Wekan - Package Updates

[Package Updates]

[4.204.1]

• Update base | final to 6.0.1
• security: fix eMudhra cert compromise

[Package Updates]

[4.205.0]

• Update wekan to 12.58
• Full Changelog
• The invite-by-email test escapes the address completely, and a partial escape is found anywhere. Thanks to GitHub CodeQL and xet7.
• Board menu / Save as Template turns an existing board into a board template. Thanks to xet7.
• A Jira export of hundreds of issues imports, and a file too large says so. Thanks to xet7.
• Comments stay with a card moved to another board, and do not reappear only when it moves back. Thanks to fabiosalles and xet7.

[Package Updates]

[4.206.0]

• Update wekan to 12.63
• Full Changelog
• Copying or linking a card carries only the custom field values of its new board. Thanks to Raymond-Voogt and xet7.
• A decluttered opened card, a compact attachment list, and Card Settings that fits the screen. Thanks to mueschel and xet7.
• A list move with no swimlane no longer fails its own history checksum. Thanks to Raymond-Voogt and xet7.
• An ordinary refused edit on one's own board no longer disables the account. Thanks to Raymond-Voogt and xet7.
• A MongoDB pod restarting is a lost connection, not a critical crash. Thanks to Raymond-Voogt and xet7.
• List sort indexes are made from key objects, so they are no longer re-created at every start. Thanks to Raymond-Voogt and xet7.
• A lost database connection inside a validation error is a connection problem, not a schema bug. Thanks to Raymond-Voogt and xet7.
• sanitize-html 2.18.1: nested iframes no longer crash imports and exports, or lock out who ran them. Thanks to xet7.
• A failed import or export disables an account only when it was an attempt. Thanks to xet7.
• The dynamic-import and meteor shell keys come from the crypto RNG. Thanks to GitHub CodeQL and xet7.

[Package Updates]

[4.207.0]

• Update wekan to 12.64
• Full Changelog
• The .spk leaves out every login method but Sandstorm's, and FerretDB's other database handlers. Thanks to xet7.
• Every platform runs the prebuilt SQLite-only ferretdb-sqlite binary from wekan/FerretDB. Thanks to xet7.
• A database speed test: the common WeKan queries on every database, twice a production WeKan of data. Thanks to xet7.
• The page reads only the ids and members of the boards it may show. Thanks to xet7.
• Its compose file starts with the current DocumentDB image. Thanks to xet7.
• Collection2 is loaded before the models, so every write is cleaned and given its defaults. Thanks to xet7.
• The Sandstorm package-import guard escapes the whole package name in its pattern. Thanks to xet7.

[Package Updates]

[4.208.0]

• Update wekan to 12.65
• Full Changelog
• The speed test report escapes a backslash before the pipe in a table cell. Thanks to GitHub CodeQL and xet7.
• An opened card shows only the fields it has data in, and + Add under the cover adds the rest. Thanks to xet7.
• A new drawing from Add Card and Add attachment, on the whole window, saved as SVG. Thanks to mimZD and xet7.
• A lasso selects lines to move, resize, group and ungroup, and to change their layer. Thanks to mimZD and xet7.
• SVG is uploaded and shown as an image: an attachment, a cover, a board background, an avatar. Thanks to xet7.
• An SVG of any size is sanitized whole, streaming, on upload, on validation and when served. Thanks to xet7.
• A checked checkbox sits on its own square, not beside it. Thanks to mimZD and xet7.
• Resizing a list follows the pointer instead of moving the other way. Thanks to mimZD and xet7.
• A notification that is not delivered says which check failed. Thanks to xet7.
• @azure/msal-node 6.0.1 7.1.1 by an npm override, for GHSA-xcx6-jx8p-x3h5. Thanks to xet7.

[Package Updates]

[4.209.0]

• Update wekan to 12.66
• Full Changelog
• An attachment upload is authorized: signed in, and allowed to edit the card or write the board. Thanks to xet7.
• Nothing inserted on one's own card can carry another board's id or checklist. Thanks to xet7.
• Siblings of six fixed vulnerabilities closed; every earlier fix is still in place. Thanks to xet7.
• A 304 Not Modified no longer replaces a stored file's own Content-Security-Policy. Thanks to xet7.
• Show when empty: the fields every card of the board shows even while they are empty. Thanks to jullbo and xet7.

[Package Updates]

[4.210.0]

• Update wekan to 12.67
• Full Changelog
• The form closes after the card is added, unless Member Settings keeps it open. Thanks to brlin-tw and xet7.
• The container that installs their Node.js gets .tools/tmp as its /tmp again. Thanks to xet7.
• start-wekan.sh starts WeKan again where there is no /proc. Thanks to xet7.
• meteor-spk is assembled where the .spk is packed from, in .tools. Thanks to xet7.
• A copy of the source tree without .git gets its own .tools/tmp. Thanks to xet7.
• The smoke-test MongoDB starts on a 6.19+ kernel, and Chromium is found. Thanks to xet7.
• Its guard pins mongo:9.0.4, not the mongo:8 that stopped starting. Thanks to xet7.
• WeKan vs Trello vs Jira says when WeKan added each feature it listed as missing. Thanks to xet7.

[Package Updates]

[4.211.0]

• Update wekan to 12.72
• Full Changelog
• A card link can no longer launch an operating-system handler with a code-execution history, such as ms-msdt (Follina) or telnet, even if an administrator lists it, and an attempt to write one shows in Admin Panel Problems. The Apache guide follows the 2024 Confusion Attacks, and the Sandstorm store build publishes to both app markets.
• ImportPlacementBleed is fixed: an import is placed only on its own board. Invite via Email adds the invited new user again, instead of the first user of the database. The OpenBSD bundle starts again, and History works on FerretDB: date custom field changes are recorded there, and the database migration says when documents did not arrive.
• All changes in v12.69
• Card Settings, in Board Settings / Card, becomes two panes of checklists - the minicard's and the card's - with a checkbox per section and the board's custom fields as items, and the opened card and the minicard follow its sections and order; every opened card shows every field its board allows, empty or not. WeKan moves to Meteor 3.6-rc.1, keeping its own security additions to Meteor's packages. Data health in Admin Panel / Problems can now clean up custom fields whose boards were all deleted, and empty fields no longer show Scrum sections on boards that have Scrum turned off.
• More details at ChangeLog

[Package Updates]

[4.212.0]

• Update wekan to 12.75
• Full Changelog
• Changing a password signs the account out in every other browser, and now a test proves it in two real browsers.
• All changes in v12.75
• CHANGELOG.md is now short: the In short of the upcoming release and of the five newest releases, in plain Markdown. The status and every change of each release are in CHANGELOG-big.md, which is the one that is written. CodeQL alert #598 in the Sandstorm host test is fixed, and the release script pulls before releasing, so a moved main no longer stops it.
• All changes in v12.73

[Package Updates]

[4.213.0]

• Update wekan to 12.77
• Full Changelog
• Two node test guards follow the movable popups and the date picker of v12.76.
• All changes in v12.77
• Security features: a password policy with an optional breached-password check, Admin Panel / Problems / Password length, compulsory two-factor authentication, sign-out of idle sessions and of every session after a password change, an audit log of what administrators did, HSTS, a cross-site request guard, and S3 encryption at rest.
• Sign-up works again; the date picker has Today, the whole card title edits and every popup can be moved; and an old Sandstorm grain migrated from MongoDB 3 shows its boards again.
• All changes in v12.76