Wekan - Package Updates

[Package Updates]

[4.133.0]

• Update wekan to 10.40
• Full Changelog
• ZipBleed: arbitrary file write when restoring a backup archive (zip-slip). Thanks to xet7.
• GHSA-3gcg-g6rf-w2rx: an invalid authToken on a board export endpoint crashed the server. Thanks to laijunyue for the coordinated disclosure, and xet7.
• Multitenancy: one WeKan server for many domains, with Organizations as the tenants. Thanks to xet7.
• Clicking a card closes the one that was open, and keeping many open is a per-user setting. Thanks to mimZD and xet7.
• A subscription with no board id took the server down; it is answered, not fatal. Thanks to xet7.
• The right sidebar starts below the header, in both modes. Thanks to xet7.
• All Boards on a phone: the board list scrolls to its last board. Thanks to mimZD and xet7.
• The password field is back on the Sign In and Register pages. Thanks to xet7.
• A finished MongoDB FerretDB migration on Snap no longer leaves WeKan on 503. Upgrading from 6.09. Thanks to S0QR2 and xet7.
• Admin Panel / People / People showed nothing at all no table, no search box, no pager. Thanks to xet7.

[Package Updates]

[4.134.0]

• Update wekan to 10.41
• Full Changelog
• A removed DDP session no longer crashes the server on its 101st message. Thanks to bluetopaz1204, Nissulya and xet7.
• One icon set: Font Awesome, and the Grey Icons feature is removed. Thanks to xet7.
• "Run ALL tests" now runs all the tests, in build.sh and in build.bat. Thanks to xet7.

[Package Updates]

[4.135.0]

• Update wekan to 10.44
• Full Changelog
• Tests menu runs every database this CPU can, and checks they answer the same. Thanks to xet7.
• The database tests run on their own ports, beside whatever else is running. Thanks to xet7.
• A Docker Compose file for every FerretDB v1 backend, generated from one source. Thanks to xet7.
• Admin Panel reports show the whole instance, not the admin's own boards. Thanks to xet7.
• The admin lists paginate honestly: one page of ten rows, index-backed. Thanks to xet7.
• Every popup had 10px of empty space above it that nothing asked for. Thanks to xet7.
• The board bar centers its items, and the hamburger sits where its space middles. Thanks to xet7.
• Every upload threw in getFileStrategy, so no new file was mime-checked. Thanks to xet7.
• Migrated images show in the card view again. Thanks to S0QR2 and xet7.
• A test pins that a per-tenant admin sees no report data. Thanks to xet7.

[Package Updates]

[4.136.0]

• Update wekan to 10.51
• Full Changelog
• One release now publishes all three snaps: wekan, wekan-ondra and wekan-gantt-gpl. Thanks to xet7.
• The variant sync renames the snap in both snapcraft files, not just one. Thanks to xet7.
• The variant Docker images are published by hand, by retagging the released image. Thanks to xet7.
• A credential the release cannot read is not the Snap Store refusing it. Thanks to xet7.
• Every maintainer script in releases/ is now a menu entry in build.sh and build.bat. Thanks to xet7.
• Twelve one-line wrapper scripts became commands, and both menus gained a command line. Thanks to xet7.
• The Windows zip was never broken: a matched file was reported as missing, because of SIGPIPE. Thanks to xet7.
• The card-drag test measured the board's edge auto-scroll, which is a feature. Thanks to xet7.
• Release jobs now say what actually failed: no snap, no evidence hidden, no wrong secret blamed. Thanks to xet7.

[Package Updates]

[4.137.0]

• Update wekan to 10.53
• Full Changelog

[Package Updates]

[4.138.0]

• Update wekan to 10.56
• Full Changelog
• Every Linux platform FerretDB builds for is built, with a Node.js to match. Thanks to xet7.
• It builds again on every architecture that has no MongoDB server. Thanks to xet7.
• The left menu fits its column on a phone instead of lying over the boards. Thanks to xet7.
• The board counts line up in one column. Thanks to xet7.
• A remote snap build that never starts now says why it did not. Thanks to xet7.

[Package Updates]

[4.139.0]

• Update wekan to 10.57
• Full Changelog
• Import downloads validate every redirect hop instead of only the URL they were given. Thanks to RandomGenerator and xet7.
• IPv6 addresses are classified by their bytes, not by how they are spelled. Thanks to tonghuaroot and xet7.
• The Sandstorm bridge guard reads the page at the path it moved to. Thanks to xet7.
• Every platform page sits under what it is - an OS, container, cloud, hardware or package. Thanks to xet7.
• The links follow the move, including the ones inside the pages that moved. Thanks to xet7.
• Doc links written from the repository root resolve from the page holding them. Thanks to xet7.
• Platform logos are stored beside their page instead of fetched from another host. Thanks to xet7.
• Packager.io and Zenith Hosting have a page of their own. Thanks to xet7.
• The Zenith Hosting page reads as prose instead of a two-item list. Thanks to xet7.

[Package Updates]

[4.140.0]

• Update wekan to 10.67
• Full Changelog
• Docker images for linux/386 and linux/arm/v7, on a Debian base with Node from the fork. Thanks to xet7.
• The Docker image drops linux/arm/v7 too, which its Dockerfile has no Node 24 to install for. Thanks to xet7.
• A loong64 with no base image is skipped, not failed, so it stops skipping the Docker image build. Thanks to xet7.
• The Docker image drops linux/386, which its ubuntu:26.04 base cannot provide. Thanks to xet7.
• The Launchpad snap builds flatten history first, so the push to git.launchpad.net stops timing out. Thanks to xet7.
• Every native bundle ships a named, checksummed Node.js and FerretDB instead of the runner's node. Thanks to xet7.
• The base amd64/arm64 bundles are attached loudly and verified, not silently by softprops. Thanks to xet7.
• The release job checks out before downloading the bundles, so the checkout stops deleting them. Thanks to xet7.
• An admin report opened by its URL keeps the subscription its own count re-render used to cancel. Thanks to xet7.
• The release notes pass the CHANGELOG through the environment instead of inline into the shell. Thanks to xet7.

[Package Updates]

[4.141.0]

• Update wekan to 10.70
• Full Changelog

[Package Updates]

[4.142.0]

• Update wekan to 10.71
• Full Changelog

[Package Updates]

[4.143.0]

• Update wekan to 10.73
• Full Changelog
• PatternBleed: a string replacement that replaced a hyphen with itself, and a guard for the whole class. Thanks to GitHub CodeQL code scanning and xet7.
• Groups may live in their own subtree, not only under the user base. Thanks to leandro-cyberproject and xet7.

[Package Updates]

[4.144.0]

• Update wekan to 10.74
• Full Changelog
• PathBleed: an avatar could name any file on disk, and board export read it. Thanks to Alpastx and xet7.
• RevokeBleed: revoking an org, team or domain share did not revoke it. Thanks to Alpastx and xet7.
• ParentBleed: one card id bridged a private board into another board's feed. Thanks to Alpastx and xet7.
• CommentBleed: the REST API let any board member delete anyone's comment. Thanks to Alpastx and xet7.
• Canary tokens record who tried to override permissions, and from where. Thanks to xet7.
• The database marks the operations WeKan never issues, so an operator sees them. Thanks to xet7.
• A daily paced check of every stored file's name, date and four hashes. Thanks to xet7.
• React as yourself, not as somebody else. Thanks to xet7.
• Fix the two bugs the Database problems page was reporting. Thanks to xet7.
• Security tests say which vulnerability they guard, and the list is checked. Thanks to xet7.

[Package Updates]

[4.145.0]

• Update wekan to 10.78
• Full Changelog
• Build the other two architectures an AppImage runtime exists for. Thanks to xet7.
• Attach full build provenance at every site that pushes an image. Thanks to xet7.
• libcurl4 does not exist on armhf, so name the package noble ships. Thanks to xet7.
• Three good snaps were reported as FAILED by the step that saves their logs. Thanks to xet7.
• Every row appeared twice, amd64 appeared not at all, and six platforms said "latest". Thanks to xet7.
• Attach the built AppImages to the release again. Thanks to xet7.
• Flatpak: attach the bundles to the release, and only the bundles. Thanks to xet7.
• Pin that every bundled binary is fetched as the newest one. Thanks to xet7.
• Release every snap, every architecture, to all four channels. Thanks to xet7.
• Say which six architectures are snaps, and why i386 and armv7 are not. Thanks to xet7.

[Package Updates]

[4.146.0]

• Update wekan to 10.81
• Full Changelog
• Connect with directConnection=true, so a fresh docker compose up starts. Thanks to Dandrass and xet7.
• The board list scrolls to its last board, the Table view scrolls at all, and the tiles are their own size. Thanks to mimZD and xet7.
• The retired Mac runner, the jobs a cancellation skipped, and the armv6 userland. Thanks to xet7.
• An optional part was ending every Launchpad build. Thanks to xet7.
• Report the releases the chart index is missing, and repair its duplicates. Thanks to xet7.
• The chart-index report is a Release menu entry in build.sh and build.bat. Thanks to xet7.
• Version is one table with combined category rows, over two 50% columns. Thanks to xet7.
• Problems / Filesystem integrity showed a blank page. Thanks to xet7.
• A database this snap cannot read stops and says so, instead of serving 502 forever. Thanks to Philippe-Bentegeac, JDeepix, imlit and xet7.
• Build a win-arm64 bundle. Thanks to xet7.