Wekan - Package Updates

[Package Updates]

[4.91.0]

• Update wekan to 8.19
• Full Changelog
• Security Fix 1: IDOR in setCreateTranslation. Non-admin could change Custom Translation
• Security Fix 2: Private-only board setting can be bypassed
• Security Fix 3: Card comment author spoofing (IDOR) via API
• Security Fix 4: Cross-board card move without destination authorization
• Security Fix 5: Read-only roles can still update cards
• Security Fix 6: Checklist delete IDOR: checklist not verified against board/card
• Security Fix 7: Checklist create IDOR: cardId not verified against boardId
• Security Fix 8: Attachments publication leaks metadata without auth
• Security Fix 9: Attachment upload not scoped to card/board relationship
• Security Fix 10: LDAP filter injection in LDAP auth

[Package Updates]

[4.93.0]

• Update wekan to 8.21
• Full Changelog
• Security Fix 2: OrgsTeamsBleed
• Security Fix 3: ChecklistRESTBleed
• Security Fix 4: MigrationsBleed2
• Security Fix 5: PositionHistoryBleed
• Security Fix 6: SyncLDAPBleed
• Security Fix 7: AttachmentMigrationBleed
• Security Fix 8: MoveStorageBleed
• Security Fix 9: ListWIPBleed
• Security Fix 10: BoardTitleRESTBleed
• Security Fix 11: CardPubSubBleed

[Package Updates]

[4.93.1]

• Update wekan to 8.22
• Full Changelog
• Fixed Add member and @mentions

[Package Updates]

[4.95.0]

• Update wekan to 8.24
• Full Changelog
• Secure Sandbox for VSCode at Debian 13 amd64. Part 1, Part 2. Thanks to xet7.
• Updated build scripts and docs to Meteor 2.16. Thanks to xet7.
• Replace mquandalle:collection-mutations with collection helpers. Thanks to harryadel.
• Replace ongoworks:speakingurl with limax. Thanks to harryadel.
• Migrate createIndex to createIndexAsync. Thanks to harryadel.
• Remove idmontie:migrations. Thanks to harryadel.
• Remove mquandalle:autofocus. Part 1, Part 2. Thanks to harryadel.

[Package Updates]

[4.96.0]

• Update wekan to 8.25
• Full Changelog
• This release fixes the following CRITICAL SECURITY ISSUES of Floppybleed:
• Fix Filebleed of Floppybleed.
• Updated code counts.
• Updated FerretDB 2 / PostgreSQL docs location.
• Most Unicode Icons back to Font Awesome 4.7 for better accessibility. Less always visible buttons, More at Mnu.
• Updated to MongoDB 7.0.29 at Snap Candidate.
• Updated to MongoDB 7.0.29 at Helm Charts.
• Fix autofocus.

[Package Updates]

[4.97.0]

• Update wekan to 8.27
• Full Changelog
• Updated MongoDB to 7.0.29 at Windows install docs
• Fix async/await in copy/move card operations
• Migrate wekan-accounts-lockout to async API for Meteor 3.0
• Added Docs: Spreadsheet vs Kanban
• Updated dependencies
• Reduce visual overflow in Member Settings menu by extending container height
• Fix Card copy menu is not displayed
• Fix Bug: Rules view translation not is not shown correctly

[Package Updates]

[4.98.0]

• Update wekan to 8.28
• Full Changelog
• Updated meteor-node-stubs
• Fixed text truncation at quick-access board link bar
• Improved cardDetails.css for better UI
• Fixed Jade syntax at header
• Await async setDone before closing popup in copy/move dialogs

[Package Updates]

[4.99.0]

• Update wekan to 8.31
• Full Changelog
• Fix Copy Card and Move Card. Thanks to xet7.
• Reverted New UI Design of WeKan v8.29 and added more fixes and performance improvements. Thanks to xet7.

[Package Updates]

[4.100.0]

• Update wekan to 8.32
• Full Changelog
• Migrate wekan-oidc to async API for Meteor 3.0.
• Migrate wekan-accounts-sandstorm to async API for Meteor 3.0.
• Migrate wekan-accounts-cas to async API for Meteor 3.0.
• Updated to MongoDB 7.0.30 at Snap Candidate.
• Updated MongoDB to 7.0.30 at Helm Chart.

[Package Updates]

[4.101.0]

• Update wekan to 8.33
• Full Changelog
• Admin Panel/Settings/Layout, for PWA: Custom head meta, link, icons, assetlinks.json, site.webmanifest.
• Migrate wekan-ldap to async API for Meteor 3.0.
• Updated dependencies.