Wekan - Package Updates

[Package Updates]

[4.159.0]

• Update wekan to 11.15
• Full Changelog
• Whitelisted token claims cannot overwrite service-owned fields. Thanks to crypto-nidh and xet7.
• Logged-out clients cannot subscribe to authentication metadata. Thanks to crypto-nidh and xet7.
• Recovery and verification DDP calls are rate-limited. Thanks to crypto-nidh and xet7.
• Move Card keeps newly created destination boards selectable. Thanks to rlach and xet7.
• Side gutters remain visible and date editors open centered without horizontal scrolling. Thanks to Alishara and xet7.

[Package Updates]

[4.160.0]

• Update wekan to 11.16
• Full Changelog
• Search pagination sessions cannot be reused across users. Thanks to crypto-nidh and xet7.
• The 32-bit AppImages pass the right startup checks. Thanks to xet7.
• Rebuilt 32-bit AppImages also protect older release bundles. Thanks to xet7.
• The full release publishes its AppImages automatically. Thanks to xet7.
• Opened cards apply their side gutters to the visible content. Thanks to rmb82 and xet7.

[Package Updates]

[4.161.0]

• Update wekan to 11.28
• Notification activity text remains text in HTML email. Thanks to binary-lover and xet7.
• Persistent resume tokens are unavailable to browser scripts. Thanks to binary-lover and xet7.
• Global search cannot execute untrusted selectors or cross board boundaries. Thanks to crypto-nidh and xet7.
• Free FerretDB ports before the Windows EXE smoke test. Thanks to xet7.
• Windows gets a portable single-file WeKan. Thanks to xet7.
• Persistent login survives page refreshes with FerretDB. Thanks to majo1989 and xet7.
• Rules cannot write cards into inaccessible private boards. Thanks to crypto-nidh and xet7.
• Avatar MIME metadata cannot serve browser-executable content. Thanks to crypto-nidh and xet7.
• Read-only members cannot create default swimlanes. Thanks to crypto-nidh and xet7.
• Save the title from the submitted top or bottom composer. Thanks to xet7.

[Package Updates]

[4.162.0]

• Update wekan to 11.36
• Full Changelog
• Snap database comparison no longer executes a host timeout command. Thanks to xet7.
• Disabled comparison and unset polling values no longer stop Snap startup. Thanks to xet7.
• Snap problem reports use the database URL of the running services. Thanks to xet7.
• Snap services recover abandoned endpoint locks. Thanks to xet7.
• Version tests compare generated text without incomplete escaping. Thanks to xet7.
• Windows PDF and Snap release builds stay portable. Thanks to xet7.
• The Version pane reads one published component manifest. Thanks to xet7.
• Private-board sessions survive page refreshes. Thanks to lucasarrudadev and xet7.
• Custom fields stay deselected on FerretDB. Thanks to Heart1010 and xet7.
• Release builds keep every scheduled artifact path healthy. Thanks to xet7.

[Package Updates]

[4.163.0]

• Update wekan to 11.39
• Full Changelog
• Muted boards no longer send assignment or other activity notifications. Thanks to Nissulya and xet7.
• Cards stay in real swimlanes and view changes no longer snap back. Thanks to hmeunier95 and xet7.
• Language, full name and initials persist immediately. Thanks to mzch and xet7.
• An uploaded avatar remains selected. Thanks to hmeunier95 and xet7.
• Calendar and Gantt switch without reloading the application. Thanks to hmeunier95 and xet7.
• Google login examples map usernames from email. Thanks to xet7.
• Packaged startup no longer guesses network endpoints. Thanks to xet7.

[Package Updates]

[4.164.0]

• Update wekan to 11.43
• Full Changelog
• Configure Nodemailer services in the Admin Panel. Thanks to xet7.
• Persist and browser-test the Admin Panel email settings. Thanks to xet7.
• Persistent login-token lookup works through nested arrays. Thanks to jeremy-arsia and xet7.
• Attachment content is fail-closed on every storage path. Thanks to avrlab233 and xet7.
• The chosen board order takes effect immediately and remains selected. Thanks to jullbo and xet7.
• Effectively unlimited sorted queries no longer reserve gigabytes up front. Thanks to jeremy-arsia, Heart1010 and xet7.
• Board content follows view changes and cards stay in their containing swimlane. Thanks to hmeunier95 and xet7.
• Destroyed swimlanes no longer initialize deferred drag-and-drop. Thanks to xet7.

[Package Updates]

[4.165.0]

• Update wekan to 11.47
• Full Changelog
• DOCX, XLSX and PPTX attachments open in a guarded viewer. Thanks to yukiyokotani and xet7.
• Meteor 3.5.2-beta.0 3.5.2-rc.0 advances the framework and its accounts, Babel, DDP, ECMAScript, minifier, MongoDB, npm-mongo, Rspack, tools-core and TypeScript packages to their release candidates, and updates @meteorjs/rspack to 2.2.0-beta.1. Thanks to Meteor developers and xet7.
• qs 6.15.3 6.16.0 query-string parsing and serialization in the browser-side Node compatibility stubs. The update enforces array limits on comma groups, preserves cycle detection for empty arrays with own properties, safely handles non-callable buffer constructors and corrects filtered dates and encoded top-level dotted keys.
• Express and body-parser use qs 6.16.0 a scoped override moves Rspack's development-server dependency tree past GHSA-x5fp-wj9c-mxmx and GHSA-4mjr-xmp4-gh2g. Thanks to xet7.
• Fedora Asahi gains a dedicated ARM64 KVM test environment. Thanks to xet7.
• Ubuntu Asahi gains the same isolated KVM workflow. Thanks to xet7.
• The required SCRAM-SHA-1 digest keeps its scoped CodeQL exception. Thanks to GitHub CodeQL and xet7.
• Update dependencies and complete the Go 1.27 migration. Thanks to dependabot and xet7.
• Refresh the MongoDB v2 driver and gRPC dependencies. Thanks to dependabot and xet7.
• Build current upstream master with newest Go and dependencies. Thanks to xet7.

[Package Updates]

[4.166.0]

• Update wekan to 11.48
• Full Changelog
• Remove the Starred controls' outline. Thanks to xet7.
• Remove the Mobile/Desktop toggle's frame. Thanks to xet7.
• Keep the selected mode icon white. Thanks to xet7.
• Show only the current Mobile/Desktop mode icon. Thanks to xet7.
• Align Add Board four pixels higher. Thanks to xet7.
• Remove the Custom Fields layout selector's frame. Thanks to xet7.
• Show one Custom Fields layout icon. Thanks to xet7.
• Match the Custom Fields layout and menu icon colours. Thanks to xet7.
• Share ordinary board-theme CSS. Thanks to xet7.
• Compact the lazy language registry. Thanks to xet7.

[Package Updates]

[4.167.0]

• Update wekan to 11.49
• Full Changelog
• It carries a checksummed copy of the win64 ZIP instead of a virtual filesystem. Thanks to xet7.
• It reads the bundle from inside itself instead of unpacking 39,035 files. Thanks to xet7.
• It drops the native prebuilds the target platform can never open. Thanks to xet7.
• Moving a list to a swimlane binds it to that swimlane. Thanks to TawsTm and xet7.

[Package Updates]

[4.168.0]

• Update wekan to 11.53
• Full Changelog
• Remove incomplete sanitizer test doubles. Thanks to GitHub CodeQL and xet7.
• Enforce Amiga-safe filenames on every read. Thanks to xet7.
• Stop creating SCRAM-SHA-1 credentials. Thanks to GitHub CodeQL and xet7.
• Secure and resume import/export operations. Thanks to xet7.
• Validate XLSX sheet colors before CSS serialization. Thanks to rbbjinioeq and xet7.
• Add verified recovery and low-load integrity audits. Thanks to xet7.
• A file WeKan refuses to serve is no longer served by Meteor-Files instead. Thanks to xet7.
• The universal change history is built, and Ctrl+Z reads it instead of positions alone. Thanks to xet7.
• Every card group is recorded, and History is one table opened from every menu. Thanks to xet7.
• Copying a list copies its cards, into a new list. Thanks to xet7.