Wekan - Package Updates

[Package Updates]

[4.153.0]

• Update wekan to 11.02
• Full Changelog
• Release metadata advances to v11.02. Thanks to xet7.
• The Delete settings pane appears above Notifications. Thanks to xet7.
• Recovery audits permanent-delete changes and board purges. Thanks to xet7.
• Permanent delete acts on selected archived boards. Thanks to xet7.
• Every named section can select all or none of its visible boards. Thanks to xet7.
• The permanent-delete checkbox stays checked after saving. Thanks to xet7.
• RouteBleed: route coverage compares exact text instead of an incompletely escaped pattern. Thanks to GitHub CodeQL code scanning and xet7.
• Saving an inline title edit renames its minicard again. Thanks to Heart1010 and xet7.
• Saved card dates can be changed and deleted again. Thanks to Alishara and xet7.
• Repeated source text reuses unambiguous translation memory from the same language. Thanks to xet7.

[Package Updates]

[4.154.0]

• Update wekan to 11.05
• Full Changelog
• Cards with saved dates open and remain editable. Thanks to ClemStrummer and xet7.
• Launchpad waits for release bundles and keeps validated snaps. Thanks to xet7.
• Offices groups login addresses by person with locations and counts. Thanks to xet7.
• Offices shows available initials instead of empty avatar circles. Thanks to xet7.
• People shows country login counters with city and address details. Thanks to xet7.
• Problems pagination keeps each pane's state separate. Thanks to xet7.
• Existing boards keep default-on opened-card custom fields. Thanks to xet7.
• Linked card content is editable from either board. Thanks to hever and xet7.
• Cross-board card links are created and their dialog closes. Thanks to ClemStrummer and xet7.
• Linked cards mirror every visible field from their source. Thanks to xet7.

[Package Updates]

[4.155.0]

• Update wekan to 11.06
• Full Changelog
• It offers board-wide lists in every swimlane and logs moves through reactive cache gaps. Thanks to mimZD, rmb82 and xet7.
• Its label picker falls back to the visible card board. Thanks to ClemStrummer and xet7.
• Adding a label through a linked card updates its source. Thanks to xet7.
• Requested By and Assigned By use an icon instead of Add text. Thanks to xet7.
• They normalize displayName values to text before saving the full name. Thanks to Nissulya and xet7.
• Regression suites follow accessible Add icons and Card-wrapped dates. Thanks to xet7.

[Package Updates]

[4.156.0]

• Update wekan to 11.07
• Full Changelog
• Organization and Team DDP writes require a site administrator. Thanks to Char0n1507 and xet7.
• REST mutations enforce the canonical board write capability. Thanks to Char0n1507 and xet7.
• ICS imports require the canonical board write capability. Thanks to Char0n1507 and xet7.
• Opening Activities shows the complete card history and REST returns every comment. Thanks to rmb82 and xet7.
• Move and Copy Card offer board-global lists in every swimlane. Thanks to rmb82 and xet7.
• Queued riscv64 snap builds survive the GitHub job limit. Thanks to xet7.

[Package Updates]

[4.157.0]

• Update wekan to 11.08
• Full Changelog
• Checklist mutations require board write access. Thanks to Char0n1507 and xet7.
• Every REST mutation follows its canonical board-role capability. Thanks to senti-man and xet7.
• Card and checklist creation requires board write access. Thanks to Char0n1507 and xet7.
• REST board creation cannot choose another owner. Thanks to Char0n1507 and xet7.
• Administrator-created login tokens require an audited reason. Thanks to Char0n1507 and xet7.
• REST failures return sanitized errors and correct HTTP statuses. Thanks to Char0n1507 and xet7.
• @aws-sdk/client-s3 3.1113.0 3.1114.0 the Amazon S3 client.
• @aws-sdk/lib-storage 3.1109.0 3.1114.0 managed multipart uploads to S3.
• @google-cloud/storage 7.22.0 8.0.1 Google Cloud Storage integration.
• dompurify 3.4.13 3.4.14 HTML sanitization in the browser.

[Package Updates]

[4.158.0]

• Update wekan to 11.13
• Full Changelog
• UserSearchBleed and MiniProfileBleed allowed logged-out profile enumeration and let any authenticated user retrieve instance-wide email, administrator, account-state and organization metadata.
• PositionHistoryBleed trusted a client-created history entry's previous board.
• SubtaskExportBleed allowed a card from a private board to appear in another board's JSON, ZIP, Excel or PDF export when its parent identifier named a card there.
• CasBleed allowed a validated CAS username to receive the session of an existing password or other non-CAS account with the same name.
• Its column headers sort rows in either direction. Thanks to rmb82 and xet7.
• It optionally groups cards under swimlane sections. Thanks to rmb82 and xet7.
• Date and add-member Rules save without schema errors. Thanks to rmb82 and xet7.
• They close when another client removes or relocates the card. Thanks to rptl and xet7.
• French notification delivery is confirmed against the recipient-language fix. Thanks to Sophalso and xet7.
• Search Back returns directly to the card wall. Thanks to 1ubuntuuser and xet7.

[Package Updates]

[4.159.0]

• Update wekan to 11.15
• Full Changelog
• Whitelisted token claims cannot overwrite service-owned fields. Thanks to crypto-nidh and xet7.
• Logged-out clients cannot subscribe to authentication metadata. Thanks to crypto-nidh and xet7.
• Recovery and verification DDP calls are rate-limited. Thanks to crypto-nidh and xet7.
• Move Card keeps newly created destination boards selectable. Thanks to rlach and xet7.
• Side gutters remain visible and date editors open centered without horizontal scrolling. Thanks to Alishara and xet7.

[Package Updates]

[4.160.0]

• Update wekan to 11.16
• Full Changelog
• Search pagination sessions cannot be reused across users. Thanks to crypto-nidh and xet7.
• The 32-bit AppImages pass the right startup checks. Thanks to xet7.
• Rebuilt 32-bit AppImages also protect older release bundles. Thanks to xet7.
• The full release publishes its AppImages automatically. Thanks to xet7.
• Opened cards apply their side gutters to the visible content. Thanks to rmb82 and xet7.

[Package Updates]

[4.161.0]

• Update wekan to 11.28
• Notification activity text remains text in HTML email. Thanks to binary-lover and xet7.
• Persistent resume tokens are unavailable to browser scripts. Thanks to binary-lover and xet7.
• Global search cannot execute untrusted selectors or cross board boundaries. Thanks to crypto-nidh and xet7.
• Free FerretDB ports before the Windows EXE smoke test. Thanks to xet7.
• Windows gets a portable single-file WeKan. Thanks to xet7.
• Persistent login survives page refreshes with FerretDB. Thanks to majo1989 and xet7.
• Rules cannot write cards into inaccessible private boards. Thanks to crypto-nidh and xet7.
• Avatar MIME metadata cannot serve browser-executable content. Thanks to crypto-nidh and xet7.
• Read-only members cannot create default swimlanes. Thanks to crypto-nidh and xet7.
• Save the title from the submitted top or bottom composer. Thanks to xet7.

[Package Updates]

[4.162.0]

• Update wekan to 11.36
• Full Changelog
• Snap database comparison no longer executes a host timeout command. Thanks to xet7.
• Disabled comparison and unset polling values no longer stop Snap startup. Thanks to xet7.
• Snap problem reports use the database URL of the running services. Thanks to xet7.
• Snap services recover abandoned endpoint locks. Thanks to xet7.
• Version tests compare generated text without incomplete escaping. Thanks to xet7.
• Windows PDF and Snap release builds stay portable. Thanks to xet7.
• The Version pane reads one published component manifest. Thanks to xet7.
• Private-board sessions survive page refreshes. Thanks to lucasarrudadev and xet7.
• Custom fields stay deselected on FerretDB. Thanks to Heart1010 and xet7.
• Release builds keep every scheduled artifact path healthy. Thanks to xet7.

[Package Updates]

[4.163.0]

• Update wekan to 11.39
• Full Changelog
• Muted boards no longer send assignment or other activity notifications. Thanks to Nissulya and xet7.
• Cards stay in real swimlanes and view changes no longer snap back. Thanks to hmeunier95 and xet7.
• Language, full name and initials persist immediately. Thanks to mzch and xet7.
• An uploaded avatar remains selected. Thanks to hmeunier95 and xet7.
• Calendar and Gantt switch without reloading the application. Thanks to hmeunier95 and xet7.
• Google login examples map usernames from email. Thanks to xet7.
• Packaged startup no longer guesses network endpoints. Thanks to xet7.

[Package Updates]

[4.164.0]

• Update wekan to 11.43
• Full Changelog
• Configure Nodemailer services in the Admin Panel. Thanks to xet7.
• Persist and browser-test the Admin Panel email settings. Thanks to xet7.
• Persistent login-token lookup works through nested arrays. Thanks to jeremy-arsia and xet7.
• Attachment content is fail-closed on every storage path. Thanks to avrlab233 and xet7.
• The chosen board order takes effect immediately and remains selected. Thanks to jullbo and xet7.
• Effectively unlimited sorted queries no longer reserve gigabytes up front. Thanks to jeremy-arsia, Heart1010 and xet7.
• Board content follows view changes and cards stay in their containing swimlane. Thanks to hmeunier95 and xet7.
• Destroyed swimlanes no longer initialize deferred drag-and-drop. Thanks to xet7.

[Package Updates]

[4.165.0]

• Update wekan to 11.47
• Full Changelog
• DOCX, XLSX and PPTX attachments open in a guarded viewer. Thanks to yukiyokotani and xet7.
• Meteor 3.5.2-beta.0 3.5.2-rc.0 advances the framework and its accounts, Babel, DDP, ECMAScript, minifier, MongoDB, npm-mongo, Rspack, tools-core and TypeScript packages to their release candidates, and updates @meteorjs/rspack to 2.2.0-beta.1. Thanks to Meteor developers and xet7.
• qs 6.15.3 6.16.0 query-string parsing and serialization in the browser-side Node compatibility stubs. The update enforces array limits on comma groups, preserves cycle detection for empty arrays with own properties, safely handles non-callable buffer constructors and corrects filtered dates and encoded top-level dotted keys.
• Express and body-parser use qs 6.16.0 a scoped override moves Rspack's development-server dependency tree past GHSA-x5fp-wj9c-mxmx and GHSA-4mjr-xmp4-gh2g. Thanks to xet7.
• Fedora Asahi gains a dedicated ARM64 KVM test environment. Thanks to xet7.
• Ubuntu Asahi gains the same isolated KVM workflow. Thanks to xet7.
• The required SCRAM-SHA-1 digest keeps its scoped CodeQL exception. Thanks to GitHub CodeQL and xet7.
• Update dependencies and complete the Go 1.27 migration. Thanks to dependabot and xet7.
• Refresh the MongoDB v2 driver and gRPC dependencies. Thanks to dependabot and xet7.
• Build current upstream master with newest Go and dependencies. Thanks to xet7.