v10.37 2026-07-25 WeKan ® release

This release fixes the following SECURITY ISSUES found by GitHub CodeQL code
scanning:

• js/incomplete-sanitization (High), alert #428, in
  tests/boardHeaderOneLine.test.cjs: the CSS rule bodies were split with
  rule.split('{') and the trailing brace removed with body.replace('}', ''),
  which strips only the FIRST }. The block is now matched with one regex that
  captures selector and body as separate groups, so no brace ends up in the text
  and there is nothing to strip.
• js/incomplete-sanitization (High), alert #427, in
  tests/testsAreRegistered.test.cjs: a file name was spliced into a RegExp
  after escaping only dots, leaving every other metacharacter — the backslash
  above all — able to change the meaning of the pattern. It now goes through an
  escapeRegExp() that escapes the full set, backslash included.
• Both are test helpers, so neither was reachable by an attacker, but both were
  genuinely wrong string handling
  (commit).
• Thanks to GitHub CodeQL (alerts #427 and #428) and xet7.

and resolves the following GitHub Dependabot alerts in npm dependencies:

• brace-expansion 5.0.7 → 5.0.8 (RUNTIME dependency, transitive via minimatch):
  fixes CVE-2026-14257
  (GHSA-mh99-v99m-4gvg, High, CVSS 7.5, alert #119) — expand() bounds how MANY
  results it produces (max, 100000) but not how LONG they get, so chained brace
  groups keep the count under the cap while every result grows one character per
  group. A ~7.5 KB input ('{a,b}'.repeat(1500)) exhausts memory and kills the Node
  process with a fatal, uncatchable out-of-memory error that try/catch cannot
  contain. 5.0.8 bounds the total characters one expand() call may accumulate
  (maxLength, default 4000000) inside the output-building loops, so intermediate
  arrays are bounded too and oversized input is truncated rather than fatal. Patch
  release in the same major line; the only other change is engines.node, which drops
  Node 18 — WeKan builds and ships on Node 24 (Dockerfile NODE_VERSION=v24.18.0, CI
  NODE_VERSION: '24'), so nothing is affected
  (#6523, merge commit).
• postcss 8.5.15 → 8.5.22 (dev dependency; enters only through css-loader, which
  the rspack build uses for .css, and is not itself part of the shipped bundle):
  fixes GHSA-r28c-9q8g-f849
  (High, CVSS 7.5) — postcss follows a /*# sourceMappingURL=... */ comment in the CSS
  it parses and builds the path with path.join(dirname(from), annotation), which
  normalises but does not sandbox .., so a crafted comment discloses arbitrary .map
  files. Affected <= 8.5.17, patched in 8.5.18. nanoid 3.3.12 → 3.3.16 rides along
  as postcss's own dependency
  (#6522, merge commit).
• Both are lock-only changes whose tarball integrity hashes were verified against the
  npm registry, and the brace-expansion lock edit was reproduced independently with
  npm update brace-expansion --package-lock-only, which produced a byte-identical
  diff. elliptic (alert #55, CVE-2025-14505) is still left pinned for the reason
  recorded in v10.14: no fixed version is published upstream — the latest release is
  still 6.6.1 and the advisory lists no patched version. It is a dev-only transitive
  polyfill (@meteorjs/rspack → node-stdlib-browser → crypto-browserify →
  browserify-sign/create-ecdh), no WeKan client module imports node crypto, and
  the built client bundle contains no elliptic/secp256k1/crypto-browserify code
  at all, so it never reaches users.
• Thanks to GitHub Dependabot and xet7.

and has the following developer-tooling fix:

• docs/Security/gh/pull-security-reports.sh reported OK for every endpoint and
  then wrote empty split files and blank counts. gh api --paginate --slurp returns
  ONE ARRAY PER PAGE, so a list endpoint arrives as [[alert,...],[alert,...]];
  nothing flattened that, so .[] yielded PAGES rather than alerts and every
  select(.state == "open") ran against an array. jq failed, its error went to
  /dev/null, and the > redirect left a 0-byte file — not valid JSON, so every
  later step on it failed too and printed nothing. A security report that quietly
  claims there is nothing to see is worse than one that fails. The pages are now
  concatenated (only when every element is itself an array, so single-object
  endpoints like the SBOM are untouched), a failed filter leaves a valid empty array
  plus a readable error instead of truncating the file, the secret-scanning
  redaction validates the redacted copy before deleting the dump that still holds
  live secrets (and removes it on the failure path too), and counts always print a
  number. The same shape had also broken the newest-analysis lookup and the
  codeql-databases dump.
  Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their
translations.

v10.36 2026-07-25 WeKan ® release

This release fixes the following bugs:

• The Change profile image window (Member settings > Change Avatar, and the same
  window in Admin Panel > People) rendered each avatar row's "Delete" link and file
  name INSIDE the row's select link. An <a> inside an <a> is invalid HTML: the
  browser closes the outer anchor, so the file name and the Delete link fell out of
  the row's flex layout and rendered as bold text floating at the right edge, and a
  click on Delete also selected that avatar. Delete and the file name were shown only
  for the avatar currently in use, so no other upload could ever be deleted, and an
  empty p.sub-name added a stray block in the middle of the row. Each row is now one
  flex line - thumbnail, file name (truncated with the full name as a tooltip), a
  check mark when it is the avatar in use, and a delete button that is a SIBLING of
  the select link, so deleting never also selects and every uploaded avatar can be
  deleted. The row in use is highlighted like in the other pop-over lists, the
  initials row shows its "Default avatar" label under the name, and the upload hints
  (max filesize, allowed filetypes, invalid filename) are grouped into one muted
  paragraph above the upload button. Deleting the avatar in use left
  profile.avatarUrl pointing at a file that no longer existed - a broken image
  everywhere - so both windows now fall back to the initials when the deleted file is
  the one in use. The Admin Panel window also passed userData= to
  userAvatarInitials, which reads this.userId, so its initials rendered
  empty.
  Thanks to xet7.
• On iPad Safari a full-screen "Uncaught runtime errors: ERROR Script error." panel
  appeared after login, and again when the Safari Share sheet was opened on All Boards
  to add WeKan to the home screen. That panel is webpack-dev-server's error overlay,
  shipped by the rspack DEV server only - a production build has no dev server and no
  overlay. It opens for every window error event, including ones that carry no
  information: a browser sanitises an error thrown by a CROSS-ORIGIN script to the bare
  message "Script error." with no error object and no stack, and iOS Safari raises those
  from its own machinery and from content blockers and extensions, which is what the
  Share sheet triggered. It cannot come from WeKan's own code, because the bundle is
  served same-origin (no CDN_URL), so a real WeKan error always reaches the overlay
  with its actual message and stack. The overlay now ignores exactly that one message
  and still shows every other runtime error and all compile
  errors.
  Thanks to xet7.
• The board bar (the second header bar) fits on one line on iPad. In landscape it
  wrapped onto two rows - board title, edit, visibility, watch, star and sort on the
  first, Filter / Search / view / dependencies / multi-selection / hamburger on the
  second. Measured at a 1180 CSS px viewport the two rows needed about 1304px on one
  line, ~124px more than the viewport, and nearly all of that is per-button empty space
  rather than text: each button carries 12px side margins, 10px on each side of its icon
  and a 10px gap after its label, about 54px of chrome around a ~60px icon+label. So
  nothing has to be hidden at that width: halving the chrome between 801px and 1400px
  frees ~295px, which fits the bar on one line with room to spare for languages with
  longer labels, and icon and label sizes are untouched so the buttons stay comfortable
  to tap. In tablet portrait (820px), where even the halved chrome cannot fit the labels,
  they drop to icons only between 801px and 1000px - the same treatment phones already
  get below 801px, with titles, tooltips and popups unchanged. Wide desktops, which never
  wrapped, look exactly as before, and phones keep their 44px touch
  targets.
  Thanks to xet7.
• A long board title now moves ALL of the board bar's buttons to its second row,
  under the title. Before, the controls were split across the two rows: the title kept
  the left group (edit, visibility, watch, star, sort) beside it and only the right
  group (Filter, Search, view, dependencies, multi-selection, hamburger) wrapped
  underneath. That is what separate flex items do - the title and the three button
  groups were four children of the header row, so the row broke wherever it ran out of
  width. The three groups now live inside one wrapper, so the row has just two items,
  the title and the buttons, and either the buttons fit beside the title or the whole
  set moves down together. A short title is unaffected, because the wrapper measures as
  its own content width and only moves down when it genuinely does not fit. A title
  longer than the whole bar now wraps inside the title instead of overflowing the
  viewport.
  Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their
translations.

v10.35 2026-07-24 WeKan ® release

This release fixes the following bugs:

• Copying a board works again (POST /api/boards/:boardId/copy). swimlane.copy(), which
  runs on the server, called the SYNCHRONOUS getDefaultSwimline() on the source board to
  detect its default swimlane; for a board with no pickable swimlane that getter self-heals via
  a synchronous Swimlanes.upsert(), which Meteor 3 rejects on the server (update is not available on the server. Please use updateAsync() instead.), so the whole copy threw. It now
  calls the existing getDefaultSwimlineAsync() (same pick + idempotent upsertAsync
  self-heal). Two related hardenings landed with it: the copy REST route caught the error with
  sendJsonResult(res, { data: error }), and that helper defaults the HTTP status to 200 when
  no code is given — so a copy that THREW was returned as 200 with the error object as the
  body, indistinguishable from success (that is what the REST test caught); the route now
  returns 500 with the message and logs the stack, so a failed copy is a clean, diagnosable
  error. And board.copy()'s custom-field remap did card.customFields.map(...), which throws
  for a card whose customFields is absent (the schema defaults it to [], but a card copied
  via .direct or seeded raw can lack it) — it now skips cards that have none, matching the
  !Array.isArray(this.customFields) guard used elsewhere in the
  model.
  Thanks to xet7.

• All Boards header on a phone, follow-up: the section icon and the Multi-Selection / Sort
  buttons really do share ONE row now, with the Search box on the row below, and a workspace
  name no longer hides under its "bars" menu button. The buttons and search box live inside a
  .path-right wrapper, so the v10.34 attempt (giving that wrapper flex) only made the
  WRAPPER wrap as a two-line block beneath the section icon, leaving the icon alone on row 1.
  On a phone .path-right is now display: contents, which dissolves the wrapper so its
  buttons and search field become direct items of the header's own flex row; the header then
  wraps them itself — section icon + buttons on row 1, full-width search on row 2. And the
  narrow-left-menu workspace NAME had a min-width floor that stopped it shrinking, so in the
  cramped row its box overflowed onto the "bars" workspace-menu button to its right and the
  hamburger looked like it sat on top of the name; the floor is removed and the name's box is
  clipped, so the name truncates with an ellipsis and can never cover the menu, while the menu
  button and count never shrink.
  Thanks to xet7.

• Upgrading no longer grows a spurious "Restored Items" column full of cards that look
  empty but are not. Four obsolete per-swimlane-lists-era board migrations fought today's
  data model and are removed. restoreLostCards created a "Lost Cards" swimlane and a
  "Restored Items" list and moved cards into them — it counted a card "orphaned" when its
  list was merely ARCHIVED (archived lists are excluded from the set it checks) and "lost"
  when its swimlaneId was '' (which is NORMAL for a board-wide shared card), so it
  dragged real, healthy cards into "Restored Items", where they rendered oddly.
  comprehensiveBoardMigration and fixMissingListsMigration converted today's board-wide
  SHARED lists (swimlaneId '') back into per-swimlane DUPLICATE columns — the exact damage
  the startup schema step merge-per-swimlane-lists now UNDOES — and restoreAllArchived
  un-archived every swimlane / list / card at once. All four had NO callers left (their admin
  migration dashboard was already removed), so they were dead code exposed only as
  admin-callable Meteor methods that could re-corrupt a board if invoked. The correct paths
  remain: the board-open self-heal (repairBoardData) relinks a genuinely missing swimlaneId
  or an orphaned card to the board's real first list/swimlane, and merge-per-swimlane-lists
  merges any per-swimlane duplicate columns back into one shared list while cards keep their
  swimlaneId; it still keys off the era's board markers in existing data, so removing the code
  that once wrote them changes nothing for already-migrated boards. A test keeps the four from
  coming back.
  Thanks to hmeunier95 and xet7.

and has the following developer-tooling changes:

• build.sh and build.bat gain a Setup → "Update git" action that makes
  the working copy current in one step: git fetch --all --prune, git pull --rebase --autostash onto origin/<branch>, then it repoints any CHANGELOG commit links the rebase
  made stale, then shows git status. It never commits — if the hash fix changed CHANGELOG.md
  it says so and leaves it for review — and on a rebase conflict it stops with the exact
  commands to continue or abort. The commit-link repair that lived inline in
  releases/release-all.sh is extracted to releases/fix-changelog-hashes.sh so there is ONE
  implementation, now called by both the release script and the new menu action; behaviour is
  unchanged (only the unreleased section is touched, stale links are repointed to the
  same-subject rewritten commit, unresolved links warn and never abort). The Windows .bat
  runs the shared bash script via Git Bash and degrades gracefully with instructions when bash
  is not on PATH.
  Thanks to xet7.

• The Playwright WebKit tests no longer fail spuriously from renderer crashes on a headless
  ARM host. A test run left eight core dumps in tests/playwright/, all of WebKit's
  WPEWebProcess renderer, aborting (SIGTRAP) from the Mesa llvmpipe software-GL stack on this
  Apple Silicon / Asahi host; a renderer that dies mid-test makes the next click/navigation time
  out, so it looked like WebKit-only failures (admin users, checklist delete, rules, All Boards
  sort) rather than real WeKan bugs. playwright.config.js now defaults
  WEBKIT_DISABLE_DMABUF_RENDERER=1 (unless already set) — the standard fix for WPE WebKit
  aborting in headless / containerized / VM / software-GL environments; Playwright passes
  process.env to the browser so it covers every run path, and it is harmless for Chromium and
  Firefox. .gitignore now ignores core dumps (core.<pid>) so a crashing test browser can no
  longer leave untracked multi-MB files to be committed by
  accident.
  Thanks to xet7.

• The developer build/test helper is renamed rebuild-wekan.sh → build.sh and
  rebuild-wekan.bat → build.bat (a shorter name; the menu and every option are unchanged).
  All references were updated across the repo — the docs (Build-from-source, Windows, Sandstorm,
  Raspberry Pi, etc.), README.md, CONTRIBUTING.md, CLAUDE.md, releases/release-all.sh and
  releases/fix-changelog-hashes.sh, tools/forge-mirror.js, and the tests (the guard suite is
  renamed to tests/buildDevServer.test.cjs). If you invoke it by the old name, use ./build.sh
  / build.bat now.
  Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their translations.

v10.34 2026-07-24 WeKan ® release

This release adds the following new features:

• Admin Panel → Problems → Summary now has a Repair button for "Broken cards N". The page
  reported the count and told the admin to "run the repair migration", but there was no
  button anywhere to run one — and no repair in the app could actually clear that count.
  countBrokenCards() counts every card missing a boardId OR a swimlaneId OR a
  listId, while repairAllBoards() walks only NON-ARCHIVED boards and only ever sets
  swimlaneId, so three kinds of counted card could never be repaired by anything: cards
  on an archived board, cards with a missing listId, and cards with no boardId at all.
  The new admin-only repairBrokenCards method runs the standard per-board pass and then
  closes those gaps, assigning the affected cards to their board's first usable
  list/swimlane (creating a default one when the board has none) and resolving each board's
  defaults once rather than once per card. Cards with no boardId cannot be placed on any
  board — guessing would drop a user's card onto an unrelated board — so they are reported
  as unfixable and left alone, never deleted, instead of leaving a count that never reaches
  zero unexplained. What counts as broken now lives in ONE pure module used by both the
  count and the repair, so they can no longer drift apart, with unit and negative tests for
  the rule.
  Thanks to xet7.

• Admin Panel → Problems → CPU usage now shows the CURRENT CPU usage between the page
  title and the Search box. The page listed only PAST high-CPU periods, so it could not
  answer "what is the CPU doing right now?" — the one question an admin opens it to ask.
  The new line shows the system CPU percentage, core count, 1/5/15 minute load average and
  the coarse "what WeKan is doing" label, refreshed every 5 seconds and outlined in red
  while the monitor considers the CPU sustainedly high. It reads the same sample the
  monitor writes its event rows from, so the header and the rows below it can never
  disagree, and with the background monitor disabled (WEKAN_CPU_MONITOR=false) it
  measures between calls using a separate baseline instead of always reading
  0%.
  Thanks to xet7.

and fixes the following bugs:

• Admin Panel → Problems no longer shows a finished board-repair as still running,
  nor counts informational CPU rows as "new problems". On an idle server with far
  fewer than 146 boards the Status page showed "Board data-repair — 146/146 boards"
  running forever (with a matching "Migration or repair" login warning), and the CPU
  area showed dozens of "new problems". The repair actually finishes and writes
  running:false, but the startup pass ALSO fired a non-awaited running:true
  progress write at the last board (boardsDone === boardsTotal); being
  fire-and-forget it could land after the awaited completion write and pin the doc at
  "running, 146/146" — and a process killed mid-repair leaves running:true too. The
  startup pass now persists only intermediate progress (the completion write owns the
  final state), and the Status page asks a pure isStatusActive() instead of reading
  the raw flag: a migration/repair counts as in progress only while it is running AND
  not in a terminal phase AND not already finished by count (done >= total) AND
  updated recently (a running flag with no recent progress write is a crashed run), so
  a doc already stuck on an instance heals itself and the "Migration or repair" warning
  clears with it. The CPU "new problems" count excluded nothing: the monitor writes one
  detected row when a high-CPU period starts and several severity:'info' rows
  (remediated when it ends, mitigation and FerretDB-governor rows), so each brief,
  already-over spike looked like several problems; the count now excludes
  severity:'info' rows — notices that a problem was handled or cleared are not
  problems — while rows with no severity still count, so nothing unclassified is
  dropped.
  Thanks to Alishara and xet7.

• "Map to existing user" for an imported (virtual) member now searches every user
  instead of listing only board members. After importing a Trello board and choosing to
  map users later, the picker offered nothing but the admin: it listed only the ACTIVE
  REAL MEMBERS of the board, and right after an import the real people have no membership
  at all — the placeholders do — so on a board whose only real member is the importing
  admin there was literally nobody to pick, and no search box either. The picker now has a
  search box that goes through the same permission-checked searchUsers method the normal
  add-member typeahead uses, so the same board-membership check and the same #6116
  same-org/team restriction apply; with the box empty it still lists the board's real
  members (which changes no roles at all), and typing searches every real user and labels
  the ones who are not on this board yet. Mapping onto a user who is not a board member
  adds them with the PLACEHOLDER's own role — the role the import recorded for that
  person, never a higher one — and only after passing exactly the checks inviting them
  would: the Admin Panel "roles allowed to invite" setting, the same-org/team restriction,
  and the refusal to add a deactivated account. This also fixes sanitizeUserForSearch
  dropping profile from every search result — it read the Mongo-style paths in its
  allowlist (profile.fullname) as FLAT keys, so both this picker and the add-member
  typeahead showed a blank name with only the username in
  brackets.
  Thanks to AmigaAbattoir and xet7.

• Admin Panel report styles were never loaded, so every report's prev/next pagination
  button rendered with a black background. client/components/settings/adminReports.css
  was not imported anywhere, and package.json sets meteor.mainModule, which disables
  Meteor's eager loading — a CSS file that nothing imports is simply not in the bundle. The
  buttons fell through to the global button { background: var(--theme-accent, #000) } in
  forms.css, which is BLACK when no custom theme colour is set. All prev/next controls in
  WeKan (admin reports, People/Org/Team/Domain, All Boards, board Table view, cron tables)
  now share one themed stylesheet that also covers :focus and :active — forms.css
  styles those at a specificity equal to or higher than a plain .some-pagination button
  rule, so even a loaded stylesheet lost as soon as the button was clicked and pressing
  "next" left it dark grey until it lost focus. Disabled is now the same themed outline
  faded rather than a grey block, and the "3 / 42" page info inherits the surrounding text
  colour instead of a hard-coded #333 that vanishes on dark
  backgrounds.
  Thanks to xet7.

• Admin Panel → Problems → Cards report loads and pages faster. The report already
  paginated server-side (25 rows per page via limit/skip), so it never loaded all cards
  into the browser, but the cardsReport publication sent WHOLE card documents —
  description, customFields, vote/poker sub-documents, every date field — when the table
  renders only six columns, so a 25-row page could be hundreds of kilobytes on boards with
  long descriptions; it now projects only the six columns shown. And every prev/next click
  re-ran the report's count method as well as re-subscribing, paying for a full collection
  count plus a second server round trip even though the total cannot change just because
  you moved to the next page; opening a report and searching in it now recount, plain
  paging does not. Both changes also apply to the files, rules, boards, impersonation and
  recovery reports, which share the same loader.
  Thanks to xet7.

• Six Meteor methods threw Did not check() all arguments during call to '<method>',
  because this app runs with the audit-argument-checks package: a method that RECEIVES
  an argument it never check()s fails the call outright. problemDetailReport(area) had
  the defect but nothing had ever passed it an argument, so it surfaced only when the new
  Admin Panel → Problems → CPU usage header started polling problemDetailReport('cpu')
  every 5 seconds and filled the server log with the exception. Auditing every server
  method for the same defect found five more that ARE called with arguments from the
  client, so those features were failing outright: unlockUser (Admin Panel → People,
  unlocking a locked-out user), runBackup, restoreBackup and saveBackupSchedule
  (Admin Panel → Attachments) and migrateTextDatabase (the MongoDB ↔ FerretDB text
  migration), plus getServiceConfiguration, which has no current client caller. Each now
  checks its arguments against the types its call sites actually pass
  .
  Thanks to xet7.

• [Every bundled binary now runs through cpu-exec on Sandstorm and in the snap, so a CPU
  missing an instruction-set feature falls back to qemu-user instead of killing the app
  with SIGILL. cpu-exec (#6458) exists for exactly that — AVX masked by a hypervisor
  (QEMU/KVM/Proxmox), an old CPU, ARMv8.0 on a Raspberry Pi — and with no features
  declared it is a plain exec, which is why the design is to route everything through it.
  Sandstorm SHIPPED cpu-exec and qemu-x86_64 but its grain launcher spawned all eight
  bundled binaries directly (ferretdb, mongod 3.0 twice, niscud, the legacy mongo CLI
  twice, and node for the bridge and the importer), so the safety net sat in the package
  unreachable — on the platform with the least control over its hardware, since a grain
  runs on wha...

v10.33 2026-07-23 WeKan ® release

This release adds the following updates:

• Added anupamme of OrbisAI Security to Hall of Shame: Fake AI.
  Part 1,
  Part 2.
  Thanks to anypamme.

and fixes the following bugs:

• List header card count is now scoped to the swimlane it is shown in, so a shared list
  no longer shows the whole-list count over an empty second swimlane (the "5 Cards" header
  above a swimlane with no cards). A shared list — one whose swimlaneId is empty, the
  pre-per-swimlane-lists layout — renders under every swimlane, but cardsCount() counted
  by the list's OWN swimlaneId (''), giving the whole-list total in every swimlane while
  the cards rendered below were correctly swimlane-scoped. It now takes the container
  swimlane id (the same ../../_id the card body already uses) and counts that swimlane's
  cards, matching what is rendered; list.cards() and the lazy (#6480) server count both
  already scope by that id, including first-swimlane shared/orphaned
  surfacing.
  Thanks to xet7.

• Re-attach mouse drag-scrolling (dragscroll) when a board's swimlanes/lists render or
  change, so lower swimlanes stay reachable by dragging. @wekanteam/dragscroll attaches
  its mouse handlers per element in reset(), but the board's reset autorun only depended
  on the touch/permission reads — not the swimlanes/lists — so when they rendered AFTER
  onRendered (adaptive lazy card loading, the on-open data-repair adding a default
  swimlane, or a board switch that reuses the template instance without re-firing
  onRendered) the new .dragscroll containers never got mouse handlers: dragging no
  longer scrolled and, with the vertical scrollbar hidden, only the top swimlane was
  reachable (touch still worked via the document-delegated dragscrollTouch). The autorun
  now reads the board view + swimlanes + lists, so reset() re-runs and re-attaches when
  the rendered containers
  change.
  Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their translations.

v10.32 2026-07-23 WeKan ® release

This release fixes the following bugs:

• Fix #6512 for OAuth / OIDC logins: after "Login with Google" (or any redirect-style
  social login) the user is now sent to All Boards instead of being left on the sign-in
  route showing only the language selector until a manual reload. The earlier #6512 fix
  covered only the password/register flow (onSubmitHook); OAuth logins do not go through
  it, so a client Accounts.onLogin handler (fires for every login method after
  Meteor.userId() is set) now navigates home when still on an auth route — guarded so an
  auto-login on a deep-linked board URL is not redirected
  away.
  Thanks to xet7.

• [Fix #6511 and #6514 (and the v10.30–10.31 Docker / Sandstorm / production "board
  maintenance spinner", missing top user/settings bar, and login-form-not-rendering
  reports): the whole client broke with Uncaught Error: ES Modules may not assign module.exports or exports.* followed by Error: No such template: swimlane /
  notifications / boardButtons. imports/collectionHelpers.js — a side-effect shim
  imported FIRST in client/main.js — ended with module.exports = {} while referencing
  the Meteor pseudo-global Package bare; the client rspack build's ProvidePlugin rewrites
  Package into an injected ESM import, marking the file an ES module, and an ES module
  that assigns module.exports throws at evaluation time. That threw before any template
  registered, so Blaze reported "No such template" for the board and header templates, the
  board stayed on the spinner, the top bar was missing and the board went blank grey after
  login. It reproduced on the official root-domain boards.wekan.team and on plain Docker
  with no reverse proxy (ROOT_URL=http://neptun:4001), so it was a global build bug, not a
  reverse-proxy / sub-path issue. collectionHelpers (the first such file) was fixed to
  use export {},
  and then a transitive walk from client/main.js found and converted EVERY remaining
  client-reachable CommonJS helper (~55 files under models/lib, client/lib,
  imports/lib, imports/) from module.exports = { … } to export { … }, so nothing in
  the client bundle assigns module.exports any more — done in
  two
  parts.
  Server-only helpers (the server/lib files Meteor never ships to the client, and the
  fs-using file-storage helpers) stay CommonJS. Their plain-Node .cjs unit tests now use
  await import(…js); the full tests/*.test.cjs suite has no new failures. This is NOT an
  rspack version regression — the lockfile has pinned @rspack/core ~1.7.x since v8.40,
  unchanged between the working v10.17 and the broken v10.27.
  Thanks to mueschel, jullbo, akshat-goel, AmigaAbattoir and xet7.

• Removed the unused jam:offline / jam:method / jam:pub-sub packages. Once the client
  booted (after the ES-module fix above), jam:offline's startup sync threw
  can't access property "remove", localCollections[name] is undefined — it tried to
  reconcile a collection the client never registered, because WeKan uses no jam:offline
.keep() and no jam:method / jam:pub-sub APIs anywhere. These were already removed
  once for the same reason and had been re-added; the offline-warning UI uses
  Meteor.status(), so it is unaffected.
  Thanks to xet7.

• Fixed six pre-existing plain-Node unit-test failures that surfaced while verifying the
  ES-module conversion: five were stale source-guards (a slice window too small, a regex
  matching a pattern quoted in a comment, a moved template button, a widened valid-width
  range, a report-controls count that grew) and one was a real cleanup race —
  streamHeaderToTemp unlinked its partial temp file fire-and-forget while the write
  stream was still opening, so a caller could see the file after the rejection; it now
  removes the file only after the stream
  closes.
  Thanks to xet7.

and updates the following dependencies:

• Pinned @rspack/core, @rspack/cli and @meteorjs/rspack to exact versions (removing
  the ^ caret ranges) so a fresh npm install cannot silently drift the bundler to a
  newer release that changes CommonJS/ES-module handling and breaks the client
  build.
  Thanks to xet7.

and has the following developer-tooling fix:

• rebuild-wekan.sh can now stop a running dev server on a minimal Linux that has neither
  fuser (psmisc) nor lsof installed: free_tcp_port gained an ss fallback that parses
  the owning pid from ss -ltnpH "sport = :PORT" and kills it. Previously it did nothing on
  such a host — while port_in_use (which uses ss) kept reporting the port busy — so the
  menu failed with "Port 3000, 8080 or 3001 is still in use … Stop it manually and retry"
  and the dev server could not restart.
  Thanks to xet7.

and improves the translation workflow:

• Fix #6494 (Transifex human translations were overwritten and the fetch was omitted):
  removed the external machine-translation service (machine-translate.mjs, which called
  LibreTranslate/DeepL and needed a WEKAN_MT_URL / WEKAN_MT_API_KEY). Remaining strings
  that are untranslated everywhere are now translated DIRECTLY (no external service, key or
  password), using each language's existing translations and general kanban terminology as
  the reference, and applied with a new fill-translations.mjs that writes ONLY into
  English-placeholder keys — so a fill can never overwrite a human translation. In the
  releases/translations/ scripts a HUMAN translation is ALWAYS PREFERRED and merged: the
  pull always fetches the newest Transifex translations first, merge-translations.mjs
  keeps a real Transifex translation and restores a committed human translation the pull
  reverted to English (leaving English only where a string is untranslated everywhere), and
  filled strings stay LOCAL — they are never pushed to Transifex as if human. This restores
  the two-way process; verify-human-preference.mjs proves both directions with 10
  cases.
  Thanks to s2ldan and xet7.

Thanks to above GitHub users for their contributions and translators for their translations.

v10.31 2026-07-23 WeKan ® release

This release fixes the following bugs:

• Fix #6512: after a successful login or register, go straight to the All Boards page
  instead of landing back on the login layout that shows only the language selector
  ("Vaihda kieltä") until a manual reload. onSubmitHook navigated home immediately, but
  the home route's sign-in guard checks Meteor.userId() non-reactively and bounced back
  to sign-in while the userId was still propagating (a tick after login); the same guard
  also stranded a returning user during auto-login from a stored token. onSubmitHook now
  waits reactively for Meteor.userId() before navigating (with a timeout fallback), and
  the All Boards guard no longer bounces while a login is in progress
  (Meteor.loggingIn()).
  Thanks to akshat-goel and xet7.

• Fix #6515: the startup / board-open board repair no longer unbinds per-swimlane lists.
  repairBoardsOnStartup ran the shared repair over every board and cleared swimlaneId
  to null on EVERY list that had one — treating any swimlane-bound list as #6484
  corruption. But a list with a swimlaneId is a legitimate PER-SWIMLANE list (rendered
  only in its own swimlane), indistinguishable from a #6484-corrupted board-wide list at
  the data level, so on upgrade to v10.26+ the routine silently unbound every per-swimlane
  list (listsUnbound: 24 in the reporter's log) and all lists then rendered in every
  swimlane; board open re-ran the repair, so even a manual restore was nulled again. The
  automatic repair no longer clears any list's swimlaneId (the safe card repairs stay);
  the #6484 code bug is already fixed, and an admin can still deliberately un-bind a
  specific board. Affected boards keep their bindings now, and a restore from a pre-upgrade
  backup will stick.
  Thanks to jullbo and xet7.

Thanks to above GitHub users for their contributions and translators for their translations.

v10.30 2026-07-23 WeKan ® release

This release updates the following dependencies:

• The bundled FerretDB v1 fork now creates the OpLog ts index on the PostgreSQL, MySQL
  and SAP HANA backends too (previously only SQLite), so an idle Meteor OpLog tail resumes
  with an index range scan instead of re-scanning the whole capped collection on every
  poll. Best-effort per backend, with a descriptive log if a live engine rejects the index
  syntax (see the FerretDB fork changelog). Ships with the bundled FerretDB update. Thanks
  to xet7.

This release fixes the following bugs:

• Fix #6515: the startup / board-open board repair no longer unbinds per-swimlane lists.
  repairBoardsOnStartup ran the shared repair over every board and cleared swimlaneId
  to null on EVERY list that had one — treating any swimlane-bound list as #6484
  corruption. But a list with a swimlaneId is a legitimate PER-SWIMLANE list (rendered
  only in its own swimlane), indistinguishable from a #6484-corrupted board-wide list at
  the data level, so on upgrade to v10.26+ the routine silently unbound every per-swimlane
  list (listsUnbound: 24 in the reporter's log) and all lists then rendered in every
  swimlane; board open re-ran the repair, so even a manual restore was nulled again. The
  automatic repair no longer clears any list's swimlaneId (the safe card repairs stay);
  the #6484 code bug is already fixed, and an admin can still deliberately un-bind a
  specific board. Affected boards keep their bindings now, and a restore from a pre-upgrade
  backup will stick.
  Thanks to jullbo and xet7.

• Fixed a stale #5623 "select all cards scoped to swimlane" unit test that failed after
  the doubled-cards render fix: shared/orphaned cards (no swimlane, or a deleted swimlane)
  now surface ONCE in the FIRST swimlane, so the helper returns them only when the first
  swimlane's other-swimlane ids are passed; the test still asserted the old behaviour. The
  test now covers both the first-swimlane (own + orphaned) and non-first-swimlane (own
  only) contracts; no runtime code change.
  Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their translations.

v10.29 2026-07-23 WeKan ® release

This release adds the following new features:

• Snap: run the bundled FerretDB v1 against an EXTERNAL PostgreSQL / MySQL / SAP HANA
  server instead of the embedded SQLite backend. Two new snap settings —
  snap set wekan wekan-ferretdb-handler=postgresql|mysql|hana and
  wekan-ferretdb-url=… — point FerretDB at a database you run; the default stays the
  zero-dependency sqlite backend, so existing installs are
  unchanged.
  Thanks to xet7.

• Translations: machine translation now only fills the English strings that are
  untranslated EVERYWHERE, so it can never overwrite a human translation. A new
  releases/translations/machine-translate.mjs step (run after the per-key Transifex
  merge, opt-in via WEKAN_MT=1 / WEKAN_MT_URL) translates exactly the leftover
  English placeholders — which also fully fills any language that has no translation at
  all — while a string a human already translated is never selected. Machine output
  stays local and is not pushed to
  Transifex.
  Thanks to xet7.

This release fixes the following bugs:

• snap run wekan.problems now loads the snap settings before its checks, so ROOT_URL /
  LDAP and the other login-page checks read the SAME configuration WeKan runs with.
  Without this the command read an empty environment and reported ROOT_URL is not set
  even after snap set wekan root-url=…, which was confusing when diagnosing a blank
  login page or missing header controls (#6512, #6514).
  Thanks to akshat-goel and xet7.

Thanks to above GitHub users for their contributions and translators for their translations.

v10.28 2026-07-23 WeKan ® release

This release fixes the following bugs:

• Fix #6508 (follow-up): the board member popup now shows "Remap User" for an imported (placeholder)
  member. The action is gated on the member's authenticationMethod === 'imported', but the board
  publication shipped board members' user docs without authenticationMethod, so the field was
  undefined on the client and the action never appeared. It is now published with the board members'
  user fields (already part of Users.safeFields), so the in-board Remap → map-to-existing-user flow
  works.
  Thanks to AmigaAbattoir and xet7.

• Fix #6511: a board showed NO cards, with Error: Bad index in range.removeMember: 0 in the console.
  The card list is a Blaze {{#each}} over a LIMITED, ordered reactive cursor sorted by { sort: 1 },
  which has TIES — when several cards share the same sort value (or due date, etc.) their order is
  non-deterministic across observe/poll cycles, so Meteor's ordered diff computes an out-of-range index
  and the #each throws, rendering no cards (and cascading into the undefined.remove() teardown
  error). A unique _id tiebreaker is now appended to the card-list sort (client cursor and server
  window), making the order deterministic.
  Thanks to mueschel and xet7.

• Opening a card no longer takes ~40 seconds on FerretDB v1 (SQLite). A card's attachments are
  looked up with the dotted key {'meta.cardId': ...}, which the bundled FerretDB dropped from the
  WHERE (it skipped any dotted-path key), so it full-scanned the whole attachments collection with
  a per-row decode on every poll while a card was open — slow card content and high idle CPU. The
  FerretDB v1 fork now pushes down a dotted-path equality/$in as the nested -> expression that
  matches the existing meta.cardId index (see the FerretDB fork changelog). Ships with the bundled
  FerretDB update. Thanks to xet7.

• Activity feed pushes down on FerretDB: the comment-only feed selected activities with a top-level
  $and, which FerretDB v1 (SQLite) does not push down, so the activities collection was
  full-scanned on every poll (slow board/card history on a big board). The scope and activityType
  are now at the top level — exactly equivalent, and both push down to the
  index.
  Thanks to xet7.

• snap run wekan.problems: the login-page checks used affirmative titles, so a FAILING check
  printed e.g. "[error] ROOT_URL is set: ROOT_URL is not set" — confusing. Titles are now neutral
  subjects ("ROOT_URL", "Migration or repair") so each line reads correctly whether the check passes
  or fails.
  Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their translations.