRENT CPU usage between the page title and the Search box.
• Admin Panel Problems no longer shows a finished board-repair as still running, nor counts informational CPU rows as "new problems".
• "Map to existing user" for an imported (virtual) member now searches every user instead of listing only board members.
• Admin Panel report styles were never loaded, so every report's prev/next pagination button rendered with a black background.
• Six Meteor methods threw Did not check() all arguments during call to '<method>'
• Drag handles: the "Show desktop drag handles" toggle now works on touch screens, the card body pans the board when handles are on, the handle is finger-sized on touch, and tab order no longer jumps to invisible controls.
• Upgrading no longer grows a spurious "Restored Items" column full of cards that look empty but are not.
• Removed the cron migration subsystem: it never ran and had no UI, yet every logged-in client paid for it.

[Package Updates]

[4.133.0]

• Update wekan to 10.40
• Full Changelog
• ZipBleed: arbitrary file write when restoring a backup archive (zip-slip). Thanks to xet7.
• GHSA-3gcg-g6rf-w2rx: an invalid authToken on a board export endpoint crashed the server. Thanks to laijunyue for the coordinated disclosure, and xet7.
• Multitenancy: one WeKan server for many domains, with Organizations as the tenants. Thanks to xet7.
• Clicking a card closes the one that was open, and keeping many open is a per-user setting. Thanks to mimZD and xet7.
• A subscription with no board id took the server down; it is answered, not fatal. Thanks to xet7.
• The right sidebar starts below the header, in both modes. Thanks to xet7.
• All Boards on a phone: the board list scrolls to its last board. Thanks to mimZD and xet7.
• The password field is back on the Sign In and Register pages. Thanks to xet7.
• A finished MongoDB FerretDB migration on Snap no longer leaves WeKan on 503. Upgrading from 6.09. Thanks to S0QR2 and xet7.
• Admin Panel / People / People showed nothing at all no table, no search box, no pager. Thanks to xet7.

[Package Updates]

[4.134.0]

• Update wekan to 10.41
• Full Changelog
• A removed DDP session no longer crashes the server on its 101st message. Thanks to bluetopaz1204, Nissulya and xet7.
• One icon set: Font Awesome, and the Grey Icons feature is removed. Thanks to xet7.
• "Run ALL tests" now runs all the tests, in build.sh and in build.bat. Thanks to xet7.

[Package Updates]

[4.135.0]

• Update wekan to 10.44
• Full Changelog
• Tests menu runs every database this CPU can, and checks they answer the same. Thanks to xet7.
• The database tests run on their own ports, beside whatever else is running. Thanks to xet7.
• A Docker Compose file for every FerretDB v1 backend, generated from one source. Thanks to xet7.
• Admin Panel reports show the whole instance, not the admin's own boards. Thanks to xet7.
• The admin lists paginate honestly: one page of ten rows, index-backed. Thanks to xet7.
• Every popup had 10px of empty space above it that nothing asked for. Thanks to xet7.
• The board bar centers its items, and the hamburger sits where its space middles. Thanks to xet7.
• Every upload threw in getFileStrategy, so no new file was mime-checked. Thanks to xet7.
• Migrated images show in the card view again. Thanks to S0QR2 and xet7.
• A test pins that a per-tenant admin sees no report data. Thanks to xet7.

[Package Updates]

[4.136.0]

• Update wekan to 10.51
• Full Changelog
• One release now publishes all three snaps: wekan, wekan-ondra and wekan-gantt-gpl. Thanks to xet7.
• The variant sync renames the snap in both snapcraft files, not just one. Thanks to xet7.
• The variant Docker images are published by hand, by retagging the released image. Thanks to xet7.
• A credential the release cannot read is not the Snap Store refusing it. Thanks to xet7.
• Every maintainer script in releases/ is now a menu entry in build.sh and build.bat. Thanks to xet7.
• Twelve one-line wrapper scripts became commands, and both menus gained a command line. Thanks to xet7.
• The Windows zip was never broken: a matched file was reported as missing, because of SIGPIPE. Thanks to xet7.
• The card-drag test measured the board's edge auto-scroll, which is a feature. Thanks to xet7.
• Release jobs now say what actually failed: no snap, no evidence hidden, no wrong secret blamed. Thanks to xet7.

[Package Updates]

[4.137.0]

• Update wekan to 10.53
• Full Changelog

[Package Updates]

[4.138.0]

• Update wekan to 10.56
• Full Changelog
• Every Linux platform FerretDB builds for is built, with a Node.js to match. Thanks to xet7.
• It builds again on every architecture that has no MongoDB server. Thanks to xet7.
• The left menu fits its column on a phone instead of lying over the boards. Thanks to xet7.
• The board counts line up in one column. Thanks to xet7.
• A remote snap build that never starts now says why it did not. Thanks to xet7.

[Package Updates]

[4.139.0]

• Update wekan to 10.57
• Full Changelog
• Import downloads validate every redirect hop instead of only the URL they were given. Thanks to RandomGenerator and xet7.
• IPv6 addresses are classified by their bytes, not by how they are spelled. Thanks to tonghuaroot and xet7.
• The Sandstorm bridge guard reads the page at the path it moved to. Thanks to xet7.
• Every platform page sits under what it is - an OS, container, cloud, hardware or package. Thanks to xet7.
• The links follow the move, including the ones inside the pages that moved. Thanks to xet7.
• Doc links written from the repository root resolve from the page holding them. Thanks to xet7.
• Platform logos are stored beside their page instead of fetched from another host. Thanks to xet7.
• Packager.io and Zenith Hosting have a page of their own. Thanks to xet7.
• The Zenith Hosting page reads as prose instead of a two-item list. Thanks to xet7.

[Package Updates]

[4.140.0]

• Update wekan to 10.67
• Full Changelog
• Docker images for linux/386 and linux/arm/v7, on a Debian base with Node from the fork. Thanks to xet7.
• The Docker image drops linux/arm/v7 too, which its Dockerfile has no Node 24 to install for. Thanks to xet7.
• A loong64 with no base image is skipped, not failed, so it stops skipping the Docker image build. Thanks to xet7.
• The Docker image drops linux/386, which its ubuntu:26.04 base cannot provide. Thanks to xet7.
• The Launchpad snap builds flatten history first, so the push to git.launchpad.net stops timing out. Thanks to xet7.
• Every native bundle ships a named, checksummed Node.js and FerretDB instead of the runner's node. Thanks to xet7.
• The base amd64/arm64 bundles are attached loudly and verified, not silently by softprops. Thanks to xet7.
• The release job checks out before downloading the bundles, so the checkout stops deleting them. Thanks to xet7.
• An admin report opened by its URL keeps the subscription its own count re-render used to cancel. Thanks to xet7.
• The release notes pass the CHANGELOG through the environment instead of inline into the shell. Thanks to xet7.

[Package Updates]

[4.141.0]

• Update wekan to 10.70
• Full Changelog

[Package Updates]

[4.142.0]

• Update wekan to 10.71
• Full Changelog

[Package Updates]

[4.143.0]

• Update wekan to 10.73
• Full Changelog
• PatternBleed: a string replacement that replaced a hyphen with itself, and a guard for the whole class. Thanks to GitHub CodeQL code scanning and xet7.
• Groups may live in their own subtree, not only under the user base. Thanks to leandro-cyberproject and xet7.

[Package Updates]

[4.144.0]

• Update wekan to 10.74
• Full Changelog
• PathBleed: an avatar could name any file on disk, and board export read it. Thanks to Alpastx and xet7.
• RevokeBleed: revoking an org, team or domain share did not revoke it. Thanks to Alpastx and xet7.
• ParentBleed: one card id bridged a private board into another board's feed. Thanks to Alpastx and xet7.
• CommentBleed: the REST API let any board member delete anyone's comment. Thanks to Alpastx and xet7.
• Canary tokens record who tried to override permissions, and from where. Thanks to xet7.
• The database marks the operations WeKan never issues, so an operator sees them. Thanks to xet7.
• A daily paced check of every stored file's name, date and four hashes. Thanks to xet7.
• React as yourself, not as somebody else. Thanks to xet7.
• Fix the two bugs the Database problems page was reporting. Thanks to xet7.
• Security tests say which vulnerability they guard, and the list is checked. Thanks to xet7.

[Package Updates]

[4.145.0]

• Update wekan to 10.78
• Full Changelog
• Build the other two architectures an AppImage runtime exists for. Thanks to xet7.
• Attach full build provenance at every site that pushes an image. Thanks to xet7.
• libcurl4 does not exist on armhf, so name the package noble ships. Thanks to xet7.
• Three good snaps were reported as FAILED by the step that saves their logs. Thanks to xet7.
• Every row appeared twice, amd64 appeared not at all, and six platforms said "latest". Thanks to xet7.
• Attach the built AppImages to the release again. Thanks to xet7.
• Flatpak: attach the bundles to the release, and only the bundles. Thanks to xet7.
• Pin that every bundled binary is fetched as the newest one. Thanks to xet7.
• Release every snap, every architecture, to all four channels. Thanks to xet7.
• Say which six architectures are snaps, and why i386 and armv7 are not. Thanks to xet7.

[Package Updates]

[4.146.0]

• Update wekan to 10.81
• Full Changelog
• Connect with directConnection=true, so a fresh docker compose up starts. Thanks to Dandrass and xet7.
• The board list scrolls to its last board, the Table view scrolls at all, and the tiles are their own size. Thanks to mimZD and xet7.
• The retired Mac runner, the jobs a cancellation skipped, and the armv6 userland. Thanks to xet7.
• An optional part was ending every Launchpad build. Thanks to xet7.
• Report the releases the chart index is missing, and repair its duplicates. Thanks to xet7.
• The chart-index report is a Release menu entry in build.sh and build.bat. Thanks to xet7.
• Version is one table with combined category rows, over two 50% columns. Thanks to xet7.
• Problems / Filesystem integrity showed a blank page. Thanks to xet7.
• A database this snap cannot read stops and says so, instead of serving 502 forever. Thanks to Philippe-Bentegeac, JDeepix, imlit and xet7.
• Build a win-arm64 bundle. Thanks to xet7.

[Package Updates]

[4.147.0]

• Update wekan to 10.83
• Full Changelog
• PassBleed: the export authorised against one board and read a card from another. Thanks to TWPaMWang and xet7.
• Ask the request who it is, because Meteor.userId() cannot. Thanks to markusst1982 and xet7.
• Honour the boardId parameter the client has been sending all along. Thanks to markusst1982 and xet7.
• WhereBleed: eight Admin Panel handlers ran the caller's selector unchecked. Thanks to TungNGo02 and xet7.
• Checklists and card feature groups collapse, on the opened card and on the minicard. Thanks to czinkos, MikeRatcliffe, JannetGen and xet7.
• A new snap revision is a new chance, so the MongoDB 4.2 reader actually gets to run. Thanks to Philippe-Bentegeac, JDeepix, imlit and xet7.
• The notification tray is capped, so SQLite is not rewriting an ever-growing array. Thanks to Nissulya and xet7.
• Clicking an open card closes it, and a focused checkbox is not drawn as a diamond. Thanks to csonkaoszimt, Heart1010 and xet7.
• A typed two-digit year is refused instead of stored as the year 26. Thanks to xet7.
• Dragging a card down scrolls the list, not the whole board. Thanks to markusst1982 and xet7.

[Package Updates]

[4.148.0]

• Update wekan to 10.85
• Full Changelog
• Font Awesome: state the bounding box each glyph actually has. Thanks to xet7.
• Snap: a started mongod is not a used mongod, so stop calling the live copy stale. Thanks to lukechao, markusst1982 and xet7.
• The three new Version-pane and checklist strings, in 133 languages. Thanks to xet7.

[Package Updates]

[4.149.0]

• Update wekan to 10.89
• Full Changelog
• A snap ends up on FerretDB, whatever it was running before. Thanks to xet7.
• There is no database setting on the snap any more, and nothing to type. Thanks to xet7.
• Only the wekan Docker image is published; the two variant names are commented out. Thanks to xet7.
• A path that stops resolving when the step changes directory, and the last bare downloads. Thanks to xet7.
• A release script the job cannot see, and an hour of build thrown away at the push. Thanks to xet7.

[Package Updates]

[4.150.0]

• Update wekan to 10.91
• Full Changelog
• Clicking a minicard again really closes the card, wherever the card was opened from. Thanks to Heart1010, csonkaoszimt and xet7.
• All Boards tiles can take the theme's lighter colour, and a highlighted popup row follows the theme too. Thanks to khuongsatou and xet7.
• A snap waiting for its database says so in the browser, instead of timing out. Thanks to Alishara and xet7.
• A restart is not a crash, and a reverse proxy is not a spoofer. Thanks to xet7.
• The pages shown when there is no database use the product name and the dashboard's colours. Thanks to xet7.
• The status report says which copy of the data is being served, and how to compare them. Thanks to waltermhl and xet7.
• Two open issues answered by reading the code, and pinned so they stay answered. Thanks to xet7.