v10.53 2026-07-31 WeKan ® release This release fixes the following bugs: The card window opens beside its card again, on whichever side has more room. Thanks to csonkaoszimt, Mintyt and xet7. "notice how the card info docks neatly right next to the card" — the 6.09 behaviour asked for in #6465. The window had been moved off the middle of the board and docked to the end edge instead, which stopped…
v10.52 2026-07-30 WeKan ® release This release fixes the following bugs: Fix WeKan not starting in Yandex Browser: Meteor's own transpile asked for a module that was not there. Thanks to zubzhaaaw and xet7. Three attempts at this had added imports to client/lib/swcHelpers.js, and 10.51 still failed in Yandex Browser with the same line: Uncaught Error: Cannot find module '@swc/helpers/_/_possible_c…
v10.51 2026-07-29 WeKan ® release This release publishes the following packages that were not being published: One release now publishes all three snaps: wekan, wekan-ondra and wekan-gantt-gpl. Thanks to xet7. People are still on the older snap names, so a release that publishes only wekan leaves them on a stale package. Two things stood in the way, both in the snap-variants job. It gated EVERYTHI…
v10.50 2026-07-29 WeKan ® release This release has the following release-workflow fix: The Windows zip was never broken: a matched file was reported as missing, because of SIGPIPE. Thanks to xet7. v10.49 printed the archive listing that the previous release added, and it ends two releases of guessing about wekan-*-win64.zip: 7z t: archive is intact. 7z l -ba listed 51850 entries; the first five: 2…
v10.49 2026-07-29 WeKan ® release This release has the following release-workflow fixes: Release jobs now say what actually failed: no snap, no evidence hidden, no wrong secret blamed. Thanks to xet7. Four jobs of release-all.yml reported the wrong cause in v10.48, which is worse than the failure itself — two of them sent a whole round of work after the wrong problem. snap-launchpad never checked…
v10.48 2026-07-28 WeKan ® release This release fixes the following bug: Moving a card no longer pans the board at the same time. Thanks to mueschel and xet7. On a board large enough to have scrollbars in both directions, dragging a card sometimes moved the card, sometimes scrolled the list, sometimes scrolled the board, and often several of those at once — so a card could not be dropped where it w…
v10.47 2026-07-28 WeKan ® release This release fixes the following SECURITY ISSUES found by GitHub CodeQL code scanning: Trust a certificate instead of disabling verification, and escape every metacharacter. Thanks to GitHub CodeQL code scanning and xet7. Alert #430, js/disabling-certificate-validation, High: reqOptions.rejectUnauthorized = false in the outgoing-webhook path. It is right, and the…
v10.46 2026-07-28 WeKan ® release This release fixes the following bug: The SWC helper fix shipped in 10.45 was deleted by the bundler, because the package says it may be. Thanks to zubzhaaaw and xet7. WeKan 10.45 still failed in Yandex Browser with Cannot find module '@swc/helpers/_/_possible_constructor_return' (#6556), and the fix for it was in that build. @swc/helpers declares "sideEffects": f…
v10.45 2026-07-28 WeKan ® release This release fixes the following bugs: Every LDAP user became an admin, and searching all boards failed. Thanks to karvox, ahlgrimma, frantzstaboeeg and xet7. With ldap-sync-admin-groups set to ONE group, every user that logged in became a WeKan administrator (#6540). Two independent causes. The group query builds (&(objectclass=group)(member=<the user>)). The mem…
v10.44 2026-07-28 WeKan ® release This release adds the following test: Tests menu runs every database this CPU can, and checks they answer the same. Thanks to xet7. FerretDB v1 translates one MongoDB query into five different SQL dialects, so "WeKan starts on MariaDB" says very little. The question that decides whether a backend can be trusted with a board is whether {n: {$gt: 5}} returns the sam…
v10.43 2026-07-28 WeKan ® release This release adds the following new features: A Docker Compose file for every FerretDB v1 backend, generated from one source. Thanks to xet7. docker-compose.yml runs FerretDB v1 on its embedded SQLite. The same FerretDB can store into PostgreSQL, MySQL, MariaDB or SAP HANA instead, and there was no compose file for any of them — those backends were reachable only…
v10.42 2026-07-27 WeKan ® release This release fixes the following bugs: Every popup had 10px of empty space above it that nothing asked for. Thanks to xet7. The space above the first row of Board Settings, Board View, Member Settings, Sort Cards, Change Watch, Change Visibility and Swimlane Actions — and above the Title field of Rename Board — was much larger than the space beside it. None of it…
v10.41 2026-07-27 WeKan ® release This release fixes the following bugs: A removed DDP session no longer crashes the server on its 101st message. Thanks to bluetopaz1204, Nissulya and xet7. From the comments today, on 10.40 with real users: TypeError: self._pendingRemoveFunction is not a function at Session.send, then Main process exited, code=exited, status=1/FAILURE and Scheduled restart job, re…
v10.40 2026-07-27 WeKan ® release This release fixes the following bugs: The right sidebar starts below the header, in both modes. Thanks to xet7. Its upper part — the panel title, the tabs, the members row — was underneath the two header bars, so the sidebar appeared to start in the middle of itself. On a phone it is position: fixed, and it has to be: the board behind it is wider than the screen,…
v10.39 2026-07-26 WeKan ® release This release fixes the following bugs: The notification bell and the avatar sit the same way in both modes. Thanks to xet7. They were placed by whatever margin happened to win: one auto margin on the zoom pill pushed the pill, the bell and the avatar to the end of the row as a packed group, so the bell sat against the pill with the empty space beyond it, and the a…
v10.38 2026-07-26 WeKan ® release This release fixes the following CRITICAL SECURITY ISSUES: ZipBleed: arbitrary file write when restoring a backup archive (zip-slip) (f1c89548e). Thanks to xet7. GHSA-3gcg-g6rf-w2rx: an invalid authToken on a board export endpoint crashed the server (40de1799a). Thanks to laijunyue for the coordinated disclosure, and xet7. and adds the following new features: Mult…
v10.37 2026-07-25 WeKan ® release This release fixes the following SECURITY ISSUES found by GitHub CodeQL code scanning: js/incomplete-sanitization (High), alert #428, in tests/boardHeaderOneLine.test.cjs: the CSS rule bodies were split with rule.split('{') and the trailing brace removed with body.replace('}', ''), which strips only the FIRST }. The block is now matched with one regex that capture…
v10.36 2026-07-25 WeKan ® release This release fixes the following bugs: The Change profile image window (Member settings > Change Avatar, and the same window in Admin Panel > People) rendered each avatar row's "Delete" link and file name INSIDE the row's select link. An <a> inside an <a> is invalid HTML: the browser closes the outer anchor, so the file name and the Delete link fell out of the row…
v10.35 2026-07-24 WeKan ® release This release fixes the following bugs: Copying a board works again (POST /api/boards/:boardId/copy). swimlane.copy(), which runs on the server, called the SYNCHRONOUS getDefaultSwimline() on the source board to detect its default swimlane; for a board with no pickable swimlane that getter self-heals via a synchronous Swimlanes.upsert(), which Meteor 3 rejects on t…
v10.34 2026-07-24 WeKan ® release This release adds the following new features: Admin Panel → Problems → Summary now has a Repair button for "Broken cards N". The page reported the count and told the admin to "run the repair migration", but there was no button anywhere to run one — and no repair in the app could actually clear that count. countBrokenCards() counts every card missing a boardId OR a…
v10.33 2026-07-23 WeKan ® release This release adds the following updates: Added anupamme of OrbisAI Security to Hall of Shame: Fake AI. Part 1, Part 2. Thanks to anypamme. and fixes the following bugs: List header card count is now scoped to the swimlane it is shown in, so a shared list no longer shows the whole-list count over an empty second swimlane (the "5 Cards" header above a swimlane with…
v10.32 2026-07-23 WeKan ® release This release fixes the following bugs: Fix #6512 for OAuth / OIDC logins: after "Login with Google" (or any redirect-style social login) the user is now sent to All Boards instead of being left on the sign-in route showing only the language selector until a manual reload. The earlier #6512 fix covered only the password/register flow (onSubmitHook); OAuth logins do…
v10.31 2026-07-23 WeKan ® release This release fixes the following bugs: Fix #6512: after a successful login or register, go straight to the All Boards page instead of landing back on the login layout that shows only the language selector ("Vaihda kieltä") until a manual reload. onSubmitHook navigated home immediately, but the home route's sign-in guard checks Meteor.userId() non-reactively and bo…
v10.30 2026-07-23 WeKan ® release This release updates the following dependencies: The bundled FerretDB v1 fork now creates the OpLog ts index on the PostgreSQL, MySQL and SAP HANA backends too (previously only SQLite), so an idle Meteor OpLog tail resumes with an index range scan instead of re-scanning the whole capped collection on every poll. Best-effort per backend, with a descriptive log if a…
v10.29 2026-07-23 WeKan ® release This release adds the following new features: Snap: run the bundled FerretDB v1 against an EXTERNAL PostgreSQL / MySQL / SAP HANA server instead of the embedded SQLite backend. Two new snap settings — snap set wekan wekan-ferretdb-handler=postgresql|mysql|hana and wekan-ferretdb-url=… — point FerretDB at a database you run; the default stays the zero-dependency sq…
v10.28 2026-07-23 WeKan ® release This release fixes the following bugs: Fix #6508 (follow-up): the board member popup now shows "Remap User" for an imported (placeholder) member. The action is gated on the member's authenticationMethod === 'imported', but the board publication shipped board members' user docs without authenticationMethod, so the field was undefined on the client and the action ne…
v10.27 2026-07-23 WeKan ® release This release fixes the following bugs: Fix #6508: two crashes in the import "map users later" workflow. (A) In the import "map members" step, clicking a searched user threw Cannot read properties of undefined (reading '_id') — the handler read Template.currentData()._id, which is undefined when the click lands on a child of the row (the avatar or the name span); i…
v10.26 2026-07-22 WeKan ® release This release fixes the following bugs: Fix #6507: on a fresh install the Admin panel would not open, the title bar sometimes failed to load or showed "You are not authorized to view this page", and the browser console looped Uncaught (in promise) TypeError: Cannot read properties of undefined (reading 'remove'). ReactiveCacheClient.getCurrentSetting() / getCurrent…
v10.25 2026-07-22 WeKan ® release This release fixes the following bugs: Fix boards that loaded their lists/columns but never their CARDS on FerretDB v1 (SQLite) (10.22: pages took minutes, columns appeared, cards never did). Every board card query used { boardId: { $in: [board._id, board.subtasksDefaultBoardId] } }, and subtasksDefaultBoardId defaults to null; on FerretDB a $in containing null do…
v10.24 2026-07-22 WeKan ® release This release fixes the following bugs: Fix #6506: board import shows the "map members" step again, and unmapped members become virtual users instead of the importer. A regression in v10.12 dropped the importMapMembers step from the import wizard and sent an empty member mapping, so the map-users screen never appeared and every imported card / member / comment was…