v10.40 2026-07-27 WeKan ® release

This release fixes the following bugs:

The right sidebar starts below the header, in both modes. Thanks to xet7.

Its upper part — the panel title, the tabs, the members row — was underneath
the two header bars, so the sidebar appeared to start in the middle of itself.
On a phone it is position: fixed, and it has to be: the board behind it is
wider than the screen, so an absolutely-positioned sidebar pins to the far
right of the BOARD and shows as a narrow strip. But fixed means against the
viewport, and it was pinned at top: 0 — where the header bars are. There is
no number to put there: the header is the quick-access bar plus a board bar
whose buttons wrap to one, two or three rows depending on language and window
width. So the header measures itself into --wekan-header-height and the
sidebar starts at that, kept current by a ResizeObserver — the buttons
re-wrapping does not fire a window resize.

A subscription with no board id took the server down; it is answered, not fatal. Thanks to xet7.

publishComposite('board') starts with check(boardId, String). A
subscription arrives with a null board id, check() throws, and a throw inside
an ASYNC publisher escapes as an unhandled promise rejection — which this app
treats as fatal: SyncedCron: Fatal error encountered (unhandledRejection) and
Exited with code: 1. One bad subscription stopped the server for everyone,
and subscription arguments come from the client, so any client could send it;
the app was sending it itself, from a popup that read
Session.get('currentBoard') on a page that has no current board. The
publisher TESTS its arguments now instead of checking them — a subscription
that names no board publishes nothing and readies — and the same guard is on
boardCardsWindow and boardCardsLoadingMode. The client no longer sends a
subscription for a board id it does not have. Each guarded publisher still
marks its arguments with check(x, Match.Any)
(b3537985e), because this
app runs with audit-argument-checks and Match.test alone is not checking —
without that, every subscription failed with "Did not check() all arguments".
tests/publicationArgumentGuard.test.cjs replays the guard and fails on an
unguarded board subscription.

The board bar's icons fit two rows, and a desktop-mode board is a desktop board. Thanks to xet7.

The board bar's icons still took four rows - title, seven, three, hamburger -
because the rule that makes each button a flex item of the bar was in
boardHeader.css, and the display: flex for those groups in header.css has
the same specificity and loads later; it is written in the file that wins now.
And lists still stacked in desktop mode: boardBody.css lays the whole canvas
out for a phone by WIDTH — display: block on the swimlane, overflow-x: hidden on the wrapper — which makes every list a full-width row and drops the
add-list form under the last list. That is mobile mode's layout now; desktop
mode gets a swimlane that is a flex ROW scrolling sideways, so the lists run
left to right and the add-list form is the last item of the row — the right in
LTR and the left in RTL, by writing direction rather than a hard-coded side.

Mobile mode is the phone layout; desktop mode is the desktop layout, on a phone too. Thanks to xet7.

Five things, one theme: what belongs to the MODE the user chose and what
belongs to the width of the window. The board bar's buttons still took three
rows in desktop mode — the metrics were written in boardHeader.css, and
Meteor loads components/boards/ before components/main/, so header.css's
margin: 0 6px won at equal specificity; they are written in the file that
wins now, and eleven icons take two rows in both modes. The sidebar hamburger
is the last button at the right of the last row instead of pinned beside the
title. The avatar was cut in half in mobile mode only: the drag-handle toggle
in the top bar is also a .board-header-btn, so mobile mode gave it 42px of
padding for one icon — the width the avatar needed. Lists stacked one per row
in desktop mode, because that layout is chosen by width; it is
body.mobile-mode now. And the minicard's full-height thumb handle, chosen by
pointer: coarse, is mobile mode's too — desktop mode keeps the compact handle
in the corner under the menu button.

The board bar's icons fit two rows on a phone. Thanks to xet7.

Eleven icons took three rows under the title: each button was ~20px of icon
inside 10px of icon margin inside 6px of button margin — 52px of a 375px bar
for 20px of icon — so five fitted a row. A 44px touch target with 2px between
buttons is 48px each, so seven fit a row and the icons take two, the first of
them sharing the title's row. 44px is the minimum comfortable touch target, so
this is as tight as it goes: one row would need 34px each, smaller than a
fingertip. tests/narrowWindowLayout.test.cjs does the arithmetic and fails if
the metrics stop fitting eleven icons in two rows.

The avatar lines up with the bell, and "My Boards" is back at the left. Thanks to xet7.

The avatar sat above the bell and against the right edge: its wrapper carries
top: -5px from the desktop bar, and #header-user-bar carries 10px of
padding on each side — 20px of a 375px bar spent on nothing. Neither applies on
a phone now, and the chips behind the mode-toggle icons are trimmed to match.
"My Boards" had moved to the middle of the second header bar, which was a
scoping mistake: the phone rule that makes the All Boards page a flex column
was written for a bare .wrapper, and header.jade puts wrapper on
#header-main-bar on every page that is not a board — so the bar became a flex
column and centred its items. It is scoped to #content .wrapper now.

The board bar reads left to right, and the header says which mode you are in. Thanks to xet7.

Four things on a phone, all the same in mobile mode and desktop mode. The
board's buttons started on a row of their own under the title, because every
group is one flex item and moves as a block; on a phone the groups are
display: contents, so each button is a flex item of the bar and they start
right of the title. The sidebar hamburger sat on a row below them although two
rules were meant to pin it to the top right corner — they were scoped to
body.board-view, a class written in 67 CSS rules and set by NO code, so they
had never applied; the width-based copy asks
:has(.board-header-sidebar-toggle) instead. The mobile/desktop toggle did not
say which mode was on: #000 against #666 at 14px is no difference, so the
current side is a filled chip in the active theme with a white glyph and the
other is faded. And the avatar sat higher than the bell — a bottom margin lifts
an item by half of it in a centred row — while its initials sat low in the
circle, at y="11" of a 15-unit viewBox with a font-size taller than the box.

All Boards on a phone: the board list scrolls to its last board. Thanks to mimZD and xet7.

Reported against 10.10, again against 10.37, and again against 10.38 after two
fixes that made the numbers more accurate instead of removing them. An inner
scroller only works when every ancestor between it and the viewport has a
definite height, and this chain was built out of viewport arithmetic: the
wrapper was 100dvh although it begins below the two header bars, so its
bottom sat about two bars below the screen; the layout between had no height at
all, so height: 100% under it resolved to auto; and the list was `calc(100dvh

120px)— a guess at everything above it, which on a phone is ~226px, so the list box reached ~100px below the screen and its last rows were under the fold where no gesture could bring them. There is no viewport arithmetic belowbodynow: the page is 100dvh and everything under it is a flex chain, so the list ends exactly where the screen does, whatever the bars above it are. Both modes use the same mechanism.tests/boardListScrollChain.test.cjs` fails if
"viewport minus a guess" comes back. Not verified on a device: there is no
phone here, and Playwright's fixed viewport has no browser toolbar.

and has the following developer-facing changes:

build.sh and build.bat always build WeKan before running the tests. Thanks to xet7.

Both built the bundle only when .build/bundle was MISSING — exactly the case
where a bundle exists and is stale. The :3000 test server runs that precompiled
bundle, so Node E2E and every Playwright browser were testing whatever was built
last time, and the run passed or failed on code that is no longer in the working
tree. Both delete .build and build every time now, and stop with an error if
the bundle is missing afterwards. build.bat was also two menu entries behind
build.sh — the dev server's custom port + ROOT_URL host, and "Install
Playwright browsers" — and both are added, renumbered and dispatched.
tests/buildScriptParity.test.cjs fails if either script stops rebuilding, if a
menu entry has no counterpart, if...

v10.39 2026-07-26 WeKan ® release

This release fixes the following bugs:

The notification bell and the avatar sit the same way in both modes. Thanks to xet7.

They were placed by whatever margin happened to win: one auto margin on the zoom
pill pushed the pill, the bell and the avatar to the end of the row as a packed
group, so the bell sat against the pill with the empty space beyond it, and the
avatar's distance from the edge was whatever was left — different in mobile mode
and in desktop mode on the same phone. Below 800px the free space is shared
around the bell instead: an auto margin on each side puts it midway between the
zoom pill and the avatar, and the avatar keeps a fixed 12px gap to the right
edge. Both .iphone-device variants are named in the selector list, since that
fallback sets these margins with !important and two classes more, and the
placement would otherwise apply everywhere except the phone it was reported
from.

All Boards on a phone: one drag-handle size, and a workspace name you can read. Thanks to xet7.

Two things differed between mobile mode and desktop mode on the same phone. The
board tile's drag handle was a 26px circle in one and a 40px circle in the
other, and on a ~97px tile the big one covered a good part of the tile it sits
on; both are the smaller one now, still well over the ~24px a finger needs. And
a workspace had no readable name in EITHER mode: the row's rule said the name
"must give way to the fixed items around it", and it gave way completely — the
drag handle, folder icon, menu button and count chip come to ~130px at their
desktop paddings, the menu column on a 375px phone is ~145px, and the name was
laid out in the 15px left over. Those items are trimmed to ~90px and the name
has a 3.5em floor it may not shrink below, with an ellipsis when it is long.
tests/allBoardsPhoneRow.test.cjs reads the sizes out of the cascade.

Admin Panel: /information and /translation showed the page you came from. Thanks to xet7.

Both old URLs are panes of Admin Panel / Settings now, and both redirected with
FlowRouter.go('setting') called from INSIDE triggersEnter. A trigger runs
while its own route is still entering, and a go() from there is swallowed - so
nothing was rendered at all and whatever page the browser was showing simply
stayed. Playwright caught it on every browser: /information showed All Boards. A
trigger now redirects with the redirect it is handed, and each URL asks for
the pane it used to be a page of, so the bookmark lands where it pointed.
tests/adminOldUrlRedirect.test.cjs pins the redirect form and the pane.

All Boards on a phone fits the screen, and the board titles get their width back. Thanks to xet7.

The board titles were laid out two characters per line. Space for the drag
handle - one absolutely-positioned circle - was reserved three times on the way
down: on the list item, on the tile and on the text container, which is more
than a ~97px phone tile has. It is reserved once now, and not at all when drag
handles are off and no handle is rendered. The page could also be dragged
sideways, with the avatar past the right edge: the quick-access bar is nowrap
with overflow: visible and every item flex-shrink: 0, so a row wider than
the screen spilled - and visible overflow is scrollable overflow. The zoom pill,
by far the widest item, gives way instead, and html { overflow-x: hidden } on
a phone is the guarantee. tests/mobileAllBoardsFit.test.cjs pins both.

The zoom number is inside its white pill again, and big enough to read. Thanks to xet7.

On a phone the pill was empty and "100" sat to the right of it in tiny type,
half under the notification bell. The pill was allowed to shrink below its own
contents, and a flex item that shrinks past its content does not clip it - the
white background ends where the width says and the text carries on outside it.
The pill is sized by what is in it now, and what is in it is made small instead.
The tiny type was font-size: 0.7em of a 12px bar - about 8px, the smallest
text on the page - now a plain 14px, which is also why the pill stays narrow.
The base rule's 24px height cap, shorter than that text, is lifted so the number
is centred. tests/mobileAllBoardsFit.test.cjs pins all of it.

A narrow window gets the narrow-window layout, not only an explicit mobile mode. Thanks to xet7.

The phone/desktop toggle writes an explicit choice, and Utils.isMiniScreen()
returns it as-is, so a phone whose user picked DESKTOP mode is not a mini screen
and its body carries no .mobile-mode — while the viewport is still 375px wide.
Three fixes written for one of those two therefore did nothing there. "Create
board" opened 160px in with its right half off the screen, because the geometry
laid it out as a floating box anchored to the button while the CSS made it the
full width; the board bar's hamburger was pushed to a third row of its own; and
the top bar was still wider than the screen, so the avatar was cut off. The
popup is a sheet pinned to the corner at any viewport that narrow, the hamburger
leaves the flow by width as well as by mode, and the drag-handle toggle, the
mode toggle and the logo give back the ~60px the avatar needed.
tests/narrowWindowLayout.test.cjs pins all three.

and improves the changelog and the documentation:

The changelog shows a short description, and hides the long one behind it. Thanks to xet7.

Every entry is a <details> now: the <summary> is a short description of what
was done and IS the link to the commit — the hash is in the href, never on the
page — and clicking it reveals the long description, wrapped at 80 columns. 977
entries across every release were converted, the ones the old prose format had
left malformed were repaired rather than carried over, and no URL or heading was
lost. The top of the file became # Platforms (with its collapsible Version
list) and # TODO Later, whose blocks carry no Thanks to because nothing
there is done yet. The rules are written down in
CLAUDE.md, and
tests/changelogFormat.test.cjs checks the whole file against them.

CLAUDE.md records how a Hall of Fame entry is written. Thanks to xet7.

The wekan.fi Hall of Fame page grew a row of
eight cells, one thing in
each — CVE, Icon beside
it, Vulnerability name, Date,
Responsible Security Disclosure by, Stars, Process, Vulnerabilities — with the
Process and Vulnerabilities
cells collapsed behind their own summary, the stars of a row on one
line and the icon beside its
red drop on one, the
reporter's nickname as the link to their
GitHub — checked to exist
before it is linked — and no role note after a
name. All of it is stated in
CLAUDE.md so the next security entry is written to fit rather than reconstructed
from the file.

Thanks to above GitHub users for their contributions and translators for their
translations.

v10.38 2026-07-26 WeKan ® release

This release fixes the following CRITICAL SECURITY ISSUES:

ZipBleed: arbitrary file write when
restoring a backup archive (zip-slip)
(f1c89548e).
Thanks to xet7.
GHSA-3gcg-g6rf-w2rx:
an invalid authToken on a board export endpoint crashed the server (40de1799a).
Thanks to laijunyue for the coordinated disclosure, and xet7.

and adds the following new features:

Multitenancy: one WeKan server for many domains, with Organizations as the
tenants (36b899b9d).
Thanks to xet7.
Admin Panel / Settings / Visibility: Change color sets the site theme
(36b899b9d).
Thanks to xet7.

and reorganises the Admin Panel:

Admin Panel / Settings is reorganised so every setting sits with the thing it
is about (fa0da9178).
Thanks to xet7.
Every Admin Panel page renders ONE shared left menu
(e26706799).
Thanks to xet7.
Admin Panel / People: Domains, Organizations, Teams and People use the shared
table page (ccc95bffb).
Thanks to xet7.
The Admin Panel Features tab is removed
(b72a4996d).
Thanks to xet7.
Admin Panel / Problems: the Security report is renamed Security Report and
moved above Broken Cards
(4df87fd6b).
Thanks to xet7.
Admin Panel: the Login and E-mail panes moved from Settings to People, above
Organizations (47b03ef89).
Thanks to xet7.
Every Admin Panel pane opens with the same heading, and the heading is the
open left-menu entry's own label
(d23219407).
Thanks to xet7.
Admin Panel / Settings / Translation renders through the shared table page
(docs/Design/Page/Table.md)
(d23219407).
Thanks to xet7.
Version is the FIRST pane of Admin Panel / Settings and the one that opens
with the page (d23219407).
Thanks to xet7.
Admin Panel / Settings / Visibility is four named groups instead of one long
list (671262ddb).
Thanks to xet7.
"Add board members only from the same Organization or Team" moves out of Admin
Panel / People / Login
(f0ea1601b).
Thanks to xet7.
Admin Panel / People / Login is one "Login: Allow" group of checkboxes
(40c1c1e71).
Thanks to xet7.
Admin Panel / People / E-mail: "Email domain name" is renamed to say what it
does (f15b37e4e).
Thanks to xet7.
Admin Panel / Settings / Visibility: the All Boards rows say only what is
hidden (2ef34924d).
Thanks to xet7.
Each section of Admin Panel / Settings / Visibility has its own Save, directly
above the rule that closes it
(9255a6533).
Thanks to xet7.
"Product name" appears once in that pane, not twice: the group holds one field
(bbb1b3ff0).
Thanks to xet7.
Admin Panel / Problems: the left menu is grouped under Settings and Reports
(fc0fe3177).
Thanks to xet7.
Admin Panel / People: Domains moves up beside E-mail, the settings it is about
(d23219407).
Thanks to xet7.
Admin Panel / Problems / Broken Cards has the same controls as the other
reports (fc0fe3177).
Thanks to xet7.
No Admin Panel pane repeats the title above it
(9a0db4343).
Thanks to xet7.
Admin Panel / Attachments opens on Backup, which is also the first entry of
its menu (a9680fa3d).
Thanks to xet7.
Admin Panel / Attachments no longer has a Sandstorm pane
(eba25459a).
Thanks to xet7.

and updates the following dependencies:

@aws-sdk/client-s3 3.1090.0 → 3.1095.0 — the S3 / MinIO attachment storage
client (#6530, 36b54b1f5).
Thanks to dependabot.
unzipper 0.12.3 → 0.12.5 — the zip reader behind board import and backup
restore (#6529, aa7abcf09).
Thanks to dependabot.
bson 7.3.0 → 7.3.1 — the BSON codec used with MongoDB and FerretDB (#6527,
047319fb2).
Thanks to dependabot.
@playwright/test 1.61.1 → 1.62.0 in tests/playwright — the browser test
runner, a development dependency that is not part of the shipped bundle
(#6528, f7fb32774).
Thanks to dependabot.
docker/login-action 4.4.0 → 4.5.1 — the GitHub Actions step that signs in
to the container registries when a release image is published (#6526,
d4684448c).
Thanks to dependabot.

and fixes the following bugs:

Clicking a card closes the one that was open; keeping many open is a per-user
setting (2973240a7).
Thanks to mimZD and xet7.
All Boards on a phone sizes its scrollers by the viewport that is actually
there (89920762a).
Thanks to mimZD and xet7.
Choosing a theme now recolours the whole UI, not just the header
(d72675906).
Thanks to xet7.
Admin Panel: the Edit User, Organization and Team popups fit the window, in
columns (19a5ea0b7).
Thanks to xet7.
Admin Panel / Settings / Visibility / Wait Spinner shows the spinner it names,
spinning (19a5ea0b7).
Thanks to xet7.
Admin Panel / Settings / Translation puts its New column on the left
(19a5ea0b7).
Thanks to xet7.
Admin Panel / People / People showed nothing at all — no table, no search box,
no pager (d23219407).
Thanks to xet7.
The right-hand side of an Admin Panel table is no longer off screen
(d23219407).
Thanks to xet7.
An empty Admin Panel table still shows its header, so its New button is there
(d23219407).
Thanks to xet7.
Every control in an Admin Panel table's controls row sits at the same height
(d23219407).
Thanks to xet7.
A long Admin Panel left menu scrolls inside its panel
(a4990a474).
Thanks to xet7.
The build stopped with Can't use the built-in 'if' here on the People page
(f8793bec4).
Thanks to xet7.
Admin Panel / People / E-mail saved neither of the two settings it shows
(f15b37e4e).
Thanks to xet7.
Admin Panel pages no longer repeat the pane name in a bar of their own
(73cd930a4).
Thanks to xet7.
The Admin Panel left menu is back on every page
(d34d28159).
Thanks to xet7.
The password field is back on the Sign In and Register pages
(696c49038).
Thanks to xet7.
A finished MongoDB → FerretDB migration on Snap no longer leaves WeKan on 503
(aebede877).
Thanks to S0QR2 and xet7.
In mobile mode the fixed-size light grey bands around a swimlane are gone
(6837198bf).
Thanks to xet7.
In mobile mode the board fits the width again
(a5850296a).
Thanks to xet7.
In mobile mode the titles and the top bar sit on one line
(a5850296a).
Thanks to xet7.
In mobile mode, clicking the Add List + no longer opens the list as well
(df27e349d).
Thanks to xet7.
In mobile mode the "Add List" + moved into each list header, between the caret
and the drag handle
(61979c0f6).
Thanks to xet7.
Checked for the same window-resizing bug everywhere else it could hide
(7dcd9da67).
Thanks to xet7.
Elements no longer change size when the browser window is resized
(d03cd0300).
Thanks to xet7.
The second header bar in mobile mode is the same on a phone as in mobile mode
on a desktop window
(72315d8f9).
Thanks to xet7.
The list title is visible in mobile mode again, both on a phone and on a
desktop (72315d8f9).
Thanks to xet7.
The board...

v10.37 2026-07-25 WeKan ® release

This release fixes the following SECURITY ISSUES found by GitHub CodeQL code
scanning:

js/incomplete-sanitization (High), alert #428, in
tests/boardHeaderOneLine.test.cjs: the CSS rule bodies were split with
rule.split('{') and the trailing brace removed with body.replace('}', ''),
which strips only the FIRST }. The block is now matched with one regex that
captures selector and body as separate groups, so no brace ends up in the text
and there is nothing to strip.
js/incomplete-sanitization (High), alert #427, in
tests/testsAreRegistered.test.cjs: a file name was spliced into a RegExp
after escaping only dots, leaving every other metacharacter — the backslash
above all — able to change the meaning of the pattern. It now goes through an
escapeRegExp() that escapes the full set, backslash included.
Both are test helpers, so neither was reachable by an attacker, but both were
genuinely wrong string handling
(commit).
Thanks to GitHub CodeQL (alerts #427 and #428) and xet7.

and resolves the following GitHub Dependabot alerts in npm dependencies:

brace-expansion 5.0.7 → 5.0.8 (RUNTIME dependency, transitive via minimatch):
fixes CVE-2026-14257
(GHSA-mh99-v99m-4gvg, High, CVSS 7.5, alert #119) — expand() bounds how MANY
results it produces (max, 100000) but not how LONG they get, so chained brace
groups keep the count under the cap while every result grows one character per
group. A ~7.5 KB input ('{a,b}'.repeat(1500)) exhausts memory and kills the Node
process with a fatal, uncatchable out-of-memory error that try/catch cannot
contain. 5.0.8 bounds the total characters one expand() call may accumulate
(maxLength, default 4000000) inside the output-building loops, so intermediate
arrays are bounded too and oversized input is truncated rather than fatal. Patch
release in the same major line; the only other change is engines.node, which drops
Node 18 — WeKan builds and ships on Node 24 (Dockerfile NODE_VERSION=v24.18.0, CI
NODE_VERSION: '24'), so nothing is affected
(#6523, merge commit).
postcss 8.5.15 → 8.5.22 (dev dependency; enters only through css-loader, which
the rspack build uses for .css, and is not itself part of the shipped bundle):
fixes GHSA-r28c-9q8g-f849
(High, CVSS 7.5) — postcss follows a /*# sourceMappingURL=... */ comment in the CSS
it parses and builds the path with path.join(dirname(from), annotation), which
normalises but does not sandbox .., so a crafted comment discloses arbitrary .map
files. Affected <= 8.5.17, patched in 8.5.18. nanoid 3.3.12 → 3.3.16 rides along
as postcss's own dependency
(#6522, merge commit).
Both are lock-only changes whose tarball integrity hashes were verified against the
npm registry, and the brace-expansion lock edit was reproduced independently with
npm update brace-expansion --package-lock-only, which produced a byte-identical
diff. elliptic (alert #55, CVE-2025-14505) is still left pinned for the reason
recorded in v10.14: no fixed version is published upstream — the latest release is
still 6.6.1 and the advisory lists no patched version. It is a dev-only transitive
polyfill (@meteorjs/rspack → node-stdlib-browser → crypto-browserify →
browserify-sign/create-ecdh), no WeKan client module imports node crypto, and
the built client bundle contains no elliptic/secp256k1/crypto-browserify code
at all, so it never reaches users.
Thanks to GitHub Dependabot and xet7.

and has the following developer-tooling fix:

docs/Security/gh/pull-security-reports.sh reported OK for every endpoint and
then wrote empty split files and blank counts. gh api --paginate --slurp returns
ONE ARRAY PER PAGE, so a list endpoint arrives as [[alert,...],[alert,...]];
nothing flattened that, so .[] yielded PAGES rather than alerts and every
select(.state == "open") ran against an array. jq failed, its error went to
/dev/null, and the > redirect left a 0-byte file — not valid JSON, so every
later step on it failed too and printed nothing. A security report that quietly
claims there is nothing to see is worse than one that fails. The pages are now
concatenated (only when every element is itself an array, so single-object
endpoints like the SBOM are untouched), a failed filter leaves a valid empty array
plus a readable error instead of truncating the file, the secret-scanning
redaction validates the redacted copy before deleting the dump that still holds
live secrets (and removes it on the failure path too), and counts always print a
number. The same shape had also broken the newest-analysis lookup and the
codeql-databases dump.
Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their
translations.

v10.36 2026-07-25 WeKan ® release

This release fixes the following bugs:

The Change profile image window (Member settings > Change Avatar, and the same
window in Admin Panel > People) rendered each avatar row's "Delete" link and file
name INSIDE the row's select link. An <a> inside an <a> is invalid HTML: the
browser closes the outer anchor, so the file name and the Delete link fell out of
the row's flex layout and rendered as bold text floating at the right edge, and a
click on Delete also selected that avatar. Delete and the file name were shown only
for the avatar currently in use, so no other upload could ever be deleted, and an
empty p.sub-name added a stray block in the middle of the row. Each row is now one
flex line - thumbnail, file name (truncated with the full name as a tooltip), a
check mark when it is the avatar in use, and a delete button that is a SIBLING of
the select link, so deleting never also selects and every uploaded avatar can be
deleted. The row in use is highlighted like in the other pop-over lists, the
initials row shows its "Default avatar" label under the name, and the upload hints
(max filesize, allowed filetypes, invalid filename) are grouped into one muted
paragraph above the upload button. Deleting the avatar in use left
profile.avatarUrl pointing at a file that no longer existed - a broken image
everywhere - so both windows now fall back to the initials when the deleted file is
the one in use. The Admin Panel window also passed userData= to
userAvatarInitials, which reads this.userId, so its initials rendered
empty.
Thanks to xet7.
On iPad Safari a full-screen "Uncaught runtime errors: ERROR Script error." panel
appeared after login, and again when the Safari Share sheet was opened on All Boards
to add WeKan to the home screen. That panel is webpack-dev-server's error overlay,
shipped by the rspack DEV server only - a production build has no dev server and no
overlay. It opens for every window error event, including ones that carry no
information: a browser sanitises an error thrown by a CROSS-ORIGIN script to the bare
message "Script error." with no error object and no stack, and iOS Safari raises those
from its own machinery and from content blockers and extensions, which is what the
Share sheet triggered. It cannot come from WeKan's own code, because the bundle is
served same-origin (no CDN_URL), so a real WeKan error always reaches the overlay
with its actual message and stack. The overlay now ignores exactly that one message
and still shows every other runtime error and all compile
errors.
Thanks to xet7.
The board bar (the second header bar) fits on one line on iPad. In landscape it
wrapped onto two rows - board title, edit, visibility, watch, star and sort on the
first, Filter / Search / view / dependencies / multi-selection / hamburger on the
second. Measured at a 1180 CSS px viewport the two rows needed about 1304px on one
line, ~124px more than the viewport, and nearly all of that is per-button empty space
rather than text: each button carries 12px side margins, 10px on each side of its icon
and a 10px gap after its label, about 54px of chrome around a ~60px icon+label. So
nothing has to be hidden at that width: halving the chrome between 801px and 1400px
frees ~295px, which fits the bar on one line with room to spare for languages with
longer labels, and icon and label sizes are untouched so the buttons stay comfortable
to tap. In tablet portrait (820px), where even the halved chrome cannot fit the labels,
they drop to icons only between 801px and 1000px - the same treatment phones already
get below 801px, with titles, tooltips and popups unchanged. Wide desktops, which never
wrapped, look exactly as before, and phones keep their 44px touch
targets.
Thanks to xet7.
A long board title now moves ALL of the board bar's buttons to its second row,
under the title. Before, the controls were split across the two rows: the title kept
the left group (edit, visibility, watch, star, sort) beside it and only the right
group (Filter, Search, view, dependencies, multi-selection, hamburger) wrapped
underneath. That is what separate flex items do - the title and the three button
groups were four children of the header row, so the row broke wherever it ran out of
width. The three groups now live inside one wrapper, so the row has just two items,
the title and the buttons, and either the buttons fit beside the title or the whole
set moves down together. A short title is unaffected, because the wrapper measures as
its own content width and only moves down when it genuinely does not fit. A title
longer than the whole bar now wraps inside the title instead of overflowing the
viewport.
Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their
translations.

v10.35 2026-07-24 WeKan ® release

This release fixes the following bugs:

Copying a board works again (POST /api/boards/:boardId/copy). swimlane.copy(), which
runs on the server, called the SYNCHRONOUS getDefaultSwimline() on the source board to
detect its default swimlane; for a board with no pickable swimlane that getter self-heals via
a synchronous Swimlanes.upsert(), which Meteor 3 rejects on the server (update is not available on the server. Please use updateAsync() instead.), so the whole copy threw. It now
calls the existing getDefaultSwimlineAsync() (same pick + idempotent upsertAsync
self-heal). Two related hardenings landed with it: the copy REST route caught the error with
sendJsonResult(res, { data: error }), and that helper defaults the HTTP status to 200 when
no code is given — so a copy that THREW was returned as 200 with the error object as the
body, indistinguishable from success (that is what the REST test caught); the route now
returns 500 with the message and logs the stack, so a failed copy is a clean, diagnosable
error. And board.copy()'s custom-field remap did card.customFields.map(...), which throws
for a card whose customFields is absent (the schema defaults it to [], but a card copied
via .direct or seeded raw can lack it) — it now skips cards that have none, matching the
!Array.isArray(this.customFields) guard used elsewhere in the
model.
Thanks to xet7.
All Boards header on a phone, follow-up: the section icon and the Multi-Selection / Sort
buttons really do share ONE row now, with the Search box on the row below, and a workspace
name no longer hides under its "bars" menu button. The buttons and search box live inside a
.path-right wrapper, so the v10.34 attempt (giving that wrapper flex) only made the
WRAPPER wrap as a two-line block beneath the section icon, leaving the icon alone on row 1.
On a phone .path-right is now display: contents, which dissolves the wrapper so its
buttons and search field become direct items of the header's own flex row; the header then
wraps them itself — section icon + buttons on row 1, full-width search on row 2. And the
narrow-left-menu workspace NAME had a min-width floor that stopped it shrinking, so in the
cramped row its box overflowed onto the "bars" workspace-menu button to its right and the
hamburger looked like it sat on top of the name; the floor is removed and the name's box is
clipped, so the name truncates with an ellipsis and can never cover the menu, while the menu
button and count never shrink.
Thanks to xet7.
Upgrading no longer grows a spurious "Restored Items" column full of cards that look
empty but are not. Four obsolete per-swimlane-lists-era board migrations fought today's
data model and are removed. restoreLostCards created a "Lost Cards" swimlane and a
"Restored Items" list and moved cards into them — it counted a card "orphaned" when its
list was merely ARCHIVED (archived lists are excluded from the set it checks) and "lost"
when its swimlaneId was '' (which is NORMAL for a board-wide shared card), so it
dragged real, healthy cards into "Restored Items", where they rendered oddly.
comprehensiveBoardMigration and fixMissingListsMigration converted today's board-wide
SHARED lists (swimlaneId '') back into per-swimlane DUPLICATE columns — the exact damage
the startup schema step merge-per-swimlane-lists now UNDOES — and restoreAllArchived
un-archived every swimlane / list / card at once. All four had NO callers left (their admin
migration dashboard was already removed), so they were dead code exposed only as
admin-callable Meteor methods that could re-corrupt a board if invoked. The correct paths
remain: the board-open self-heal (repairBoardData) relinks a genuinely missing swimlaneId
or an orphaned card to the board's real first list/swimlane, and merge-per-swimlane-lists
merges any per-swimlane duplicate columns back into one shared list while cards keep their
swimlaneId; it still keys off the era's board markers in existing data, so removing the code
that once wrote them changes nothing for already-migrated boards. A test keeps the four from
coming back.
Thanks to hmeunier95 and xet7.

and has the following developer-tooling changes:

Thanks to above GitHub users for their contributions and translators for their translations.

v10.34 2026-07-24 WeKan ® release

This release adds the following new features:

Admin Panel → Problems → Summary now has a Repair button for "Broken cards N". The page
reported the count and told the admin to "run the repair migration", but there was no
button anywhere to run one — and no repair in the app could actually clear that count.
countBrokenCards() counts every card missing a boardId OR a swimlaneId OR a
listId, while repairAllBoards() walks only NON-ARCHIVED boards and only ever sets
swimlaneId, so three kinds of counted card could never be repaired by anything: cards
on an archived board, cards with a missing listId, and cards with no boardId at all.
The new admin-only repairBrokenCards method runs the standard per-board pass and then
closes those gaps, assigning the affected cards to their board's first usable
list/swimlane (creating a default one when the board has none) and resolving each board's
defaults once rather than once per card. Cards with no boardId cannot be placed on any
board — guessing would drop a user's card onto an unrelated board — so they are reported
as unfixable and left alone, never deleted, instead of leaving a count that never reaches
zero unexplained. What counts as broken now lives in ONE pure module used by both the
count and the repair, so they can no longer drift apart, with unit and negative tests for
the rule.
Thanks to xet7.
Admin Panel → Problems → CPU usage now shows the CURRENT CPU usage between the page
title and the Search box. The page listed only PAST high-CPU periods, so it could not
answer "what is the CPU doing right now?" — the one question an admin opens it to ask.
The new line shows the system CPU percentage, core count, 1/5/15 minute load average and
the coarse "what WeKan is doing" label, refreshed every 5 seconds and outlined in red
while the monitor considers the CPU sustainedly high. It reads the same sample the
monitor writes its event rows from, so the header and the rows below it can never
disagree, and with the background monitor disabled (WEKAN_CPU_MONITOR=false) it
measures between calls using a separate baseline instead of always reading
0%.
Thanks to xet7.

and fixes the following bugs:

v10.33 2026-07-23 WeKan ® release

This release adds the following updates:

Added anupamme of OrbisAI Security to Hall of Shame: Fake AI.
Part 1,
Part 2.
Thanks to anypamme.

and fixes the following bugs:

List header card count is now scoped to the swimlane it is shown in, so a shared list
no longer shows the whole-list count over an empty second swimlane (the "5 Cards" header
above a swimlane with no cards). A shared list — one whose swimlaneId is empty, the
pre-per-swimlane-lists layout — renders under every swimlane, but cardsCount() counted
by the list's OWN swimlaneId (''), giving the whole-list total in every swimlane while
the cards rendered below were correctly swimlane-scoped. It now takes the container
swimlane id (the same ../../_id the card body already uses) and counts that swimlane's
cards, matching what is rendered; list.cards() and the lazy (#6480) server count both
already scope by that id, including first-swimlane shared/orphaned
surfacing.
Thanks to xet7.
Re-attach mouse drag-scrolling (dragscroll) when a board's swimlanes/lists render or
change, so lower swimlanes stay reachable by dragging. @wekanteam/dragscroll attaches
its mouse handlers per element in reset(), but the board's reset autorun only depended
on the touch/permission reads — not the swimlanes/lists — so when they rendered AFTER
onRendered (adaptive lazy card loading, the on-open data-repair adding a default
swimlane, or a board switch that reuses the template instance without re-firing
onRendered) the new .dragscroll containers never got mouse handlers: dragging no
longer scrolled and, with the vertical scrollbar hidden, only the top swimlane was
reachable (touch still worked via the document-delegated dragscrollTouch). The autorun
now reads the board view + swimlanes + lists, so reset() re-runs and re-attaches when
the rendered containers
change.
Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their translations.

v10.32 2026-07-23 WeKan ® release

This release fixes the following bugs:

Fix #6512 for OAuth / OIDC logins: after "Login with Google" (or any redirect-style
social login) the user is now sent to All Boards instead of being left on the sign-in
route showing only the language selector until a manual reload. The earlier #6512 fix
covered only the password/register flow (onSubmitHook); OAuth logins do not go through
it, so a client Accounts.onLogin handler (fires for every login method after
Meteor.userId() is set) now navigates home when still on an auth route — guarded so an
auto-login on a deep-linked board URL is not redirected
away.
Thanks to xet7.
[Fix #6511 and #6514 (and the v10.30–10.31 Docker / Sandstorm / production "board
maintenance spinner", missing top user/settings bar, and login-form-not-rendering
reports): the whole client broke with Uncaught Error: ES Modules may not assign module.exports or exports.* followed by Error: No such template: swimlane /
notifications / boardButtons. imports/collectionHelpers.js — a side-effect shim
imported FIRST in client/main.js — ended with module.exports = {} while referencing
the Meteor pseudo-global Package bare; the client rspack build's ProvidePlugin rewrites
Package into an injected ESM import, marking the file an ES module, and an ES module
that assigns module.exports throws at evaluation time. That threw before any template
registered, so Blaze reported "No such template" for the board and header templates, the
board stayed on the spinner, the top bar was missing and the board went blank grey after
login. It reproduced on the official root-domain boards.wekan.team and on plain Docker
with no reverse proxy (ROOT_URL=http://neptun:4001), so it was a global build bug, not a
reverse-proxy / sub-path issue. collectionHelpers (the first such file) was fixed to
use export {},
and then a transitive walk from client/main.js found and converted EVERY remaining
client-reachable CommonJS helper (~55 files under models/lib, client/lib,
imports/lib, imports/) from module.exports = { … } to export { … }, so nothing in
the client bundle assigns module.exports any more — done in
two
parts.
Server-only helpers (the server/lib files Meteor never ships to the client, and the
fs-using file-storage helpers) stay CommonJS. Their plain-Node .cjs unit tests now use
await import(…js); the full tests/*.test.cjs suite has no new failures. This is NOT an
rspack version regression — the lockfile has pinned @rspack/core ~1.7.x since v8.40,
unchanged between the working v10.17 and the broken v10.27.
Thanks to mueschel, jullbo, akshat-goel, AmigaAbattoir and xet7.
Removed the unused jam:offline / jam:method / jam:pub-sub packages. Once the client
booted (after the ES-module fix above), jam:offline's startup sync threw
can't access property "remove", localCollections[name] is undefined — it tried to
reconcile a collection the client never registered, because WeKan uses no jam:offline
.keep() and no jam:method / jam:pub-sub APIs anywhere. These were already removed
once for the same reason and had been re-added; the offline-warning UI uses
Meteor.status(), so it is unaffected.
Thanks to xet7.
Fixed six pre-existing plain-Node unit-test failures that surfaced while verifying the
ES-module conversion: five were stale source-guards (a slice window too small, a regex
matching a pattern quoted in a comment, a moved template button, a widened valid-width
range, a report-controls count that grew) and one was a real cleanup race —
streamHeaderToTemp unlinked its partial temp file fire-and-forget while the write
stream was still opening, so a caller could see the file after the rejection; it now
removes the file only after the stream
closes.
Thanks to xet7.

and updates the following dependencies:

Pinned @rspack/core, @rspack/cli and @meteorjs/rspack to exact versions (removing
the ^ caret ranges) so a fresh npm install cannot silently drift the bundler to a
newer release that changes CommonJS/ES-module handling and breaks the client
build.
Thanks to xet7.

and has the following developer-tooling fix:

rebuild-wekan.sh can now stop a running dev server on a minimal Linux that has neither
fuser (psmisc) nor lsof installed: free_tcp_port gained an ss fallback that parses
the owning pid from ss -ltnpH "sport = :PORT" and kills it. Previously it did nothing on
such a host — while port_in_use (which uses ss) kept reporting the port busy — so the
menu failed with "Port 3000, 8080 or 3001 is still in use … Stop it manually and retry"
and the dev server could not restart.
Thanks to xet7.

and improves the translation workflow:

Fix #6494 (Transifex human translations were overwritten and the fetch was omitted):
removed the external machine-translation service (machine-translate.mjs, which called
LibreTranslate/DeepL and needed a WEKAN_MT_URL / WEKAN_MT_API_KEY). Remaining strings
that are untranslated everywhere are now translated DIRECTLY (no external service, key or
password), using each language's existing translations and general kanban terminology as
the reference, and applied with a new fill-translations.mjs that writes ONLY into
English-placeholder keys — so a fill can never overwrite a human translation. In the
releases/translations/ scripts a HUMAN translation is ALWAYS PREFERRED and merged: the
pull always fetches the newest Transifex translations first, merge-translations.mjs
keeps a real Transifex translation and restores a committed human translation the pull
reverted to English (leaving English only where a string is untranslated everywhere), and
filled strings stay LOCAL — they are never pushed to Transifex as if human. This restores
the two-way process; verify-human-preference.mjs proves both directions with 10
cases.
Thanks to s2ldan and xet7.

Thanks to above GitHub users for their contributions and translators for their translations.

v10.31 2026-07-23 WeKan ® release

This release fixes the following bugs:

Fix #6512: after a successful login or register, go straight to the All Boards page
instead of landing back on the login layout that shows only the language selector
("Vaihda kieltä") until a manual reload. onSubmitHook navigated home immediately, but
the home route's sign-in guard checks Meteor.userId() non-reactively and bounced back
to sign-in while the userId was still propagating (a tick after login); the same guard
also stranded a returning user during auto-login from a stored token. onSubmitHook now
waits reactively for Meteor.userId() before navigating (with a timeout fallback), and
the All Boards guard no longer bounces while a login is in progress
(Meteor.loggingIn()).
Thanks to akshat-goel and xet7.
Fix #6515: the startup / board-open board repair no longer unbinds per-swimlane lists.
repairBoardsOnStartup ran the shared repair over every board and cleared swimlaneId
to null on EVERY list that had one — treating any swimlane-bound list as #6484
corruption. But a list with a swimlaneId is a legitimate PER-SWIMLANE list (rendered
only in its own swimlane), indistinguishable from a #6484-corrupted board-wide list at
the data level, so on upgrade to v10.26+ the routine silently unbound every per-swimlane
list (listsUnbound: 24 in the reporter's log) and all lists then rendered in every
swimlane; board open re-ran the repair, so even a manual restore was nulled again. The
automatic repair no longer clears any list's swimlaneId (the safe card repairs stay);
the #6484 code bug is already fixed, and an admin can still deliberately un-bind a
specific board. Affected boards keep their bindings now, and a restore from a pre-upgrade
backup will stick.
Thanks to jullbo and xet7.

Thanks to above GitHub users for their contributions and translators for their translations.

Uh oh!

Uh oh!

Releases: wekan/wekan

Release list

v10.40

v10.40 2026-07-27 WeKan ® release

Uh oh!

v10.39

v10.39 2026-07-26 WeKan ® release

Uh oh!

v10.38

v10.38 2026-07-26 WeKan ® release

Uh oh!

v10.37

v10.37 2026-07-25 WeKan ® release

Uh oh!

v10.36

v10.36 2026-07-25 WeKan ® release

Uh oh!

v10.35

v10.35 2026-07-24 WeKan ® release

Uh oh!

v10.34

v10.34 2026-07-24 WeKan ® release

Uh oh!

v10.33

v10.33 2026-07-23 WeKan ® release

Uh oh!

v10.32

v10.32 2026-07-23 WeKan ® release

Uh oh!

v10.31

v10.31 2026-07-23 WeKan ® release

Uh oh!