Wekan - Package Updates

[Package Updates]

[4.131.0]

• Update wekan to 10.33
• Full Changelog
• Added anupamme of OrbisAI Security to Hall of Shame: Fake AI.
• List header card count is now scoped to the swimlane it is shown in, so a shared list no longer shows the whole-list count over an empty second swimlane (the "5 Cards" header above a swimlane with no cards). A shared list one whose swimlaneId is empty, the pre-per-swimlane-lists layout renders under every swimlane, but cardsCount() counted by the list's OWN swimlaneId (''), giving the whole-list total in every swimlane while the cards rendered below were correctly swimlane-scoped. It now takes the container swimlane id (the same ../../_id the card body already uses) and counts that swimlane's cards, matching what is rendered; list.cards() and the lazy (#6480) server count both already scope by that id, including first-swimlane shared/orphaned surfacing.
• Re-attach mouse drag-scrolling (dragscroll) when a board's swimlanes/lists render or change, so lower swimlanes stay reachable by dragging. @wekanteam/dragscroll attaches its mouse handlers per element in reset(), but the board's reset autorun only depended on the touch/permission reads not the swimlanes/lists so when they rendered AFTER onRendered (adaptive lazy card loading, the on-open data-repair adding a default swimlane, or a board switch that reuses the template instance without re-firing onRendered) the new .dragscroll containers never got mouse handlers: dragging no longer scrolled and, with the vertical scrollbar hidden, only the top swimlane was reachable (touch still worked via the document-delegated dragscrollTouch). The autorun now reads the board view + swimlanes + lists, so reset() re-runs and re-attaches when the rendered containers change.
• Fix #6512 for OAuth / OIDC logins: after "Login with Google" (or any redirect-style social login) the user is now sent to All Boards instead of being left on the sign-in route showing only the language selector until a manual reload. The earlier #6512 fix covered only the password/register flow (onSubmitHook); OAuth logins do not go through it, so a client Accounts.onLogin handler (fires for every login method after Meteor.userId() is set) now navigates home when still on an auth route guarded so an auto-login on a deep-linked board URL is not redirected away.
• [Fix #6511 and #6514 (and the v10.3010.31 Docker / Sandstorm / production "board maintenance spinner", missing top user/settings bar, and login-form-not-rendering reports): the whole client broke with Uncaught Error: ES Modules may not assign module.exports or exports.* followed by Error: No such template: swimlane / notifications / boardButtons.](https://github.com/wekan/wekan/commit/e62c77575297319cb967b031bafa91421424abe9)
• Snap: run the bundled FerretDB v1 against an EXTERNAL PostgreSQL / MySQL / SAP HANA server instead of the embedded SQLite backend. Two new snap settings snap set wekan wekan-ferretdb-handler=postgresql|mysql|hana and wekan-ferretdb-url= point FerretDB at a database you run; the default stays the zero-dependency sqlite backend, so existing installs are unchanged.
• Fix #6508 (follow-up): the board member popup now shows "Remap User" for an imported (placeholder) member. The action is gated on the member's authenticationMethod === 'imported', but the board publication shipped board members' user docs without authenticationMethod, so the field was undefined on the client and the action never appeared..
• Fix #6511: a board showed NO cards, with Error: Bad index in range.removeMember: 0 in the console. The card list is a Blaze {{#each}} over a LIMITED, ordered reactive cursor sorted by { sort: 1 }, which has TIES when several cards share the same sort value (or due date, etc.) their order is non-deterministic across observe/poll cycles, so Meteor's ordered diff computes an out-of-range index and the #each throws, rendering no cards (and cascading into the undefined.remove() teardown error). A unique _id tiebreaker is now appended to the card-list sort (client cursor and server window), making the order deterministic.
• Opening a card no longer takes ~40 seconds on FerretDB v1 (SQLite). A card's attachments are looked up with the dotted key {'meta.cardId': ...}, which the bundled FerretDB dropped from the WHERE (it skipped any dotted-path key), so it full-scanned the whole attachments collection with a per-row decode on every poll while a card was open slow card content and high idle CPU.
• Activity feed pushes down on FerretDB: the comment-only feed selected activities with a top-level $and, which FerretDB v1 (SQLite) does not push down, so the activities collection was full-scanned on every poll (slow board/card history on a big board). The scope and activityType are now at the top level exactly equivalent, and both push down to the index.

[Package Updates]

[4.132.0]

• Update wekan to 10.37
• Full Changelog
• Copying a board works again (POST /api/boards/:boardId/copy). swimlane.copy(), which runs on the server, called the SYNCHRONOUS getDefaultSwimline() on the source board to detect its default swimlane; for a board with no pickable swimlane that getter self-heals via a synchronous Swimlanes.upsert(), which Meteor 3 rejects on the server (update is not available on the server. Please use updateAsync() instead.), so the whole copy threw.
• Admin Panel Problems Summary now has a Repair button for "Broken cards N".
• Admin Panel Problems CPU usage now shows the CURRENT CPU usage between the page title and the Search box.
• Admin Panel Problems no longer shows a finished board-repair as still running, nor counts informational CPU rows as "new problems".
• "Map to existing user" for an imported (virtual) member now searches every user instead of listing only board members.
• Admin Panel report styles were never loaded, so every report's prev/next pagination button rendered with a black background.
• Six Meteor methods threw Did not check() all arguments during call to '<method>'
• Drag handles: the "Show desktop drag handles" toggle now works on touch screens, the card body pans the board when handles are on, the handle is finger-sized on touch, and tab order no longer jumps to invisible controls.
• Upgrading no longer grows a spurious "Restored Items" column full of cards that look empty but are not.
• Removed the cron migration subsystem: it never ran and had no UI, yet every logged-in client paid for it.