Wekan - Package Updates

[Package Updates]

[4.121.0]

• Update wekan to 9.87
• Full Changelog
• Normal users cannot move cards between swimlanes: in the swimlanes view the .js-swimlanes sortable which also carries moving a card from one swimlane to another was disabled for every non-admin (!isBoardAdmin()), even though its own comment said it should be disabled only for non-members. So ordinary board members could move a card within a swimlane but not between swimlanes, and could not reorder swimlanes. Now it is disabled only for users without write access (!canModifyCard(): comment-only, worker, read-only), so board members can move cards between swimlanes again.

[Package Updates]

[4.122.0]

• Update wekan to 9.89
• Full Changelog
• SortBleed: a low-privilege (comment-only / read-only) board member could escalate to board admin and take over a private board via the board sort collection-allow rule
• Added docs about new Sandstorm WeKan. Thanks to xet7.
• Sandstorm build: fixed "not writing through dangling symlink" that failed the sandstorm.yml workflow at sandstorm-src/build-deps.sh step [3/7]. Thanks to xet7.
• Sandstorm build: write the signing keyring to the path meteor-spk pack actually reads. Thanks to xet7.
• Sandstorm .spk: trim it back toward Cloudflare's 100 MB upload limit. Thanks to xet7.
• Sandstorm .spk: don't crash the grain when capnp.node can't load on Node 24. Thanks to xet7.
• Sandstorm .spk: fix server-boot crashes from stale globals (Users, HTTP) in sandstorm.js. Thanks to xet7.
• Sandstorm .spk: open All Boards (not sign-in) and keep the grain URL in sync. Thanks to xet7.
• Avatars and original members now travel with a board (export/import), from every identity source.
• Update Sandstorm WeKan info. Part 1, Part 2, Part 3. Thanks to xet7.

[Package Updates]

[4.123.0]

• Update wekan to 9.91
• Full Changelog
• MimeBleed: file-upload MIME-type validation bypass stored XSS on deployments without the file binary
• Admin Panel / Features / Security: import/export privacy controls. Six new optional toggles govern how boards and user data cross the WeKan boundary:
• Admin Panel / Features / Security: new optional "Always show all code as plain text" toggle. When enabled, rich text is never rendered as markdown or HTML the entire source is shown as escaped plain text in every rich text field (board and card titles, descriptions, comments, checklists, etc.)
• Admin Panel / Features: new optional "Render links as plain text" security toggle. When enabled, all links both markdown links like [label](url) and raw HTML <a href> tags are always shown as plain, non-clickable text in every rich text field
• Outgoing webhooks / notifications: include the card description (#5143).
• Sandstorm: the WeKan Admin Panel is now always available in a migrated grain, not just a freshly created one.
• Admin Panel / Version: show the MongoDB storage engine even with per-database credentials (no more "unknown").
• Admin Panel / Features / Security: "Always show all code as plain text" did not take effect (links stayed clickable, code stayed rendered).
• i18n: several languages fell back to English (or clobbered another language) because a browser language string did not map to the right translation file.

[Package Updates]

[4.124.0]

• Update wekan to 9.95
• Full Changelog
• FerretDB: WeKan did not work after migrating to FerretDB every logged-in browser was logged out again and the database CPU was pinned at 100% (#6457, server/accounts-resume-login.js, server/imports.js). Meteor's accounts-base "resume" login handler projects one array element with the positional operator ({fields: {'services.resume.loginTokens.$': 1}}), and FerretDB rejects that find with "Executor error during find command :: caused by :: positional operator '.$' couldn't find a matching element in the array" (code 51246). Thanks to markusst1982 and xet7.
• Snap: the database setting is now authoritative, with a snap run wekan.database mongodb|ferretdb command and no-downtime handling of a failed migration (snap-src/bin/wekan-database, snap-src/bin/wekan-control, snap-src/bin/mongodb-control, snap-src/bin/ferretdb-control, snap-src/bin/migration-control, snap-src/bin/migration-pending). Thanks to xet7.
• Snap: new snap run wekan.migrate command to force a fresh MongoDB FerretDB migration (snap-src/bin/wekan-force-migrate, registered in snapcraft.yaml). Thanks to xet7.
• Snap: new maintenance mode (snap run wekan.maintenance on|off) so you can run MongoDB OR FerretDB by hand for data access (snap-src/bin/wekan-maintenance, snap-src/bin/wekan-maintenance-page.mjs, and the DB control scripts). Thanks to xet7.
• Snap: WeKan never started on a running MongoDB, looping "MongoDB not ready yet, retrying in 5 seconds..." forever, on any server with less than ~34 GB RAM (#6454, snap-src/bin/mongodb-control, snap-src/bin/migration-control). Thanks to xet7.
• Snap: the MongoDB 6/7 FerretDB importer now resolves the correct driver and matches the MongoDB 3.2 importer's safety and dashboard (releases/migrate-mongodb-to-ferretdb.mjs). Thanks to xet7.
• Snap: after a MongoDB FerretDB migration, FerretDB never started and WeKan was stuck on "MongoDB not ready yet, retrying..." (snap-src/bin/migration-control). Thanks to xet7.
• Snap: WeKan now starts its database itself on startup instead of waiting forever for a stopped one (snap-src/bin/wekan-control). Thanks to xet7.
• Snap: WeKan never starts an EMPTY FerretDB while data still lives in MongoDB (snap-src/bin/wekan-control). Thanks to xet7.
• Snap: db-eval could not load the MongoDB driver, so EVERY database readiness check silently failed (snap-src/bin/db-eval.mjs; also migrate-schema-v843.mjs, migrate-gridfs-to-fs.mjs). Thanks to xet7.

[Package Updates]

[4.125.0]

• Update wekan to 9.96
• Full Changelog
• Bump websocket-driver from 0.7.4 to 0.7.5. Thanks to dependabot.
• Subtasks: creating a subtask crashed with "Exception while invoking method 'addSubtaskCard'" (#6456, models/boards.js, tests/subtasksDefaultBoard.test.cjs). Thanks to sjohnen and xet7.
• GUI: the "More" menu of cards was completely empty, so cards could not be deleted from it (#6459, npm-packages/meteor-jade-loader/lib/vendor/htmljs.js, client/components/lists/listHeader.jade). Thanks to thku and xet7.
• Cards: the "You have an unsaved description" warning could never be cleared by saving (#6455, reincarnation of #1287, client/components/cards/cardDetails.js, client/components/cards/cardDescription.js). Thanks to C0rn3j and xet7.
• Comments: a comment being written was lost when the card was closed or a click landed outside the card (#5547, client/components/activities/comments.js). Thanks to Finnlife, webenefits and xet7.
• Attachments: deleting an attachment could log a client-side "Removed nonexistent document" exception even though the delete succeeded (#5282, client/components/cards/attachments.js). Thanks to lupuszr and xet7.
• Rules: the "move card to top/bottom" actions did nothing (#6472, server/rulesHelper.js, client/components/rules/actions/boardActions.js, client/components/rules/rulesImportExport.js, server/rulesButton.js, models/lists.js). Thanks to jmb26240 and xet7.
• GUI: desktop density regressions from the v7.98v8.18 mobile UI work (#6465, client/components/main/layouts.css, client/components/cards/cardDetails.css, client/components/main/header.css, client/components/settings/peopleBody.jade, client/components/settings/settingBody.css, client/components/boards/boardHeader.jade). Thanks to Mintyt, csonkaoszimt, micha141076 and xet7.
• LDAP: group search filters were double-escaped and broke group filtering (#6460, MR #6469, packages/wekan-ldap/server/ldap.js). Thanks to ChristianMa97.
• LDAP: enabling org/team sync made every LDAP login fail with 'forbidden' (#6461, MR #6470, packages/wekan-ldap/server/loginHandler.js, packages/wekan-ldap/server/sync.js). Thanks to ChristianMa97 and xet7.

[Package Updates]

[4.126.0]

• Update wekan to 9.99
• Full Changelog
• Updated Sandstorm Backup docs. Thanks to robertdahlem and xet7.
• WeKan has been translated to 154 languages. Thanks to xet7.
• Member menu / Change Color global theme override, visible swatches, applies everywhere, no Save button (#5778, docs/Theme/Theme.md).
• Member Settings / Font pick an installed UI font, size and text colors (part of #4759).
• Soft delete + Undo/Redo + change-History deleting is reversible, and moves can be undone (#1023, #6478, docs/Features/Undo/Undo.md).
• Home board set a board that opens automatically after login (#2220).
• Add List moved from a standing column to a per-list header button (#6465).
• Denser default layout: thinner lists, board tiles and card dock; taller-looking minicards (#6465).
• Confirmation dialogs work again clicking any .js-confirm button (e.g. "Remove Member") did nothing because Popup.afterConfirm() stashed the pending action on the Blaze data context (#6479). Thanks to mueschel (report) and xet7.
• FerretDB (bundled) #6476 crash-loop root cause fixed, and label/title/date filters pushed down to SQLite (#6476).

[Package Updates]

[4.127.0]

• Update wekan to 10.04
• Full Changelog
• Safe filename handling everywhere: attachment and avatar names are always shown clean URL-decoded, normalized to generally-used characters, invisible/control/bidi characters removed and HTML/JS/XML markup stripped.
• CPU-usage monitor + governor + Admin Panel / Problems / CPU usage report: watch system-wide CPU, record only the START and END of each sustained high-CPU period with what WeKan/FerretDB were doing.
• Fix RedirectBleed: avatar localization validated only the original host and then followed redirects with native fetch, so a public avatar URL could 302 to a loopback/private/metadata address (SSRF).

[Package Updates]

[4.128.0]

• Update wekan to 10.08
• Full Changelog
• Verified that list widths on public boards (#5659) are fixed: uncustomized lists render the one shared default width for logged-out public-board visitors and members alike, board-wide widths apply to everyone, and anonymous viewers customize via localStorage. The listWidthDefaults.test.cjs regression test existed but was never wired into npm run test:unit:node, so it did not run; it is now wired in so the fix stays verified.
• Files admin report follow-up: made the filesReport helpers defensive so a throwing data helper can no longer blank the whole report, and corrected the v10.07 changelog claim the report still does not list its attachments in the Playwright test, which points at the attachmentsList publication returning no rows and is still under investigation.
• Fix: the Statistics board view never rendered. statsView.jade / .js / .css were not imported anywhere in the client build, so the statsView Blaze template was never registered switching a board to the Statistics view left the board canvas empty (the header still showed "Statistics", which only reflects the saved board view). The three files are now imported alongside the other board views, so the view renders its board counts and time summary.
• Fix: on phones the All Boards list grew to the full height of all its boards instead of staying a bounded, scrollable region, so boards below the fold were clipped by the surrounding overflow:hidden and could not be reached. Two leftover .board-list.mobile-view rules (min-height: 100vh and a phantom ::after) re-introduced the exact bug an earlier fix removed elsewhere; removing them lets the bounded height take effect and the two-column list scrolls.
• Files admin report (Admin Panel / Reports / Files): read the underlying reactive Attachments.collection instead of the ostrio FilesCollection wrapper, whose FilesCursor does not reliably re-run in a Blaze helper.
• Fix: force changeStreams out of the reactivity order for FerretDB on all platforms, not only the snap. FerretDB v1 does not implement MongoDB change streams, so a $changeStream aggregate returns "not implemented" and Meteor busy-loops retrying it (high FerretDB CPU, cards not opening). The snap fix already stripped changeStreams from METEOR_REACTIVITY_ORDER; the same strip is now applied to the remaining FerretDB run-paths the standalone FerretDB release start-wekan.sh, the FerretDB Docker image wekan-entrypoint.sh, and the Windows start-wekan.bat so changeStreams can never enter the order however it was passed in (OpLog + polling only). The Docker compose files already hardcode safe values, and the real-MongoDB start-wekan.sh / start-wekan.bat are unchanged (#6492, #6493, #6480).
• Fix: FerretDB high CPU and cards not opening FerretDB v1 does not implement MongoDB change streams, but the snap default reactivity order put changeStreams first, so Meteor issued $changeStream aggregates that FerretDB rejected thousands of times per second (a busy-loop pinning FerretDB CPU at 100-390% the "aggregate=" that dominated the operations summary and starving board/card loading so cards would not open). The snap now forces changeStreams out of the reactivity order for FerretDB (oplog + polling only); real MongoDB is unchanged (#6492, #6493, #6480).
• Fix: switching the board view now persists the setBoardView method did not await the profile write, so the client reloaded before it was saved (and a rejected write was invisible), making view switching (e.g. to the new Statistics view) unreliable; and All Boards on phones now lays the board icons out as a real 2-column CSS grid so at least 2 show per row, where the earlier float rule did not (#6488).

[Package Updates]

[4.129.0]

• Update wekan to 10.11
• Full Changelog
• Fix: FerretDB high CPU that continued even with no clients connected (#6498).
• Fix: on Sandstorm, the browser error that a page "can not be displayed embedded in another page" after a grain's first-launch data migration.
• The recovery maintenance page now works the same on ALL FerretDB v1 platforms (#6492).
• Fix: high FerretDB CPU (300%+, even idle) from a bloated or corrupt simulated OpLog (#6492).
• Safety measures against SQLite corruption/bloat (#6492).
• Automatic recovery/remediation for the SQLite text data, with an Admin Panel / Problems / Recovery report (#6492).
• While a data recovery is in progress, WeKan now shows a full-page maintenance spinner instead of errors or half-loaded data (#6492).
• Fix: on the phone All Boards layout, board titles were cut off the right edge and workspace names were hard-cut in the narrow menu.
• Fix: on phone-sized touch screens the All Boards page put the board icons BELOW the left menu and search bar.
• Fix: the Files admin report (Admin Panel / Reports / Files) was stuck on the loading spinner and never listed its files.

[Package Updates]

[4.130.0]

• Update wekan to 10.27
• Full Changelog
• Fix #6508: two crashes in the import "map users later" workflow in clicking a searched user and saving an imported user (commit)
• Fix #6507: on a fresh install the Admin panel would not open, the title bar sometimes failed to load or showed "You are not authorized to view this page" (commit)
• Fix boards that loaded their lists/columns but never their CARDS on FerretDB v1 (SQLite) (commit)
• Fix #6506: board import shows the "map members" step again, and unmapped members become virtual users instead of the importer (commit)
• ExportBleed: stored XSS in HTML board exports through a card-title second parse fixed by building the modal with DOM nodes (commit)
• Admin Panel / Problems "Status" overview + snap run wekan.problems (commit)
• FerretDB high CPU: run FerretDB standalone (no OpLog) by default (commit)
• Card links keep working after the card is moved to another board (commit)
• SpliceBleed: incomplete multi-character sanitization when stripping exploit markup from a filename fixed by applying removals repeatedly until the string stops changing (commit)
• Fix: cards not opening clicking a card did nothing (#6493) (commit)