Binaries in these bundles

Each bundle carries a Node.js, a FerretDB and the MongoDB Database Tools.
Which source has a given CPU varies from release to release - nodejs.org
builds some architectures, unofficial-builds others, and the
wekan/node-patches build the ones
neither of them does - and not every source publishes a checksum. This is
what went into this release, and which downloads were checked against a
published SHA256.

A row saying no checksum published is not a failed check - it is a
source that publishes nothing to check against. Those are the ones worth
fixing at the source.

v11.05 2026-08-19 WeKan ® release

In short: opened cards with saved dates render normally again, retain
their labels and remain editable instead of stopping Blaze reactivity with a
date-template context error. Launchpad snap builds now wait for their
release bundles and preserve valid artifacts when Snapcraft only fails during
post-download cleanup.

This release fixes the following bug:

and fixes the following developer-tooling bug:

Thanks to above GitHub users for their contributions and translators for their translations.

Binaries in these bundles

Each bundle carries a Node.js, a FerretDB and the MongoDB Database Tools.
Which source has a given CPU varies from release to release - nodejs.org
builds some architectures, unofficial-builds others, and the
wekan/node-patches build the ones
neither of them does - and not every source publishes a checksum. This is
what went into this release, and which downloads were checked against a
published SHA256.

A row saying no checksum published is not a failed check - it is a
source that publishes nothing to check against. Those are the ones worth
fixing at the source.

v11.03 2026-08-19 WeKan ® release

In short: accessibility gives shared tabs, dialogs, images, password
controls and card edit targets coherent names and keyboard order throughout
WeKan, with one common keyboard utility keeping those behaviors consistent.
Card details restore checkbox custom fields, keep their saved values
separate from field visibility, save currency values, provide independent
opened-card and minicard visibility settings, make every custom-field value
copyable, use compact accessible pencil icons for Edit actions, restore the
grid/one-per-row layout switch, restore cross-board card links, omit deleted
custom fields from exports, and make attachment previews use the available
viewport. JFIF image uploads receive portable JPEG download names. Linked cards
mirror every visible source field across boards and
authorized members can edit that shared content from either board. Card
locations recognize both map URLs and plain coordinate pairs. Positive,
negative and browser regression coverage keeps each interaction working.
Existing boards also receive the new default-on opened-card custom-fields
setting during schema upgrade. Opened cards can be resized wider as well as
narrower on desktop. All Boards keeps the complete
invitation message and its actions visible on phone-sized layouts.
Developer tooling keeps long-running Rspack development watchers from
retaining cache state until they exhaust the JavaScript heap, and lets Flatpak
terminals run the Firefox/WebKit matrix through host Docker. Dependencies
refresh S3 storage, build analysis, keyboard shortcuts, CSV parsing and browser
automation.
Admin Panel / Problems / Offices groups login addresses by person and shows
each address family, available location, per-person login count and available
initials instead of empty avatar circles.
Admin Panel / People / People summarizes each person's login countries and
opens country-by-country city, IPv4, IPv6 and login-time details. Problems
pagination no longer mixes a specialized pane's state with the shared reports.
The complete browser run restores inline title and date editing, popup focus,
loading-state accessibility and phone board scrolling while bringing its
selectors in step with the current UI.

This release fixes the following bugs:

The Admin Panel - reports about people and where they log in from.

Card details - fields, attachments and links on an opened card.

Binaries in these bundles

Each bundle carries a Node.js, a FerretDB and the MongoDB Database Tools.
Which source has a given CPU varies from release to release - nodejs.org
builds some architectures, unofficial-builds others, and the
wekan/node-patches build the ones
neither of them does - and not every source publishes a checksum. This is
what went into this release, and which downloads were checked against a
published SHA256.

A row saying no checksum published is not a failed check - it is a
source that publishes nothing to check against. Those are the ones worth
fixing at the source.

v11.02 2026-08-18 WeKan ® release

In short: nothing here yet. This paragraph is the first thing a reader sees,
so replace it as entries are added: say what the release amounts to, which areas
changed and what changed about them, with the notable names in bold, and
account for the rest in a closing clause. The table below is carried over from
the release under this one, and is refilled from each build's provenance.tsv
when this release is made.

Binaries in these bundles

Each bundle carries a Node.js, a FerretDB and the MongoDB Database Tools.
Which source has a given CPU varies from release to release - nodejs.org
builds some architectures, unofficial-builds others, and the
wekan/node-patches build the ones
neither of them does - and not every source publishes a checksum. This is
what went into this release, and which downloads were checked against a
published SHA256.

A row saying no checksum published is not a failed check - it is a
source that publishes nothing to check against. Those are the ones worth
fixing at the source.

v11.01 2026-08-18 WeKan ® release

In short: Admin Panel / Problems gains the missing Delete settings pane,
where a Global Admin can enable the existing, default-off permanent-delete gate.
The pane sits above Notifications, has a stable address of its own, and explains
that enabling the gate does not delete content by itself. Its checkbox also stays
checked after saving because the reactive settings publication returns the stored
value. Below that: regression coverage keeps the menu order, pane rendering, URL,
setting handler and publication together, with the corresponding Admin Panel
documentation and English source strings. The newest All Boards and
permanent-delete controls are also translated into 69 languages and regional
variants.
Permanent-delete setting changes and
board-purge attempts, including unauthorized and failed ones, are audited in
Recovery with Boolean status, acting user, proxy-aware IP address, board IDs
and titles; coloured icons distinguish success, failure and deleted data, and a
dropdown filters the audit to All, Done, Failed or Deleted events. A second
description below the database-recovery explanation names the permanent-delete
events and fields recorded here.
The Delete settings pane repeats that audit explanation below its existing text,
so an administrator sees what Recovery will record before changing the gate.
Board Archive removes permanent delete from individual board icons and
offers it as one confirmed red action on a multi-selection, with the same gate
enforced again on the server without Meteor argument-audit failures. When that
gate is disabled, the sidebar explains
where to enable it instead of showing an inapplicable selection instruction. Its
enabled Delete button and server method both require the site-wide Global Admin
flag. Select All and Select None above the icons make that selection explicit
and quick.
Dragging that archived selection now highlights only Remaining and existing
Workspaces as valid restore targets. Archived tiles no longer show an
action-looking archive glyph at their lower-left corner.
The same themed controls now cover Remaining, Starred, Home and Templates,
always following the visible section and search result. While that mode is on,
its action sidebar now stays visible until Multi-Selection is turned off, and
its actions remain available before the first board is checked. Closing that
sidebar with its X also turns Multi-Selection off. Setting a Home board now
requires exactly one checked board, and the Home section offers only the actions
that make sense for its current board. Dragging a selection onto Home follows
the same one-board rule. Remaining can now drag boards onto
Starred or Archive as green targets. Home's empty state also states its
one-board limit before dragging begins. All Boards and board loading now
publish only dashboard board fields, keep templates separate, omit empty share
branches, paginate in the database and snapshot lazy card windows on FerretDB.
Workspace boards can also be dragged additively to Starred or, after
confirmation, moved to Archive, and existing Workspace views now show Select
All and Select None while Multi-Selection is active.
The CPU governor also observes FerretDB before acting and never slows its read
path when its configured cap is zero or an idle WeKan sees FerretDB itself busy.

This release adds the following features:

The Admin Panel - server-wide safety settings.

Binaries in these bundles

Each bundle carries a Node.js, a FerretDB and the MongoDB Database Tools.
Which source has a given CPU varies from release to release - nodejs.org
builds some architectures, unofficial-builds others, and the
wekan/node-patches build the ones
neither of them does - and not every source publishes a checksum. This is
what went into this release, and which downloads were checked against a
published SHA256.

A row saying no checksum published is not a failed check - it is a
source that publishes nothing to check against. Those are the ones worth
fixing at the source.

v11.00 2026-08-17 WeKan ® release

In short: RouteBleed, found by GitHub CodeQL, removes an incompletely
escaped dynamic regular expression from board-export route coverage. All
Boards on phones uses one native page scroller in mobile and desktop UI modes,
so ordinary boards, invitation controls and table rows remain reachable with
the same vertical swipe; the shared layout extends that behavior to every page.
Snap database recovery can read retained MongoDB 4.x, 5.0,
6 and 7 data and merge it into the live FerretDB without opening SQLite twice.
Helm containers size the Node.js heap from their memory limit, and the
official chart supplies enough memory for startup plus native allocations.
Minicard titles save again from their inline editor, and card dates can
be reopened, changed or deleted again after they have been saved. Full-suite repairs
keep the shared date form registered before its events, preserve the one mobile
page scroller in mobile-view mode, and make the standalone E2E browser selection
architecture-safe. Translations reuse 3,838 unambiguous same-language
values, and the new reports are complete in Finnish. Regression coverage
now exercises inline minicard title editing in the browser and guards the
Finnish Office and API report vocabulary directly. Requested By and Assigned
By say Edit when their free-text value already exists and Add when it is empty.

This release fixes the following SECURITY ISSUES found by GitHub CodeQL code
scanning:

and fixes the following bugs:

All Boards - scrolling the overview on a phone.

Binaries in these bundles

Each bundle carries a Node.js, a FerretDB and the MongoDB Database Tools.
Which source has a given CPU varies from release to release - nodejs.org
builds some architectures, unofficial-builds others, and the
wekan/node-patches build the ones
neither of them does - and not every source publishes a checksum. This is
what went into this release, and which downloads were checked against a
published SHA256.

A row saying no checksum published is not a failed check - it is a
source that publishes nothing to check against. Those are the ones worth
fixing at the source.

v10.99 2026-08-17 WeKan ® release

In short: the unified export dialog can finally be changed, visibly
shows its selection with the Admin Panel's own checkbox, and passes that
selection to every export format. PDF and Excel exports now share one card
document, use the saved user language or browser fallback, keep the opened
card's date format, preserve multilingual text, and name downloads for the
localized board, swimlane, list or card exported. Their shared card layout now
includes locations, stickers, dependencies and sort position; PDF also embeds
JPEG and PNG attachment previews plus Unicode-plane fonts. Admin Panel / Problems keeps
avatars at avatar size, and All Boards keeps its Add Board and Home
placeholder tiles as tall as the boards beside them. Requested By and Assigned
By can select board members while retaining their free-text fields. Below
that: fourteen export fixes, one export-layout consolidation, one people-picker
fix, two shared-checkbox fixes, two UI sizing fixes, restored subtask creation,
and the documentation move into its feature and platform hierarchy with every
local link checked.

This release adds the following new feature:

Opened cards - the people responsible for requesting and assigning work.

and fixes the following bugs:

Opened cards - the people responsible for requesting and assigning work.

Subtasks - creating their hidden helper-board records.

Binaries in these bundles

Each bundle carries a Node.js, a FerretDB and the MongoDB Database Tools.
Which source has a given CPU varies from release to release - nodejs.org
builds some architectures, unofficial-builds others, and the
wekan/node-patches build the ones
neither of them does - and not every source publishes a checksum. This is
what went into this release, and which downloads were checked against a
published SHA256.

A row saying no checksum published is not a failed check - it is a
source that publishes nothing to check against. Those are the ones worth
fixing at the source.

v10.98 2026-08-16 WeKan ® release

In short: one CRITICAL fix, and the whole of logging in reworked
around it. WeKan's brute-force lockout counted an attacker's failed logins
against the victim's account rather than against the address they came from,
so anyone who knew a username could lock its owner out from every address,
repeatably — and a correct password was refused while the lock held, and
counted as another failure. Usernames are public, so any account was a target
and an administrator was as easy to lock out as anyone else. Reported by daniais
as JamBleed. Two GitHub CodeQL alerts on one line of release tooling go with
it. Around that fix: increasing delays after a wrong password, per source
address rather than per account; a record of who logs in from where, both
directions, which is what the new Problems / Offices pane groups into the
offices an admin recognises — "London", with the flag, rather than
100.100.100.100; and the reason it exists, which is that blocking an ADDRESS
would take a whole office off WeKan at once, so WeKan blocks the account.
Admin Panel / Problems now keeps ONE summary row per problem — a count, a
window, and who tried it how often — instead of a document per event that grew
with the attack it was recording, and gains an API pane answering the
opposite question: not what went wrong, but who called which REST endpoint and
how often. Then: v10.97 shipped a bundle that could not
start, the third release in a row stopped by the same habit. Trimming what a
bundle carries is measured by a graph of what the server can reach, and that
graph read require() only. Meteor compiles an ESM import to module.link(),
so every ESM import in every Meteor package was invisible to it: it called
live code dead, and the bundle shipped without nodemailer-openpgp, which
packages/email.js links on its first tick. The reachable count goes from 211
to 450 with the fix — the measurement was wrong rather than merely optimistic —
and the category it justified is withdrawn: 61.3 MiB becomes 40.0 MiB. What
changes beyond that one fault is the check: a release now has to start the
bundle it built and see it reach its database before it may carry it.
That fix had a cost nobody saw for a day: its package loaded on the CLIENT
too, so require('crypto') reached the browser bundle and every page died
on load with Cannot find module 'stream' — fixed here, and the whole class
is now guarded. CHANGELOG.md is 2.5 MB lighter of history, keeping the
current MONTH while older months and years move to old-CHANGELOG/. And
Build WeKan release bundle is a menu entry now, building what a release
would publish rather than
a plain meteor build — so "does it start at all" no longer takes a release to
answer. Below that: the Sandstorm pack that was throwing its own trim away,
Admin Panel / People showing who is locked again, a location in an admin table
opening a map through the card's own chooser, the Problems route and template
finally called what the menu calls them, and the documentation refiled to match
the menu — including Directory-Structure.md, which had been describing the
tree as it was in 2017.

This release fixes the following CRITICAL SECURITY ISSUE of JamBleed:

Logging in - who the brute-force lockout is protecting, and from whom.

Binaries in these bundles

Each bundle carries a Node.js, a FerretDB and the MongoDB Database Tools.
Which source has a given CPU varies from release to release - nodejs.org
builds some architectures, unofficial-builds others, and the
wekan/node-patches build the ones
neither of them does - and not every source publishes a checksum. This is
what went into this release, and which downloads were checked against a
published SHA256.

A row saying no checksum published is not a failed check - it is a
source that publishes nothing to check against. Those are the ones worth
fixing at the source.

v10.97 2026-08-16 WeKan ® release

In short: v10.96 shipped a bundle that could not start. Trimming what a
bundle carries went one file too far: boot.js reads every source map NAMED in
programs/server/program.json, unconditionally, so removing the maps left 63
dangling names and the server died before opening its port. The names go with
the files now, and the fix was checked by BOOTING a trimmed bundle rather than
by reading the code again. Then the snap, which had been taking itself
offline at every restart: the startup comparison of the two database copies ran
unbounded with nothing on the web port, on an ambiguity that its own reading of
MongoDB kept recreating. Below that: another 61 MiB off every bundle, from
packages no require() can reach, and a guard that keeps all 246 translations
loading one at a time.

This release fixes the following bugs:

Bundles and images - what a build carries, and what it no longer does.

  Error: ENOENT: no such file or directory,
    open '/build/programs/server/packages/ecmascript.js.map'
    at /build/programs/server/boot.js:101:29

  serverJson.load.forEach(function (fileInfo) {
    if (fileInfo.sourceMap) {
      var rawSourceMap = fs.readFileSync(
        path.resolve(serverDir, fileInfo.sourceMap), 'utf8');

The snap's two copies of the database - after a migration both stay on disk,
and starting is where that gets decided.

  WeKan: BOTH databases have been written to since the migration.
    MongoDB  last written 2026-08-16 01:41 (WiredTiger.wt)
    FerretDB last written 2026-08-16 01:38

Binaries in these bundles

Each bundle carries a Node.js, a FerretDB and the MongoDB Database Tools.
Which source has a given CPU varies from release to release - nodejs.org
builds some architectures, unofficial-builds others, and the
wekan/node-patches build the ones
neither of them does - and not every source publishes a checksum. This is
what went into this release, and which downloads were checked against a
published SHA256.

A row saying no checksum published is not a failed check - it is a
source that publishes nothing to check against. Those are the ones worth
fixing at the source.

v10.96 2026-08-16 WeKan ® release

In short: one CRITICAL fix. With registration turned OFF in the Admin
Panel, POST /users/register created accounts anyway — for anybody who asked,
on an instance whose administrator had decided nobody else may join. The guard
that was supposed to stop it read a Meteor option WeKan never sets, so it was
always false and the endpoint had never refused anyone. It was found while
reviewing a pull request about the opposite symptom. Then the release
workflow: pressing Cancel did not stop a run, so docker went on building
an image for a release being abandoned, and the Sandstorm .spk gets under
its 1 GiB limit at last, now that its size report says what filled the gigabyte.
What that measurement found ended up changing every platform, not just
Sandstorm: uws is not reliable enough yet, so every default is now
sockjs, and no bundle carries uWebSockets.js (121M), the legacy client
(81M) or source maps (152M) — around 354M a bundle, none of it on any
loading path. Below that: two AWS SDK updates for the S3 attachment path.

This release fixes the following CRITICAL SECURITY ISSUE of SignupBleed:

Account creation - who may make an account, and who decides.

Binaries in these bundles

Each bundle carries a Node.js, a FerretDB and the MongoDB Database Tools.
Which source has a given CPU varies from release to release - nodejs.org
builds some architectures, unofficial-builds others, and the
wekan/node-patches build the ones
neither of them does - and not every source publishes a checksum. This is
what went into this release, and which downloads were checked against a
published SHA256.

A row saying no checksum published is not a failed check - it is a
source that publishes nothing to check against. Those are the ones worth
fixing at the source.

v10.95 2026-08-16 WeKan ® release

In short: the Sandstorm .spk still will not pack - Sandstorm refuses an
app over 1 GiB uncompressed - and v10.94 was supposed to say what filled it.
It said nothing, because the size report ran BEFORE meteor-spk pack, and pack
is what builds the trees it was trying to measure. The sizes are taken after
pack now, on failure and on success, dereferencing the symlink that hid most of
them; and the bundle is pruned of its build-only toolchain and packed once more
before the job gives up, which is the same pruning every other bundle already
gets and the one reduction available without guessing.

This release fixes the following build failures:

The release workflow - the bundles a release is supposed to carry.

  --- packing (Sandstorm refuses over 1 GiB uncompressed)
  Building Meteor app...

Thanks to above GitHub users for their contributions and translators for their translations.