In short On an iPad the opened card covers the header bar instead of sitting behind it, and the speed test measures where the time goes when a WeKan board is opened, on FerretDB and on MongoDB. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short The database speed test has a new small-scale result, ordered from fastest to slowest with how many times slower each database is, and two more databases: pgrust (PostgreSQL in Rust) and TiDB. Noria, YugabyteDB and CockroachDB were looked at and cannot be used, for reasons the README gives. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short A missing REST checklist answers a JSON 404 instead of an empty 500. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short A GitHub CodeQL finding in a test is fixed, and the guard against replacing text with itself now also sees patterns with a ^ or $ anchor. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short The login page can have its own background color, Member Settings has a per-member switch, Show focus outline, to hide the blue focus ring, and Escape closes the add-list composer. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short Keyboard shortcuts run once on a non-Latin keyboard: d no longer opens the Due date popup and closes it again on a Farsi layout. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short Every board theme and every color a member chooses is readable: the dark themes' Card Settings, popups and sidebars, the header of eight themes, and a custom accent, text or label color made legible. A padded REST label name no longer creates a second label. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short A REST API "get one" that finds nothing answers 404 instead of 200 with an empty body. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short The daily notification cleanup and the file integrity audit run once for the whole installation, not once per server. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short The findings of the accessibility audit are fixed in the default theme: header and label colour contrast, names that contain the visible text, named form fields, card section headings that are real buttons, and landmarks and headings on every page. axe-core now finds no violation on 22 pages. A cleared database connection pool is reported as a lost connection. Thanks to above GitHub users…
In short GitHub code scanning's code-quality findings are fixed: a promise formatted as text, undeclared globals, an upload that hung on an unreadable file, and the lint around them. npm run lint:promises now finds promises that are not awaited or handled. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short A card moved to another board, restored from the archive or given a number no longer takes a card number another card on that board has. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short An LDAP login with a reused login name no longer opens the previous owner's account, and existing accounts record their directory identifier. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short The database health probe reports a finding once, not once per server. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short minimatch is updated to 11.0.4 for GHSA-g3hv-75wg-m249, a glob pattern that used up CPU and memory. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short A cluster of servers runs the schema re-check and the due-date reminders once, and a slow-query warning says which query it is. The site announcement shows on Home and All Boards too. The date picker popup shows the year and has year, month and day drop-downs under the calendar. The macOS sandbox for VSCodium no longer asks for a keychain, starts from the checkout, and can carry a Claude…
In short CrossBoardExportBleed and UnassignedAttachBleed are fixed: a checklist scope stays on its board, every export obeys Disable all export and Anonymize export users, and an assigned-only member changes attachments only on their own cards. SAML logins use node-saml 5.2.0, and continuous backup no longer misses a change made right after it starts. Keyboard shortcuts keep working after a popup…
In short Two node test guards follow the movable popups and the date picker of v12.76. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short Security features: a password policy with an optional breached-password check, Admin Panel / Problems / Password length, compulsory two-factor authentication, sign-out of idle sessions and of every session after a password change, an audit log of what administrators did, HSTS, a cross-site request guard, and S3 encryption at rest. Sign-up works again; the date picker has Today, the whole…
In short Changing a password signs the account out in every other browser, and now a test proves it in two real browsers. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short Caddy and FerretDB, the Go servers WeKan ships, no longer open MPTCP listeners, which Linux kernel bug CVE-2026-98432 is reachable through. The real fix is a patched host kernel. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short CHANGELOG.md is now short: the In short of the upcoming release and of the five newest releases, in plain Markdown. The status and every change of each release are in CHANGELOG-big.md, which is the one that is written. CodeQL alert #598 in the Sandstorm host test is fixed, and the release script pulls before releasing, so a moved main no longer stops it. Thanks to above GitHub users for t…
In short The Sandstorm build installs Sandstorm from install.sandstorm.org, as the Sandstorm workflows already did, and the docs link sandstorm.org. The Hall of Fame guards read every vulnerability name now that each one links to its own page. Thanks to above GitHub users for their contributions. More details at ChangeLog
In short A card link can no longer launch an operating-system handler with a code-execution history, such as ms-msdt (Follina) or telnet, even if an administrator lists it, and an attempt to write one shows in Admin Panel → Problems. The Apache guide follows the 2024 Confusion Attacks, and the Sandstorm store build publishes to both app markets. Thanks to above GitHub users for their contributions…
In short The AppImages and the Launchpad snaps build again: their FerretDB and mongo-tools are readable by every user, and the snap source carries what its downloads need. Continuous backup names a changed encrypted file as changed with OpenSSL 4, and the release and test tooling runs on macOS and reports a bad certificate as one. Thanks to above GitHub users for their contributions. More details…
In short ImportPlacementBleed is fixed: an import is placed only on its own board. Invite via Email adds the invited new user again, instead of the first user of the database. The OpenBSD bundle starts again, and History works on FerretDB: date custom field changes are recorded there, and the database migration says when documents did not arrive. Security An import into a board is placed only besi…
In short Card Settings, in Board Settings / Card, becomes two panes of checklists - the minicard's and the card's - with a checkbox per section and the board's custom fields as items, and the opened card and the minicard follow its sections and order; every opened card shows every field its board allows, empty or not. WeKan moves to Meteor 3.6-rc.1, keeping its own security additions to Meteor's p…
In short a list's Add card form closes once the card is added, unless Member Settings keeps it open for the next one. And the v12.66 release build is whole again: the emulated-CPU Linux bundles and win32, FreeBSD, OpenBSD, the Mac app, the Sandstorm .spk, the Ondra and Gantt GPL snaps and the Bun bundles had failed to build or to start - most because build scripts had moved their files into .tools…
In short two CRITICAL security fixes: UploadBleed - attachment uploads were not authorized at all - and StampBleed, and a FrameBleed follow-up. Card Settings opens on Card, with Show empty fields, a Show empty column, Select all / Select none and drag and drop lists. A card opened from its link no longer vanishes behind a reverse proxy; minicards show only filled custom fields, lost cards reappear…
In short an opened card shows only the fields it has, with + Add for the rest. Drawing works with a pen on the whole window - from Add Card and Add attachment, saved as SVG, with an eraser, palm rejection and a lasso that moves, resizes, groups and layers lines - and SVG is an image again, sanitized whole at any size, streaming, on upload and on every serve. FerretDB answers WeKan's queries in the…