Wekan - Package Updates

[Package Updates]

[4.193.0]

• Update wekan to 12.20
• Full Changelog
• Confirm the board domains REST route is site-admin only; GHSA-r3c4-5xwp-vf54 does not apply. Thanks to a25370 and xet7.
• A card open no longer re-renders every card: lists and cards read only the user fields they use. Thanks to markusst1982 and xet7.
• A card opened or closed by its address no longer rebuilds the whole board. Thanks to markusst1982 and xet7.
• Closing a card no longer makes every card re-read the current board. Thanks to markusst1982 and xet7.
• Drag-and-drop options are set only when they change. Thanks to markusst1982 and xet7.
• Opening a card no longer leaves a subscription running after it closes. Thanks to markusst1982 and xet7.
• The snap now defaults cards-loading to auto, so big boards load only their visible cards. Thanks to markusst1982 and xet7.

[Package Updates]

[4.194.0]

• Update wekan to 12.22
• Full Changelog
• D opens the Due date editor of the opened card. Thanks to mimZD and xet7.
• Today's day stands out in the date popup and the board Calendar view. Thanks to mimZD and xet7.
• pbkdf2 3.1.3 3.1.7 key derivation in the browser crypto stubs that meteor-node-stubs bundles; fixes long passwords being hashed again on every iteration, GHSA-477h-4r7f-fvrx.
• A database connection refused by AppArmor is named at once, with the fix. Thanks to fabiosalles and xet7.
• Every service log no longer starts with four snapctl get errors. Thanks to fabiosalles and xet7.
• The Set color to action can pick any card color, not only green. Thanks to titver968 and xet7.
• Select all and Unselect all visibly tick and untick every rule. Thanks to titver968 and xet7.
• Card More and multi-selection list every board for a user without a templates board. Thanks to xet7.
• Filter matches follow a member's access even when the board observer stalls. Thanks to xet7.
• Backup and restore start the database first, and every wait says why it fails. Thanks to fabiosalles and xet7.

[Package Updates]

[4.195.0]

• Update wekan to 12.25
• Full Changelog
• Every provider login uses a full-page redirect by default instead of a popup. Thanks to xet7.
• Caddy sends each WeKan container and Sandstorm the visitor's real address. Thanks to xet7.
• Boards import and export as Todoist project templates (CSV). Thanks to xet7.
• Boards import and export as OPML outlines from Workflowy, Dynalist, Logseq and others. Thanks to xet7.
• Boards import and export as Org mode outlines. Thanks to xet7.
• A rule can set and clear assignees, and needs no title. Thanks to xeruf and xet7.
• A rule can fire when a card moves forward to a later list or back to an earlier one. Thanks to rlach and xet7.
• Header login is set by the environment only, and shown read-only in the Admin Panel. Thanks to xet7.
• Automatic logout with LOGOUT_WITH_TIMER and the LOGOUT_* settings works again. Thanks to xet7.
• Translation tests check links by their parsed host, not as substrings. Thanks to GitHub CodeQL and xet7.

[Package Updates]

[4.196.0]

• Update wekan to 12.27
• Full Changelog
• FerretDB answers a $group with several accumulators, $min/$max and capped max like MongoDB. Thanks to xet7.
• EVERYTHING compares MongoDB 8 and MongoDB 9 too, queried directly. Thanks to xet7.
• MongoDB 6 and 7 are compared too: all eight databases answer all 110 cases the same. Thanks to xet7.
• build.bat runs Mocha, guards, Playwright, builds and Setup the same way as build.sh. Thanks to xet7.
• A link title or URL in an import file can no longer end its link early. Thanks to GitHub CodeQL and xet7.
• Sheet names are read in linear time, and the manual test pages pin their CDN script. Thanks to GitHub CodeQL and xet7.
• The import and export docs test escapes headings, and identity replacements are found in regex form too. Thanks to GitHub CodeQL and xet7.
• Card close from 4 s to 0.1 s on a 4,000-card board; only visible data loads. Thanks to markusst1982 and xet7.
• Attach a card to a card, as Trello's card attachments, and import them from Trello. Thanks to ricardoboss and xet7.
• Calendar Mode, Trello's calendar, below Calendar in the view menu. Thanks to tripledee and xet7.

[Package Updates]

[4.197.0]

• Update wekan to 12.38
• Full Changelog
• End-tag patterns also match tags that carry attributes. Thanks to GitHub CodeQL and xet7.
• It says why an existing account could not be linked, and finds it by email. Thanks to xet7.
• Private starred boards show in the Favorites popup. Thanks to Raymond-Voogt and xet7.
• A dragged list shows clearly where it will land. Thanks to mimZD and xet7.
• Repair target builds and release asset checks. Thanks to xet7.
• Bun builds install Rspack before compiling. Thanks to xet7.
• Bun setup accepts the selected runtime version. Thanks to xet7.
• Package scanning and generated code handle unsafe input. Thanks to GitHub CodeQL and xet7.
• Builds cover every supported OS and CPU. Thanks to dupontbertrand and xet7.
• No pattern is built from an unescaped value, and no escape stops at the first match. Thanks to GitHub CodeQL and xet7.

[Package Updates]

[4.198.0]

• Update wekan to 12.39
• Full Changelog
• It no longer installs docker-cli, whose Go 1.24 filled the scans. Thanks to xet7.
• Eight npm packages inside Meteor's packages are raised to fixed releases. Thanks to xet7.
• They are built with Go 1.27.2 and golang.org/x/net v0.60.0. Thanks to xet7.
• SAML logs in a binding that lacks the optional qualifiers. Thanks to xet7.
• Android and FreeBSD build, and windows-arm64 no longer shows a false error. Thanks to xet7.
• The Docker job checks the bundle version again. Thanks to xet7.
• The build script parity guard passes again. Thanks to xet7.

[Package Updates]

[4.199.0]

• Update wekan to 12.46
• Full Changelog
• SQRL's sqrlonly and hardlock lock an account to SQRL. Thanks to xet7.
• Windows single sign-on with Kerberos or NTLM. Thanks to nikalasmd and xet7.
• WeKan's changes are written back to GitLab. Thanks to gotjoshua and xet7.
• Planka, Microsoft To Do, KanbanFlow, Basecamp, Google Tasks and Google Keep import from their APIs. Thanks to xet7.
• Channels are the cards with a conversation on every board, with unread counts. Thanks to xet7.
• Batch undo and redo of a large sprint is 2.6 times faster. Thanks to xet7.
• Two changes saved at the same moment no longer fork a board's History chain. Thanks to xet7.
• The email view renders its subjects and previews as Markdown. Thanks to xet7.
• Version Control, the activity feed and the email list render titles as Markdown. Thanks to xet7.
• The activity feed names the checklist, item, lists and people it is about. Thanks to xet7.

[Package Updates]

[4.200.0]

• Update wekan to 12.48
• Full Changelog
• Assigned-only members get only their own cards' files and document text. Thanks to crypto-nidh and xet7.
• No expressions in scripts, every action pinned, and write access only where it is used. Thanks to Qlty and xet7.
• The Windows bundles build again: release scripts read their files as UTF-8. Thanks to xet7.
• The NetBSD bundle builds again: node-gyp finds pkgsrc's Python. Thanks to xet7.
• It imports new users again and keeps the sync interval it is given. Thanks to tromlet and xet7.
• Caddyfile examples are Caddy 2, and Caddy proxies to where WeKan listens. Thanks to Group-Deed and xet7.
• List Sync works from a Sandstorm grain. Thanks to xet7.
• The import brings closed sprints, rebuilt from the issues. Thanks to xet7.
• Jira, Deck, OpenProject, Asana and GitLab imports bring their attachment files. Thanks to xet7.
• A sync interval in milliseconds no longer stops WeKan. Thanks to B2RN, tromlet and xet7.

[Package Updates]

[4.201.0]

• Update wekan to 12.49
• Full Changelog
• Board role permissions apply to every board view and every path to a card. Thanks to crypto-nidh, binary-lover and xet7.
• Board roles: how a role applies to every board view, the API and every write. Thanks to xet7.
• Custom roles from the Admin Panel apply in every board view as built-in roles do, verified for every combination. Thanks to xet7.

[Package Updates]

[4.202.0]

• Update wekan to 12.52
• Full Changelog
• Release builds - the Android, musl and single-file builds of v12.51, and the guards of the dependency updates.
• The guards follow freebsd-vm 1.5.9 and qrcode-generator 2.0.4. Thanks to dependabot and xet7.
• Android bundles: the checkout belongs to Termux's user, so npm may chmod. Thanks to xet7.
• musl bundles carry libstdc++ and libgcc_s, so their Node.js starts on a bare Alpine. Thanks to xet7.
• Single files: a Node.js that LIEF cannot inject is skipped with the reason, not failed. Thanks to xet7.
• A due date typed at the end of a card title becomes its due date. Thanks to xet7.
• Similar cards and possible duplicates while adding a card and on the opened card. Thanks to xet7.
• Rules suggests rules from what people keep doing by hand. Thanks to xet7.
• Board menu: Summary, what each person did in the last day or week. Thanks to xet7.
• The web login no longer tells by its response time whether a username exists. Thanks to xet7.

[Package Updates]

[4.203.0]

• Update wekan to 12.55
• Full Changelog
• A 32-bit ARM single file's blob is injected in a 64-bit process. Thanks to xet7.
• Each musl AppImage is built once, and every AppImage job has its own name. Thanks to xet7.
• Android bundles preload termux-exec, so bcrypt's install script runs. Thanks to xet7.
• A single file's --build-sea is tried again when it runs out of memory. Thanks to xet7.
• musl bundles carry every library their Node.js needs, libatomic too. Thanks to xet7.
• Moving a card with an outgoing webhook is no HookBleed and keeps the mover's account. Thanks to do4me and xet7.

[Package Updates]

[4.203.1]

• Update wekan to 12.56
• Full Changelog
• Inactive accounts can be disabled; LDAP sync honours its search filter; everyone's Last active is shown. Thanks to Raymond-Voogt and xet7.
• #6783: Admin Panel / People showed "Last active" as "-" for every user but the administrator, because the people publication did not carry lastConnectionDate. The table's own row projection left it out too, which the UI test found (the table's half).
• #6784: USERS_DISABLE_INACTIVE_AFTER_DAYS disables, once a night, accounts unused for that many days, and revokes their logins.
• #6785: LDAP background sync looked users up without LDAP_USER_SEARCH_FILTER. An account the filter excludes, such as one disabled in Active Directory, could not log in but was still found: it was never disabled, and a manual disable was undone on the next sync. The filter is now part of the lookup, and an account disabled for inactivity is not re-enabled by the sync.
• A checked checkbox shows a check mark in right-to-left languages too. Thanks to mimZD and xet7.
• #6786: the tick is a box rotated 40 degrees and drawn by its bottom and side borders. The side was border-inline-end, which a right-to-left page puts on the left, so the tick opened the other way. All 25 rules that draw a tick now use border-right.
• Restored list swimlanes stay restored after a WeKan upgrade. Thanks to mimZD and xet7.
• #6787: after every new release, the startup upgrade's merge-per-swimlane-lists step, written for v7.98-era damage, un-bound every list on a board with two lists of one title, the lists "Lists missing their swimlane" -> Restore had bound included. So the count came back the same after each upgrade. A list bound to the swimlane it was created in, with all its cards there, is now left alone. Press Restore once more after upgrading.

[Package Updates]

[4.204.0]

• Update wekan to 12.57
• Full Changelog
• Attachment retention: delete card attachments after N days, purge deleted ones after M days. Thanks to Raymond-Voogt and xet7.
• Backup status: every run recorded, failures and overdue backups shown, old backups pruned. Thanks to Raymond-Voogt and xet7.
• The newest features' settings are on every release platform and in the Admin Panel. Thanks to xet7.
• Adding a board member by email works in any letter case, and search finds colleagues past five matches. Thanks to Raymond-Voogt and xet7.
• History rows are hashed as stored, so an unset value is not tampering. Thanks to xet7.
• FileNameBleed: a percent-encoded name is not an exploit, and opening a file is not an upload. Thanks to xet7.
• A clean file-integrity scan is no longer a StorageBleed event. Thanks to xet7.
• Locations from Cloudflare keep their letters: Dinkelsbhl, not Dinkelsbhl. Thanks to xet7.
• Bun bundles wait for their smoke-test MongoDB, and replace a lost one. Thanks to xet7.
• Launchpad snaps retry an outage there for longer, not three strikes. Thanks to xet7.

[Package Updates]

[4.204.1]

• Update base | final to 6.0.1
• security: fix eMudhra cert compromise

[Package Updates]

[4.205.0]

• Update wekan to 12.58
• Full Changelog
• The invite-by-email test escapes the address completely, and a partial escape is found anywhere. Thanks to GitHub CodeQL and xet7.
• Board menu / Save as Template turns an existing board into a board template. Thanks to xet7.
• A Jira export of hundreds of issues imports, and a file too large says so. Thanks to xet7.
• Comments stay with a card moved to another board, and do not reappear only when it moves back. Thanks to fabiosalles and xet7.

[Package Updates]

[4.206.0]

• Update wekan to 12.63
• Full Changelog
• Copying or linking a card carries only the custom field values of its new board. Thanks to Raymond-Voogt and xet7.
• A decluttered opened card, a compact attachment list, and Card Settings that fits the screen. Thanks to mueschel and xet7.
• A list move with no swimlane no longer fails its own history checksum. Thanks to Raymond-Voogt and xet7.
• An ordinary refused edit on one's own board no longer disables the account. Thanks to Raymond-Voogt and xet7.
• A MongoDB pod restarting is a lost connection, not a critical crash. Thanks to Raymond-Voogt and xet7.
• List sort indexes are made from key objects, so they are no longer re-created at every start. Thanks to Raymond-Voogt and xet7.
• A lost database connection inside a validation error is a connection problem, not a schema bug. Thanks to Raymond-Voogt and xet7.
• sanitize-html 2.18.1: nested iframes no longer crash imports and exports, or lock out who ran them. Thanks to xet7.
• A failed import or export disables an account only when it was an attempt. Thanks to xet7.
• The dynamic-import and meteor shell keys come from the crypto RNG. Thanks to GitHub CodeQL and xet7.