Wekan - Package Updates

[Package Updates]

[4.199.0]

• Update wekan to 12.46
• Full Changelog
• SQRL's sqrlonly and hardlock lock an account to SQRL. Thanks to xet7.
• Windows single sign-on with Kerberos or NTLM. Thanks to nikalasmd and xet7.
• WeKan's changes are written back to GitLab. Thanks to gotjoshua and xet7.
• Planka, Microsoft To Do, KanbanFlow, Basecamp, Google Tasks and Google Keep import from their APIs. Thanks to xet7.
• Channels are the cards with a conversation on every board, with unread counts. Thanks to xet7.
• Batch undo and redo of a large sprint is 2.6 times faster. Thanks to xet7.
• Two changes saved at the same moment no longer fork a board's History chain. Thanks to xet7.
• The email view renders its subjects and previews as Markdown. Thanks to xet7.
• Version Control, the activity feed and the email list render titles as Markdown. Thanks to xet7.
• The activity feed names the checklist, item, lists and people it is about. Thanks to xet7.

[Package Updates]

[4.200.0]

• Update wekan to 12.48
• Full Changelog
• Assigned-only members get only their own cards' files and document text. Thanks to crypto-nidh and xet7.
• No expressions in scripts, every action pinned, and write access only where it is used. Thanks to Qlty and xet7.
• The Windows bundles build again: release scripts read their files as UTF-8. Thanks to xet7.
• The NetBSD bundle builds again: node-gyp finds pkgsrc's Python. Thanks to xet7.
• It imports new users again and keeps the sync interval it is given. Thanks to tromlet and xet7.
• Caddyfile examples are Caddy 2, and Caddy proxies to where WeKan listens. Thanks to Group-Deed and xet7.
• List Sync works from a Sandstorm grain. Thanks to xet7.
• The import brings closed sprints, rebuilt from the issues. Thanks to xet7.
• Jira, Deck, OpenProject, Asana and GitLab imports bring their attachment files. Thanks to xet7.
• A sync interval in milliseconds no longer stops WeKan. Thanks to B2RN, tromlet and xet7.

[Package Updates]

[4.201.0]

• Update wekan to 12.49
• Full Changelog
• Board role permissions apply to every board view and every path to a card. Thanks to crypto-nidh, binary-lover and xet7.
• Board roles: how a role applies to every board view, the API and every write. Thanks to xet7.
• Custom roles from the Admin Panel apply in every board view as built-in roles do, verified for every combination. Thanks to xet7.

[Package Updates]

[4.202.0]

• Update wekan to 12.52
• Full Changelog
• Release builds - the Android, musl and single-file builds of v12.51, and the guards of the dependency updates.
• The guards follow freebsd-vm 1.5.9 and qrcode-generator 2.0.4. Thanks to dependabot and xet7.
• Android bundles: the checkout belongs to Termux's user, so npm may chmod. Thanks to xet7.
• musl bundles carry libstdc++ and libgcc_s, so their Node.js starts on a bare Alpine. Thanks to xet7.
• Single files: a Node.js that LIEF cannot inject is skipped with the reason, not failed. Thanks to xet7.
• A due date typed at the end of a card title becomes its due date. Thanks to xet7.
• Similar cards and possible duplicates while adding a card and on the opened card. Thanks to xet7.
• Rules suggests rules from what people keep doing by hand. Thanks to xet7.
• Board menu: Summary, what each person did in the last day or week. Thanks to xet7.
• The web login no longer tells by its response time whether a username exists. Thanks to xet7.

[Package Updates]

[4.203.0]

• Update wekan to 12.55
• Full Changelog
• A 32-bit ARM single file's blob is injected in a 64-bit process. Thanks to xet7.
• Each musl AppImage is built once, and every AppImage job has its own name. Thanks to xet7.
• Android bundles preload termux-exec, so bcrypt's install script runs. Thanks to xet7.
• A single file's --build-sea is tried again when it runs out of memory. Thanks to xet7.
• musl bundles carry every library their Node.js needs, libatomic too. Thanks to xet7.
• Moving a card with an outgoing webhook is no HookBleed and keeps the mover's account. Thanks to do4me and xet7.

[Package Updates]

[4.203.1]

• Update wekan to 12.56
• Full Changelog
• Inactive accounts can be disabled; LDAP sync honours its search filter; everyone's Last active is shown. Thanks to Raymond-Voogt and xet7.
• #6783: Admin Panel / People showed "Last active" as "-" for every user but the administrator, because the people publication did not carry lastConnectionDate. The table's own row projection left it out too, which the UI test found (the table's half).
• #6784: USERS_DISABLE_INACTIVE_AFTER_DAYS disables, once a night, accounts unused for that many days, and revokes their logins.
• #6785: LDAP background sync looked users up without LDAP_USER_SEARCH_FILTER. An account the filter excludes, such as one disabled in Active Directory, could not log in but was still found: it was never disabled, and a manual disable was undone on the next sync. The filter is now part of the lookup, and an account disabled for inactivity is not re-enabled by the sync.
• A checked checkbox shows a check mark in right-to-left languages too. Thanks to mimZD and xet7.
• #6786: the tick is a box rotated 40 degrees and drawn by its bottom and side borders. The side was border-inline-end, which a right-to-left page puts on the left, so the tick opened the other way. All 25 rules that draw a tick now use border-right.
• Restored list swimlanes stay restored after a WeKan upgrade. Thanks to mimZD and xet7.
• #6787: after every new release, the startup upgrade's merge-per-swimlane-lists step, written for v7.98-era damage, un-bound every list on a board with two lists of one title, the lists "Lists missing their swimlane" -> Restore had bound included. So the count came back the same after each upgrade. A list bound to the swimlane it was created in, with all its cards there, is now left alone. Press Restore once more after upgrading.

[Package Updates]

[4.204.0]

• Update wekan to 12.57
• Full Changelog
• Attachment retention: delete card attachments after N days, purge deleted ones after M days. Thanks to Raymond-Voogt and xet7.
• Backup status: every run recorded, failures and overdue backups shown, old backups pruned. Thanks to Raymond-Voogt and xet7.
• The newest features' settings are on every release platform and in the Admin Panel. Thanks to xet7.
• Adding a board member by email works in any letter case, and search finds colleagues past five matches. Thanks to Raymond-Voogt and xet7.
• History rows are hashed as stored, so an unset value is not tampering. Thanks to xet7.
• FileNameBleed: a percent-encoded name is not an exploit, and opening a file is not an upload. Thanks to xet7.
• A clean file-integrity scan is no longer a StorageBleed event. Thanks to xet7.
• Locations from Cloudflare keep their letters: Dinkelsbhl, not Dinkelsbhl. Thanks to xet7.
• Bun bundles wait for their smoke-test MongoDB, and replace a lost one. Thanks to xet7.
• Launchpad snaps retry an outage there for longer, not three strikes. Thanks to xet7.

[Package Updates]

[4.204.1]

• Update base | final to 6.0.1
• security: fix eMudhra cert compromise

[Package Updates]

[4.205.0]

• Update wekan to 12.58
• Full Changelog
• The invite-by-email test escapes the address completely, and a partial escape is found anywhere. Thanks to GitHub CodeQL and xet7.
• Board menu / Save as Template turns an existing board into a board template. Thanks to xet7.
• A Jira export of hundreds of issues imports, and a file too large says so. Thanks to xet7.
• Comments stay with a card moved to another board, and do not reappear only when it moves back. Thanks to fabiosalles and xet7.

[Package Updates]

[4.206.0]

• Update wekan to 12.63
• Full Changelog
• Copying or linking a card carries only the custom field values of its new board. Thanks to Raymond-Voogt and xet7.
• A decluttered opened card, a compact attachment list, and Card Settings that fits the screen. Thanks to mueschel and xet7.
• A list move with no swimlane no longer fails its own history checksum. Thanks to Raymond-Voogt and xet7.
• An ordinary refused edit on one's own board no longer disables the account. Thanks to Raymond-Voogt and xet7.
• A MongoDB pod restarting is a lost connection, not a critical crash. Thanks to Raymond-Voogt and xet7.
• List sort indexes are made from key objects, so they are no longer re-created at every start. Thanks to Raymond-Voogt and xet7.
• A lost database connection inside a validation error is a connection problem, not a schema bug. Thanks to Raymond-Voogt and xet7.
• sanitize-html 2.18.1: nested iframes no longer crash imports and exports, or lock out who ran them. Thanks to xet7.
• A failed import or export disables an account only when it was an attempt. Thanks to xet7.
• The dynamic-import and meteor shell keys come from the crypto RNG. Thanks to GitHub CodeQL and xet7.

[Package Updates]

[4.207.0]

• Update wekan to 12.64
• Full Changelog
• The .spk leaves out every login method but Sandstorm's, and FerretDB's other database handlers. Thanks to xet7.
• Every platform runs the prebuilt SQLite-only ferretdb-sqlite binary from wekan/FerretDB. Thanks to xet7.
• A database speed test: the common WeKan queries on every database, twice a production WeKan of data. Thanks to xet7.
• The page reads only the ids and members of the boards it may show. Thanks to xet7.
• Its compose file starts with the current DocumentDB image. Thanks to xet7.
• Collection2 is loaded before the models, so every write is cleaned and given its defaults. Thanks to xet7.
• The Sandstorm package-import guard escapes the whole package name in its pattern. Thanks to xet7.

[Package Updates]

[4.208.0]

• Update wekan to 12.65
• Full Changelog
• The speed test report escapes a backslash before the pipe in a table cell. Thanks to GitHub CodeQL and xet7.
• An opened card shows only the fields it has data in, and + Add under the cover adds the rest. Thanks to xet7.
• A new drawing from Add Card and Add attachment, on the whole window, saved as SVG. Thanks to mimZD and xet7.
• A lasso selects lines to move, resize, group and ungroup, and to change their layer. Thanks to mimZD and xet7.
• SVG is uploaded and shown as an image: an attachment, a cover, a board background, an avatar. Thanks to xet7.
• An SVG of any size is sanitized whole, streaming, on upload, on validation and when served. Thanks to xet7.
• A checked checkbox sits on its own square, not beside it. Thanks to mimZD and xet7.
• Resizing a list follows the pointer instead of moving the other way. Thanks to mimZD and xet7.
• A notification that is not delivered says which check failed. Thanks to xet7.
• @azure/msal-node 6.0.1 7.1.1 by an npm override, for GHSA-xcx6-jx8p-x3h5. Thanks to xet7.

[Package Updates]

[4.209.0]

• Update wekan to 12.66
• Full Changelog
• An attachment upload is authorized: signed in, and allowed to edit the card or write the board. Thanks to xet7.
• Nothing inserted on one's own card can carry another board's id or checklist. Thanks to xet7.
• Siblings of six fixed vulnerabilities closed; every earlier fix is still in place. Thanks to xet7.
• A 304 Not Modified no longer replaces a stored file's own Content-Security-Policy. Thanks to xet7.
• Show when empty: the fields every card of the board shows even while they are empty. Thanks to jullbo and xet7.

[Package Updates]

[4.210.0]

• Update wekan to 12.67
• Full Changelog
• The form closes after the card is added, unless Member Settings keeps it open. Thanks to brlin-tw and xet7.
• The container that installs their Node.js gets .tools/tmp as its /tmp again. Thanks to xet7.
• start-wekan.sh starts WeKan again where there is no /proc. Thanks to xet7.
• meteor-spk is assembled where the .spk is packed from, in .tools. Thanks to xet7.
• A copy of the source tree without .git gets its own .tools/tmp. Thanks to xet7.
• The smoke-test MongoDB starts on a 6.19+ kernel, and Chromium is found. Thanks to xet7.
• Its guard pins mongo:9.0.4, not the mongo:8 that stopped starting. Thanks to xet7.
• WeKan vs Trello vs Jira says when WeKan added each feature it listed as missing. Thanks to xet7.

[Package Updates]

[4.211.0]

• Update wekan to 12.72
• Full Changelog
• A card link can no longer launch an operating-system handler with a code-execution history, such as ms-msdt (Follina) or telnet, even if an administrator lists it, and an attempt to write one shows in Admin Panel Problems. The Apache guide follows the 2024 Confusion Attacks, and the Sandstorm store build publishes to both app markets.
• ImportPlacementBleed is fixed: an import is placed only on its own board. Invite via Email adds the invited new user again, instead of the first user of the database. The OpenBSD bundle starts again, and History works on FerretDB: date custom field changes are recorded there, and the database migration says when documents did not arrive.
• All changes in v12.69
• Card Settings, in Board Settings / Card, becomes two panes of checklists - the minicard's and the card's - with a checkbox per section and the board's custom fields as items, and the opened card and the minicard follow its sections and order; every opened card shows every field its board allows, empty or not. WeKan moves to Meteor 3.6-rc.1, keeping its own security additions to Meteor's packages. Data health in Admin Panel / Problems can now clean up custom fields whose boards were all deleted, and empty fields no longer show Scrum sections on boards that have Scrum turned off.
• More details at ChangeLog

[Package Updates]

[4.212.0]

• Update wekan to 12.75
• Full Changelog
• Changing a password signs the account out in every other browser, and now a test proves it in two real browsers.
• All changes in v12.75
• CHANGELOG.md is now short: the In short of the upcoming release and of the five newest releases, in plain Markdown. The status and every change of each release are in CHANGELOG-big.md, which is the one that is written. CodeQL alert #598 in the Sandstorm host test is fixed, and the release script pulls before releasing, so a moved main no longer stops it.
• All changes in v12.73

[Package Updates]

[4.213.0]

• Update wekan to 12.77
• Full Changelog
• Two node test guards follow the movable popups and the date picker of v12.76.
• All changes in v12.77
• Security features: a password policy with an optional breached-password check, Admin Panel / Problems / Password length, compulsory two-factor authentication, sign-out of idle sessions and of every session after a password change, an audit log of what administrators did, HSTS, a cross-site request guard, and S3 encryption at rest.
• Sign-up works again; the date picker has Today, the whole card title edits and every popup can be moved; and an old Sandstorm grain migrated from MongoDB 3 shows its boards again.
• All changes in v12.76