WeKan ® 2026-08 releases

Moved out of CHANGELOG.md to keep that file small enough to open (wekan/wekan#6580). Nothing here has been changed: a release section is a record, and it reads the same as it did there.

Releases per day:

v11.39 2026-08-31 WeKan ® release

In short: Notifications respect Muted as the final board-level opt-out, including assignment and mention paths. Board views keep cards in their real swimlanes and keep the selected layout visible while its profile change reaches the client.

This release fixes the following bugs:

Notifications - board watch levels remain authoritative for every source.

Direct assignment notifications bypassed the board watch-level selection, so a card assignment could send email from a Muted board. Mentions, card/list watchers and broad-event configuration could enter through the same path. The final recipient boundary now requires an active board member with Watching or Tracking selected. Regression coverage keeps those positive cases and rejects explicit/default Muted, inactive and non-member candidates.

Board views - cards and the selected layout remain where the user put them.

The orphan-card fallback considered only active swimlanes, so cards correctly belonging to an archived swimlane looked orphaned and appeared in the first active one. It now excludes every real swimlane while retaining genuine orphan rescue. Separately, a successful persistence callback could clear a pending view before the reactive profile caught up and reveal the old view again. The pending choice now remains until the profile confirms it. Selector and persistence regressions cover both positive and negative paths.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.38 2026-08-31 WeKan ® release

In short: Member Settings reliably preserve language, profile identity and uploaded-avatar choices instead of reverting them after the interface changes. Board views switch to Calendar and Gantt reactively without a full page reload that restores the previous view, while authenticated server methods and awaited writes keep all three preferences durable.

This release fixes the following bugs:

Member Settings - profile identity, language and avatars remain selected.

Language and profile identity changes used direct optimistic client collection updates. When the server rejected or cleaned that modifier, Minimongo rolled the visible change back, so language returned to the default and full name or initials appeared lost until another login. Authenticated server methods now validate and await these writes; unsupported languages, oversized fields and logged-out callers are rejected. Regression coverage excludes the old direct write path and checks both persistence methods.

Avatar upload completion previously left the profile-pointer update as a floating promise. The interface could refresh while the old or default avatar was still selected. Upload completion now awaits that durable profile write, and a negative regression prevents the unawaited call from returning.

Board views - Calendar and Gantt remain open after they are selected.

An authenticated board-view change persisted its choice and then forced a full page reload. Calendar or Gantt therefore appeared briefly before the navigation restored the preceding profile view. A pending reactive value now renders the choice immediately while the authenticated method persists it; the full reload is removed. Coverage checks the positive persistence path and rejects any reload inside the authenticated branch.

and improves the documentation:

• Google login examples map usernames from email. Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.37 2026-08-31 WeKan ® release

In short: Packaged network configuration is explicit again. Bundles, containers, Docker Compose, AppImage, Windows and Snap no longer guess a network interface or replace configured ports and URLs at startup; stable localhost defaults remain where a self-contained bundle needs them, and administrator environment variables and Snap settings remain authoritative.

This release fixes the following bug:

Automatic ROOT_URL, PORT and database-port discovery is reverted from the release bundles, Docker image and Compose files, AppImage, Windows executable and Snap because it caused packaged services to remain down. These targets again use their explicit environment or Snap configuration, while self-contained launchers retain their established localhost defaults. The automatic detector and its generated state and lock files are no longer shipped. Regression coverage checks that every packaged launcher stays free of endpoint discovery and preserves explicit configuration.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.36 2026-08-31 WeKan ® release

In short: Snap startup remains inside strict confinement while it compares MongoDB and FerretDB data, so the web service starts instead of failing before it can bind its port. The comparison keeps its configurable time limit, cleanup and recovery diagnostics without depending on a host executable that a confined Snap cannot run.

This release fixes the following bugs:

Snap startup - confined startup reaches the selected database and web port.

The automatic comparison of MongoDB and FerretDB data used /usr/bin/timeout. Strict Snap confinement denied that executable, so wekan-control stopped before Node could listen on the configured web port even though the service appeared active. A shell-native process monitor now enforces the same configurable bound, allows the comparison's cleanup trap to stop its temporary database readers, force-stops an unresponsive child, and retains the existing timeout diagnostics. Regression coverage rejects any return to the host command and checks malformed timeout settings.

Setting autopick=false previously disabled only the comparison script itself, after wekan-control had already tried to launch it through the forbidden host timeout command. The launcher is now skipped entirely. FerretDB startup also defaults its polling throttle and interval through unset-safe shell expansion, instead of terminating under set -u before Node binds the web port. Negative tests reproduce both conditions from Snap revision 3872.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.35 2026-08-30 WeKan ® release

In short: The Snap Problems report connects to the database endpoint selected by the running services, including an automatically chosen FerretDB port, while preserving explicitly configured external database URLs. Snap services also recover an abandoned endpoint lock instead of appearing active without starting FerretDB.

This release fixes the following bugs:

Snap startup - database services and diagnostics share one live endpoint.

Snap services can select a free FerretDB port when the preferred port 27019 is occupied, but wekan.problems continued connecting to the old fixed default and reported ECONNREFUSED even while FerretDB and WeKan were active. The command now sources the services' shared startup-network state and passes its resolved MONGO_URL to the report. An administrator's explicit external database URL remains authoritative. Positive tests execute the real wrapper with a dynamic port and an external URL; negative coverage prevents the obsolete fixed port from returning to the wrapper.

WeKan 11.34 could leave an empty .startup-network.lock directory without its endpoint state file when a service stopped between acquiring the lock and the atomic state-file rename. Every later service then waited forever: snap showed the shell wrappers as active, but FerretDB never launched and port 27019 refused connections. New locks record their owner. A dead owner's lock is reclaimed immediately, an older empty lock after a short grace period, and a live owner is never displaced. Waiting for a live owner is bounded and fails explicitly instead of presenting a permanently active service. Executable regressions cover both the exact empty-lock failure and a dead-owner lock.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.34 2026-08-30 WeKan ® release

In short: Release metadata advances WeKan to v11.34 consistently across the Node package, Docker, Snap and Sandstorm packages, generated API files and Windows offline documentation. This keeps every published platform and its documentation on the same version instead of leaving consumers with conflicting package identities.

This release updates the following release metadata:

The release workflow updates package.json and its lockfile, the Docker and Stacker image definitions, Snap and Sandstorm package metadata, generated API documentation, and Windows offline-install documentation together. Recording the generated version commit makes the actual contents of v11.34 visible instead of leaving the released section with an Upcoming placeholder.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.33 2026-08-30 WeKan ® release

In short: PDFKit is statically included in every fresh production bundle while using its platform-portable CommonJS entry, so Docker and offline packages start without a missing module or a Linux build-runner path.

This release fixes the following build and release bugs:

Release builds - packaged dependencies and published version metadata stay portable and synchronized.

The v11.32 runtime resolver avoided PDFKit's Linux build-time URL on Windows, but also bypassed Meteor's application-dependency discovery. Fresh Docker images consequently omitted PDFKit and stopped during boot with Cannot find module '/build/programs/server/npm/node_modules/pdfkit'. WeKan again uses a static import so Rspack includes the dependency, while an install-time, fail-closed patch selects PDFKit's published CommonJS entry and its deployed __filename resource paths on every operating system. Positive and negative tests cover the package layout and dependency-discovery boundary. A fresh production build, the Docker-equivalent server install and every release prune pass the real bundle smoke boot.

The version-manifest regression no longer repeats WeKan, Meteor, Node and NPM versions as test constants that become stale at the next release. It reads the same validated Dockerfile pins as the release helper under test, while keeping the injected FerretDB version independent. This restored the complete Node test run after the WeKan 11.31 version bump and preserves exact manifest coverage.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.32 2026-08-30 WeKan ® release

In short: Windows release bundles load PDFKit from their deployed path instead of retaining a Linux build-runner URL, and Snap builds retry transient Store failures while installing LXD. Cross-platform PDF generation and native release assembly now have regression coverage for both failure boundaries, while a CodeQL incomplete-escaping alert is removed.

This release fixes the following SECURITY ISSUE found by GitHub CodeQL code scanning:

The website-version test no longer interpolates generated manifest text into a regular expression after escaping only dots, which left backslashes and every other regular-expression metacharacter active. It now compares the expected pre block as literal text, removing CodeQL alert 441 and the unnecessary encoding boundary. The positive manifest and negative injected-version cases both pass through the real release helper.

and fixes the following build and release bugs:

The server PDF renderer now asks Meteor's runtime CommonJS resolver for PDFKit, selecting the package entry that derives resource paths from the deployed __filename. The Linux-built Windows bundle therefore no longer passes its build runner's file:// URL to Node's createRequire. The native Snap jobs also preinstall LXD with five bounded attempts before the official build action, so a transient Snap Store nonce timeout no longer ends a release before Snapcraft starts. Positive and negative regression tests preserve both paths; the PDF generation suites and production Meteor bundle build pass.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.31 2026-08-30 WeKan ® release

In short: User sessions now survive page refreshes and board-view navigation with the HttpOnly-cookie security model. Admin version checks report the newest published WeKan and FerretDB releases with safe localized failure handling. Packaged WeKan also starts on the current Ethernet or WLAN IPv4 address, preferring port 80 and selecting free web and loopback-only FerretDB ports when not configured; Docker Compose follows the same path.

This release adds the following new feature:

A button above the installed-version table asks the server for the fixed https://wekan.fi/version.txt resource, then shows its WeKan, FerretDB, Meteor, Node and NPM lines as escaped text in a pre block. Only Global Admins can call the method; a ten-second timeout, five exact labels, strict version grammar and a one-kilobyte limit turn offline, malformed and injected responses into one safe localized failure. The release-all website job and the local release path now generate both that file and the identical install-page block from the release and Dockerfile pins plus the validated FerretDB tag. The website companion commit adds the initial files. Unit and negative tests cover parsing, generation and workflow wiring, and the production Meteor build passes.

and improves packaged startup:

Packaged startup - automatic endpoints stay consistent everywhere.

When ROOT_URL is not configured, the bundle ZIP, Docker image, AppImage, Windows single executable and Snap now discover the active IPv4 address and a port the runtime can bind. Port 80 is preferred and produces a clean http://IP-address URL; another free port is selected and included in the URL when port 80 is unavailable. Bundled FerretDB independently selects a free localhost-only port, and MONGO_URL follows that exact endpoint. Startup logs show the resulting ROOT_URL, PORT, FerretDB address and MONGO_URL, while explicit deployment settings remain authoritative. Positive and negative tests cover automatic and configured endpoints, loopback enforcement and all five packaging paths; all 694 Node suites pass.

The seven single-instance Docker Compose files no longer activate hard-coded ROOT_URL, PORT or MONGO_URL values. Their commented configuration explains that startup selects the current IPv4 and a usable port, derives the internal MongoDB or FerretDB service URL from Compose metadata, and prints every resolved endpoint in the Node console. Published container port 80 now agrees with the automatic preference. The POSIX and Windows offline launchers document and use the same resolver, and Docker no longer preselects port 27017 before its free localhost-port check. Positive and negative tests cover MongoDB, FerretDB v1, authenticated FerretDB v2, explicit overrides and every configuration file. The private-board refresh browser regression passes with both repo-local FerretDB and Meteor's included MongoDB; all 694 Node suites pass.

and fixes the following bug:

WeKan configured Meteor's HttpOnly-cookie session mode after the Accounts client had already performed its one startup resume check. A successful login wrote the protected cookie, but a fresh page held no token in its intentionally memory-only client storage and never asked the cookie endpoint to restore it. WeKan now starts Meteor's public cookie-login path immediately after enabling the mode, so refreshes and board-view navigations restore the same user instead of showing Sign In. Static positive and negative tests preserve the protected flow, and a Chromium regression reloads a private board against the repo-local Meteor server and included MongoDB and verifies both the user and board remain.

and improves the following translations:

The check button and its offline, timeout or invalid-response message now use dedicated translation keys. Every locale keeps the English key order, every previously complete non-English locale has localized text, and only the same 37 already-incomplete locales retain English placeholders. Regression coverage checks all locale files, representative natural translations and the existing placeholder inventory; all 695 plain-Node suites and the production Meteor build pass.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.30 2026-08-30 WeKan ® release

In short: Custom fields can now be removed from cards backed by FerretDB, completing the selection, checkbox and export repairs for issue #6611. The database now follows MongoDB's document-condition behavior for array removals, so a saved field value cannot make the field reappear after it is deselected. Compatibility and browser coverage protect the complete flow.

This release fixes the following bug:

FerretDB compared the $pull operand {_id: customFieldId} with the complete array element, which also contains value, so it could never match. Its MongoDB-compatible document-condition fix now matches fields within each element. Positive and negative backend tests cover matching and non-matching wider documents; WeKan's server contract and browser test cover removing a valued field from a card. The earlier checkbox and deleted-export fixes remain covered in the same interaction suite.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.29 2026-08-30 WeKan ® release

In short: Release builds now wait for every AppImage input, hand a slow riscv64 Launchpad build off cleanly, and start the Enigma-packaged Windows EXE despite its false legacy-Windows version result. Browser tests follow the new HttpOnly session model, the Helm chart has a viable default memory budget, and AWS storage, PDF generation, browser automation and Playwright's MongoDB driver are updated.

This release updates the following dependencies:

• @aws-sdk/client-s3 3.1117.0 → 3.1119.0 — the Amazon S3 client.
• @aws-sdk/lib-storage 3.1114.0 → 3.1119.0 — managed multipart uploads to S3.
• mongodb 7.5.0 → 7.6.0 — the Playwright test database driver.
• pdfkit 0.19.1 → 0.20.1 — PDF generation.
• puppeteer 25.8.0 → 25.9.0 — browser automation.

Thanks to dependabot.

and fixes the following developer-tooling bugs:

Build and release tooling - every scheduled artifact path completes or hands its remote work off cleanly.

The AppImage workflow now waits for the i386 and armhf bundles before deciding whether those images can be built. The riscv64 Launchpad waiter uses an isolated timeout process group, so its five-hour limit returns the status handled as a pending remote build instead of cancelling the Actions step. The Windows single-EXE launcher also sets Node's platform-check escape hatch when Enigma's virtualization reports a false legacy Windows version, while preserving an explicit administrator value. Static positive and negative regression tests pin all three build paths; the platform-specific builds remain verified by their workflow smoke tests.

The test harness - authentication and static checks match the production session model and the workflows they validate.

The Node E2E and Playwright login helpers now seed their generated resume token through the browser's native HttpOnly, SameSite=Lax cookie before logging in. This preserves authentication when a navigation creates a new DDP connection without exposing the credential to page JavaScript or restoring Local Storage tokens. The release-script parity test also classifies the private FerretDB preflight correctly, and Windows release commands put --repo on the command line their static guard inspects. Positive and negative session tests cover the cookie attributes and navigation boundary; all 693 Node suites pass.

The Helm chart - the default pod budget fits WeKan's container-aware Node.js heap and native processes.

• The default WeKan pod requests 512 MiB with a 2 GiB limit. Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.28 2026-08-29 WeKan ® release

In short: MailTitleBleed prevents stored board, list, card and other activity text from becoming active HTML in notification emails. The completed localized message is escaped at the final HTML boundary, and notification subjects cannot inject additional mail headers. CookieTokenBleed moves persistent resume authentication from JavaScript-readable cookies and Web Storage into Meteor's native HttpOnly cookie flow.

This release fixes the following CRITICAL SECURITY ISSUES:

GHSA-hp9m-vff5-7pvw, Moderate, CWE-79. Stored board, list and card titles and other activity values were interpolated into localized notification prose before that prose was used as an HTML email body. A writable member could therefore place active markup in a title and have it delivered to another member's mail client.

The complete localized notification is now HTML-escaped once at the final output boundary, before its plain-text newlines become HTML line breaks. This protects every current and future activity parameter without changing ordinary text or the plain-text notification mode. The subject formatter also removes newlines so stored values cannot create additional mail headers. Positive and negative unit coverage exercises active markup, ordinary titles, header newlines, the final output wiring and all 246 locale bundles.

CookieTokenBleed - GHSA-8phm-9rqm-v9hc, Moderate, CWE-1004. WeKan's custom file-route authentication mirror wrote the Meteor resume token into a cookie from browser JavaScript, which cannot apply the HttpOnly attribute. Meteor also kept its original token in Local Storage, so script running in the WeKan origin could read either persistent copy.

WeKan now enables Meteor 3.5's maintained HttpOnly resume-cookie flow on both client and server with persistent Web Storage disabled. The custom readable cookie synchronization and bootstrap code is removed, leaving only an in-memory credential in the active tab. Header login applies HttpOnly as well as SameSite=Lax and HTTPS Secure to the cookies it issues. Positive and negative regression coverage pins both configurations, the absence of browser cookie/token copying and retention of the Secure header-login path; existing request-auth and session-isolation suites remain green.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.27 2026-08-29 WeKan ® release

In short: SearchBleed closes a global-search authorization bypass that let an authenticated user submit an executable database selector and search cards outside their boards on MongoDB deployments. Initial searches and stored pagination selectors are now independently rejected or constrained to the caller's current board access.

This release fixes the following CRITICAL SECURITY ISSUE of SearchBleed:

GHSA-33h9-rc5h-667p, High, CWE-943. The global-search publication accepted a selector supplied by an authenticated client and used it instead of the normal board-scoped selector. On MongoDB, execution operators could cause denial of service and act as an oracle over cards belonging to inaccessible boards. FerretDB rejected the reported execution operator, but the missing authorization boundary existed in the application and is now enforced independently of the database backend.

Executable selectors now go through WeKan's shared NoSQL guard before reaching the database. Other client selectors are conjoined with the caller's authorized board IDs rather than replacing that scope. The shared query path repeats both checks for stored next-page and previous-page selectors, so sessions created by an older vulnerable release cannot preserve broader access after upgrade. Positive, negative and legacy-session unit coverage pins both layers; the existing rendered-browser search regression verifies that inaccessible-board cards remain absent while ordinary global search continues to work.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.26 2026-08-29 WeKan ® release

In short: The Windows single-EXE CI smoke test no longer fails with port-binding errors for FerretDB (ports 27017 and 8088) on GitHub Actions runners that ship MongoDB 7 as a pre-installed system service. The release also corrects the GitHub issue-closing metadata for the persistent-login fix shipped in WeKan 11.25.

This release fixes the following CI reliability issue:

Windows single EXE - smoke test was failing because the GitHub Actions Windows runner ships MongoDB Server 7.0 as a running system service that holds port 27017 (the same port the bundled FerretDB needs) and optionally port 8088.

The GitHub Actions windows-latest runner ships MongoDB Server 7.0 as a running Windows service. The bundled FerretDB inside the packaged WeKan EXE tries to bind to 127.0.0.1:27017 (main listener) and 127.0.0.1:8088 (debug handler). When these ports are already occupied, FerretDB exits immediately, causing WeKan to restart in a loop and the smoke test to time out with "The packaged EXE did not answer on port 8080."

The fix adds a "Free ports used by the packaged EXE before smoke test" step that stops the MongoDB (and mongod) Windows service and then kills any remaining process holding ports 27017 or 8088 before the smoke EXE is launched. This is CI-only and has no effect on the packaged EXE behavior for end-users.

The failing run shows the port collision and timeout this change addresses.

and corrects the following release metadata:

• Close the persistent-login report with valid GitHub metadata. Thanks to majo1989 and xet7.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.25 2026-08-29 WeKan ® release

In short: Persistent login survives page refreshes again on FerretDB deployments. Docker replaces an incompatible cached database binary instead of retaining it indefinitely across every FerretDB v1 backend, and Helm refreshes its moving database image. Portable Windows WeKan packages Node.js, FerretDB SQLite and the server into one executable with its data beside it. Release preflight also prevents bundles from shipping an incompatible FerretDB version.

This release adds the following new feature:

The release workflow wraps the already verified win64 bundle with the freeware Enigma Virtual Box archived in the WeKan v11.25 release, verifies its pinned SHA256, and produces WeKan-<version>-win64.exe with its own SHA256. A small native entry point launches the bundle's existing start-wekan.bat, which starts Node.js, FerretDB's embedded SQLite backend and WeKan together. Persistent SQLite data, attachments and avatars remain outside the virtual executable in wekan-files beside it, so moving the EXE and directory together keeps the installation portable. The final packed executable must answer its HTTP sign-in route before it can be attached to a release. Full and missing-asset release workflows both publish it, with regression coverage for the complete startup and delivery chain.

and fixes the following login bug:

Persistent sessions - deployment paths deliver the FerretDB behavior that Meteor's standard resume-token query requires.

WeKan 11.24 restored Meteor's standard resume-login query, but its release delivery could retain a FerretDB binary from before nested positional projections were fixed. Refreshing either a local-password or SSO session then returned 403 and exposed an empty board shell before the login page appeared. Bundles now reject FerretDB releases older than v1.63.0. Docker records the release represented by its cached binary and replaces a changed requirement atomically instead of retaining an incompatible executable indefinitely. Unit coverage accepts compatible and newer versions, rejects older and unknown versions, and verifies cache replacement; existing authenticated Playwright board tests cover reloads through the UI.

Docker resolves the newest FerretDB release on every start, verifies its published checksum and atomically replaces a differently tagged cached binary. Regression coverage also audits the release workflow: FerretDB and MongoDB Database Tools come from their latest releases, while the Node resolver walks maintained Node versions newest-first and uses the matching newest available node-patches binary when the official sources do not publish that platform.

The PostgreSQL, MySQL, MariaDB and SAP HANA Compose variants previously downloaded FerretDB only when their persistent volume had no executable. They now resolve the concrete newest release on every start, compare it with a release marker, verify the replacement's published SHA256 and move it into place only after verification. Regression coverage applies the same cache, checksum and atomic-replacement requirements to all five FerretDB v1 Compose files.

The chart deliberately uses ghcr.io/wekan/ferretdb:latest, but IfNotPresent allowed Kubernetes to reuse an older image already cached on a node. Its FerretDB container now uses Always, so every newly started pod asks the registry for the current image. Chart regression coverage pins that policy.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.24 2026-08-29 WeKan ® release

In short: Notification title structure now lives in server code instead of translation files, so translators cannot accidentally rename or remove its board and card values. All locale bundles retain their translated prose while the application owns these two non-language layouts, with focused regression coverage for formatting, translation fallback and every supported locale.

This release fixes the following translation regression:

Notification titles - structural board and card layouts no longer depend on translator-maintained executable tokens.

A translation refresh translated or renamed underscore-delimited placeholders in sixteen locale files. Those placeholders are executable tokens rather than prose, so this restores their exact English-source spelling. Seven focused translation regression suites verify both their inventories and values.

The board-only and board/card notification subjects contained no translatable prose, yet their executable markers appeared in every locale. The server now formats both layouts itself, while ordinary notification subjects still use the recipient's language. The two obsolete keys are removed from all 246 locale files, and tests cover both hardcoded layouts, the translated fallback and the complete locale inventory.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.23 2026-08-29 WeKan ® release

In short: Snap assembly finds its migration helper from the working directory it actually uses, while extra-architecture builds tolerate a transient registry response without accepting incomplete manifest data.

This release fixes the following release build failures:

Snapcraft enters .build before assembling the downloaded bundle, so all six native and variant Snap jobs looked for the MongoDB-to-FerretDB migrator under the nonexistent .build/releases directory. The Core 24 and staged Core 26 recipes now step back to the repository before copying it. The extra-architecture preflight also retries a Docker registry manifest request five times, writing to a temporary file so a partial response is never parsed. A persistent registry failure still stops the build. Focused Snap, ARM-container and Node-source tests cover both fixes.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.22 2026-08-29 WeKan ® release

In short: RuleBleed closes the server-side automation path that could write cards into an inaccessible private board. Its browser regression now uses isolated rule data, while Snap and multi-architecture builds resolve their inputs reliably across working directories and transient registry responses.

This release fixes the following CRITICAL SECURITY ISSUE of RuleBleed:

GHSA-9w4x-hf2r-hc9v, High, CWE-862 and CWE-863. Move, link and bulk-move automation actions execute server-side, so they bypass the collection deny hook that protects direct DDP writes. Rule creation now validates destination write access before inserting anything, and execution validates again before resolving destination structure. This protects legacy, imported and scheduled rules while removing the private list/swimlane oracle. Denied attempts are bounded and summarized as RuleBleed in Admin Panel → Problems. Positive, negative, legacy-path, REST-preservation and rendered-browser regressions cover both authorization layers.

and fixes the following release build failures:

Snapcraft enters .build before assembling the downloaded bundle, so all six native and variant Snap jobs looked for the MongoDB-to-FerretDB migrator under the nonexistent .build/releases directory. The Core 24 and staged Core 26 recipes now step back to the repository before copying it. The extra-architecture preflight also retries a Docker registry manifest request five times, writing to a temporary file so a partial response is never parsed. A persistent registry failure still stops the build. Focused Snap, ARM-container and Node-source tests cover both fixes.

and fixes the following test isolation bug:

The RuleBleed browser regression correctly received not-authorized, but its global count by a non-unique title found a stale rule left by an earlier interrupted run. The assertion now scopes its query to the current fixture board. Board cleanup also removes its rules, triggers and actions, so one browser project cannot contaminate the next. A source regression pins all three cleanup paths.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.21 2026-08-29 WeKan ® release

In short: File responses, board writes and automation rules close four security gaps. Database launchers use FerretDB's write-notified OpLog with an explicit standalone fallback, while DEBUGSPEED diagnostics make comparative MongoDB/FerretDB traffic runs measurable, and FerretDB board creation and loading now complete reliably on a restored large dataset despite a small remaining delay. Card date badges share one self-cleaning minute ticker, translations render bundled English without waiting for database overrides, minicard composers and board creation save from the form the user submitted, database selectors no longer accommodate FerretDB query-planner gaps, and Snap assembly uses the correct extracted release bundle on every architecture. Regression coverage now preserves translation placeholders and isolates browser fixtures while accepting the bounded delivery time observed with a restored database.

This release fixes the following CRITICAL SECURITY ISSUES:

File responses - stored MIME metadata cannot turn downloads into active content.

AvatarMimeBleed - GHSA-4mjm-vj9f-p629, Moderate, CWE-79 and CWE-434. Both current and CollectionFS-compatible avatar routes trusted their stored MIME type. HTML, XML, SVG or JavaScript content could therefore render under the WeKan origin. A shared policy now serves every browser-executable type as a sandboxed opaque download with nosniff and frame denial, while safe images remain inline. No Problems event is emitted because legitimate avatar views use this path and cannot attribute old metadata to an attacker. Behavioral tests cover every dangerous family, and a whole-route negative scan forbids stored MIME fields from reaching Content-Type directly.

LegacyAttachBleed - GHSA-xcxp-hx9w-q5q9, Moderate, CWE-79 and CWE-693. The legacy attachment route forced downloads but applied CSP, nosniff and frame denial only to SVG filenames, leaving stored HTML, XML and JavaScript MIME types active. It now uses the same centralized opaque-download policy as avatars. There is no attributable Problems event: ordinary legacy downloads use the same path, and logging would blame a viewer for metadata supplied earlier. Positive MIME decisions and the repository-wide negative response-header scan cover the fix.

Board structure - creating a swimlane requires the shared write capability.

SwimlaneBleed - GHSA-2x89-6mq2-834r, Moderate, CWE-862. ensureDefaultSwimlane authorized an insertion with read membership, bypassing the collection's write rule and allowing read-only roles to alter board structure. The method now requires the same shared write capability as every swimlane mutation. Rejected direct calls are bounded and summarized as SwimlaneBleed in Admin Panel → Problems, and logging failure cannot weaken the denial. Tests pin the guard before insertion and forbid read membership or public visibility from authorizing the method.

Automation rules - cross-board actions enforce destination permissions.

RuleBleed - GHSA-9w4x-hf2r-hc9v, High, CWE-862 and CWE-863. Move, link and bulk-move automation actions execute server-side, so they bypass the collection deny hook that protects direct DDP writes. An authenticated user could store a destination board ID in a rule on their own board and inject cards into a private board they could not access. Rule creation now validates destination write access before inserting any document, and execution validates again before resolving destination structure, protecting legacy and imported rules while removing the list/swimlane oracle. Denied attempts are bounded and summarized as RuleBleed in Admin Panel → Problems. Positive, negative, legacy-path, REST-preservation and rendered-browser regressions cover both authorization layers.

and improves the following database deployment configuration:

Database launchers - bundled processes use the correct reactive mode.

The bundle, Windows, container entrypoint and every FerretDB v1 Compose backend now clear inherited OpLog settings and start without replica-set arguments. MongoDB 7 keeps its explicit rs0 connection, while the Meteor 3 multitenancy guide gains an idempotent replica-set initializer and scoped OpLog credentials. Positive and negative regression tests pin the separation.

The Snap and DEBUGSPEED launcher now start FerretDB as a single-node replica set and give Meteor an OpLog URL, using oplog,polling without attempting unsupported change streams. FerretDB wakes idle awaitData tails when a write actually appends an OpLog record and emits directly applicable replacement updates, eliminating the SQLite query loop and invalid whole-document $set that previously made polling the safer default. Setting wekan-ferretdb-oplog=false retains the standalone polling fallback. The FerretDB write notification fix has broadcast, gate and update-shape coverage. Its follow-up idle-tail fix makes cursors wait before querying and repairs the logical timestamp index on older OpLogs. The filled-batch fix returns a notified OpLog batch before waiting for another write, so reactive board lists and newly opened boards cannot remain one mutation behind. A restored large-dataset run confirms that creating a board, receiving its tile and opening it now work reliably; a small query delay remains but does not prevent completion. The projection fix avoids recursively decoding unrequested large fields during selective collection scans, and its ID follow-up retains MongoDB's implicit _id through the internal projection pipeline. The distinct optimization also decodes only its result path and filter fields instead of every complete candidate document. Its SQLite pushdown now constructs minimal result documents and collapses duplicate top-level keys before they cross into Go. Its indexed follow-up selects an existing distinct-key index and labels slow query shapes by their originating command. The linear deduplication follow-up sorts once and compacts adjacent equal BSON values instead of repeatedly scanning the growing result array; 45,640 unique values now compact in about 5–18 milliseconds instead of consuming 15–17 seconds. The raw-value SQLite follow-up deduplicates schema/value pairs before constructing SJSON, reducing the restored 299,539-card distinct(listId) SQL workload from 3.60 to 2.94 seconds while preserving all 41,875 BSON-distinct values. The full-document decoder optimization reuses bounded parsed schemas and avoids a streaming decoder allocation for each common scalar. Its allocation follow-up uses direct full-document JSON parsing, strict scalar conversion and preallocated ordered fields, cutting the representative decoder benchmark from 617 to 561 allocations and about 53 KB to 44 KB per document. The hot-schema and indexed-write optimization replaces the cache's periodic full flush with a bounded 4,096-entry LRU; across the restored 299,539-card dataset it reduced isolated complete decoding from 35.1 seconds to 17.2–19.0 seconds. It also makes SQLite updates and deletes use the existing unique _id expression index instead of scanning the collection. The non-finite numeric pushdown keeps the unchanged numeric $type plus negated-range repair query inside SQLite: across five restored ordered collections containing about 747,000 documents, it returns zero candidates in 1.9 seconds instead of spending about 30 seconds decoding every document. Ambiguous values remain candidates for the authoritative MongoDB-compatible filter. The nested-composite decoder optimization also replaces per-document and per-array streaming decoders with complete-value parsing. The representative nested-card workload drops from 561 to 431 allocations and from about 44 KB to 31 KB per document, with median decode time improving from about 179 to 141 microseconds while preserving malformed-input behavior. The linear document-construction follow-up uses the document's existing key-count map to distinguish new fields from replacements instead of searching all previously appended fields. The restored 299,539-card collection averages 31.3 fields per document; a representative 40-field decode improves by about 8% without adding allocations. The SQLite iterator follow-up also resolves result-column metadata once per query instead of requesting and comparing it for every row. Full card scans avoid nearly 300,000 redundant metadata calls, and each distinct scan avoids one call per returned key. The schema-covering index optimization appends internal BSON schema expressions to eligible SQLite indexes while retaining their original value prefix and Mongo-visible definition. Existing indexes are upgraded transactionally once. The restored 299,539-card distinct(listId) SQL falls from 2.96 seconds to 45 milliseconds using a covering scan, while unique and dotted indexes remain unchanged. Its compound-index follow-up also covers every top-level logical key and selects the narrowest index containing the distinct and filter fields. The restored filtered distinct(swimlaneId, archived) SQL becomes a 176-millisecond covering scan; its live non-covering stage previously took about 12.2 seconds. FerretDB now also creates a private scalar access path when a numeric corruption check targets a field already present in a declared compound index. SQLite cannot seek a non-leading compound key; the restored 299,539-card sort check instead falls from 1.31 seconds to 17 milliseconds after a 1.26-second one-time index build, without changing the MongoDB query or visible index definition. Top-level $exists probes now run exactly inside SQLite as well, distinguishing a missing field from explicit BSON null. The schema upgrader's no-match archived probe previously decoded all 299,539 cards for 20.6 seconds; its equivalent SQLite scan takes 20 milliseconds and needs no additional index. The DEBUGSPEED launcher now waits for FerretDB to finish one-time database preparation and accept connections before starting Meteor, reporting progress every ten seconds and failing clearly if FerretDB exits or exceeds its bounded readiness timeout. This prevents OpLog startup from crashing WeKan while an index-format migration is still running. During that wait, the normal WeKan port serves the existing blue migration page with the Admin Panel Product name, a rebuilding-indexes explanation and automatic refresh. FerretDB publishes its current database, collection and index atomically, and the page turns that into a progress bar, percentage, current step and total, elapsed time, and estimated time remaining. A configured Product name replaces both application names in all user-facing migration text. The standalone page is stopped and its port released before Meteor starts; source runs keep the Product name current in their writable cache just as Snap already does. Launcher tests pin both modes, while FerretDB unit tests and benchmarks cover projected, distinct and complete decoding, malformed input, cache eviction, SQL filtering and missing keys, numeric and logical fallback safety, implicit and excluded IDs, and every query field retained for filtering and sorting.

and improves the following client performance behavior:

Card date badges - one shared clock replaces per-card timers.

Card dates and date custom fields subscribe to one reactive clock. Each view unsubscribes when destroyed; duplicate cleanup is harmless, the interval remains for other subscribers, and the final unsubscribe stops it. Regression tests exercise teardown and later restart as well as rejecting per-badge intervals.

and fixes the following minicard bug:

Minicard composers - saving targets the form the user submitted.

Each list renders independent add-card composers above and below its cards, but the bubbled submit handler read the first textarea under the whole list. Saving the visible bottom composer therefore read the hidden top composer's empty title, closed the form and sent no database insert. The handler now resolves the actual submitted form and obtains its title, position, labels, members and custom fields from that same form. Regression coverage pins both positive form targeting and the absence of list-wide first-textarea lookup; the existing Playwright add-card flow covers the rendered save behavior.

and fixes the following board creation bug:

Shared board forms - every rendered variant submits through its owner.

The All Boards and popup variants render one included form, but their submit events remained attached to the parent templates. Blaze scopes an event map to the template that rendered the matching DOM, so clicking Create never called the server method and no board reached MongoDB or FerretDB. The shared form now owns its events and receives its state owner explicitly, preserving visibility, template-board and header-star behavior. Positive and negative regression checks pin the event owner, submitted form and all four callers.

and adds the following performance diagnostic tooling:

DEBUGSPEED - opt-in measurements and failure logs explain local database behavior.

DEBUGSPEED=true records bounded process, event-loop and slow DDP handler measurements in Admin Panel → Problems → Speed without recording arguments, credentials or query values. debug-speed-server.sh starts WeKan on a chosen localhost port with either Meteor's MongoDB or a freshly compiled FerretDB, and keeps their raw logs together; debug-speed-test.sh drives repeatable anonymous or authenticated browser traffic. The matching FerretDB diagnostics add SQLite query-shape, candidate-row and separate SQL/decode timings while keeping small indexed lookups silent. Static positive/negative guards, FerretDB unit tests, both database startup modes and an anonymous browser traffic run cover the workflow.

debug-speed-server.sh now explicitly starts FerretDB at the safe info log level and prints the exact ferretdb.log path. The matching FerretDB change makes DEBUGSPEED=true select that level itself, so connection warnings, errors and existing bounded query-shape diagnostics reach the log even outside this launcher. Debug-level wire messages remain disabled because they may contain user data. Positive launcher and FerretDB unit tests pin the level and path; a negative guard prevents enabling payload-bearing debug logging.

debug-speed-server.sh now owns separate process groups for WeKan/Meteor, FerretDB, terminal log following and a resource watcher. One Ctrl-C stops and reaps all of them, including Meteor's child processes. The watcher records timestamped CPU, RSS, process state, load, available memory and disk space in resources.tsv without command arguments or environments. WeKan console output goes to wekan.log, while bounded structured timings go only to the private wekan-debugspeed.jsonl file beside it, never to Admin Panel → Problems. FerretDB continues to use ferretdb.log. Static positive and data-exposure guards cover supervision, file routing and the absence of the Problems logger; shell syntax and a live watcher smoke test cover the executable paths.

debug-speed-ferretdb.sh builds and starts the same DEBUGSPEED-enabled local FerretDB used by the comparative launcher, but deliberately leaves WeKan and Meteor stopped so mongorestore does not compete with application writes for SQLite's single write lock. It preserves the existing port, state-directory, log-level and log-directory overrides, records ferretdb.log, build output and resource samples together, and stops all supervised processes on one Ctrl-C. Positive tests pin the shared options and cleanup; negative tests ensure the restore-safe launcher cannot start Meteor or enable payload-bearing debug logs.

debug-speed-test.sh now verifies Playwright's actual Chromium executable, not only its installed npm module, and downloads the matching browser revision when it is absent. The browser cache lives under .tools/ms-playwright, consistently with the main Playwright configuration, instead of depending on a populated home-directory cache. Static tests cover detection, installation and the local cache path; a live one-client traffic run completed 17 iterations with no failures.

and fixes the following registration bug:

Account creation - first-user detection stays bounded on large databases.

The account-creation hook needs only to know whether any account already exists so it can make the first one administrator, but it counted and decoded the entire users collection. On a restored 14,631-user FerretDB database that made registration take 55 seconds: the account and verification email were created, but the browser timed out and incorrectly displayed “Something went wrong.” A projected one-document lookup now preserves the first-administrator rule without work proportional to the instance's user count. Positive and negative regression checks pin the bounded lookup and forbid a full count in the hook.

and removes the following database-specific application workarounds:

Database compatibility - ordinary selectors work without client exceptions.

Board card scopes again use their normal null-containing $in, client and authorization selectors remain explicit $and conjuncts, activity predicates are not flattened, and one-branch visibility still uses $or. The matching FerretDB backend fixes now push null and empty $in, booleans, $or, $and, and indexed single-field or compound equality constraints into SQLite. WeKan's tests pin the database-independent selector shapes; FerretDB's unit suite pins the SQL constraints and index choices.

WeKan no longer replaces Meteor's resume-login handler to avoid a FerretDB positional-projection error. FerretDB now correctly selects an array element for a projection such as services.resume.loginTokens.$ when the query matches services.resume.loginTokens.hashedToken, so Meteor's standard authentication path works unchanged. FerretDB unit tests cover a matching token and a negative no-match case.

and fixes the following client startup bug:

Language startup - bundled text renders before optional overrides arrive.

English is already part of the client bundle, but i18n readiness still waited up to ten seconds for the optional custom-translation DDP subscription. A busy restored database therefore printed a default-language timeout even though the English data was present and usable. Bundled English now becomes ready immediately; database overrides load asynchronously and invalidate translation helpers when they arrive. Positive and negative loader tests pin the ordering, fallback and late reactive update.

and fixes the following release tooling bug:

Snap releases - assembly consumes the bundle produced for the release.

Snapcraft entered .build and extracted the archive as bundle/, but then looked for .build/bundle/, effectively asking for .build/.build/bundle/. That made native, variant and Launchpad snap jobs fail while copying Node.js. The Core 24 and staged Core 26 definitions now use the correct relative path, with a regression test that pins the working-directory transition.

and fixes the following regression-suite failures:

Test reliability - assertions follow current behavior without weakening product checks.

Protected activity placeholders are restored in sixteen locale files, and a repository-wide token inventory confirms that every locale now matches English. The Traditional Chinese check accepts correct human wording while still rejecting the wrong script. Source guards recognize the current FerretDB $or/$and pushdown and board publication shapes, while runtime-only files and DEBUGSPEED diagnostics are excluded from documentation and release-menu parity checks. The lazy-board browser test allows 30 seconds for a remote update and move: its focused Chromium run passed in 22.2 seconds, matching Firefox's valid slow path instead of failing at the former ten-second bound.

The RuleBleed browser regression correctly received not-authorized, but its global count by a non-unique human-readable title found a stale rule left by an earlier interrupted run. The assertion now scopes its query to the current fixture board. Board cleanup also removes its rules, triggers and actions, so one browser project or interrupted run cannot contaminate the next. A source regression pins all three cleanup paths.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.20 2026-08-28 WeKan ® release

In short: Translation maintenance commands no longer pass repository filenames through a shell, resolving two CodeQL command-injection findings in standalone tooling. Launchpad snap assembly reuses completed per-architecture bundles and packs them with faster compression, reducing work on scarce builders. Large boards now show card edits and moves immediately without a browser reload. The table below is carried over from the release under this one, and is refilled from each build's provenance.tsv when this release is made.

This release fixes the following SECURITY ISSUES found by GitHub CodeQL code scanning:

CodeQL alerts #439 and #440 found that the translation merge and English- regression report interpolated Git revisions and locale paths into shell command strings. The supported pull path supplied a snapshot directory and did not reach these commands, but standalone use could interpret shell metacharacters from a contributor-controlled locale filename.

Both scripts now invoke Git directly with separate arguments and consume its changed-file list with NUL delimiters. Positive coverage retains normal translation restoration and regression reporting; negative coverage uses a locale filename containing shell syntax and proves neither script executes it.

and fixes the following bug:

Lazy card loading kept each sorted, limited window as a one-time snapshot to avoid a FerretDB cursor hang. The snapshot rendered initially, but later card edits and cross-list moves did not publish changes to an already-open board, so the browser showed stale cards until a forced reload.

Each window now observes its unrestricted indexed selector and fetches a new bounded snapshot only when a matching card changes. It diffs that snapshot and publishes additions, field changes and removals without overlapping refreshes; the problematic limited live cursor remains unused. Unit coverage checks every diff outcome, including removed fields and unchanged cards, and a forced-lazy browser scenario checks a remote title edit and cross-list move without reload.

and improves the following developer tooling:

The s390x, riscv64 and other Launchpad jobs previously downloaded bundles whose dependencies had already been rebuilt and pruned for their target architecture, deleted that completed dependency tree, installed an npm build toolchain and repeated the entire installation through the build-farm proxy.

Snap assembly now uses the no-op plugin, retains the prepared dependency tree and omits the unnecessary compiler and npm packages. Both maintained base definitions also select LZO instead of the slower default XZ compression for the large final SquashFS, trading a larger download for faster packing and cold startup. Regression coverage pins the prebuilt-bundle boundary, the absent npm commands and build packages, and the compression choice.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.19 2026-08-28 WeKan ® release

In short: HostnameBleed regression coverage now checks documented hostnames as exact parsed tokens, resolving two follow-up CodeQL findings in test-only code. Test-matrix reliability covers resumed profile languages, speech scrolling, local Node discovery and bounded reusable AppImage jobs. Translations now merge valid Transifex human work over local fills without uploading machine translations as human, and recover human values displaced after mass filling. The table below is carried over from the release under this one, and is refilled from each build's provenance.tsv when this release is made.

This release fixes the following SECURITY ISSUES found by GitHub CodeQL code scanning:

CodeQL alerts #437 and #438 reported incomplete URL substring sanitization in the HostnameBleed regression test. The findings were limited to fixed test data: no request, user input or runtime application path reached these assertions. Parsing the example list and comparing its complete tokens avoids ambiguous URL substring checks while retaining positive coverage and a negative check for the wildcard lookalikes that the original HostnameBleed fix rejects.

and improves the following developer tooling:

Test matrix - local tool discovery and bounded workflows keep every stage running against the intended versions.

Persisted profile languages now apply reactively when a stored login finishes resuming, so Chinese and Japanese accessibility checks observe the user's real locale instead of the browser default. The speech-command regression gives its focusable list a deterministic overflow boundary before testing Page Down.

GitHub does not allow timeout-minutes on a job that calls a reusable workflow, so the release guard now recognizes that syntax and separately proves every job inside the called AppImage workflow has its own timeout. The previously unbounded release lookup and publishing jobs are limited to 15 and 30 minutes.

The test runner previously added only the exact Node version named by the Dockerfile to PATH. When that version had just advanced beyond the toolchain already downloaded under .tools, the plain import stage could not find Node and Playwright version discovery silently selected its obsolete 1.60 fallback for dependencies that required 1.62.1.

It now selects the newest installed architecture-matching local Node until setup downloads the exact release. A regression pins the fallback, version-aware ordering and exported path used by every subsequent test stage.

and improves the translation workflow:

Translation precedence - human work stays preferred without trusting wrong-language or provenance-unknown values.

The pull previously treated every committed non-English value as human and force-pushed restored languages, so direct machine/LLM fills could be uploaded to Transifex under false provenance. It also compared against HEAD, allowing an uncommitted local fill to be lost before the merge saw it.

The workflow now snapshots the complete pre-pull tree, keeps each valid target-language Transifex value, and restores the snapshot wherever Transifex returns English or malformed code tokens. Nothing is pushed automatically. Known Russian-seeded Mongolian values are rejected even though both languages use Cyrillic, and protected @PH…@ markers are restored without discarding the surrounding human prose.

The interrupted pull merged 47 non-English human values across 29 locale files and four new source keys into eleven English variants. All available local fallbacks remain; the result has zero detected wrong-script values, placeholder markers or local translations lost to English.

A history audit compared every non-English value at the final pre-mass-fill boundary with the current locale files. Of 31 differences, seventeen are newer valid Spanish, Kinyarwanda or Traditional Chinese human translations and remain preferred. Fourteen older human values had regressed: Breton, Occitan, Volapük, Walloon, Wolof and Tamazight received French; Welsh retained an English word; Xhosa gained malformed prose; and three French variants received a broken placeholder example.

Those fourteen exact historical values are restored. A reproducible audit pins the reviewed boundary and keys, while the pull merge rejects the known bad fingerprints on recurrence without blocking a future corrected Transifex human translation.

The first corrected live pull exposed an ordering edge case: eight known bad Welsh, French and Xhosa values arrived with protected @PH…@ markers, so their bad-value fingerprints did not exist until marker repair ran after the merge. The workflow now performs the reviewed historical-human restoration after that decoding step. The eight regressions from the run were restored, and a test pins the required stage order. A subsequent clean live run pulled all 147 Transifex locales, restored 4,976 local fallback values across 124 files, decoded 43 protected markers in 31 values and restored the eight reviewed human values. It pushed nothing, left no working-tree difference and finished with zero displaced historical translations, machine markers or detected wrong-script values.

The bulk, single-locale and English-copy helpers all force-pushed complete local locale files to Transifex. Because those files intentionally combine human work with direct machine/LLM fallbacks, the helpers could publish provenance-unknown values as human translations and overwrite newer community work.

Removing them makes the supported workflow pull-only for target translations; the separate English-source upload remains available. Regression coverage rejects any translation shell script that invokes a target-translation push and also pins the intentional source-only command.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.18 2026-08-28 WeKan ® release

In short: Archive keeps archived subtask helper boards reachable for restoration or permanent deletion, and Card locations can again be removed with their X button. The table below is carried over from the release under this one, and is refilled from each build's provenance.tsv when this release is made.

This release fixes the following bugs:

Archive - every counted archived board remains visible and manageable.

Ordinary board lists deliberately hide internal helper boards whose titles are wrapped in carets. The shared client query also applied that filter to Archive, even though the archived-board publication and count included those boards, so the counter increased while the tile stayed invisible.

Archive now keeps published helper boards in its tile query, allowing their owners to restore or permanently delete them, while active views continue to hide them. Positive, negative and live browser regressions cover both sides of that boundary.

Card locations - location controls act on the surrounding card.

Each location row has its own Blaze data context, so the X handler previously mistook that row for the card and never reached the removal model method. It now resolves the open card, awaits removal by the location's stable id and retains the separate legacy-location cleanup path.

Source regressions prove the nested context cannot return, and a live browser test adds a map location, removes it and confirms both the rendered row and database value disappear.

The live test names issue 6644 and locates the seeded card by its board and title before checking its stored locations array. This keeps the final database assertion independent of fixture-only convenience fields while still proving the X removed the same location that disappeared from the UI.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.17 2026-08-28 WeKan ® release

In short: HostnameBleed, found by GitHub CodeQL, makes tenant-hostname translation coverage compare example domains as exact text. Card titles keep markdown links clickable and mouse text selection native, while comment markdown retains its per-render fallback. REST user deletion now reports the database-confirmed outcome and documents both success and missing-user responses. Translations complete Swati, begin Sesotho and raise the measured essentially-complete total to 197 while protecting target-language vocabulary and code tokens. The table below is carried over from the release under this one, and is refilled from each build's provenance.tsv when this release is made.

This release fixes the following SECURITY ISSUES found by GitHub CodeQL code scanning:

HostnameBleed covers code scanning alerts #435 and #436, rule js/incomplete-hostname-regexp (CWE-20), in tests/marathiTranslationProgress.test.cjs. The test passed a.example.com and kanban.example.org directly to RegExp, so each dot acted as a wildcard. A wrong hostname such as aXexampleXcom could therefore satisfy coverage that was meant to require the exact documentation example.

The affected code runs only in a translation regression test over hardcoded strings. It is not shipped in the server or browser bundle, accepts no request or user input and denies no operation, so there is no attributable runtime attempt to record in Admin Panel → Problems.

The test now uses exact includes() comparisons. Positive and negative cases prove literal dots are required, while a repository-wide source guard detects the reported loop-to-RegExp shape and confirms it exists nowhere else in tracked first-party JavaScript.

and fixes the following bugs:

Card titles - links, editing and mouse selection remain distinct gestures.

The fixed-width transparent edit overlay previously covered the leading half of every title, which swallowed every pixel of a short rendered markdown link. The title container itself is now the edit target, while nested viewer links receive and stop their own click before editing can open.

Keyboard access remains on the title container, and its focus semantics are preserved. Positive and negative source tests cover the event boundary; a live Chromium regression edits a title to a markdown link, clicks it, and proves that the editor stays closed.

Card sorting and opened-card window dragging previously claimed mouse gestures that began inside a title textarea. Those editors and their controls are now excluded from sorting, and the window-drag handler returns before suppressing the browser's native selection behavior.

Source regressions pin both drag boundaries. A live Chromium test drags across an opened-card title, verifies a non-empty selection range and confirms the card window did not move.

Specs that open a card now activate the shared wrapper-link helper instead of clicking title text, whose intended action is inline editing. The Firefox mouse selection regression keeps both drag coordinates over rendered title text, and the failed-copy negative check uses the stable board canvas rather than a strict union that fails when both healthy regions are visible.

The affected title-selection, failed-copy, LTR/RTL card-panel and board-comment paths pass together in a fresh Chromium run. Firefox and WebKit remain covered by the full Docker browser matrix.

Comments and Activities - one markdown render cannot blank surrounding UI.

The per-render exception boundary already added in 75a23b76a catches markdown or sanitization failures and returns safe escaped text, so one bad comment does not abort the card comment list or Activities rendering. The reported French emphasis, list and literal greater-than forms now run through the real shipped markdown configuration as explicit regression coverage.

REST API - user deletion responses reflect the authoritative database result.

The route previously discarded removeAsync's result and returned the requested id even when no account matched. It now returns 200 only when exactly one user was removed, returns a deterministic 404 for zero matches and treats unexpected counts or database failures as internal errors.

Repeatable response annotations let the OpenAPI generator document the exact 200 and 404 response bodies. Unit and negative tests cover authorization and every removal outcome, regenerated YAML matches the route source byte for byte, and a live Chromium API test confirms deletion in MongoDB before repeating the request and receiving 404.

and improves the following translations:

Translations - Swati reaches completion, Sesotho begins and measured completion assertions stay current.

The remaining 417 Swati strings now cover jobs, storage, migrations, backups, privacy, monitoring, repositories and imports. A same-script vocabulary audit also replaces the Zulu word ibhodi with the Swati libhodi.

Regression coverage proves the locale has no English placeholders, preserves the exact source placeholder and HTML inventories and uses Swati vocabulary. These direct translations have lower confidence than reviewed human work and remain open to correction by Swati speakers.

The first 50 Sesotho strings translate activity titles and descriptions, members, comments, dates, attachments, labels, checklists, custom fields, archives and imports. Source placeholders remain exact, and a language-specific regression checks Sesotho vocabulary while recording the 2,117 strings still untranslated at this commit.

The translation documentation now reports 197 essentially complete locales, and the Northern Sotho regression expects its measured zero remaining English placeholders. Tests calculate these values from the locale files so stale completion claims fail visibly.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.16 2026-08-27 WeKan ® release

In short: Search pagination now binds every stored query to its authenticated owner, closing cross-board card disclosure through reused session IDs. The full release now publishes AppImages automatically after its core bundles, while 32-bit AppImages distinguish an unavailable runner from a broken package and keep i686 Node within its virtual-address-space limit. Card details regain their inner gutters, including on widened desktop panels. The table below is carried over from the release under this one, and is refilled from each build's provenance.tsv when this release is made.

This release fixes the following CRITICAL SECURITY ISSUE of SessionBleed:

The nextPage and previousPage DDP publications accepted a client-supplied global-search session ID, loaded its stored board selector without checking its owner, and could return private card titles, descriptions and custom-field values to a logged-out or different user. The session ID had to be obtained first, but neither publication enforced the authentication boundary.

Both paths now refuse logged-out clients and perform one owner-scoped lookup using the authenticated user and session ID together. Missing or foreign sessions complete without publishing data. Attributable logged-out probes are folded into a bounded SessionBleed summary in Admin Panel → Problems; ordinary authenticated pagination is never logged. Positive decision tests, a negative whole-publication scan and a live Chromium DDP test cover the boundary.

and fixes the following bugs:

AppImage packaging - 32-bit images start safely and report runner limits.

The i686 launcher no longer gives a 32-bit Node process a 4 GiB V8 heap that exhausts its virtual address space while deserializing the startup snapshot. Automatic selection is capped at 1 GiB for an ELF 32-bit Node, while an explicit NODE_OPTIONS remains authoritative.

The armhf workflow now probes the Node binary inside the image instead of only the outer AppImage runtime. A runner whose kernel can execute the wrapper but lacks /lib/ld-linux-armhf.so.3 therefore uploads the package with an honest unchecked warning; a runnable Node must still pass the real HTTP smoke test. Positive and negative plain-Node coverage pins the heap ceiling, override, inner-runtime probe and smoke-test ordering.

The v11.15 rerun proved that fixing the bundle launcher alone was insufficient: an AppImage wraps the ZIP already attached to that release, so its bundled start-wekan.sh still predated the fix and i686 again died with GC during deserialization.

The generated AppRun now supplies the same 1 GiB V8 ceiling for i686 and armhf before invoking the bundle launcher. This makes a missing AppImage safely rebuildable around an older published ZIP, while ${NODE_OPTIONS} supplied by an administrator still wins. Regression coverage pins that old-bundle boundary and the architecture substitution.

release-all.yml built and published the core ZIP bundles but never called the reusable AppImage workflow, leaving AppImages to a separate manual or missing-assets run. It now calls AppImage.yml immediately after the core GitHub Release has attached its amd64 and arm64 ZIPs. The exact new tag is passed explicitly, release-asset write permission is scoped to the call, and the work runs in parallel with the other post-release formats.

Regression coverage pins the release dependency, reusable-workflow path, tag, publish flag and permission, while the workflow-interface guard proves the called workflow exists and accepts every supplied input.

Card details - visible content stays inset at standard and custom widths.

An accessibility markup change accidentally made .card-details-canvas an empty sibling of the card header and body. Its computed 20-pixel padding still looked correct, but no visible content was inside it, so descriptions and custom fields touched the panel edges.

The canvas once again owns the whole card body. Positive and negative source coverage pins that ownership and rejects the empty-sibling structure, while the Playwright regression reproduces an 1100-pixel desktop panel and verifies the actual content-to-edge gaps rather than trusting the wrapper's computed style.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.15 2026-08-27 WeKan ® release

In short: Three authentication boundaries now prevent OIDC claim-based account takeover, logged-out membership discovery and account-recovery floods. Blocked metadata probes and recovery throttles appear in Problems. Nine translations are now complete, replacing 18,653 English placeholders while preserving human translations, format tokens and markup exactly. Cross-board card moves retain newly created destinations and assign stable positions.

This release fixes the following CRITICAL SECURITY ISSUES:

OIDC identities - access-token metadata cannot replace trusted account identity.

ClaimBleed blocked access-token claims from replacing the trusted userinfo id, username, email and related service-owned values, which could otherwise link an attacker's OIDC session to a victim. Prototype keys and WeKan's token bookkeeping are protected too, while ordinary whitelisted profile metadata continues to merge. There is no Problems event because every legitimate OIDC login uses this path and a bad claim cannot be distinguished from an administrator's mistaken whitelist. Positive behavioral coverage pins safe metadata and a negative whole-package scan prevents any bulk assignment into serviceData.

User metadata - sensitive membership and authentication fields require login.

MembershipBleed made the user-authenticationMethod publication return ready without querying whenever the DDP connection has no authenticated user. This closes enumeration of authentication methods, teams and organizations. Denied probes are safely folded into one MembershipBleed summary in Admin Panel → Problems with their source address. Positive ordering coverage pins the guard before the query, and a negative scan requires every sensitive user publication to retain a login boundary.

Account recovery - unauthenticated email and token methods are bounded by address.

ResetBleed limits each source address to five forgotPassword or resetPassword calls and ten verifyEmail calls per minute, stopping unbounded email floods, enumeration loops and token guessing. Only refused requests are folded into a ResetBleed Problems summary; ordinary recovery use is never logged, and a logging failure cannot weaken the denial. Behavioral tests cover allowed and refused decisions, while negative source coverage prevents any recovery method from escaping the shared callback.

and fixes the following bug:

The Move Card and Copy Card dialogs now own an authorization-filtered live destination subscription and query its Minimongo results reactively. A board created through WeKan therefore remains in the selector instead of disappearing behind a cached empty result. The #2494 regression creates the destination board, list and cards through the visible UI, uses the real Move Card dialog, verifies finite unique sort values in the database, and confirms every card remains visible in Chromium, Firefox and WebKit. A negative publication test also pins active membership and excludes unrelated public boards.

and completes the following translations:

Hausa - every interface area now uses Hausa instead of English placeholders.

Across 27 direct-translation batches, 1,317 remaining values gained Hausa activity, board, card, automation, account, search, report, storage, migration and problem-management vocabulary. Whole-locale regression coverage verifies that no English placeholders remain and that named and formatted tokens and HTML tags match English exactly; the human-preference suite proves a future Transifex translation still replaces a direct fill while existing human work cannot be overwritten.

Haitian Creole - the complete interface is available in Kreyòl ayisyen.

Across 44 direct-translation batches, all 2,167 placeholders gained Haitian Creole wording for activity, workspaces, cards, imports, automation, search, administration, storage and migrations. Whole-locale regression coverage pins zero remaining placeholders and exact token and markup inventories, while the shared negative tests protect human translations from direct fills.

Icelandic - every interface area now has Icelandic wording.

Across 44 direct-translation batches, all 2,167 placeholders gained Icelandic activity, board, import, automation, search, reporting, storage and migration terms. The locale regression proves completion and exact code-token and markup preservation; shared negative coverage ensures fills cannot replace human translations.

Inuktitut - the complete interface is available in Inuktitut syllabics.

Across 44 direct-translation batches, all 2,167 placeholders gained Inuktitut wording spanning the full board, card, automation, search, administration, storage and migration interface. Regression coverage checks zero remaining English values, preserves the syllabic-script requirement and compares every code token and HTML tag with English, including negative human-preference tests.

Javanese - every interface area now uses Javanese.

Across 44 direct-translation batches, all 2,167 placeholders gained Javanese activity, workspace, board, import, automation, search, report, storage and migration vocabulary. Whole-locale regression coverage pins completion and exact placeholders and markup; shared negative tests protect human translations.

Kazakh - every interface area now uses Kazakh and its expected script.

Across 44 direct-translation batches, all 2,167 placeholders gained Kazakh wording throughout activity, boards, imports, automation, search, reporting, storage and migrations. The locale regression verifies completion, Cyrillic vocabulary and exact code-token and markup inventories; shared negative tests continue protecting human translations.

Greenlandic - the whole interface is now available in Kalaallisut.

Across 44 direct-translation batches, all 2,167 placeholders gained Greenlandic activity, board, import, automation, search, reporting, storage and migration terms. Whole-locale coverage verifies zero English placeholders and exact token and markup inventories, with shared negative tests preventing replacement of human translations.

Kannada - every interface area now uses Kannada and its native script.

Across 62 direct-translation batches, all 2,167 placeholders gained Kannada wording for boards, cards, imports, automation, search, administration, storage and migration operations. Regression coverage verifies completion, Kannada script and exact token and markup preservation; shared negative tests protect human translations from direct fills.

Konkani - the complete interface now uses Devanagari Konkani.

Across 56 direct-translation batches, all 2,167 placeholders gained Konkani activity, board, import, automation, search, reporting, storage, migration and problem-repair vocabulary. The locale regression verifies completion, Devanagari vocabulary and every code token and HTML tag against English; shared negative coverage ensures direct fills cannot overwrite human translations.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.14 2026-08-26 WeKan ® release

In short: Card details retain their side gutters so content no longer crowds either edge. Every shared date editor opens centered in the visible viewport, and its Date and Time controls shrink within the available width instead of creating a horizontal scrollbar. Ordinary menus remain anchored to the controls that open them.

This release fixes the following bug:

Card details - opened cards and their date editors remain comfortably inside their visible bounds.

The card canvas now uses border-box sizing so its 20-pixel inline padding is part of its available width instead of allowing content to consume the gutters. All seven shared date editors open at the horizontal center of the visible viewport, using their rendered 400-pixel shell width in the offset calculation. Their Date and Time flex columns may shrink, and their controls fit the columns, removing the bottom scrollbar introduced when those controls were placed on one row.

Pure geometry coverage checks every date editor while scrolled, positive CSS coverage pins the shrink and gutter contracts, and the existing ordinary-popup tests ensure menus remain anchored to their controls. A Playwright regression opens a card and its due-date editor, then checks both gutters, exact centering and the absence of horizontal overflow.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.13 2026-08-26 WeKan ® release

In short: FerretDB closes its CodeQL findings while preserving required legacy compatibility. The Board Table view is responsive, sortable and can group cards by swimlane. Rules save date and member actions again, card details close when their card disappears, legacy minicards retain their creator choice, email notifications use recipient languages, and mobile Search returns directly to the board. Speech scrolling targets lists and cards. Private linked cards remain usable without exposing their source boards. LDAP/OIDC account linking, login boundaries, provider endpoints and group restrictions now preserve account data, resolve provider URLs consistently, use directory authentication consistently and fail closed when required. Sandstorm member cleanup distinguishes WeKan visibility from grain access, and Snap database settings preserve external URLs and restore safely.

This release fixes the following SECURITY ISSUES found by GitHub CodeQL code scanning:

FerretDB - query values remain fixed-width until their bounds are proven.

Readiness probes redact MongoDB credentials before any URI reaches a log. Aggregation array, string, date and conversion operators keep client-provided BSON numbers fixed-width until their bounds are validated, including on 32-bit builds. Developer-tool URL expressions match the complete github.com hostname literally. The MongoDB-mandated MD5 preparation inside legacy SCRAM-SHA-1 is narrowly documented and suppressed rather than changed incompatibly; new deployments retain SCRAM-SHA-256 as the stronger option. Native unit tests, extreme-value regressions, 32-bit cross-compilation, the FerretDB build, vet and the affected tools-module tests pass.

Numeric aggregation type codes are compared without narrowing, every $range result is checked at its int32 conversion boundary, and array and code-point indexes retain int64 results when they exceed BSON's int32 range. The legacy SCRAM-SHA-1 compatibility path now performs its MongoDB-mandated MD5 preparation as one direct digest, placing its narrow CodeQL exception on the reported operation. Native boundary tests, vet and 32-bit cross-compilation pass for alerts 6, 11 and 38 through 42.

Aggregation indexes are parsed directly at the requested BSON width instead of narrowing an architecture-dependent native integer. MongoDB's mandatory legacy SCRAM-SHA-1 password preparation carries both current and legacy query-specific CodeQL annotations at the exact MD5 digest operation, documenting why replacing it would reject protocol-compatible credentials rather than improve security. Native boundary tests, vet and 32-bit cross-compilation pass for alerts 43 and 44; the MongoDB-generated authentication vectors remain unchanged.

and adds the following new features:

Board Table view - a responsive overview adapts to each reader's workflow.

Card, List and Swimlane cells no longer stop growing at a hardcoded 250 pixels. The table consumes its available container width, and card titles default to a single ellipsized line whose native tooltip retains the complete text. A toolbar control opts into wrapping, with the choice stored separately for each user. Unit coverage checks defaults, persistence and user isolation; a browser test checks width, tooltip, both modes and persistence across reload.

Card, List, Swimlane, people, label and date headers now toggle ascending and descending client-side sorting. Empty date values remain last in both directions, and card title provides deterministic ordering when selected values match. Comparator tests cover text, numeric titles, dates, nulls and state transitions; a browser regression checks header toggling and indicators.

Flat rows remain the default. A per-user toolbar toggle groups cards in board swimlane order while retaining the selected column sort inside each lane. Section headers are inserted after pagination, so they never consume any of the 25 card slots; a page beginning partway through a lane still names that lane. Unit coverage checks defaults, isolation and boundaries, and a browser scenario checks lane order, card count and persistence across reload.

and fixes the following bugs:

Rules - actions save reliably and moved-from-list triggers match the correct direction.

The three affected card-action handlers copied their generated description into both the Action and its schema-bound Rule, although desc belongs only to the Action. SimpleSchema rejected the unknown Rule key and returned the user to the add-rule screen. Current-date, remove-date-value and add-member actions now match every working handler by storing desc solely on the Action. Positive and negative source coverage protects all three branches, and a Playwright flow checks that the UI saves a date Rule without desc while its Action retains the description.

The reported checklist, email, member-removal and date-action failures were already corrected by earlier changes. The remaining moved-from-list case is also fixed: its trigger resolves the activity's old list and matches a move away, while rejecting a move into that list. The existing rule-engine suite now names issue 1972 on both the positive and negative cases so that the historical report cannot silently regress.

Lists and swimlanes - color choices persist behind prefixed reverse proxies.

Firefox treated the popup's Save buttons as implicit form submissions and navigated before the list or swimlane mutation completed, which was most visible when ROOT_URL included a path prefix. The existing handlers now prevent that navigation on both the click and submit paths. Four focused positive and negative checks pass. A production-mode Meteor server under /path compiled and started, and live Chromium changed both stored colors without leaving the prefixed board URL. The Firefox browser regression is registered but could not run locally because its Playwright binary is absent. FerretDB and the service-worker 404 are unrelated to these client mutations.

Minicards - upgrades preserve whether creator avatars are displayed.

Boards created before the dedicated minicard creator setting existed no longer inherit the separate opened-card creator setting in the Card Settings popup. Their checkbox and rendered cards now both remain off by default, while an explicit click persists the opt-in and shows the creator. Five focused positive, negative and wiring checks pass. A live Meteor development stack compiled and started, and Chromium reproduced the legacy missing field, checked the initial UI state, enabled it and observed the avatar appear. FerretDB only stores the board setting and is not involved in its interpretation.

Filters and bulk selection - cached cards remain confined to the board being edited.

The earlier board-scoping fix constrains both the filter-to-selection query and every subsequent bulk action to the current board. Its positive, negative and end-to-end selector tests reproduce two boards whose cards share the filtered member, then prove that the cached card from the other board is neither selected nor mutated. This closing commit records that verified fix against issue 2306.

All Boards - tiles stay stable and every board-creation path sees templates.

The earlier startup-schema and tile-data fix restored card counters and member avatars without reactive cursor loops. The current suite verifies enabled and disabled counters independently, treats a missing legacy flag consistently as disabled, keeps boards and their lists isolated, and confirms that the template uses the resolved per-board settings. This closing commit records that verified fix against issue 4825.

The non-reactive tile-data implementation already restored the optional list names and card counts that were removed to stop board icons moving beneath the pointer. The positive regression now names issue 4959 and confirms that an enabled board receives every list in board order. Disabled, legacy and cross-board negative cases remain covered by the same suite.

The top-bar Create Board control is restored and now classifies its nested picker as a board-template search, just like Add Board on the overview. The picker remains open while its template-container subscription becomes ready, instead of returning early with stale or empty data. Focused coverage protects both entry points, archived filtering and custom-field remapping. Live Chromium shows only the active Std template, excludes an archived old template and an ordinary card, creates the board and verifies its custom-field definition.

The Admin Panel - People paging stays consistent with stored account data.

The current server-side People paging explicitly names every page and the table renders only those users in the server's stable creation-time order. Each row also receives its email, creation time and authentication method. Positive and negative coverage now names issue 4897 so unrelated cached user documents cannot make rows disappear, duplicate or display different account data while an administrator scrolls or pages.

LDAP accounts - directory data, access filters and transport settings stay explicit and valid.

LDAP servers can return one email as a Buffer or several aliases as an array of Buffers. Expanding a Buffer produced numeric byte values, while preserving an array passed binary objects into Meteor's string-only email schema and rejected the first login. WeKan now decodes every shape to UTF-8 text, keeps all aliases, uses the first as the account email, ignores empty values and removes duplicate aliases case-insensitively. Nine focused positive, negative and wiring tests pass, all LDAP tests pass, the package compiles in the live Meteor stack, and the related live Chromium suites pass 19 tests with one opt-in scenario skipped.

Enabling LDAP group filtering without its member attribute could omit the only clause tying a group search to the current user. The directory then returned every group, and the logs did not explain which setting was absent. Every group consumer now requires the identifier, member attribute and member-value format; the login restriction additionally requires an allowed group. Missing values are named in the error and produce no groups or a refused login before an LDAP search begins. Six focused configuration and wiring tests pass, the full LDAP suite remains green, and the package compiles and starts in the live Meteor stack. FerretDB is not involved in the pre-login directory searches.

The existing fix already ORed ordinary login groups with admin-sync groups, so an administrator no longer had to be duplicated into the ordinary-user group. The closing audit now parses that combined list once, removes blank and case-insensitive duplicate names, escapes every LDAP assertion value and refuses a blank-only list before it can become a broad directory query. Nine positive, negative and wiring cases cover admin-only users, multiple groups, disabled admin sync and malformed lists; the full LDAP suite passes and the package compiles and starts in Meteor. A live bind still needs an external LDAP directory; FerretDB is not involved.

The existing Meteor login-attempt guard already rejected a migrated LDAP account's retained local password in browser logins. The REST email form did not use Meteor's login hooks and could still compare that stale bcrypt hash directly. It now applies the same guard first, performs dummy bcrypt work and returns the route's uniform failure. Fourteen guard, eight REST LDAP, seven timing and ten throttle tests pass. In the live Meteor stack, the same valid password receives HTTP 401 for an LDAP account and HTTP 200 for a local account. FerretDB is not involved in authentication.

The earlier merge fix updates an LDAP account with verified OIDC identity data instead of replacing its profile, so avatars, template board and swimlane references, language and preferences remain present. The behavioral regression executes the real account-creation hook and now also proves that existing login sessions, LDAP service data and organization membership survive. Seven profile merge, eleven concurrent-login, twelve login-style and three CAS boundary tests pass, and the full app compiles and starts in Meteor. A real provider handshake still requires external LDAP and OIDC services; FerretDB is not involved.

Existing LDAP accounts are re-found by their stored identifier attribute, with the configured search field as a fallback, so later username, full-name and email changes are written instead of stopping after the first import. The opt-in authoritative mode disables a user only when a successful directory search returns zero entries and re-enables that user on reappearance. Missing identifier configuration and ambiguous matches now abort safely rather than masquerading as deletion. Eight new background-sync and eleven identifier filter tests pass, every LDAP plain-Node suite remains green, and Meteor compiles and starts. A live directory sync still requires an external LDAP server; FerretDB only stores the resulting user document.

A base DN containing both people and groups could return Active Directory, OpenLDAP or POSIX group objects when LDAP_USER_SEARCH_FILTER was empty. Their name plus the configured default email domain was enough to create spurious WeKan accounts. Bulk import now skips known group object classes and account creation independently rejects them, case-insensitively and with string, Buffer or array attributes. Standard and custom user schemas remain accepted. Six focused positive, negative and wiring tests and every LDAP plain-Node suite pass, and Meteor compiles and starts. The guide also shows appropriate user filters. FerretDB only stores accounts after this validation.

The maintained LDAP guide now recommends true for immediate TLS (LDAPS), starttls for an upgraded connection and false only for an unencrypted connection. It removes the obsolete claim that STARTTLS is inherently more secure than LDAPS and updates the FreeIPA example. Legacy ssl and tls values remain compatible with explicit deprecation warnings. Twenty-five positive, negative, wiring and documentation tests pass, and the package compiles and starts with Meteor's development MongoDB. A real TLS handshake still needs an external LDAP directory; FerretDB is not involved.

The REST route called Meteor's private bcrypt checker directly, so every LDAP account without a duplicated local password failed before WeKan's LDAP handler could run. Existing and first-time LDAP username logins now use Meteor's server-side login-handler API, then receive the same REST token as local users. Local-password accounts, uniform failure messages, throttling and two-factor checks retain their existing paths. Seven focused positive, negative and wiring tests and 28 related authentication tests pass; the full app compiles and all 25 live REST API browser tests pass. A real LDAP bind still requires an external directory fixture and was not available locally. FerretDB is not involved in credential validation.

OIDC login - provider endpoint settings work as either relative paths or complete URLs.

Authorization, token, Oracle token and UserInfo requests now share one endpoint resolver. Complete HTTP and HTTPS URLs remain intact, while relative paths are joined to the provider URL without duplicate slashes. The maintained guide documents Spring Authorization Server's /oauth2/authorize, /oauth2/token and /userinfo defaults and the exact WeKan callback. Six endpoint and 30 related OIDC/CAS tests pass, and the live Meteor app compiles and starts. A complete Spring handshake still requires an external authorization server; FerretDB is not involved in provider communication.

Language and fonts - CJK text follows the reader's selected locale.

The Japanese-specific Yu Gothic and Meiryo defaults were removed in 2017, and the current client also synchronizes the document language with the selected locale while retaining a validated per-user font override. Positive and negative source coverage protects all three boundaries. A live Chromium regression selects Chinese, requires html[lang="zh-CN"] and rejects both Japanese fonts from the computed default stack.

The earlier scoped CJK wrapping fix keeps Japanese words such as 追加 (Add) and リンク (Link) intact while allowing the footer to wrap between controls. Nine positive, negative and scope checks prevent either mid-word CJK breaks or a global rule that would damage Latin and long-URL wrapping. A live Meteor development stack compiled and started, and Chromium selected Japanese, opened the real add-card composer and measured every translated control as one line. FerretDB is not involved in client layout.

Accessibility - independently scrolling board regions can be targeted without a mouse.

Each list body and card-details window now exposes the standard region role, a translated accessible name and keyboard focus. Speech-recognition software can therefore target the intended scrollbar instead of guessing among the several independent regions on a board, and keyboard users gain the same control. Four focused positive, negative and wiring checks pass. A live Meteor development stack compiled and started, and Chromium focused overflowing list and card regions and scrolled each with Page Down. A Dragon installation was not available for its proprietary voice-command layer. FerretDB is not involved in client focus or scrolling.

Container logging - startup remains independent of obsolete transports.

The Winston/Zulip database observer that replaced Meteor's default console transport was removed in 2017, restoring normal database startup. Docker guidance no longer advertises that obsolete integration. Focused regressions protect the removed startup files and dependencies while requiring the active container database URL; live Meteor runs also started logging and MongoDB together.

REST authentication - clients can invalidate bearer tokens explicitly.

The existing logout endpoint revokes either the presented token or every session with authenticated-user scoping. All 12 positive and negative planning cases pass. A new end-to-end API regression logs out with a real bearer token, verifies its removal from the user's resume tokens and requires that same token to receive HTTP 401 on its next request.

The board archive - card actions stay visually attached to their card.

The earlier fix wraps every archived card together with its own Restore and Delete links and separates that complete group from the next card. Structural, spacing, hover, narrow-sidebar, RTL and theme-neutral regressions all pass, and the browser restore flow remains registered. The negative case prevents the old equal spacing above and below the actions from returning.

The existing cascade archives a swimlane's active cards with the lane and restores exactly those cards later. Eleven positive, negative, legacy-data and repeated-round-trip cases pass: cards archived independently remain archived, other lanes remain untouched and no active card can be stranded beneath an archived swimlane.

The current board menu opens its card, list and swimlane archive in the board sidebar, while archived boards remain a distinct section of All Boards. The strengthened 12-case navigation suite now names issue 1280 and prevents those destinations from being conflated again. The archived-card browser restore flow also remains registered.

Board members - invitation decisions and team grants stay consistent.

The earlier invitation fix deactivates removed or declining members, clears the pending invitation and refuses to reactivate anyone who no longer has a real invite, while preserving the valid acceptance path. All 11 lifecycle cases and 16 team-to-board propagation cases pass. Browser coverage also registers both administrator removal and the negative non-admin permission path.

Subtasks - their own stored board remains a usable navigation target.

The existing navigation helper derives the card and board route from the subtask itself and falls back to its stored board ID when a cross-board deposit board is not loaded in the browser. Eleven loaded, unloaded, plain-document and malformed-data cases pass; truly broken references warn instead of throwing or routing to an undefined card.

Linked cards - safe snapshots remain usable across board boundaries.

A member of the linking board must not inherit access to the private source board. Current source already filters the real card and all children by board visibility while falling back to the linked card's stored snapshot, avoiding the historical blank and frozen view. Unit coverage pins both sides of that boundary, and a browser scenario proves an unauthorized viewer can open and close the snapshot normally without weakening source-board authorization.

Board imports - old Sandstorm exports retain their cards and dates.

The existing importer restores created, received, start, due and end dates and falls back to the exported card when an old or pruned board has no creation activity. Thirteen focused cases prove valid dates, missing fields and corrupt values; invalid optional dates become null rather than aborting insertion and hiding the entire card. Both WeKan import browser flows remain registered.

Old Sandstorm exports can omit the board permission. The importer now preserves an exact explicit public or private value while missing, malformed and lookalike values fail closed to private. Five focused positive and negative cases pass, and a browser regression imports a permission-less Sandstorm-style board and verifies its stored visibility.

Sandstorm grains - preserved iframes recover and board sharing works across the grain.

A grain that finished rendering while its iframe was hidden could retain the hidden frame's narrow dimensions because returning did not reliably emit a resize. Visibility, page-show and focus restoration now coalesce into the ordinary resize path after the iframe has rendered, refreshing the sidebar, header, popups and responsive layout. Hidden-frame, timing, wiring and hot-reload regressions pass, and a live Chromium test confirms that restoring a preserved page publishes a fresh viewport measurement.

The member button no longer depends exclusively on the Powerbox native module, which is unavailable in the Node 24 bundle and never attached its claimed identity to the selected board. It now opens WeKan's maintained, permission-checked search for identities that have visited the grain. Local email-account creation stays hidden because those accounts cannot authenticate through Sandstorm. Focused coverage protects the Sandstorm branch and admin mapping; live Chromium adds a user to the second of two boards, leaves the first unchanged and opens the second board as that user.

Revoking a user's Sandstorm share prevents access but cannot notify the app, so the old WeKan member avatar can remain. Board administrators can remove that stale local member and all of their card roles, while a Sandstorm-only warning now states that this action does not revoke grain access and points them to the platform's Share access dialog. Four positive, negative and wiring regressions pass, the complete client compiles, and both live member-removal permission scenarios pass in Chromium. A real revoke callback cannot be tested because Sandstorm exposes none; FerretDB is not involved in grain authorization.

The earlier Sandstorm account fix probes candidate usernames with an anchored, escaped, case-insensitive match and retries the next numeric suffix if a concurrent insert wins the unique-index race. Eleven positive, negative, race and integration-wiring regressions pass. This closing commit records the verified implementation against issue 574.

Labels - sidebar drag-and-drop follows cards added after initial render.

The existing reactive dependency reinitializes droppable behavior whenever a card enters the board after its lists first render. Three focused wiring cases pass. A new browser regression inserts a late card, performs a real pointer drag from the sidebar label and verifies the resulting label assignment in the database, reproducing the navigation-dependent failure from issue 1554.

The linked-source publication already sends the minimal username, name, initials and avatar fields only after source-board visibility filtering. Three field-parity and authorization checks pass. The cross-board browser regression now assigns a custom avatar to a second source member, leaves the picker subscription, reloads through the linking board and requires that image to remain rendered in card details.

Card copying - duplicated conversations remain recognizable as history.

Comment authorship was already retained, and the copy dialog already prefilled the source title, but schema auto-values still replaced every copied comment's date with the copy time. Copies now re-home immutable comment data without mutating the cached source or emitting false new-comment activity. Unit tests cover preserved history and invalid input; the REST browser regression checks the original author, timestamp and destination board together.

Email notifications - translated messages follow their recipient's profile.

The earlier server-language loading fix ensures the recipient's translation bundle is present before notification subjects and activity descriptions are rendered, then carries that same language into buffered delivery. Six focused checks cover exact French prose, placeholder preservation, load order, the send-language handoff, supported-language fallback and rejection of the server default in this path; seven invitation-language tests also pass. The live Meteor development stack compiles and starts. An SMTP server was not required to verify content generation before transport, and FerretDB is not involved in localization.

User invitations - email-derived accounts remain distinct and login-safe.

The production correction landed earlier in commit 0f2179988 for duplicate issue #619: email addresses are normalized to lowercase, and a repeated local part receives the first free numeric suffix before account creation. New tests pin #825's exact john.doe addresses at two domains and its mixed-case account scenario, proving they produce distinct, lowercase-login-safe usernames rather than the old raw 403 response.

Verification emails were enabled, but the accounts package's token route was never configured, so links fell through to WeKan's signed-in guard without changing the account. /verify-email/:token and the companion resend route are now installed explicitly. Routing and mail regressions pass; live Chromium coverage proves a valid token verifies the address, is consumed and signs the user in, while an invalid token leaves both account and session unchanged.

CAS login - first-time identities follow their own validated account shape.

The shared account-creation hook assumed every login handler supplied an OIDC services object. CAS instead supplies its validated username, verified email, profile and authentication method as top-level fields, so a first login crashed before insertion. OIDC normalization now runs only when that service data exists. Focused coverage proves the missing-services path and complete CAS identity wiring while retaining the negative conflict check that prevents a CAS identity from silently taking over a non-CAS username. Provider validation still requires a deployment's external CAS server.

User profiles - accounts without email metadata can add their first address.

Sandstorm and other SSO accounts may have no emails array. Profile submission now treats that state as an empty address instead of dereferencing a missing element, and the server honors the configured Allow Email Change setting for the authenticated user's own account. Global administrators retain their existing authority; cross-user and disabled-setting writes are rejected, and new addresses begin unverified. Focused regressions and live Chromium cover all three authorization paths and the complete missing-field save.

Mobile navigation - full-screen panels return readers to their board.

On a mini screen, Search occupies the board area, but its Back arrow used to replace Search with the sidebar Home/settings content. It now resets Search for the next opening and closes the sidebar, uncovering the board immediately. Desktop Search and every other sidebar view retain their existing transitions. Positive and negative unit coverage protects that boundary, and a mobile browser regression checks the full Search-to-board interaction.

Card details - open views follow remote card lifecycle changes.

A deleted, archived or cross-board-moved card no longer leaves an empty details shell open on mobile. Each details instance observes the card that created it and clears desktop windows, mobile routes and popup state when that card disappears or changes boards. Positive and negative unit coverage pins the presence decision and cleanup wiring; a mobile browser regression removes an open card directly from the database and expects the board canvas to return.

Activities starts collapsed to keep card opening light, but its caret now asks for the complete card history regardless of obsolete per-card visibility flags. All 26 section-state, keyboard, subscription and negative regressions pass. A new browser scenario seeds a non-comment activity, opens the card's Activities section and requires that exact persisted entry to render.

Card movement - drag-and-drop remains visually stable during reactive work.

The required jQuery UI cancellation used to draw a card back in its source list until Blaze finished rendering the database move, producing the intermittent one-second flicker reported on large boards. A presentation-only copy now holds the target slot until the real reactive card arrives; it cannot receive pointer events and is removed immediately on arrival or failure, with a safety timeout. A Chromium drag regression deliberately delays the model move and verifies the target remains occupied throughout before the real card replaces the preview.

The touch bridge synthesized a click for every gesture shorter than 500 ms, even after jQuery UI had completed a sortable drag. That click followed the minicard link, making the board appear to reload with the moved card open. The adapter now suppresses only the synchronous post-drag click; normal taps and later independent clicks remain unchanged. Positive and negative unit coverage pins that boundary, and a Chromium regression performs a raw fast touch drag, checks the database move and verifies that card details stay closed.

The synchronous client no-cache lookup already prevents destination sort values from becoming NaN, overlapping existing cards and making them appear or disappear during later reordering. Eight focused positive and negative cases pass. A new browser regression moves a card into a populated list on another board, requires three distinct finite positions and verifies that all destination cards remain visible.

The current drag handler scrolls the list body under the pointer, refreshes sortable geometry after scrolling, and keeps the board still until the list reaches its end. Focused source regressions cover list selection, both scroll directions, the end boundary and geometry refresh. A Chromium regression drags through a long list, observes vertical scrolling and requires the persisted card position to change.

Snap database restore - backup archives replace existing data predictably.

The restore command retains its existing --drop behavior, preventing the duplicate-key collisions caused by merging a backup into populated collections. It now also requires exactly one existing file and preserves an archive path containing spaces as one argument. Three command-level positive and negative regressions execute the real script around a mocked Snap environment and mongorestore; the related 13 old-database recovery checks and shell syntax validation pass. Building and installing a complete Snap was not required to exercise this command boundary. FerretDB is not used by this MongoDB archive restore path.

The earlier startup fix gives an explicitly configured mongo-url priority over the internally constructed address, including its database name, while an empty setting still receives the local port and oplog defaults. Four executable positive and negative regressions run the real setting reader with a mocked snapctl and evaluate the startup selection block. They prove that both the external database and its explicit oplog URL survive unchanged; shell syntax validation also passes. A complete Snap install and external MongoDB were not needed to exercise the configuration boundary. FerretDB is bypassed when this external URL is selected.

Outgoing webhooks - activity notifications retain their translated values.

The canonical report, #2226, is closed and the current activity builder resolves members, checklist items, cards, lists, swimlanes, boards and labels before the complete parameter object reaches TAPi18n. Focused regression coverage now protects that wiring and verifies that representative German activity strings remain translated while preserving the exact replaceable-token inventory.

The current activity hook starts each outgoing delivery without awaiting it, and its guard resolves both synchronous and asynchronous failures instead of propagating them into the database operation. New regressions hold a receiver promise open and prove the caller continues immediately, verify rejected delivery is isolated, and pin the non-awaited Meteor callback wiring. This closes the older custom-field report against the completed non-blocking path.

Apache deployments - reverse-proxy examples cannot inherit open forwarding.

The abusive third-party traffic came from Apache's ProxyRequests On, not from WeKan or its database. Both reverse-proxy examples now set ProxyRequests Off inside the virtual host and no longer grant wildcard proxy access, preventing an unsafe global setting from leaking into the WeKan host. The guide also explains why ProxyMaxForwards does not close an open proxy. Three positive and negative configuration regressions protect those boundaries.

and improves the following translation:

Fulah - direct whole-file translation using established Pulaar vocabulary.

Board membership, comments, dates, attachments, checklists, custom fields and imports now use Fulah. Named and percent placeholders and HTML tags remain exact, and whole-locale invariant coverage leaves 2,116 values.

Card movement, activity summaries, checklist events and workspace controls now use Fulah. Named and percent placeholders, HTML tags and Markdown remain exact, leaving 2,066 values.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.12 2026-08-25 WeKan ® release

In short: FerretDB board loading and database searches do substantially less work through adaptive loading, narrower publications, bounded result windows and indexed shared discovery. LDAP profiles retain Active Directory display names even with restricted attributes. Cherokee, Central Kurdish, Chuvash, Dzongkha and Ewe translations are complete, with whole-locale integrity checks preserving code tokens.

This release fixes the following bug:

Board loading - bounded, indexed work for FerretDB publications.

FerretDB launchers now default to adaptive card loading instead of forcing every board into eager mode. All Boards publishes only boards related to the signed-in user rather than every public board on the instance; direct public links and the Public Boards page remain available. Linked-card and parent discovery now uses two narrow indexed queries shared only among one composite parent evaluation, with no TTL or board-id authorization cache. Compound indexes cover those card queries and the common All Boards filter and ordering. Positive and negative coverage preserves assigned-only scoping, share revocation, direct public access, pagination parity and explicit loading-mode overrides.

Attachment and checklist discovery is restricted to the authorized board scope, and filename searches retrieve only the cardId they consume. Text ranking retains only skip + limit candidates instead of every match. Due Cards uses reachable Previous/Next pages rather than an unlimited live cursor or a truncating cap. MongoDB receives compound indexes covering lazy card windows and due-card selection. The companion FerretDB change selects the declared compound filter index and bounds sorted-query memory while preserving MongoDB BSON ordering. Regression coverage checks projections, board scoping, pagination, index order and positive and negative ranking behavior.

LDAP profiles - directory names shown to signed-in users.

An LDAP user-attribute allowlist could omit LDAP_FULLNAME_FIELD even though displayName was configured separately. Active Directory then returned the login attribute but not the full name, leaving the profile header showing sAMAccountName. Restricted searches now merge in every configured identity attribute, including fields inside templates, with case-insensitive deduplication. Regression coverage requires the positive displayName request and rejects the old allowlist-only query.

and improves the following translation:

Cherokee - direct whole-file translation in Cherokee syllabary.

Card moves, membership changes, activity history, checklist events, dates and workspace controls now use Cherokee syllabary. Named and percent placeholders, HTML tags and Markdown remain exact, and whole-locale invariant coverage leaves 2,066 values.

Workspace deletion, multi-board selection, Home-board controls, due and end dates, list widths, keyboard shortcuts, swimlane heights, templates, subtasks and checklist controls now use Cherokee syllabary. Percent placeholders remain exact, and whole-locale invariant coverage leaves 2,016 values.

Administrator announcements, public boards, offline recovery, board archives, templates, attachments, backgrounds, member and assignee views and private board notices now use Cherokee syllabary. Named and percent placeholders and HTML tags remain exact, and whole-locale invariant coverage leaves 1,966 values.

Public-board notices, board movement, colors and backgrounds, desktop and mobile views, zoom, calendar and statistics views, archive recovery and card labels now use Cherokee syllabary. Named and percent placeholders and HTML tags remain exact, and whole-locale invariant coverage leaves 1,916 values.

Card membership and dates, voting, Planning Poker, dependencies, organizations, teams, accounts, backgrounds and checklist, swimlane, list, card and board imports now use Cherokee syllabary. Whole-locale placeholder, markup and script coverage leaves 1,866 values.

Member popups, archive restoration, imported-user mapping, permissions, themes, fonts, text colors, avatars and language controls now use Cherokee syllabary. Digits and whole-locale placeholder, markup and script invariants remain exact, leaving 1,816 values.

Board and page starring, automatic list widths, card-aging tiers, keyboard-style movement, dialogs, archive recovery and twenty-three color names now use Cherokee syllabary. Whole-locale placeholder, markup and script invariants leave 1,766 values.

Comment-only, read-only and worker roles, deletion confirmations, clipboard actions, linked cards, templates and custom-field types now use Cherokee syllabary. The bulk-card example remains valid JSON with exact field names, and whole-locale invariant coverage leaves 1,716 values.

Custom-field text, permanent deletion, profiles, WIP limits, account enrollment, invitation, password-reset and verification emails and authorization, JSON, CSV, TSV and board-import errors now use Cherokee syllabary. Named email tokens and paragraph breaks remain exact, leaving 1,666 values.

Account errors, attachment-free board export, PDF and Excel card exports, attachment metadata, list sorting and due-date, label and member filters now use Cherokee syllabary. File-format and product names remain intact, and whole-locale invariant coverage leaves 1,616 values.

Advanced custom-field filters, activity and imported-member states and Kanboard, NextCloud, OpenProject, issue, Asana, ZenKit, Trello, CSV, Jira, Excel and WeKan imports now use Cherokee syllabary. Operators, regex, API paths, JSON properties, file extensions and named tokens remain exact, leaving 1,566 values.

Trello archive validation, workspaces, API credentials, board selection, progress, cancellation and recovery, imported-member mapping, date validation, keyboard shortcuts and label controls now use Cherokee syllabary. URLs, file extensions, format names, percent tokens and digits remain exact, leaving 1,516 values.

Board departure, list links, archive and deletion, user, team and organization settings, swimlane actions, calendar, login, multi-selection, muted boards, archives and assigned-only roles now use Cherokee syllabary. The board-title token and file-format names remain exact, leaving 1,466 values.

Watched-board notices, private-page login, image previews, board visibility, member removal, card-description rescue, search, WIP limits, keyboard shortcuts, sidebars, signup and starred boards now use Cherokee syllabary. Named and percent tokens and link markup remain exact, leaving 1,416 values.

Starred boards, subscriptions, time tracking, numeric shortcuts, upload state, custom logo, help and URL settings, imported usernames, watching, welcome and template boards, WIP limits and attachment/API limits now use Cherokee syllabary. Digits and URL/API terms remain exact, leaving 1,366 values.

Attachment and API transfer limits, avatar blocking, registration, invitations, SMTP configuration and testing, authorization, outgoing and bidirectional webhooks and package, database, Node and Meteor metadata now use Cherokee syllabary. Invitation tokens and protocol/product names remain exact, leaving 1,316 values.

Database and FerretDB revisions, reactivity and DDP modes, OS metrics, time units, custom-field display, account changes, visibility and organization/team templates, authentication synchronization, tenancy, domains and administrators now use Cherokee syllabary. Environment variables, hostnames and product names remain exact, leaving 1,266 values.

Received and end dates, colors, requester and assigner labels, board and notification deletion, duplicate-list cleanup, subtask destinations, minicard fields, attachment and checklist counts, parent paths and label activity now use Cherokee syllabary. Named and percent tokens and counters remain exact, leaving 1,216 values.

Attachment, label and custom-field activity, rule creation and selection, visual workflow construction, card, label, member, checklist, attachment and scheduled triggers and JSON, CSV and Trello Butler rule imports now use Cherokee syllabary. Named and percent tokens and format names remain exact, leaving 1,166 values.

n8n and Node-RED workflow imports, scheduled and button triggers, daily, weekly and monthly timing, due-date conditions, card/list duration, sorting, completion, bulk movement and relative dates now use Cherokee syllabary. Named tokens, product names, weekday notation and the literal N remain exact, leaving 1,116 values.

Card movement and archives, label, member, attachment and checklist conditions, checked states, card placement, member and label removal, colors, checklist actions and email subjects now use Cherokee syllabary. The composable rule fragments remain internally consistent, leaving 1,066 values.

Automation email, archive, labels, card creation, member, checklist and swimlane actions, relative date fields, authentication, product naming, custom head tags, web manifests, asset links, layout and member displays now use Cherokee syllabary. Comma-separated examples and HTML/JSON names remain exact, leaving 1,016 values.

Custom body HTML, authentication, board duplication, swimlane deletion, date and due-time reminders, mentions, account, team and organization deletion, minicard labels, drag handles and editor behavior now use Cherokee syllabary. HTML and named and percent tokens remain exact, leaving 966 values.

Multi-card windows, Enter-key editor behavior, organization, team and user editing, notification state, rename and invitation permissions, board-role status, weekdays, ownership and linked-card deletion safeguards now use Cherokee syllabary. Keyboard combinations remain exact, leaving 916 values.

Checklist visibility, tasks, domains, shared templates, people and time scopes, My Cards sorting, Due Cards and global-search views and missing board-element errors now use Cherokee syllabary. Domain examples, Markdown emphasis and percent tokens remain exact, leaving 866 values.

Missing organizations, teams, comments and cards, global-search result counts, search operators and date, state and card-content predicates now use Cherokee syllabary. Percent and pagination tokens remain exact, leaving 816 values.

Global-search validation, paging, operators, status filters, sorting and search examples now use Cherokee syllabary. Named tokens, Markdown, pseudo-tags and literal search examples remain exact, leaving 766 values.

Board and card sorting, completion, stickers, dependency graphs, board backgrounds and card locations now use Cherokee syllabary. Import counters, JSON, SVG, dimensions and sort arrows remain exact, leaving 716 values.

Map detection, server troubleshooting, swimlanes, string templates, file, security and performance reports and office-login details now use Cherokee syllabary. Commands, entities, template tokens and IP versions remain exact, leaving 666 values.

Office and REST API reports, automatic data recovery, wait indicators, organization safeguards and support-request states now use Cherokee syllabary. API settings, product names and punctuation remain exact, leaving 616 values.

Teams, organizations, Node memory metrics, legal notices, checklist actions and attachment-storage movement now use Cherokee syllabary. URL, Node, filesystem, GridFS and S3 terminology remains intact, leaving 566 values.

Bulk attachment movement, location repair, storage statistics and MongoDB compaction now use Cherokee syllabary. Filesystem, GridFS, cloud, MongoDB, Meteor and identifier terminology remains intact, leaving 516 values.

Board timing, uploads, custom translations, checklist folding, support and accessibility settings now use Cherokee syllabary. Workspace tokens and PDF, ISO 8601, Markdown, ZIP and JSON names remain exact, leaving 466 values.

Accessibility content, brute-force lockouts, administrator user filters, attachment paths and scheduled board operations now use Cherokee syllabary. Whole-locale token and markup invariants remain exact, leaving 416 values.

Scheduled migration recovery, filesystem, S3 and Azure storage, MongoDB and FerretDB migration and Sandstorm conversion now use Cherokee syllabary. URLs, ports, environment variables and database tokens remain exact, leaving 366 values.

Sandstorm cleanup, lazy card loading, safe rich-text rendering, import/export privacy controls, activity suppression and backups now use Cherokee syllabary. HTML, environment variables, formats and identity-provider names remain exact, leaving 316 values.

Backup restoration and scheduling and Google Cloud, AWS S3 and Azure storage configuration now use Cherokee syllabary. Time formats, JSON fields, console paths, provider names and secret labels remain exact, leaving 266 values.

GridFS state, migration controls, S3 authentication, scheduled board operations and attachment monitoring now use Cherokee syllabary. MongoDB, CollectionFS, MinIO, regions and transport protocols remain exact, leaving 216 values.

Board-integrity analysis, lost-card recovery, archive restoration and file URL repair now use Cherokee syllabary. Swimlane and list identifiers, URLs and confirmation punctuation remain exact, leaving 166 values.

Board-conversion steps, scheduled-job monitoring, CPU and memory metrics and filesystem and GridFS statistics now use Cherokee syllabary. URLs, backend names, numeric intervals and identifiers remain exact, leaving 116 values.

Bulk attachment migration, throttling, monitoring and storage distribution now use Cherokee syllabary. Filesystem, GridFS, S3, units and numeric ranges remain exact, leaving 66 values.

OTP account access, repository management, administrator problem status and broken-card repair now use Cherokee syllabary. API, CPU and named repair tokens remain exact, leaving 16 values.

Event network addresses, scoped import/export and number-search guidance now use Cherokee syllabary. IP versions, file formats, product names, named tokens and pseudo-tags remain exact. All 2,166 formerly untranslated values are now translated, with zero English placeholders remaining.

Central Kurdish - direct whole-file translation in Sorani Kurdish script.

Board, list, swimlane, card, checklist, comment, member and archive activity now uses Central Kurdish. Named and percent placeholders remain exact, and new whole-locale invariant coverage leaves 2,116 values.

Card moves, checklist history, received and start dates and All Boards workspace controls now use Central Kurdish. Named and percent placeholders and Markdown terminology remain exact, leaving 2,066 values.

Workspace deletion, multi-board selection, Home boards, list widths, keyboard shortcuts, swimlane heights, templates, subtasks and checklist controls now use Central Kurdish. Percent placeholders and numeric limits remain exact, leaving 2,016 values.

Administrator announcements, offline recovery, archives, templates, attachments, backgrounds, member and assignee views and private-board notices now use Central Kurdish. Named and percent tokens and HTML tags remain exact, leaving 1,966 values.

Public-board notices, board movement, backgrounds, desktop and mobile modes, zoom, calendar and statistics views, archive recovery and card controls now use Central Kurdish. Named and percent tokens and HTML tags remain exact, leaving 1,916 values.

Card membership and dates, voting, Planning Poker, dependencies, organizations, teams, backgrounds and checklist, swimlane, list, card and board imports now use Central Kurdish. Product names remain exact, leaving 1,866 values.

Member popups, archive restoration, imported-user mapping, permissions, themes, fonts, text colors, avatars and language controls now use Central Kurdish. CAS, digits and whole-locale invariants remain exact, leaving 1,816 values.

Starring, automatic list widths, card-aging tiers, keyboard-style movement, dialogs, archive recovery and twenty-three color names now use Central Kurdish. Digits and whole-locale invariants remain exact, leaving 1,766 values.

Comment-only, read-only and worker roles, deletion confirmations, clipboard actions, linked cards, templates and custom-field types now use Central Kurdish. The bulk-card example remains valid JSON, leaving 1,716 values.

Custom-field text, permanent deletion, profiles, WIP limits, account emails and authorization, JSON, CSV, TSV and board-import errors now use Central Kurdish. Named email tokens and paragraph breaks remain exact, leaving 1,666 values.

Account errors, attachment-free board export, PDF and Excel card exports, attachment metadata, list sorting and date, label and member filters now use Central Kurdish. File-format names remain exact, leaving 1,616 values.

Advanced custom-field filters and Kanboard, NextCloud, OpenProject, issue, Asana, ZenKit, Trello, CSV, Jira, Excel and WeKan imports now use Central Kurdish. Operators, regexes, API paths, file extensions and named tokens remain exact, leaving 1,566 values.

Trello archive validation, workspaces, API credentials, board selection, progress, cancellation and recovery, imported-member mapping, date validation, keyboard shortcuts and label controls now use Central Kurdish. URLs, percent tokens and digits remain exact, leaving 1,516 values.

Board departure, list archive and movement, user, team and organization settings, swimlane actions, calendar, login, multi-selection, muted boards, archives and assigned-only roles now use Central Kurdish. The board-title token and file-format names remain exact, leaving 1,466 values.

Watched-board notices, private-page login, image previews, board visibility, member removal, card-description rescue, search, WIP limits, keyboard shortcuts, sidebars, signup and starred boards now use Central Kurdish. Named and percent tokens and link markup remain exact, leaving 1,416 values.

Starred boards, subscriptions, time tracking, numeric shortcuts, uploads, custom branding and URL settings, imported usernames, watching, welcome and template boards, WIP limits and attachment/API limits now use Central Kurdish. Digits and URL/API terms remain exact, leaving 1,366 values.

Attachment and API transfer limits, avatar blocking, registration, invitations, SMTP configuration and testing, authorization, outgoing and bidirectional webhooks and package, database, Node and Meteor metadata now use Central Kurdish. Invitation tokens and protocol names remain exact, leaving 1,316 values.

Database and FerretDB revisions, reactivity and DDP modes, OS metrics, time units, custom-field display, account changes, visibility, shared templates, authentication synchronization, tenancy, domains and administrators now use Central Kurdish. Environment variables, hostnames and product names remain exact, leaving 1,266 values.

Received and end dates, colors, requester and assigner labels, board and notification deletion, duplicate-list cleanup, subtask destinations, minicard fields, attachment and checklist counts, parent paths and label activity now use Central Kurdish. Named and percent tokens and counters remain exact, leaving 1,216 values.

Attachment, label and custom-field activity, rule creation and selection, workflow editing, card/member/checklist triggers and JSON, CSV and Trello Butler rule transfer now use Central Kurdish. Named and percent tokens and product and format names remain exact, leaving 1,166 values.

Visual-workflow imports, scheduled and button triggers, recurrence, due-date and list-duration conditions, sorting, completion, bulk movement and relative dates now use Central Kurdish. Named tokens, product names and weekday ranges remain exact, leaving 1,116 values.

Moves, archives, label, member, attachment and checklist conditions, card placement, member and label removal, colors, checklist actions and email actions now use Central Kurdish. Rule terminology remains consistent, leaving 1,066 values.

Rule emails, archives, labels, cards, members, checklists, swimlanes and date fields, authentication, custom product metadata and manifests, layout and board member lists now use Central Kurdish. Delimiters, HTML, JSON and filenames remain exact, leaving 1,016 values.

Custom body HTML, authentication, board duplication, counts, swimlane deletion, date changes and reminders, card placement, account deletion and desktop layout controls now use Central Kurdish. HTML tags, line breaks, named and percent tokens remain exact, leaving 966 values.

Multi-window cards, editor submission, organization, team and user dialogs, notification filters, renaming, board-role permissions and status, weekdays, ownership, activity, voting and linked-card deletion now use Central Kurdish. Keyboard combinations remain exact, leaving 916 values.

Checklist visibility, tasks, domains, shared templates, people and time units, My Cards sorting, due-card and global-search views and missing-object messages now use Central Kurdish. Domain examples, Markdown and percent tokens remain exact, leaving 866 values.

Missing comments, organizations and teams, card-result counts, search operators for board fields and predicates for status, dates and content now use Central Kurdish. Search tokens remain space-free and percent and range tokens remain exact, leaving 816 values.

Search predicates and validation, paging, operator syntax and examples, board, list, swimlane, label, user, organization, team, date, status, content, sorting and limit guidance now use Central Kurdish. Pseudo-tags, named tokens, examples and line breaks remain exact, leaving 766 values.

Label metadata, board and card sorting, completion, stickers, dependency types and transfer, board backgrounds and card-location fields now use Central Kurdish. Sort arrows, format names, named tokens and size syntax remain exact, leaving 716 values.

Map detection, server troubleshooting, sorting, links, board activity, swimlanes, string templates, creator fields and file, security, speed, test, database, rule, board, card, impersonation, recovery and office reports now use Central Kurdish. Commands, line breaks, entities and tokens remain exact, leaving 666 values.

Office and API reporting, automatic recovery, swimlane copying, card creators, wait animations, card sizing, organization and team deletion warnings, ticket fields and statuses, requests, card sorting and details now use Central Kurdish. API settings and product names remain exact, leaving 616 values.

Team and organization assignment, invitations, Node heap and memory metrics, legal notices, checklist copying and line conversion, card/subtask actions and attachment movement between filesystem, GridFS and S3 now use Central Kurdish. Runtime and storage names remain exact, leaving 566 values.

Attachment moves and location repair, avatar storage, default upload storage, file counts and identifiers, MongoDB GridFS compaction and board metadata now use Central Kurdish. Storage, database, runtime and oplog names remain exact, leaving 516 values.

Board time statistics, upload progress, login, file limits and validation, workspace assignment, custom translations, checklist folding, board ZIP import and support and accessibility pages now use Central Kurdish. Named tokens, formats and standards remain exact, leaving 466 values.

Accessibility content, brute-force protection, locked-user administration, active-user filters, scheduled jobs and migrations, attachment/avatar paths and scheduled board archive, backup and cleanup now use Central Kurdish. Durations and status distinctions remain explicit, leaving 416 values.

Scheduled-job and migration recovery, filesystem and S3 settings, Azure credentials, MongoDB/FerretDB text-data migration and Sandstorm grain migration now use Central Kurdish. URLs, ports, environment variables, paths and database and platform names remain exact, leaving 366 values.

Sandstorm cleanup, card-loading modes, safe link and code rendering, import, export, avatar and identity privacy, activities, notifications, watching and instance/organization backups now use Central Kurdish. HTML, code, environment variables, paths and cloud-provider names remain exact, leaving 316 values.

Backup schedules and restore modes, Google Cloud service accounts, S3, Azure and GCS configuration paths, secret handling, connection tests and attachment movement to cloud storage now use Central Kurdish. Time formats, console labels, key names and provider names remain exact, leaving 266 values.

GridFS, general migration progress and controls, CollectionFS moves, S3 authentication and connectivity, scheduled board operations, writable paths and attachment and board migration settings now use Central Kurdish. Storage, region and transport names remain exact, leaving 216 values.

Comprehensive board migration, duplicate-list cleanup, lost and archived item recovery, missing-list and file/avatar URL repair, confirmations, progress and structural migration steps now use Central Kurdish. Field identifiers and URL terminology remain exact, leaving 166 values.

Board repair steps, conversion notices, CPU and memory usage, database migrations, job schedules and queues, filesystem and GridFS monitoring and minicard list visibility now use Central Kurdish. Identifiers, intervals and storage names remain exact, leaving 116 values.

Bulk storage migration, batch size, CPU and delay thresholds, background migration state, monitoring, schedules, progress and attachment totals and minicard list/checklist visibility now use Central Kurdish. Numeric ranges, units and storage names remain exact, leaving 66 values.

Accounts and repositories, problem and repair reporting, CPU and event details, filesystem integrity, scoped import/export and number-search guidance now use Central Kurdish. OTP, API, IP versions, product and format names, named tokens and pseudo-tags remain exact. All 2,166 formerly untranslated values are now translated, with zero English placeholders remaining.

Chuvash - direct whole-file translation in Chuvash Cyrillic script.

Board, list, swimlane, card, attachment, subtask, label, checklist, comment, custom-field, member, archive and import activity now uses Chuvash. Named and percent placeholders remain exact, and new whole-locale invariant coverage leaves 2,116 values.

Card moves, member changes, generic and checklist activity, comment and date changes and All Boards workspace controls now use Chuvash. Named and percent placeholders and Markdown terminology remain exact, leaving 2,066 values.

Workspace deletion, multi-board selection, Home boards, list widths, keyboard shortcuts, swimlane heights, templates, subtasks and checklist controls now use Chuvash. Percent placeholders and numeric limits remain exact, leaving 2,016 values.

Administrator announcements, offline recovery, archives, templates, attachments, backgrounds, member and assignee views and private-board notices now use Chuvash. Named and percent tokens and HTML tags remain exact, leaving 1,966 values.

Public-board notices, board movement, backgrounds, desktop and mobile modes, zoom, calendar and statistics views, archive recovery and card controls now use Chuvash. Named and percent tokens and HTML tags remain exact, leaving 1,916 values.

Card membership and dates, voting, Planning Poker, dependencies, organizations, teams, backgrounds and checklist, swimlane, list, card and board imports now use Chuvash. Product names remain exact, leaving 1,866 values.

Member popups, archive restoration, imported-user mapping, permissions, themes, fonts, text colors, avatars and language controls now use Chuvash. CAS, digits and whole-locale invariants remain exact, leaving 1,816 values.

Starring, automatic list widths, card-aging tiers, keyboard-style movement, dialogs, archive recovery and twenty-three color names now use Chuvash. Digits and whole-locale invariants remain exact, leaving 1,766 values.

Comment-only, read-only and worker roles, deletion confirmations, clipboard actions, linked cards, templates and custom-field types now use Chuvash. The bulk-card example remains valid JSON, leaving 1,716 values.

Custom-field text, permanent deletion, profiles, WIP limits, account emails and authorization, JSON, CSV, TSV and board-import errors now use Chuvash. Named email tokens and paragraph breaks remain exact, leaving 1,666 values.

Account errors, attachment-free board export, PDF and Excel card exports, attachment metadata, list sorting and date, label and member filters now use Chuvash. File-format names remain exact, leaving 1,616 values.

Advanced custom-field filters and Kanboard, NextCloud, OpenProject, issue, Asana, ZenKit, Trello, CSV, Jira, Excel and WeKan imports now use Chuvash. Operators, regexes, API paths, file extensions and named tokens remain exact, leaving 1,566 values.

Trello archive validation, workspaces, API credentials, board selection, progress, cancellation and recovery, imported-member mapping, date validation, keyboard shortcuts and label controls now use Chuvash. URLs, percent tokens and digits remain exact, leaving 1,516 values.

Board departure, list archive and movement, user, team and organization settings, swimlane actions, calendar, login, multi-selection, muted boards, archives and assigned-only roles now use Chuvash. The board-title token and file-format names remain exact, leaving 1,466 values.

Watched-board notices, private-page login, image previews, board visibility, member removal, card-description rescue, search, WIP limits, keyboard shortcuts, sidebars, signup and starred boards now use Chuvash. Named and percent tokens and link markup remain exact, leaving 1,416 values.

Starred boards, subscriptions, time tracking, numeric shortcuts, uploads, custom branding and URL settings, imported usernames, watching, welcome and template boards, WIP limits and attachment/API limits now use Chuvash. Digits and URL/API terms remain exact, leaving 1,366 values.

Attachment and API transfer limits, avatar blocking, registration, invitations, SMTP configuration and testing, authorization, outgoing and bidirectional webhooks and package, database, Node and Meteor metadata now use Chuvash. Invitation tokens and protocol names remain exact, leaving 1,316 values.

Database and FerretDB revisions, reactivity and DDP modes, OS metrics, time units, custom-field display, account changes, visibility, shared templates, authentication synchronization, tenancy, domains and administrators now use Chuvash. Environment variables, hostnames and product names remain exact, leaving 1,266 values.

Received and end dates, colors, requester and assigner labels, board and notification deletion, duplicate-list cleanup, subtask destinations, minicard fields, attachment and checklist counts, parent paths and label activity now use Chuvash. Named and percent tokens and counters remain exact, leaving 1,216 values.

Attachment, label and custom-field activity, rule creation and selection, workflow editing, card/member/checklist triggers and JSON, CSV and Trello Butler rule transfer now use Chuvash. Named and percent tokens and product and format names remain exact, leaving 1,166 values.

Visual-workflow imports, scheduled and button triggers, recurrence, due-date and list-duration conditions, sorting, completion, bulk movement and relative dates now use Chuvash. Named tokens, product names and weekday ranges remain exact, leaving 1,116 values.

Moves, archives, label, member, attachment and checklist conditions, card placement, member and label removal, colors, checklist actions and email actions now use Chuvash. Rule terminology remains consistent, leaving 1,066 values.

Rule emails, archives, labels, cards, members, checklists, swimlanes and date fields, authentication, custom product metadata and manifests, layout and board member lists now use Chuvash. Delimiters, HTML, JSON and filenames remain exact, leaving 1,016 values.

Custom body HTML, authentication, board duplication, counts, swimlane deletion, date changes and reminders, card placement, account deletion and desktop layout controls now use Chuvash. HTML tags, line breaks, named and percent tokens remain exact, leaving 966 values.

Multi-window cards, editor submission, organization, team and user dialogs, notification filtering, board-role permissions and status, weekdays, ownership and linked-card deletion guards now use Chuvash. Keyboard chords and weekday terminology remain exact, leaving 916 values.

Checklist visibility, tasks, domains, shared templates, display names, calendar units, My Cards, due-card and global-search views and missing-object messages now use Chuvash. Domain examples, Markdown emphasis and percent tokens remain exact, leaving 866 values.

Missing comments, organizations and teams, card-result counts and the search operators and predicates for boards, people, dates, content and card state now use Chuvash. Percent and result-range tokens remain exact, leaving 816 values.

Search predicates, validation, paging, operator syntax, statuses, sorting, limits and combination guidance now use Chuvash. Named tokens, pseudo-tags, Markdown examples and line breaks remain exact, leaving 766 values.

Label metadata, board sorting, card completion, stickers, dependency relations and imports, board backgrounds and location fields now use Chuvash. JSON, SVG, named and size tokens and sort arrows remain exact, leaving 716 values.

Map locations, server-error diagnostics, activity sorting, string templates, file and security reports, impersonation, recovery and office-login details now use Chuvash. Commands, HTML entities, format tokens, line breaks and IP versions remain exact, leaving 666 values.

Office and API reports, recovery events and maintenance, swimlane copying, loading animations, organization guards, tickets, requests and card details now use Chuvash. REST API, environment, database and email-copy terms remain exact, leaving 616 values.

Team invitations, Node memory statistics, organizations, legal notices, checklist transformations and attachment-storage movement now use Chuvash. Node, heap, malloc, URL, GridFS and S3 terminology remains exact, leaving 566 values.

Bulk attachment movement, storage discovery and repair, default backends, file counts and MongoDB compaction now use Chuvash. GridFS, S3, IDs, MongoDB, oplog, Meteor and Compact terminology remains exact, leaving 516 values.

Board timing, uploads, file restrictions, custom translations, checklist display and support and accessibility pages now use Chuvash. Workspace tokens, PDF, ISO 8601, Markdown, JSON and ZIP terminology remains exact, leaving 466 values.

Accessibility, brute-force lockouts, administrator user filters, scheduled jobs, storage paths and scheduled board archive, backup and cleanup operations now use Chuvash. Security distinctions and time units remain explicit, leaving 416 values.

Scheduled-job recovery, filesystem and cloud storage and MongoDB, FerretDB and Sandstorm migrations now use Chuvash. URLs, ports, environment variables, commands, paths, database names and the destination token remain exact, leaving 366 values.

Sandstorm cleanup, adaptive card loading, safe text rendering, import/export controls, identity anonymization, activity and notification controls and backup scope and storage now use Chuvash. HTML, environment variables, formats, paths and cloud-service names remain exact, leaving 316 values.

Backup schedules and restoration plus GCS, S3 and Azure credentials, permission paths and connection tests now use Chuvash. Time formats, JSON fields, provider names, console paths, roles and file extensions remain exact, leaving 266 values.

GridFS and S3 storage, migration lifecycle controls, scheduled board operations, attachment monitoring and board migration now use Chuvash. MongoDB, GridFS, CollectionFS, AWS, MinIO, region and TLS terminology remains exact, leaving 216 values.

Comprehensive board migration, duplicate-list cleanup, lost-card restoration, archive recovery and broken list, avatar and attachment repair now use Chuvash. Database field names, IDs and URLs remain exact, leaving 166 values.

Board-repair steps, conversion progress, CPU and memory monitoring, schedules, filesystem and GridFS statistics and job queues now use Chuvash. IDs, URLs, CPU, GridFS and numeric intervals remain exact, leaving 116 values.

Attachment migration destinations, batch and CPU thresholds, background status, monitoring controls, schedules, storage distribution and system-resource totals now use Chuvash. GridFS, S3, CPU, percentages and numeric ranges remain exact, leaving 66 values.

OTP and account flows, repositories, problem and repair reporting, CPU and event details, filesystem integrity, scoped import/export and number-search guidance now use Chuvash. Named tokens, pseudo-tags, IP versions, product names and file extensions remain exact. All 2,166 formerly untranslated values are translated, with zero English placeholders remaining.

Dzongkha - direct whole-file translation in Bhutanese Tibetan script.

Board, list, swimlane, card, attachment, subtask, label, checklist, comment, custom-field, member, archive and import activity now uses Dzongkha. Named and percent placeholders remain exact, and new whole-locale invariant coverage leaves 2,116 values.

Card moves, member changes, generic and checklist activity, comments, dates and All Boards workspace controls now use Dzongkha. Named and percent placeholders and Markdown terminology remain exact, leaving 2,066 values.

Workspace deletion, multi-board selection, Home boards, list widths, keyboard shortcuts, swimlane heights, templates, subtasks and checklist controls now use Dzongkha. Percent placeholders and numeric limits remain exact, leaving 2,016 values.

Administrator announcements, offline recovery, archives, templates, attachments, backgrounds, member and assignee views and private-board notices now use Dzongkha. Named and percent tokens and HTML tags remain exact, leaving 1,966 values.

Public-board notices, board movement, backgrounds, desktop and mobile modes, zoom, calendar and statistics views, archive recovery and card controls now use Dzongkha. Named and percent tokens and HTML tags remain exact, leaving 1,916 values.

Card membership and dates, voting, Planning Poker, dependencies, organizations, teams, backgrounds and checklist, swimlane, list, card and board imports now use Dzongkha. Product names remain exact, leaving 1,866 values.

Member popups, archive restoration, imported-user mapping, permissions, themes, fonts, text colors, avatars and language controls now use Dzongkha. CAS, digits and whole-locale invariants remain exact, leaving 1,816 values.

Starring, automatic list widths, card-aging tiers, keyboard-style movement, dialogs, archive recovery and twenty-three color names now use Dzongkha. Digits and whole-locale invariants remain exact, leaving 1,766 values.

Comment-only, read-only and worker roles, deletion confirmations, clipboard actions, linked cards, templates and custom-field types now use Dzongkha. The bulk-card example remains valid JSON, leaving 1,716 values.

Custom-field text, permanent deletion, profiles, WIP limits, account emails and authorization, JSON, CSV, TSV and board-import errors now use Dzongkha. Named email tokens and paragraph breaks remain exact, leaving 1,666 values.

Account errors, attachment-free board export, PDF and Excel card exports, attachment metadata, list sorting and date, label and member filters now use Dzongkha. File-format names remain exact, leaving 1,616 values.

Advanced custom-field filters and Kanboard, NextCloud, OpenProject, issue, Asana, ZenKit, Trello, CSV, Jira, Excel and WeKan imports now use Dzongkha. Operators, regexes, API paths, file extensions and named tokens remain exact, leaving 1,566 values.

Trello archive validation, workspaces, API credentials, board selection, progress, cancellation and recovery, imported-member mapping, date validation, keyboard shortcuts and label controls now use Dzongkha. URLs, percent tokens and digits remain exact, leaving 1,516 values.

Board departure, card and list links, archive actions, user, team and organization settings, imports, navigation, list movement, multi-selection, notifications and board roles now use Dzongkha. The named board-title token and whole-locale markup invariants remain exact, leaving 1,466 values.

Watching, public and private access, image previews, member removal, rescue dialogs, search, WIP limits, keyboard shortcuts, sidebars and starred and default boards now use Dzongkha. Named and percent tokens and HTML link markup remain exact, leaving 1,416 values.

Time tracking, assignments, subscriptions, uploads, custom branding, URL schemes, watching, welcome and board templates and WIP-limit controls now use Dzongkha. Product names, numeric ranges and whole-locale invariants remain exact, leaving 1,366 values.

Attachment and API transfer limits, avatar restrictions, registration, invitations, SMTP configuration and tests, authorization, webhooks and software version labels now use Dzongkha. Email tokens and paragraph structure and whole-locale markup invariants remain exact, leaving 1,316 values.

Database, FerretDB, reactivity and operating-system diagnostics, time units, custom-field display, account options, visibility, shared templates, multitenancy, organization domains and scoped administrators now use Dzongkha. Environment names and example hostnames remain exact, leaving 1,266 values.

Received and end dates, colors, requester and assigner labels, destructive board and notification actions, duplicate lists, subtask destinations, minicard fields, card hierarchy and label activity now use Dzongkha. Named and percent tokens and numeric checklist formats remain exact, leaving 1,216 values.

Attachment, label and custom-field activity, visual rule construction, card, label, member and checklist triggers and JSON, CSV and Trello Butler rule imports now use Dzongkha. Percent and named automation tokens remain exact, leaving 1,166 values.

Visual-workflow formats, scheduled and due-date triggers, card and board buttons, list sorting, completion actions, relative dates and automation time units now use Dzongkha. Workflow product names, counts and schedule parameters remain exact, leaving 1,116 values.

List and archive conditions, label, member, attachment and checklist triggers, card movement and restoration, membership, color, checklist and email actions now use Dzongkha. Whole-locale token and markup invariants remain exact, leaving 1,066 values.

Card creation, archive, membership, checklist and date-field actions, automation notes, authentication, custom product names, head tags, web manifests, Android asset links and layout controls now use Dzongkha. Example lists and HTML, JSON and filename literals remain exact, leaving 1,016 values.

Custom body HTML, authentication display, duplication, destructive swimlane and account actions, date activity, due reminders, mention notifications, drag-resizing and multi-card controls now use Dzongkha. HTML tags, named and percent tokens and keyboard names remain exact, leaving 966 values.

Multi-card and keyboard submission behavior, organization, team and user dialogs, notification controls, renaming and board-role permissions, weekdays, status fields and linked-card deletion warnings now use Dzongkha. Keyboard chords and whole-locale invariants remain exact, leaving 916 values.

Checklist visibility, domain-scoped shared templates, My Cards sorting, Due Cards and global-search views and board, swimlane, list, label and username errors now use Dzongkha. Domain examples, Markdown emphasis and percent tokens remain exact, leaving 866 values.

Comment, organization and team errors, result counts and board, swimlane, list, label, user, date, status, attachment, checklist and custom-field search operators and predicates now use Dzongkha. Percent and result-range tokens remain exact, leaving 816 values.

Public, private, selector and projection predicates, validation errors, pagination and the complete global-search operator, status, presence, sorting, limit and composition guidance now use Dzongkha. Named tokens, pseudo-tags and Markdown examples remain exact, leaving 766 values.

Labels, board and card sorting, completion, stickers, dependency relationships and JSON/SVG imports, board backgrounds and location fields now use Dzongkha. Sort markers, named import counts and the background-size token remain exact, leaving 716 values.

Map detection and providers, server troubleshooting, sorting, board activity, swimlane movement, string templates, file, security, speed, test, database, rule, recovery and office-login reports now use Dzongkha. Shell commands, entities, format tokens and IP versions remain exact, leaving 666 values.

Office and REST API reporting, data recovery and maintenance, swimlane copying, wait spinners, card sizing, organization and team deletion constraints and ticket and help-request workflows now use Dzongkha. API settings, database names and mail headers remain exact, leaving 616 values.

Team and organization controls, Node heap and memory diagnostics, legal notices, checklist movement and copying and filesystem, GridFS and S3 attachment storage actions now use Dzongkha. Technical storage and memory names and the checklist line example remain exact, leaving 566 values.

Attachment relocation and location repair, avatar scopes, default storage, move progress and file counts, storage identifiers and MongoDB collection compaction now use Dzongkha. Backend names, identifiers and oplog terminology remain exact, leaving 516 values.

Board timing and uploads, file restrictions, workspace assignment, custom translations, subtasks, ISO week display, Markdown conversion, board ZIP imports, checklist folding, support and accessibility now use Dzongkha. Named tokens and format names remain exact, leaving 466 values.

Accessibility content, brute-force account protection and unlocking, active user filters, attachment and avatar paths, scheduled board archive, backup and cleanup operations and cron migrations now use Dzongkha. Whole-locale token and markup invariants remain exact, leaving 416 values.

Scheduled-job and migration recovery, filesystem, S3-compatible and Azure storage, MongoDB/FerretDB text-data migration and Sandstorm grain conversion now use Dzongkha. Database URLs, ports, environment names, commands, named tokens and grain paths remain exact, leaving 366 values.

Sandstorm cleanup, adaptive card loading, plain-text link and code controls, import/export and avatar restrictions, user anonymization, activity, notification and watch controls and scoped backups now use Dzongkha. Environment names, markup, examples and backup paths remain exact, leaving 316 values.

Backup frequency and restoration, Google Cloud credentials and permissions, AWS/S3, Azure and GCS setup paths, secret handling, connection tests and cloud attachment movement now use Dzongkha. Time formats, ranges, credential fields, roles, provider names and filenames remain exact, leaving 266 values.

GridFS storage, migration start, pause, stop and status controls, CollectionFS movement guidance, S3 credentials and connections, scheduled board operations, attachment monitoring and board migrations now use Dzongkha. Backend, region and transport names remain exact, leaving 216 values.

Comprehensive board integrity checks, duplicate-list cleanup, lost-card and archive restoration, missing-list repair, avatar and attachment URL repair, confirmation dialogs, progress and migration steps now use Dzongkha. Schema identifiers and URL and ID literals remain exact, leaving 166 values.

Final board-repair steps, conversion status, CPU and memory reporting, scheduled intervals, filesystem and GridFS monitoring, board scans, job queues and migration state now use Dzongkha. Identifiers, metric names and numeric intervals remain exact, leaving 116 values.

Attachment migration destinations, batch and CPU thresholds, background status, monitoring controls, schedules, storage distribution and system resources now use Dzongkha. GridFS, S3, CPU, percent signs and numeric ranges remain exact, leaving 66 values.

Repository authentication and uploads, problem monitoring, event diagnostics, broken-card repair and import/export controls now use Dzongkha. Named tokens, angle-bracket examples, inline code, emphasis, file extensions and product names remain exact. This final 66-value batch completes all 2,166 Dzongkha placeholders.

Ewe - direct whole-file translation using established Ewe vocabulary.

Organization and team membership, comments, due dates, attachments, subtasks, labels, checklists, boards, lists, cards, swimlanes and archive and import activity now use Ewe. Percent and named activity tokens remain exact, leaving 2,116 values.

Card movement and restoration, member removal, general activity sentences, checklist events, received and start dates and workspace creation and settings now use Ewe. Named and percent activity tokens and Markdown terminology remain exact, leaving 2,066 values.

Workspace deletion, board selection and starring, Home-board behavior, list widths, keyboard shortcuts, swimlane height and checklist and card controls now use Ewe. Percent placeholders, pixels and the 270-pixel limit remain exact, leaving 2,016 values.

Administration and announcements, public boards, archive and restore controls, templates, attachments, backgrounds, All Boards settings, members and assignees now use Ewe. Named and percent tokens, URL terminology and strong markup remain exact, leaving 1,966 values.

Board rearrangement and workspace assignment, visibility and watch controls, desktop and mobile views, zoom, calendar navigation, archives and card editing now use Ewe. Named and percent tokens, strong markup and the zoom range remain exact, leaving 1,916 values.

Card membership, voting, Planning Poker, dependencies, organization and team assignment, backgrounds, account deletion, domains and board-part imports now use Ewe. Product terminology remains exact, leaving 1,866 values.

Member dialogs, card and board links, imported-member mapping, themes, fonts, text colors, avatars, language and permission controls now use Ewe. CAS, email and the numeric font sample remain exact, leaving 1,816 values.

Settings, starring, automatic list widths, card aging, movement, dialogs, accessibility navigation and twenty-three color names now use Ewe. Numeric tiers and whole-locale invariants remain exact, leaving 1,766 values.

Comment and read-only roles, deletion confirmations, link copying, multi-card templates, labels and custom-field types now use Ewe. The translated card template remains valid JSON and keyboard terminology remains exact, leaving 1,716 values.

Custom-field text, permanent deletion, WIP limits, dates, reactions, notifications, account emails and board, user and import validation now use Ewe. Named email tokens, line breaks, WIP, JSON, CSV, TSV and WeKan remain exact, leaving 1,666 values.

User and account errors, card exports, attachment metadata, free-space errors, sorting and date, label and member filters now use Ewe. PDF, Excel and disk terminology remain exact, leaving 1,616 values.

Advanced filtering, activity visibility, imported members and Kanboard, NextCloud Deck, OpenProject, Asana, ZenKit, Trello, Jira, Excel and WeKan board imports now use Ewe. Operators, regex, tokens, API paths, extensions and product names remain exact, leaving 1,566 values.

Trello ZIP validation, workspace placement, API imports, credential storage, bulk selection and cancellation, member mapping, date validation, keyboard shortcuts and labels now use Ewe. The API URL, key and token names, year example and percent token remain exact, leaving 1,516 values.

Last-administrator protection, leaving boards, list archives, role settings, swimlane actions, card imports, login, selection tools and notification roles now use Ewe. Named board-title tokens and import formats remain exact, leaving 1,466 values.

Watch notifications, private and public access guidance, member removal, description rescue, search, WIP limits, keyboard shortcuts, sidebars and default-board behavior now use Ewe. HTML links, named and percent tokens and product and keyboard terms remain exact, leaving 1,416 values.

Starred boards, time tracking, label and assignee shortcuts, uploads, custom logos and URLs, welcome templates, WIP errors and attachment/API limits now use Ewe. Numeric ranges, dimensions and technical names remain exact, leaving 1,366 values.

Attachment transfer limits, avatar uploads, registration, invitations, SMTP/TLS settings and test mail, webhooks and package, database, Node and Meteor labels now use Ewe. Named email tokens and technical names remain exact, leaving 1,316 values.

Database and FerretDB metadata, reactivity, DDP and operating-system metrics, custom fields, visibility, organizations, teams and multitenancy now use Ewe. Technical modes, environment names and example domains remain exact, leaving 1,266 values.

Received and end dates, color dialogs, permanent board and duplicate-list deletion, subtask and card settings, minicard fields, parent paths and label activity now use Ewe. Named and percent tokens and count examples remain exact, leaving 1,216 values.

Attachment and custom-field activity, visual rule workflows, triggers, actions, rule selection and JSON, CSV and Trello Butler imports now use Ewe. Percent and named tokens and format and product names remain exact, leaving 1,166 values.

n8n and Node-RED workflow imports, scheduled and button triggers, due-date conditions, list sorting, completion, relative dates, units and board and card actions now use Ewe. Product names, count tokens and variables remain exact, leaving 1,116 values.

Rule predicates and actions for lists, labels, members, attachments, checklists, card movement, colors and email now use Ewe. Whole-locale token and markup invariants remain exact, leaving 1,066 values.

Automation actions, checklist construction, date-field updates, card links, authentication, custom HTML and JSON, web manifests, assetlinks and layout settings now use Ewe. Comma-separated examples, extensions and format names remain exact, leaving 1,016 values.

Custom body HTML, LDAP and OIDC authentication, duplication, swimlane deletion, due-time activity and reminders, mentions, destructive confirmations and drag resizing now use Ewe. HTML tags, named and percent tokens, line breaks and keyboard terminology remain exact, leaving 966 values.

Multi-card windows, editor submission, organization, team and user dialogs, notification state, role permissions, weekdays, status, voting and linked-card deletion guidance now use Ewe. Keyboard combinations remain exact, leaving 916 values.

Checklist visibility, tasks, domains, shared templates, My Cards, Due Cards, global search views and not-found messages now use Ewe. Domain examples, Markdown emphasis and percent placeholders remain exact, leaving 866 values.

Search result counts, operators and predicates for boards, swimlanes, lists, users, dates, attachments, descriptions and checklists now use Ewe. Named result-range and percent tokens remain exact, leaving 816 values.

Search predicates, validation, pagination and the complete global-search instruction set now use Ewe. Named operator and predicate tokens, pseudo-tags, inline-code examples, quoted values and Markdown emphasis remain exact, leaving 766 values.

Sorting, card completion, stickers, dependency relations and imports, board backgrounds and locations now use Ewe. Sort directions, JSON and SVG, named import counts and size tokens remain exact, leaving 716 values.

Location detection, map settings, server troubleshooting, swimlane movement, string templates, system reports, impersonation, recovery and office login data now use Ewe. Shell commands, placeholders, HTML entities, IPv4 and IPv6 remain exact, leaving 666 values.

REST API reporting, recovery and database health, swimlane copying, wait spinners, card sizing, deletion constraints, tickets, requests and card details now use Ewe. Environment, database, spinner and mail-header names remain exact, leaving 616 values.

Teams and organizations, invitations, Node heap and memory diagnostics, legal notices, checklist movement and copying and filesystem, GridFS and S3 attachment moves now use Ewe. Technical storage and diagnostic names remain exact, leaving 566 values.

Attachment movement and location repair, default storage, progress and counts, storage identifiers and MongoDB GridFS collection compaction now use Ewe. Backend, identifier, database and oplog terminology remain exact, leaving 516 values.

Board timing and uploads, file restrictions, workspace assignment, custom translations, subtasks, ISO week display, Markdown conversion, board ZIP imports, checklist folding, support and accessibility now use Ewe. Named tokens and format names remain exact, leaving 466 values.

Accessibility content, brute-force account protection and unlocking, active user filters, attachment and avatar paths and scheduled board archive, backup and cleanup operations now use Ewe. Whole-locale token and markup invariants remain exact, leaving 416 values.

Scheduled-job and migration recovery, filesystem, S3-compatible and Azure storage, MongoDB/FerretDB text-data migration and Sandstorm grain conversion now use Ewe. Database URLs, ports, environment names, commands, named tokens and grain paths remain exact, leaving 366 values.

Sandstorm cleanup, adaptive card loading, plain-text link and code controls, import/export and avatar restrictions, user anonymization, activity, notification and watch controls and scoped backups now use Ewe. Environment names, markup, examples and backup paths remain exact, leaving 316 values.

Backup frequency and restoration, Google Cloud credentials and permissions, AWS/S3, Azure and GCS setup paths, secret handling, connection tests and cloud attachment movement now use Ewe. Time formats, ranges, credential fields, roles, provider names and filenames remain exact, leaving 266 values.

GridFS storage, migration lifecycle controls, CollectionFS movement guidance, S3 credentials and connections, scheduled board operations, attachment monitoring and board migrations now use Ewe. Backend, region and transport names remain exact, leaving 216 values.

Comprehensive board integrity checks, duplicate-list cleanup, lost-card and archive restoration, missing-list repair, avatar and file URL repair, confirmations, progress and migration steps now use Ewe. Schema identifiers, IDs and URLs remain exact, leaving 166 values.

Final board-repair steps, conversion status, CPU and memory reporting, scheduled intervals, filesystem and GridFS monitoring, board scans, job queues and migration state now use Ewe. Identifiers, metric names and numeric intervals remain exact, leaving 116 values.

Attachment migration destinations, batch and CPU thresholds, background status, monitoring controls, schedules, storage distribution and system resources now use Ewe. GridFS, S3, CPU, percent signs and numeric ranges remain exact, leaving 66 values.

Repository authentication and uploads, problem monitoring, event diagnostics, broken-card repair and import/export controls now use Ewe. Named tokens, angle-bracket examples, inline code, emphasis, file extensions and product names remain exact. This final 66-value batch completes all 2,166 Ewe placeholders.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.11 2026-08-25 WeKan ® release

In short: this release closes five security and privacy gaps, improves board creation and filtering, and makes denied attacks visible to administrators. It also completes substantial translation and locale-integrity work, strengthens cross-browser testing, updates dependencies, and documents Haxe, Go and Free Pascal alternatives for WeKan's future architecture.

This release fixes the following HIGH AND MODERATE SECURITY ISSUES:

User search - login, identity fields and literal query boundaries.

UserSearchBleed and MiniProfileBleed allowed logged-out profile enumeration and let any authenticated user retrieve instance-wide email, administrator, account-state and organization metadata. Both publications now require authentication; the general search returns only public identity fields. User-controlled search text is escaped before becoming a regular expression, and both DDP search paths are rate-limited. Regression coverage pins the positive identity projection and the negative sensitive-field and raw-pattern cases. The logged-out mini-profile denial is summarized as MiniProfileBleed in Admin Panel → Problems with its source address. UserSearchBleed has no runtime event because its fixes change what legitimate search responses carry and how ordinary punctuation is interpreted; logging those calls would record normal use.

Position history - authorization for recorded moves and undo.

PositionHistoryBleed trusted a client-created history entry's previous board. Inserts now require membership on both named boards, the undo method rechecks the history board, the model rechecks destination membership immediately before moving a card, and clients cannot rewrite trusted history after insertion. The test covers allowed same-board history and rejected cross-board data. Denied inserts, rewrites and undo moves are summarized as PositionHistoryBleed in Admin Panel → Problems with the account and source address.

Board exports - keeping subtask data inside the exported board.

SubtaskExportBleed allowed a card from a private board to appear in another board's JSON, ZIP, Excel or PDF export when its parent identifier named a card there. All six subtask query paths now include the exporting board identifier. Regression coverage checks every board and card export implementation and rejects the old parent-only selectors. There is no runtime event because the fix changes the contents of a legitimate export instead of denying an attributable attack.

CAS login - explicit ownership of matching local accounts.

CasBleed allowed a validated CAS username to receive the session of an existing password or other non-CAS account with the same name. New CAS users are marked with their authentication method; a conflicting account is rejected unless the administrator explicitly sets CAS_MERGE_EXISTING_USERS=true. Positive CAS reuse and negative implicit linking are pinned by regression coverage. Refused implicit links are summarized as CasBleed in Admin Panel → Problems.

Security reporting - denied attributable attacks reach Admin Panel Problems without turning ordinary use into noise.

Denied MiniProfileBleed, PositionHistoryBleed and CasBleed attempts now create attributed, rate-bounded entries in Admin Panel → Problems. UserSearchBleed and SubtaskExportBleed remain silent because their safe paths are indistinguishable from normal searches and exports. Clients are also prevented from rewriting validated position-history records after insertion. Canary, advisory and negative authorization tests cover the reporting boundary.

and updates the following dependencies:

Dependencies - storage, authentication, build and lint packages stay current.

The first refresh advances the resolved AWS, Azure authentication, MongoDB, Rspack diagnostics, SWC, TypeScript ESLint, browser-compatibility and supporting packages without changing WeKan's declared dependency ranges.

A follow-up lockfile refresh takes the compatible patch releases published after the first batch, including the final AWS SDK, Smithy, parser, lint and browser-data resolutions used by this release.

and fixes the following bugs:

All Boards - the overview's Lists and Table layouts.

The All Boards Table layout displayed existing boards but offered no way to create one. It now shows the same create action and uses the same handler as the Lists tile, including the Template Container wording and workspace context. Archive and the special Home section continue to exclude creation. Source, negative and browser tests cover the available and excluded sections.

The source-level Lists and phone-layout tests now recognize the shared Add Board action introduced in Table view while continuing to pin scrolling, tile and layout behaviour. This keeps the feature's new control from being mistaken for an unexpected duplicate by the older regression assertions.

Board views - alternate ways to display one board's cards.

The Table layout queried every active card directly and ignored label, member, assignee, date and other criteria from the board Filter. Its reactive query now ANDs the Filter selector with immutable board and archive boundaries before the view's own text search and pagination. Unit, wiring and browser tests cover both unfiltered and filtered rows.

and improves the following developer tooling:

Complete tests - suites use repository tools and available CPU browsers.

Translation subprocesses now use the suite's own Node executable, invariant and backlog expectations follow the current translation helpers, and the Table-view browser test reapplies its filter after the view-change reload. The complete runner therefore checks current behaviour instead of failing on stale harness assumptions.

The Puppeteer-based Node regression harness now routes through the existing Playwright container when its browser must come from Docker. Linux arm64 no longer falls back to a missing /usr/bin/chromium, and selection tests pin both the local and container paths.

Browser isolation - one test's teardown cannot revoke another test's login.

Each Red Strings case now creates a separate resume token. Closing an earlier Chromium or WebKit connection can no longer revoke the session a later Firefox case is about to use, eliminating the cross-browser ordering failure while retaining normal session teardown.

Release notes - readers get a brief overview before topic and commit detail.

AGENTS.md and CLAUDE.md now define three levels: a release-wide In short paragraph of at most about 120 words, one high-level summary for each topic, and commit-specific expandable details. The format regression caps the introductory word count and checks that the documented grouping vocabulary remains present.

and improves the following documentation:

Multiverse - alternative implementation languages and dependency mappings.

The Multiverse design compares incremental Haxe/JavaScript modules, a Haxe browser client, a Haxe/Node server and native HashLink, C++ and JVM servers. It maps Meteor platform facilities and WeKan dependencies to Haxe libraries or explicitly custom replacements, and recommends a tested vertical slice before any complete rewrite.

The Go design maps the server, browser, data, authentication, storage, export, operations, testing and distribution stack to standard-library facilities, maintained packages or custom compatibility work. It separates Pug as Jade's JavaScript successor from Go-native html/template and templ rewrites.

The Free Pascal design derives its stack from Omi and Wami: FCL fphttpapp, httproute, fpjson, linked SQLite, server-rendered HTML, optional interact.js, Caddy at the TLS edge and mORMot 2 or Brook only when measured scale requires them.

Development sandbox - the documented editor sandbox uses its maintained, open-source distribution consistently.

The sandbox directory, launcher and documentation now consistently name VSCodium. Obsolete VS Code-specific setup is removed so paths and commands match the editor distribution the sandbox actually installs.

and improves the translation workflow:

Translation policy - correct-language and placeholder integrity.

Human-preference protection now applies only to translations written in the locale tag’s language. Mixed or wrongly seeded values must be replaced directly, including same-script cases such as Russian text in Mongolian, with vocabulary review and regression coverage where script detection cannot distinguish them.

Underscore-delimited tokens such as __board__ and percent-prefixed format tokens such as %s are code, not translatable prose. They must retain their English spelling, case, count and format. A translated, renamed, missing or malformed token is restored from the same key in en.i18n.json, even inside an otherwise human translation, and regression coverage compares token inventories with English.

The invariant-source regression now follows the completed-locale list and the current fill helper instead of retaining obsolete exclusions. It continues to prove that already completed locales stay at zero fillable English placeholders as translation work advances.

Placeholder repairs - exact named and printf token inventories.

Spanish (Argentina), Galician, Gujarati, Hungarian, Polish and Portuguese variants now preserve the same named and printf tokens as their English keys. The repair keeps exact spelling and case, updates obsolete Hungarian prose and replaces copied Portuguese wording with Galician. Whole-file regression coverage proves all eleven locale files are clean and rejects the malformed, missing and wrong-language forms. The direct Galician and Hungarian wording welcomes human review. Another 1,331 mismatched keys across 108 locale files remain for audited batches.

Welsh, Greek, Spanish, Basque, Finnish, Croatian and Slovenian variants now preserve exact named, printf and HTML placeholders. The repair covers 34 counted token mismatches plus four Welsh machine-placeholder remnants, removes a duplicated English sentence from Greek and replaces Catalan prose in Basque. Whole-file regression coverage proves all seventeen locale files are clean and rejects the corrupt or wrong-language forms. The direct Welsh, Basque, Finnish, Croatian and Slovenian wording welcomes human review. Another 1,297 mismatched keys across 91 locale files remain for audited batches.

Asturian, Bulgarian, Czech, Danish, Persian, Hebrew, Japanese, Georgian, Macedonian, Slovak, Serbian, Tamil, Venda and Xhosa now preserve their exact named and printf placeholders. The repair covers 54 counted mismatches plus a hidden Xhosa machine remnant, and replaces same-script wrong-language carryovers according to each locale tag. Whole-file regression coverage proves all eighteen files are clean and rejects the corrupt tokens and copied neighbouring-language forms. These direct translations have mixed confidence and welcome native-speaker review. Another 1,243 mismatched keys across 73 locale files remain for audited batches.

Esperanto, Japanese hiragana, Korean, Malay, Swedish, Telugu, Uzbek and Vietnamese variants now preserve the exact spelling, case and multiplicity of their English placeholders. The repair covers 56 mismatches, replaces copied Spanish in Esperanto, and writes the hiragana and Arabic-script variants in their declared scripts. Whole-file regression coverage proves all fourteen files are clean and rejects translated token names, duplicate prompt values and wrong-language forms. These direct translations have mixed confidence and welcome native-speaker review. Another 1,187 mismatched keys across 59 locale files remain for audited batches.

The coherent part of the five-mismatch tier now preserves exact activity, email, count and search tokens across eleven locale variants. Search examples such as user:<name> and has:-due remain literals instead of becoming extra runtime placeholders. Whole-file regression coverage proves all eleven files are clean and rejects embedded spaces, incomplete named tokens and invented operator tokens. Another 1,132 mismatched keys across 48 locale files remain; the four wrongly seeded files from this tier are handled separately in the next entry.

Breton, Walloon and Wolof no longer use copied French in the five affected activity and search strings, and Klingon no longer uses copied German. Their twenty mismatches now preserve the exact English token inventory while search examples remain literals. Whole-file regression coverage proves all four files are clean and rejects the French and German seed wording. These direct translations have low confidence and welcome native-speaker review. Another 1,112 mismatched keys across 44 locale files remain for audited batches.

The coherent part of the six-mismatch tier restores 60 logical locale values across nine tracked data files and the ru-RU symlink alias. Azerbaijani activities retain every board location, Catalan search help restores its full predicate inventory, and Russian email subjects and errors use exact named and printf tokens. Whole-file regression coverage proves all ten tags are clean and rejects corrupted predicates, %1 fragments and substituted URL tokens. The direct Azerbaijani wording welcomes human review. Another 1,052 mismatched keys across 34 locale files remain for audited batches.

Italian restores its six activity placeholders, while Venda and Volapük replace wrong-language seed prose as they restore the same exact token inventories. Whole-file regression coverage proves all three files are clean, checks every due-time value and rejects the Italian, Esperanto and French seed wording. The direct Venda and Volapük translations have low confidence and welcome native-speaker review. Another 1,034 mismatched keys across 31 locale files remain for audited batches.

A deterministic, transactional utility maps PH0, PH1 and later markers to the protected backtick, HTML, angle, named and printf spans in each matching English source key. It repaired 1,208 markers in 539 translated values across Igbo, Odia, Turkmen, Uyghur and Yoruba without replacing their surrounding prose. Repository-wide negative coverage rejects every marker spelling variant. Igbo and Yoruba are now placeholder-clean; another 546 mismatched keys across 29 locale files remained for audited batches.

The remaining 32 malformed activity, member, range and search-help values restore every named and printf placeholder while retaining prose in each declared language. Whole-file coverage proves all three locale inventories are clean, and focused negative tests reject the final Odia marker fragment and missing Turkmen and Uyghur values. The direct translations welcome native-speaker review. Another 514 mismatched keys across 26 locale files remained for audited batches.

Acehnese, Indonesian, Turkish and Traditional Chinese restore 28 named and printf inventories. Acehnese replaces Indonesian seed wording with its existing kad, senarai and papan terminology; focused negative tests also reject case-damaged Turkish tokens and translated Chinese token names. All four files are clean. The direct Acehnese prose has low confidence and welcomes native-speaker review. Another 486 mismatches across 22 locale files remained.

Latvian, Norwegian Bokmål, Occitan and Hong Kong Traditional Chinese restore 37 named and printf inventories. Occitan also replaces French-seeded prose in its affected values. Whole-file coverage and focused negative tests reject mistyped, translated and wrong-language identifiers. All four files are clean; the direct Occitan prose welcomes native-speaker review. Another 449 mismatches across 18 locale files remained.

Ten locale files restore 145 named and printf inventories. Romanian replaces Italian-seeded activity prose, while Simplified and Traditional Chinese variants reuse only asserted placeholder-clean sibling translations. Family-wide and focused negative coverage proves every file clean and rejects translated or wrong-language identifiers. Another 304 mismatches across eight locale files remain; direct translations welcome native-speaker review.

Sixty-eight values restore exact activity arities plus every operator and predicate in Ukrainian search help. Whole-file and focused coverage proves both variants clean. Direct wording welcomes native-speaker review.

Thirty-five activity, email, due-date, range and search values restore their named and printf inventories. Whole-file negative coverage rejects translated identifiers. Direct wording welcomes native-speaker review.

Arabic, Algerian Arabic, Egyptian Arabic and Moroccan Arabic restore 160 activity and email inventories. Script and identifier regressions cover every file. Moroccan Arabic wording has low dialect confidence and welcomes review.

The final 41 mismatches now use Latin-script Tamazight prose instead of mixed Arabic and French seed text. Whole-file coverage proves the repository-wide placeholder mismatch count is zero. These translations have low confidence and welcome native-speaker review.

Numbers, symbols, empty values, placeholder-only formats, product names and storage backends no longer appear as impossible translation work. Real sentences containing placeholders remain listed. The corrected direct-fill backlog is 202,628 values across 210 locales, with CLI regression coverage.

Finnish, two Hindi variants and two Ukrainian variants translate their final genuine English values with exact-value and target-script coverage.

Both Vietnamese variants translate checklist, font-preview and storage terms. Date-format masks are now classified as invariant, completing both Hebrew tags. CLI and language regressions cover both outcomes.

Connection-string, container, backup and project-ID values now use Greek, with Greek-script and zero-backlog coverage.

Gujarati, Odia, Punjabi and Telugu translate 28 board-selection and permanent-delete values. Target-script and English-remnant coverage verifies all four completed files.

Belarusian, Armenian, Georgian, Mongolian, Serbian and Tamil translate their remaining board controls and technical labels. Zero-backlog and script coverage verifies all six files.

Bulgarian, both Persian variants and Macedonian translate their remaining board controls and technical labels while preserving product and JSON identifiers.

Thirteen board-selection, permanent-delete and wait-spinner values now use Khmer across all tags, with Khmer-script and English-remnant coverage.

• The tracked Khmer underscore tag carries the same verified translations. Thanks to xet7.

Three tags translate 57 color, menu, location, Office and API report values, using explicit Portuguese alternatives for valid cognates. Zero-backlog and report coverage verifies every tag.

Nineteen board-selection, permanent-delete, Office and API report values now use Thai, with target-script, English-remnant and API-literal coverage.

Three Tshivenda and two isiZulu tags translate 95 values with distinct language mappings. Zero-backlog and language-distinction coverage verifies every file. The direct translations have low confidence and welcome native-speaker review.

Twenty board, clipboard, Office and API report values now use Esperanto, with zero-backlog, vocabulary and English-remnant coverage.

The shared 20-value tail completes 180 UI, Office, API report and ticket values. Explicit Spanish alternatives replace valid cognates, and report coverage verifies every tag.

Twenty checklist, typography, Office, API report and storage values now use Turkish, with zero-backlog, terminology and English-remnant coverage.

Twenty-one board, archive, Office and API report values now use Hungarian, with zero-backlog, terminology and protected-literal coverage.

Twenty-one board, archive, Office and API report values now use Latvian, with zero-backlog, terminology and protected-literal coverage.

Forty-two board, admin, Office, API report and search-help values now use Basque and Uyghur. Zero-backlog and target-language coverage preserves %s, __operator_number__, IPv4, IPv6, REST API and WITH_API=true exactly. The Uyghur translations have low confidence and welcome native-speaker review.

Sixty-six board, admin, Office, API, storage and search-help values now use their target languages. Zero-backlog, terminology and script coverage preserves every protected API and search placeholder. Breton and Yiddish have low confidence and welcome native-speaker review.

Both Galician tags and Xhosa translate 69 board, admin, Office, API, storage and typography values. Xhosa has low confidence and welcomes native-speaker review.

Twenty-four board, colour, admin, Office, API and CPU values now use Swahili, with zero-backlog, terminology and protected-literal coverage.

Seven tags translate 175 values without replacing existing human Uzbek text. Zero-backlog coverage preserves network and configuration literals. Asturian and Uzbek have mixed confidence and welcome native-speaker review.

Azerbaijani, Croatian, Polish and Slovak translate 182 values with zero-backlog, sibling-consistency and protected-token coverage. Azerbaijani has mixed confidence and welcomes native-speaker review.

Estonian, Romanian and Walloon translate 108 values with zero-backlog, sibling-consistency and protected-token coverage. Walloon has low confidence and welcomes native-speaker review.

Indonesian, Occitan, Brazilian Portuguese, Turkmen and Tamazight translate 140 values with embedded-JSON, zero-backlog and placeholder coverage. Occitan, Turkmen and Tamazight have low confidence and welcome review.

Acehnese and both Czech tags translate 87 values with embedded-JSON, sibling-consistency and protected-token coverage. Acehnese has low confidence and welcomes native-speaker review.

Both Slovenian tags and Volapük translate 90 values with mixed-language, sibling-consistency and protected-token coverage. Volapük has low confidence and welcomes native-speaker review.

Thirty-one board, admin, Office, API and storage values now use Valencian, with zero-backlog, terminology and protected-token coverage.

Sixty-four values now use their target languages with zero-backlog, mixed-language and protected-placeholder coverage. Both have low confidence.

Thirty-three interface, Office, API and storage values now use explicit Italian alternatives for valid cognates, with zero-backlog coverage.

Thirty-five values now use standard Catalan terminology distinct from Valencian, with zero-backlog and protected-token coverage.

Seventy values now use their target languages with zero-backlog, foreign-script and protected-placeholder coverage. Klingon has very low confidence; its older mixed-language seed text remains for the whole-file audit.

Seventy-two values now use their target languages with zero-backlog, storage-ID and protected-token coverage. Igbo has low confidence and welcomes review.

Seventy-four values now use explicit Afrikaans alternatives for valid cognates, with zero-backlog and sibling-consistency coverage.

Seventy-six values now use Malay with executable-JSON, zero-backlog and sibling-consistency coverage.

Forty interface, Office, API and storage values now use explicit Danish alternatives for valid cognates, with zero-backlog coverage.

Forty-two interface, Office, API and storage values now use explicit Norwegian alternatives for valid cognates, with zero-backlog coverage.

Forty-four values now use Wolof with zero-backlog, terminology and English-remnant coverage. The translations have low confidence.

Two hundred seventy values now use explicit French phrases for valid cognates, with zero-backlog and sibling-consistency coverage.

One hundred ten values now use West Frisian with zero-backlog, storage-ID and sibling-consistency coverage. The translations have mixed confidence.

Two hundred thirty-two values now use established German UI terms instead of English loanword placeholders, with zero-backlog and sibling coverage.

One hundred thirty-two values now use established Dutch UI terms instead of English loanword placeholders, with zero-backlog and sibling coverage.

Seventy-three values now use verified Dutch terminology plus regional Flemish board and admin wording, with zero-backlog coverage.

The first 50 activity and board-history values now use Amharic. Progress, Ethiopic-script and whole-locale placeholder coverage verifies the batch; 2,116 values remain. The translations have mixed confidence and welcome review.

The second direct batch completes the remaining activity-history and initial workspace strings. Whole-locale placeholder coverage leaves 2,066 values.

Workspace, board-selection, list-sizing and checklist controls now use Amharic. Progress, Ethiopic-script and placeholder coverage leaves 2,016 values.

Admin, archive, attachment and board-information values now use Amharic. Whole-locale coverage now also preserves HTML tags; 1,966 values remain.

Visibility, display-mode, archive and card-editing values now use Amharic. Placeholder, markup and Ethiopic-script coverage leaves 1,916 values.

Membership, voting, Planning Poker, dependency and import values now use Amharic. Whole-locale invariant coverage leaves 1,866 values.

Popups, imported-member mapping, themes and typography now use Amharic. Placeholder, markup and Ethiopic-script coverage leaves 1,816 values.

Settings, subtasks, starring, card aging, movement dialogs and most color names now use Amharic. Whole-locale invariant coverage leaves 1,766 values.

Colors, board roles, deletion confirmations, copying and custom fields now use Amharic. Percent-token coverage now protects every letter-style placeholder; 1,716 values remain.

Profile, email-template, WIP and error values now use Amharic while retaining every message placeholder. Whole-locale invariant coverage leaves 1,666 values.

User errors, card exports, sorting and initial filters now use Amharic. Whole-locale invariant coverage leaves 1,616 values.

Advanced filters, activities and board-import instructions now use Amharic while preserving grammar, JSON terms, paths and placeholders. Focused syntax coverage leaves 1,566 values.

Trello API imports, member mapping, validation and labels now use Amharic while retaining the API URL, year example and percent placeholder. Whole-locale invariant coverage leaves 1,516 values.

Board departure, list and archive actions, selection tools, notifications and roles now use Amharic while retaining the board-title placeholder. Whole-locale invariant coverage leaves 1,466 values.

Notifications, privacy, removal, search, WIP and shortcuts now use Amharic while retaining login markup and member placeholders. Whole-locale invariant coverage leaves 1,416 values.

Time tracking, uploads, custom branding, welcome templates and WIP warnings now use Amharic while retaining URL, API, WIP and numeric terms. Whole-locale invariant coverage leaves 1,366 values.

Attachment limits, registration, SMTP, invitations, webhooks and runtime versions now use Amharic while retaining invitation placeholders and technical terms. Whole-locale invariant coverage leaves 1,316 values.

Diagnostics, custom-field display, visibility, organizations and teams now use Amharic while retaining environment variables, protocols, hostnames and multitenancy syntax. Whole-locale invariant coverage leaves 1,266 values.

Card dates, colors, deletion, subtasks, minicard display and activity labels now use Amharic while retaining board and percent placeholders. Whole-locale invariant coverage leaves 1,216 values.

Activity messages and automation workflow/import controls now use Amharic while retaining repeated percent argument order, named tokens and format terms. Focused positional coverage leaves 1,166 values.

Visual workflows, schedules, due-date triggers, buttons, sorting and relative dates now use Amharic while retaining workflow product names and structural values. Whole-locale invariant coverage leaves 1,116 values.

List, label, member, checklist, card and email automation fragments now use consistent Amharic rule-builder terminology. Whole-locale invariant coverage leaves 1,066 values.

Automation actions, authentication, custom-head settings and layout controls now use Amharic while retaining comma-separated examples, format names and assetlinks.json. Whole-locale invariant coverage leaves 1,016 values.

Custom body HTML, authentication, duplication, deletion, positioning, due reminders, drag and editor controls now use Amharic while retaining HTML tags, newlines and activity placeholders. Whole-locale coverage leaves 966 values.

Multi-card and editor behavior, organizations, notifications, role permissions, weekdays and linked-card warnings now use Amharic while retaining keyboard chords. Whole-locale invariant coverage leaves 916 values.

Checklist visibility, domains, shared templates, My Cards, Due Cards, global search and lookup errors now use Amharic while retaining domain examples, Markdown and percent placeholders. Whole-locale coverage leaves 866 values.

Result counts, search operators and predicates now use Amharic while retaining percent tokens and range-placeholder order. Focused order coverage leaves 816 values.

Search predicates, validation messages and full operator help now use Amharic while retaining backticked expressions, metavariables, Markdown, newlines and placeholders. Whole-locale invariant coverage leaves 766 values.

Sorting, stickers, dependencies, board backgrounds and locations now use Amharic while retaining JSON/SVG, named tokens and double-brace templates. Expanded token coverage leaves 716 values.

Maps, server troubleshooting, string templates, reports and office locations now use Amharic while retaining shell commands, HTML entities, IP terms and percent-brace tokens. Expanded token coverage leaves 666 values.

Office, API and recovery reports, loading indicators, organization warnings and ticket workflow terms now use Amharic while retaining REST API, WITH_API=true and Cc. Whole-locale invariant coverage leaves 616 values.

Team and organization controls, Node memory diagnostics, legal notices, checklists and attachment-storage moves now use Amharic while retaining Node, URL, GridFS and S3. Whole-locale invariant coverage leaves 566 values.

Attachment migration and repair, storage statistics, MongoDB compaction and board metadata now use Amharic while retaining GridFS, S3, MongoDB, Meteor and ID. Whole-locale invariant coverage leaves 516 values.

Board timing and upload status, file constraints, custom translations, checklists, support and accessibility now use Amharic while retaining the workspace placeholder, ISO 8601, PDF, JSON and ZIP terms. Whole-locale invariant coverage leaves 466 values.

Accessibility, brute-force lockouts, user-state filters, scheduled jobs, attachment paths and board maintenance scheduling now use Amharic. Whole-locale invariant coverage leaves 416 values.

Scheduled-job results, filesystem and cloud storage, MongoDB/FerretDB migration and Sandstorm status now use Amharic while retaining the database placeholder, URLs, environment variables and product names. Whole-locale invariant coverage leaves 366 values.

Sandstorm cleanup, card loading, security switches, anonymized import/export and backups now use Amharic while retaining markup, environment variables, service names and backup paths. Whole-locale invariant coverage leaves 316 values.

Backup scheduling and restoration plus AWS, Azure and Google Cloud setup guidance now use Amharic while retaining JSON, IDs, filenames, field labels and HH:MM. Whole-locale invariant coverage leaves 266 values.

GridFS and attachment migrations, S3 settings, scheduled board operations and storage navigation now use Amharic while retaining storage products, SSL/TLS and the region example. Whole-locale invariant coverage leaves 216 values.

Lost-card recovery, duplicate-list cleanup, archive restoration, URL repairs and migration steps now use Amharic while retaining field identifiers, IDs and URLs. Whole-locale invariant coverage leaves 166 values.

Remaining migration steps plus job, CPU/memory, filesystem/GridFS and monitoring labels now use Amharic while retaining technical identifiers. Whole-locale invariant coverage leaves 116 values.

Bulk attachment migration, throttling, monitoring, pagination, schedules and progress counters now use Amharic while retaining numeric ranges, percent, ms, CPU, GridFS and S3. Whole-locale invariant coverage leaves 66 values.

Repository login/upload, authentication errors, problem monitoring, broken-card repair, CPU status and event columns now use Amharic while retaining repair placeholders in source order. Whole-locale invariant coverage leaves 16 values.

The final 16 integrity, export, import and number-search values now use Amharic while retaining IP versions, file extensions, product names and exact search metavariables. The fill tool and focused regression now require zero English placeholders across the whole locale.

The first 50 activity and board-history values now use Assamese while retaining every named and percent placeholder. New whole-locale regression coverage checks the exact remaining count, token and HTML inventories, Assamese script and representative activity placeholders, leaving 2,116 values.

Card movement, activity phrases and All Boards workspace controls now use Assamese while retaining named placeholders, percent multiplicity and Markdown terminology. Whole-locale invariant coverage leaves 2,066 values.

Workspace selection and home-board controls, due dates, list widths, swimlane heights, keyboard shortcuts and card/checklist actions now use Assamese while retaining percent placeholders. Whole-locale invariant coverage leaves 2,016 values.

Administration, archives, templates, attachments, board appearance, members and privacy now use Assamese while retaining named and percent placeholders, URL terminology and the exact strong-tag pair. Whole-locale invariant coverage leaves 1,966 values.

Public-board markup, board navigation and view modes, zoom, calendar, archive/delete guidance and card editing now use Assamese while retaining markup, the workspace placeholder, percent values and comments. Whole-locale invariant coverage leaves 1,916 values.

Card membership, voting, Planning Poker, dependencies and administration, domain, import and export dialogs now use Assamese. Whole-locale invariant coverage leaves 1,866 values.

Member and dialog titles, imported-member mapping, themes, fonts, colors, avatars, language and permissions now use Assamese while retaining CAS and numeric preview content. Whole-locale invariant coverage leaves 1,816 values.

Starring, automatic list widths, clipboard and card-aging controls, movement, navigation dialogs and the first color vocabulary set now use Assamese. Whole-locale invariant coverage leaves 1,766 values.

Board roles and comment permissions, deletion confirmations, clipboard and link copying, multi-card templates and custom-field types now use Assamese. The translated multi-card example remains valid JSON. Whole-locale invariant coverage leaves 1,716 values.

Custom fields, permanent deletion, WIP and profile dialogs, email templates, validation and import errors now use Assamese while retaining placeholders, paragraph breaks and JSON/CSV/TSV terminology. Focused email-template coverage leaves 1,666 values.

Account-name errors, card export fields, disk-space messages, list sorting and date, label and member filters now use Assamese while retaining PDF, Excel and file-format names. Whole-locale invariant coverage leaves 1,616 values.

Advanced filters and board-import instructions for multiple services and formats now use Assamese while retaining operators, regex, escapes, JSON field names, API paths, extensions and placeholders. Focused syntax coverage leaves 1,566 values.

Safe Trello ZIP/API imports, job controls and results, member mapping, validation, keyboard shortcuts and labels now use Assamese while retaining the Trello URL, API terminology, year example and percent placeholder. Whole-locale invariant coverage leaves 1,516 values.

Board departure, list archive/move/delete actions, settings dialogs, multi-selection, notification modes and normal/assigned roles now use Assamese while retaining the board-title placeholder. Whole-locale invariant coverage leaves 1,466 values.

Watched updates, private-page login links, board visibility, member removal, rescue/search/WIP controls, shortcuts, sidebars and starred/home boards now use Assamese while retaining exact HTML and member placeholders. Whole-locale invariant coverage leaves 1,416 values.

Subscriptions, tracking, time and shortcut labels, uploads, branding URLs, welcome/template boards, WIP errors and attachment/API limits now use Assamese while retaining numeric ranges and technical terms. Whole-locale invariant coverage leaves 1,366 values.

Attachment/API transfer limits, registration and invitations, SMTP settings, test mail, webhooks and runtime versions now use Assamese while retaining technical terms and the invitation template's placeholders and paragraph structure. Focused coverage leaves 1,316 values.

Database/FerretDB/reactivity diagnostics, OS metrics, custom-field display, account visibility, organization tenancy/domains/admins and team propagation now use Assamese while retaining modes, hostnames and environment variables. Whole-locale invariant coverage leaves 1,266 values.

Received/end dates, colors, destructive cleanup, subtask/card settings, minicard display, parent paths and label activity now use Assamese while retaining the board and quoted percent placeholders. Whole-locale invariant coverage leaves 1,216 values.

Activity phrases, rule management, workflow/list views, triggers, actions, scheduled time and JSON/CSV/Trello Butler import/export now use Assamese while retaining all placeholders and formats. Focused repeated-percent coverage leaves 1,166 values.

n8n/Node-RED workflows, schedules, due-date triggers, buttons, sorting, relative dates, units and movement conditions now use Assamese while retaining the count placeholder, N, product names and schedule semantics. Whole-locale invariant coverage leaves 1,116 values.

Rule-builder vocabulary for lists, labels, members, attachments, checklists/items, card movement, colors and email actions now uses consistent Assamese automation terminology. Whole-locale invariant coverage leaves 1,066 values.

Automation actions, authentication, custom-head, manifest and asset-link settings plus layout controls now use Assamese while retaining HTML, JSON, assetlinks.json and product names. Whole-locale invariant coverage leaves 1,016 values.

Custom HTML placement, authentication errors, board duplication, activity dates and reminders, account cleanup and drag controls now use Assamese while retaining HTML tags, named activity tokens and percent arguments. Whole-locale invariant coverage leaves 966 values.

Card-window and editor preferences, organizations, users, notification states, board-role permissions, weekdays and linked-card deletion warnings now use Assamese. Whole-locale invariant coverage leaves 916 values.

Domains, shared templates, My Cards, Due Cards and global search now use Assamese while retaining example.com, emphasis markers and positional percent arguments. Whole-locale invariant coverage leaves 866 values.

Search result counts, operators and predicates now use Assamese while retaining positional and range placeholders. Whole-locale invariant coverage leaves 816 values.

Advanced-search validation, paging, operator instructions and combination notes now use Assamese while retaining every code fragment, markup marker, named operator token and positional argument. Whole-locale invariant coverage leaves 766 values.

Sorting, completion, stickers, card dependencies, board backgrounds and locations now use Assamese while retaining JSON, SVG and named size/import tokens. Whole-locale invariant coverage leaves 716 values.

Map detection, server troubleshooting, custom-field formatting, problem reports and Office login metadata now use Assamese while retaining shell commands, HTML entities, the value placeholder and IP protocol names. Whole-locale invariant coverage leaves 666 values.

Office/API reports, automatic data recovery, swimlane copying, wait spinners, organization safeguards and support tickets now use Assamese while retaining REST API, WITH_API, MongoDB and mail-header terms. Whole-locale invariant coverage leaves 616 values.

Team and organization administration, Node memory metrics, legal notices, checklist actions and attachment-storage movement now use Assamese while retaining Node, GridFS, S3 and URL terms. Whole-locale invariant coverage leaves 566 values.

Attachment storage movement and repair, file statistics and MongoDB compaction now use Assamese while retaining filesystem, GridFS, S3, MongoDB, Meteor, oplog and identifier terminology. Whole-locale invariant coverage leaves 516 values.

Board timing, upload restrictions, custom translations, checklist display, support and accessibility settings now use Assamese while retaining the workspace token, PDF, ISO 8601, JSON and archive formats. Whole-locale invariant coverage leaves 466 values.

Accessibility content, brute-force lockouts, user-state filters, scheduled jobs, attachment paths and board maintenance now use Assamese. Whole-locale invariant coverage leaves 416 values.

Scheduled migration controls, filesystem, S3 and Azure storage, MongoDB to FerretDB migration and Sandstorm migration status now use Assamese while retaining the database token, URLs, environment variables, paths and product names. Whole-locale invariant coverage leaves 366 values.

Sandstorm cleanup, card-loading modes, safe rich-text rendering, import/export controls, user anonymization, activity/watch controls and backup scopes now use Assamese while retaining HTML/markdown examples, environment variables, paths and product names. Whole-locale invariant coverage leaves 316 values.

Backup schedules and restore modes plus Google Cloud, AWS S3 and Azure credential guidance now use Assamese while retaining console paths, JSON field names, time syntax and storage product names. Whole-locale invariant coverage leaves 266 values.

GridFS and S3 configuration, attachment and board migration controls, scheduled board operations and writable storage paths now use Assamese while retaining storage product and protocol names. Whole-locale invariant coverage leaves 216 values.

Board-integrity checks, lost-card recovery, duplicate-list cleanup and avatar/attachment URL repair now use Assamese while retaining ID field names, URLs and storage terminology. Whole-locale invariant coverage leaves 166 values.

Board-conversion steps, database cleanup, CPU/memory metrics, recurring schedules, export monitoring and job queues now use Assamese while retaining ID, URL, GridFS and CPU terms. Whole-locale invariant coverage leaves 116 values.

Attachment migration destinations, batch/CPU/delay tuning, logs, progress, monitoring controls and storage statistics now use Assamese while retaining GridFS, S3, CPU, percent and millisecond syntax. Whole-locale invariant coverage leaves 66 values.

OTP/account access, repository management, problem summaries, broken-card repair, CPU load and diagnostic events now use Assamese while retaining named repair tokens, API, OTP and IP terminology. Whole-locale invariant coverage leaves 16 values.

The final sixteen event-address, filesystem-integrity, scoped import/export and card-number search values now use Assamese. Zero-backlog coverage retains the operator token, markup and file-format names across all 2,166 values.

Fifty activity values for boards, cards, attachments, labels, checklists, comments, custom fields and imports now use Bashkir while retaining every named activity token. Focused Cyrillic and whole-locale invariant coverage leaves 2,116 values.

Card movement, positional activity phrases, checklist states and workspace management now use Bashkir while retaining repeated percent order and named location tokens. Whole-locale invariant coverage leaves 2,066 values.

Workspace deletion, multi-board selection, Home boards, card insertion, personal/shared list widths, swimlane heights and checklist actions now use Bashkir while retaining positional activity arguments. Whole-locale invariant coverage leaves 2,016 values.

Administrator announcements, archives, templates, attachments, board backgrounds and member/assignee summaries now use Bashkir while retaining count, size and HTML emphasis tokens. Whole-locale invariant coverage leaves 1,966 values.

Board visibility, icon ordering, backgrounds, desktop/mobile modes, zoom, calendar navigation, archive guidance and card-edit labels now use Bashkir while retaining workspace, comment, percent and HTML emphasis tokens. Whole-locale invariant coverage leaves 1,916 values.

Card membership, voting, Planning Poker, dependencies, organization/team/domain membership and component import/export dialogs now use Bashkir. Whole-locale invariant coverage leaves 1,866 values.

Member mapping, theme categories, fonts and sizes, text colors, avatar actions, language and permission dialogs now use Bashkir. Whole-locale invariant coverage leaves 1,816 values.

Starred boards/pages, automatic list width, clipboard input, card aging, movement/dialog accessibility and twenty-two color names now use Bashkir. Whole-locale invariant coverage leaves 1,766 values.

Board role restrictions, deletion confirmations, clipboard links, JSON card templates and custom-field types/options now use Bashkir while retaining JSON structure. Whole-locale invariant coverage leaves 1,716 values.

Custom-field dialogs, permanent deletion, profiles, dates, account emails, WIP limits and board/import errors now use Bashkir while retaining email paragraph structure, named tokens and JSON/CSV/TSV terms. Whole-locale invariant coverage leaves 1,666 values.

Account validation, card PDF/Excel exports, attachment metadata, list sorting and date/label/member filters now use Bashkir while retaining export format names. Whole-locale invariant coverage leaves 1,616 values.

Advanced filters and Kanboard, Deck, OpenProject, issue, Asana, ZenKit, Trello, CSV/TSV, Jira, Excel and WeKan import guidance now use Bashkir while retaining operators, regex, endpoint tokens, API paths and data-format examples. Whole-locale invariant coverage leaves 1,566 values.

Trello ZIP safety, workspace placement, API credentials, multi-board job progress/cancellation and member mapping now use Bashkir while retaining the API URL, file formats and percent label argument. Whole-locale invariant coverage leaves 1,516 values.

Last-admin safeguards, board departure, list/archive actions, settings dialogs, multi-selection, archive states and assigned-only notification roles now use Bashkir while retaining the board-title token. Whole-locale invariant coverage leaves 1,466 values.

Watched updates, private and public pages, member removal, unsaved-description recovery, card search, WIP controls and keyboard shortcuts now use Bashkir while retaining the HTML login link and member/board tokens. Whole-locale invariant coverage leaves 1,416 values.

Tracking, time and overtime, uploads, custom branding and URL schemes, welcome/template boards, WIP warnings and attachment/API limits now use Bashkir. Whole-locale invariant coverage leaves 1,366 values.

Attachment transfer limits, avatar blocking, registration, invitations, SMTP and outgoing/two-way webhooks now use Bashkir while retaining four invitation placeholders and its paragraph structure. Whole-locale invariant coverage leaves 1,316 values.

Database and operating-system diagnostics, time units, custom-field display, account changes, visibility, shared templates and organization/team tenancy now use Bashkir while retaining configuration names, domain examples and MULTITENANCY=true. Whole-locale invariant coverage leaves 1,266 values.

Received/end dates, colors, destructive board/notification/list actions, subtask routing, minicard badges and parent-card paths now use Bashkir while retaining the board token and positional label-activity arguments. Whole-locale invariant coverage leaves 1,216 values.

Attachment/custom-field activity, rule management, the visual workflow builder, event triggers and JSON/CSV/Trello Butler imports now use Bashkir while retaining time/count and positional activity arguments. Whole-locale invariant coverage leaves 1,166 values.

n8n/Node-RED workflow imports, scheduled triggers, due-date and list-duration conditions, card/board buttons, sorting and relative dates now use Bashkir while retaining the unmapped-count token and integration names. Whole-locale invariant coverage leaves 1,116 values.

Movement, archive, label/member/attachment/checklist conditions and actions, card positioning and rule-email subjects now use Bashkir. Whole-locale invariant coverage leaves 1,066 values.

Rule email/checklist/swimlane/date actions, authentication, product naming, custom HTML/manifest/assetlinks metadata and layout controls now use Bashkir while retaining HTML/JSON and assetlinks.json literals. Whole-locale invariant coverage leaves 1,016 values.

Custom body HTML, authentication display, board/swimlane duplication and deletion, date activity, due reminders, mentions, account deletion and resize controls now use Bashkir while retaining body tags, positional arguments, named tokens and multiline structure. Whole-locale invariant coverage leaves 966 values.

Multi-card/editor behavior, organization/team/user dialogs, notification management, renaming, board-role permissions/status, weekdays and linked-card deletion safeguards now use Bashkir while retaining keyboard shortcut names. Whole-locale invariant coverage leaves 916 values.

Checklist visibility, domains, shared templates, My Cards sorting, due-card views, global search and missing-object errors now use Bashkir while retaining domain examples, Markdown emphasis and percent arguments. Whole-locale invariant coverage leaves 866 values.

Search result counts and board/swimlane/list/label/user/member/assignee, status/date/comment/content operators and predicates now use Bashkir while retaining positional and pagination tokens. Whole-locale invariant coverage leaves 816 values.

Operator validation, pagination and the complete advanced-search operator, status, field, sorting, limit and combination guidance now use Bashkir while retaining code spans, Markdown emphasis, angle-bracket parameters, examples, newlines and every search token. Whole-locale invariant coverage leaves 766 values.

Labels, board/card sorting, completion, stickers, dependency relationships and JSON/SVG imports, board backgrounds and location fields now use Bashkir while retaining imported/unmatched and maximum-size tokens. Whole-locale invariant coverage leaves 716 values.

Map detection, server troubleshooting, sorting, activity visibility, string templates and administrative file/security/performance/database/rules/board/ card/impersonation/recovery/office reports now use Bashkir while retaining commands, the value placeholder, HTML entities and IPv4/IPv6 names. Whole-locale invariant coverage leaves 666 values.

Office/API usage, automatic recovery, swimlane copying, wait indicators, organization/team deletion safeguards and support tickets now use Bashkir while retaining REST API, WITH_API=true, MongoDB and spinner-style names. Whole-locale invariant coverage leaves 616 values.

Team/organization administration, invitations, Node heap/memory diagnostics, legal notices, checklist/subtask actions and filesystem/GridFS/S3 attachment moves now use Bashkir while retaining runtime and storage names. Whole-locale invariant coverage leaves 566 values.

Attachment storage moves, location repair, storage statistics/defaults and MongoDB GridFS compaction now use Bashkir while retaining filesystem, GridFS, S3, MongoDB, Compact, oplog, Meteor and identifier names. Whole-locale invariant coverage leaves 516 values.

Board timing/upload status, upload limits, card details, workspace assignment, custom translations, checklist visibility, board ZIP imports and support/ accessibility pages now use Bashkir while retaining the workspace token and ISO/PDF/JSON/Markdown/.zip names. Whole-locale invariant coverage leaves 466 values.

Accessibility metadata, brute-force protection/lockouts, administrator user filters, scheduled jobs, attachment/avatar paths and scheduled board archive, backup and cleanup operations now use Bashkir. Whole-locale invariant coverage leaves 416 values.

Scheduled-job and migration recovery, filesystem/S3/Azure storage, MongoDB ↔ FerretDB text-data migration and Sandstorm grain migration now use Bashkir while retaining URLs, environment variables, commands, database/version names, paths and the database token. Whole-locale invariant coverage leaves 366 values.

Sandstorm cleanup, card-loading modes, plain-text security rendering, import/export/avatar/activity/watch controls, user anonymization and instance/ organization backups now use Bashkir while retaining markup examples, environment variables, integration names, usernames and backup paths. Whole-locale invariant coverage leaves 316 values.

Backup scheduling/restoration and GCS, AWS S3, MinIO, Azure, Cloudflare R2, Backblaze B2, Wasabi and DigitalOcean Spaces setup guidance now use Bashkir while retaining console menu labels, JSON fields, key names, HH:MM and .csv. Whole-locale invariant coverage leaves 266 values.

GridFS and S3 storage, migration start/pause/stop controls, scheduled board operations, writable paths and attachment/board migration settings now use Bashkir while retaining MongoDB, GridFS, CollectionFS, AWS, MinIO, SSL/TLS and region names. Whole-locale invariant coverage leaves 216 values.

Comprehensive board-integrity migration, duplicate-list deletion, lost/archive restoration, list/avatar/file repair, confirmations, progress and migration steps now use Bashkir while retaining swimlaneId, listId, URL and ID names. Whole-locale invariant coverage leaves 166 values.

Board-repair steps, conversion status, CPU/memory/filesystem/GridFS monitoring, scheduled frequencies, job queues and export monitoring now use Bashkir while retaining CPU, GridFS, URL and ID names. Whole-locale invariant coverage leaves 116 values.

Bulk storage migration, batch/CPU/delay tuning, background migration guidance, monitoring refresh/export, schedules, operation progress and system-resource totals now use Bashkir while retaining GridFS, S3, CPU, percentages and units. Whole-locale invariant coverage leaves 66 values.

OTP/account/repository access, API endpoints, problem summaries, repair status, CPU load and diagnostic event fields now use Bashkir while retaining fixed/ unfixable tokens and IP/CPU names. Whole-locale invariant coverage leaves 16 values.

IP address diagnostics, filesystem integrity, scoped card export/import and number-search guidance now use Bashkir while retaining IPv4/IPv6, WeKan, archive/data-format names, the search token and angle-bracket parameter. The authoritative missing-value list is empty, and whole-locale token, markup and key-order coverage verifies all 2,166 values.

Board membership restrictions and board/card/list/swimlane creation, deletion, archive, import, attachment, subtask, label, checklist and comment activity now use Bhojpuri while retaining percent and named location/content tokens. New whole-locale regression coverage checks every translated token inventory and HTML tag, representative Bhojpuri terminology and activity placeholders, leaving 2,116 values.

Card movement/restoration, member removal, positional activity phrases, checklist states, dates and workspace creation/editing now use Bhojpuri while retaining every positional and named argument. Whole-locale invariant coverage leaves 2,066 values.

Workspace deletion, multi-board selection, Home boards, card insertion, personal/shared/fixed list widths, keyboard shortcuts, swimlane heights and checklist actions now use Bhojpuri while retaining positional date arguments. Whole-locale invariant coverage leaves 2,016 values.

Administration announcements, archives, templates, attachments, automatic watching, board backgrounds, All Boards display and member/assignee summaries now use Bhojpuri while retaining count/size/percent tokens and HTML emphasis. Whole-locale invariant coverage leaves 1,966 values.

Board visibility, icon ordering, backgrounds, desktop/mobile modes, zoom, calendar/table/statistics views and card/list/swimlane archive/deletion guidance now use Bhojpuri while retaining the workspace token, percent argument and HTML emphasis. Whole-locale invariant coverage leaves 1,916 values.

Card membership, voting, Planning Poker, dependencies, organization/team/ domain management and checklist/swimlane/list/card/board import/export dialogs now use Bhojpuri while retaining the Planning Poker name. Whole-locale invariant coverage leaves 1,866 values.

Member/sticker/invite/sorting dialogs, archive restoration, imported-member mapping, themes, fonts, text colors and avatar/language/permission dialogs now use Bhojpuri while retaining CAS, Markdown and preview digits. Whole-locale invariant coverage leaves 1,816 values.

Starred boards/pages, automatic list width, clipboard input, card aging, movement/dialog accessibility and twenty-two color names now use Bhojpuri. Whole-locale invariant coverage leaves 1,766 values.

Comment/read/worker permissions, deletion confirmations, clipboard actions, copy/import dialogs and custom-field basics now use Bhojpuri while retaining the copied-card JSON structure. Whole-locale invariant coverage leaves 1,716 values.

Custom fields, profile/date dialogs, account emails, WIP settings and import/ authorization errors now use Bhojpuri while retaining every account, site, board, inviter and URL placeholder. Whole-locale invariant coverage leaves 1,666 values.

User/account errors, attachment-free and card exports, Excel fields, sorting, and date/label/member filters now use Bhojpuri while retaining Excel and PDF names. Whole-locale invariant coverage leaves 1,616 values.

Advanced filters and board imports from Kanboard, Deck, OpenProject, issue trackers, Asana, ZenKit, Trello, CSV, Jira, Excel and WeKan now use Bhojpuri. Operators, examples, API paths, JSON fields, extensions and source/endpoint placeholders remain exact. Whole-locale invariant coverage leaves 1,566 values.

Trello ZIP/API imports, job controls, imported-member mapping, validation messages and labels now use Bhojpuri while retaining the API-key URL and %s label placeholder. Whole-locale invariant coverage leaves 1,516 values.

Board departure, archive/list actions, settings, multi-selection, notification states and normal-role permissions now use Bhojpuri while retaining the board title placeholder. Whole-locale invariant coverage leaves 1,466 values.

Watching/privacy, member removal, search/WIP controls, keyboard shortcuts, sidebars, signup and starred/default boards now use Bhojpuri while retaining the login anchor and its %s placeholder. Whole-locale invariant coverage leaves 1,416 values.

Subscriptions, time tracking, assignee/label shortcuts, uploads, custom branding URLs, welcome/template labels, WIP errors and attachment/API limits now use Bhojpuri. Whole-locale invariant coverage leaves 1,366 values.

Attachment/API limits, registration invitations, SMTP, webhooks and system version labels now use Bhojpuri while retaining all invitation placeholders and the SMTP, TLS, API, Node and Meteor identifiers. Whole-locale invariant coverage leaves 1,316 values.

Diagnostics, custom-field display, account and board visibility, organization tenancy/admin controls, teams and timestamps now use Bhojpuri while retaining environment variables, modes, sample domains and technical identifiers. Whole-locale invariant coverage leaves 1,266 values.

Card dates/colors, destructive board and notification actions, duplicate-list cleanup, subtask/card/minicard settings, parent paths and label activity now use Bhojpuri while retaining the board and positional activity placeholders. Whole-locale invariant coverage leaves 1,216 values.

Activity messages, rule management, workflow builder triggers/actions and JSON, CSV and Trello Butler imports now use Bhojpuri. Positional custom-field values, time and imported-count placeholders retain their source order and spelling. Whole-locale invariant coverage leaves 1,166 values.

Workflow formats, scheduled/button triggers, due-date timing, list sorting, card completion, bulk moves and relative dates now use Bhojpuri while retaining the imported-count placeholder and n8n, Node-RED and WeKan names. Whole-locale invariant coverage leaves 1,116 values.

List/archive movements, label/member/attachment/checklist triggers, card and checklist actions and email actions now use consistent, compact Bhojpuri sentence-building fragments. Whole-locale invariant coverage leaves 1,066 values.

Archive/member/checklist/date automation actions, authentication, custom HTML/ JSON head configuration and layout controls now use Bhojpuri while retaining manifest and assetlinks filenames/formats. The checklist example is translated rather than left as English. Whole-locale invariant coverage leaves 1,016 values.

Custom body HTML placement, authentication, duplication/counts, swimlane deletion, date/reminder activities, mentions, destructive account/team/ organization actions and UI behavior now use Bhojpuri. Body tags, placeholders, percent arguments and line breaks remain exact. Invariant coverage leaves 966 values.

Multi-window cards, editor key behavior, organization/team/user dialogs, notifications, board-role permissions/status, weekdays, voting and linked-card deletion guards now use Bhojpuri while retaining keyboard combinations and the Admin Panel name. Whole-locale invariant coverage leaves 916 values.

Checklist visibility, domain/template sharing, My Cards and Due Cards views, global search and lookup errors now use Bhojpuri while retaining the domain example, Markdown emphasis and positional lookup arguments. Whole-locale invariant coverage leaves 866 values.

Search result counts and global-search operator/predicate labels now use Bhojpuri while retaining percent and start/end/total pagination placeholders. Whole-locale invariant coverage leaves 816 values.

Search validation, pagination and full operator/status/note documentation now use Bhojpuri while retaining every named placeholder, Markdown code/emphasis, angle-bracket metavariable, operator example and deliberate line break. Whole-locale invariant coverage leaves 766 values.

Sorting/completion, stickers, dependency relationships/imports, board backgrounds and card locations now use Bhojpuri while retaining import counters, the background-size placeholder and JSON/SVG terminology. Whole-locale invariant coverage leaves 716 values.

Map detection, server-error troubleshooting, sorting, swimlane movement, string-template fields and admin reports now use Bhojpuri while retaining shell commands, the value placeholder, space entities, IPv4 and IPv6. Whole-locale invariant coverage leaves 666 values.

Office/API/recovery reports, recovery maintenance, swimlane copying, wait spinners, card sizing, organization/team deletion guards and tickets now use Bhojpuri while retaining REST API and WITH_API=true. Whole-locale invariant coverage leaves 616 values.

Team/organization invitations, Node heap diagnostics, legal notices, checklist, subtask and attachment actions and storage moves now use Bhojpuri while retaining Node, GridFS, S3, filesystem and URL terminology. Whole-locale invariant coverage leaves 566 values.

Attachment/avatar storage moves and repair, default storage, file statistics and MongoDB GridFS compaction now use Bhojpuri while retaining filesystem, GridFS, S3, MongoDB, replica-set, oplog and ID terminology. Whole-locale invariant coverage leaves 516 values.

Board status, upload progress, password/login prompts, file restrictions, PDF fallback, workspace assignment, custom translations, checklist collapsing, support and accessibility now use Bhojpuri while retaining the workspace placeholder, ISO 8601, PDF, JSON and .zip. Invariant coverage leaves 466 values.

Accessibility content, brute-force login lockouts, admin user filters, scheduled jobs, attachment/avatar paths and scheduled board operations now use Bhojpuri. Whole-locale invariant coverage leaves 416 values.

Scheduled-job/migration control, filesystem/S3/Azure storage, MongoDB/FerretDB text-data migration and Sandstorm migration status now use Bhojpuri while retaining URLs, ports, environment variables, configuration literals, versions, paths and the database placeholder. Invariant coverage leaves 366 values.

Sandstorm cleanup, card-loading modes, secure rendering, import/export/avatar/ anonymization policies, activity/watch controls and backups now use Bhojpuri. Anchor/comment syntax, environment variables, formats, providers and backup paths remain literal. Whole-locale invariant coverage leaves 316 values.

Scheduled backup restore plus GCS, AWS/S3, Azure, MinIO and compatible cloud storage setup now use Bhojpuri while retaining console paths, credential field names, JSON/CSV formats, time syntax, identifiers and product names. Whole-locale invariant coverage leaves 266 values.

GridFS/S3 storage, migration controls and monitoring, scheduled board operations and attachment settings now use Bhojpuri while retaining MongoDB, GridFS, CollectionFS, AWS S3, MinIO, SSL/TLS, region examples and paths. Whole-locale invariant coverage leaves 216 values.

Duplicate/absent lists, lost cards, archive restoration, avatar/file URLs, confirmations, progress and validation steps now use Bhojpuri while retaining swimlaneId, listId, IDs and URLs. Whole-locale invariant coverage leaves 166 values.

Board-migration steps, conversion status, cleanup, CPU/memory diagnostics, schedules, export monitoring and filesystem/GridFS statistics now use Bhojpuri while retaining IDs, CPU, GridFS and numeric intervals. Whole-locale invariant coverage leaves 116 values.

Migration tuning, background progress/logs, monitoring refresh/export, schedules, storage distribution and system resources now use Bhojpuri while retaining CPU percentages, millisecond units, numeric ranges, GridFS and S3. Whole-locale invariant coverage leaves 66 values.

OTP/account access, repository management, API endpoints, problem monitoring, broken-card repair, CPU status and event fields now use Bhojpuri while retaining OTP/API/CPU names and fixed/unfixable counters. Whole-locale invariant coverage leaves 16 values.

IP/IPv4/IPv6 event labels, filesystem integrity, card/scoped export, WeKan file import and the card-number search operator now use Bhojpuri while retaining the named operator placeholder, number metavariable, formats and product names. Whole-locale invariant coverage proves zero English placeholders across all 2,166 values.

Board/card/list/swimlane activity, attachments, subtasks, labels, checklists, comments, custom fields and archive/import actions now use Bambara. New whole-locale regression coverage checks all token/tag inventories and leaves 2,116 values.

Card movement, membership, compact activity/checklist messages and All Boards workspace controls now use Bambara while retaining every positional and named placeholder in source order. Whole-locale invariant coverage leaves 2,066 values.

Workspace settings, board selection and Home-board controls now use Bambara, along with list and swimlane sizing, keyboard shortcuts and common card, checklist and member actions. Positional placeholders remain exact, and whole-locale invariant coverage leaves 2,016 values.

Archive operations, attachments, templates, board backgrounds, All Boards settings, member and assignee labels and private-board messaging now use Bambara. Named and positional placeholders and the strong-emphasis tags remain exact, and whole-locale invariant coverage leaves 1,966 values.

Board appearance and view modes, zoom and calendar controls, card and list archive guidance and common card editing labels now use Bambara. Named and positional placeholders, percentages and emphasis tags remain exact, and whole-locale invariant coverage leaves 1,916 values.

Voting, Planning Poker, card dependencies, organizations, teams, account and background administration and import/export popup titles now use Bambara. Whole-locale invariant coverage leaves 1,866 values.

Popup labels, archived-item restoration, imported-member mapping, themes, fonts, avatars, language selection and permission controls now use Bambara. Whole-locale invariant coverage leaves 1,816 values.

Automatic list width, card aging, keyboard navigation, accessible close labels, board restoration guidance and the first color-name set now use Bambara. Whole-locale invariant coverage leaves 1,766 values.

Board roles and permissions, destructive confirmations, clipboard and linking actions, bulk-template copying and custom-field controls now use Bambara. The embedded JSON example retains valid syntax, and invariant coverage leaves 1,716 values.

Account enrollment, invitation, password-reset and verification emails now use Bambara, along with WIP controls and board, JSON, CSV, import and linked-card errors. Every email placeholder remains exact, and invariant coverage leaves 1,666 values.

Account-name conflicts, PDF and Excel card exports, attachment metadata, list sorting and date, label and member filters now use Bambara. Whole-locale invariant coverage leaves 1,616 values.

Advanced-filter help and Kanboard, Deck, OpenProject, issue, Asana, ZenKit, Trello, CSV, Jira, Excel and WeKan imports now use Bambara. Operators, regex, escapes, JSON fields, API paths and named placeholders remain exact, and invariant coverage leaves 1,566 values.

Trello API credentials, workspace and board selection, import-job lifecycle, member mapping, date and user validation, shortcuts and label controls now use Bambara. The API URL and positional placeholder remain exact, and invariant coverage leaves 1,516 values.

Board departure, list and card archive actions, user, team and organization settings, multi-selection, muted notifications and normal-role permissions now use Bambara. The board-title placeholder remains exact, and invariant coverage leaves 1,466 values.

Watch notifications, public and private pages, member removal, rescue dialogs, search and WIP controls, keyboard shortcuts, sidebars, signup and starred and default boards now use Bambara. Markup and all placeholders remain exact, and invariant coverage leaves 1,416 values.

Time tracking, assignee and label shortcuts, uploads, custom branding URLs, welcome and template boards, WIP errors and attachment limits now use Bambara. Whole-locale invariant coverage leaves 1,366 values.

Attachment and API size limits, registration, invitations, SMTP configuration, invitation emails, authorization, webhooks and diagnostic version labels now use Bambara. Every email token remains exact, and invariant coverage leaves 1,316 values.

Runtime, OS and memory diagnostics, time units, custom-field display controls, account and board visibility settings and organization tenancy, domains and administration now use Bambara. Environment names, modes and example hostnames remain literal, and invariant coverage leaves 1,266 values.

Received and end dates, assignment metadata, board and notification deletion, subtask and card settings, minicard fields, parent and source relationships and label activity now use Bambara. Named and positional placeholders remain exact, and invariant coverage leaves 1,216 values.

Attachment and custom-field activity, automation rule controls and the visual workflow and JSON, CSV and Trello Butler import/export paths now use Bambara. Every positional and named token remains exact, and invariant coverage leaves 1,166 values.

Visual-workflow formats, scheduled, due, list and button triggers, relative dates, sorting, completion and card movement now use Bambara. The named count, day marker, product names and weekday range remain exact, and invariant coverage leaves 1,116 values.

List, label, member, attachment and checklist triggers and card movement, membership, color, checklist-item and email actions now use Bambara. Whole-locale invariant coverage leaves 1,066 values.

Archive, label, card, member, checklist, swimlane and date-field rule actions now use Bambara, along with authentication, custom product, head, manifest, assetlinks, layout and board-list settings. JSON and HTML formats remain literal, and invariant coverage leaves 1,016 values.

Custom body HTML, authentication, board duplication, destructive actions, received, start, due and end activities, reminders, mentions, drag resizing, editor submission and multi-card behavior now use Bambara. Markup, multiline structure and every token remain exact, and invariant coverage leaves 966 values.

Multi-window and editor behavior, organization, team and user dialogs, notification controls, board-role permissions and status, weekdays, ownership, voting and linked-card deletion guards now use Bambara. Whole-locale invariant coverage leaves 916 values.

Checklist visibility, domains, shared templates, My Cards, Due Cards, global search and lookup errors now use Bambara. Every positional placeholder and emphasis marker remains exact, and invariant coverage leaves 866 values.

Global-search lookup and result-count messages and board, list, user, status, date, organization, content and existence operators and predicates now use Bambara. Every positional and range placeholder remains exact, and invariant coverage leaves 816 values.

Operator validation and the complete global-search operator, status, field, sorting, limit and composition documentation now use Bambara. Code examples, metavariables, formatting, semantic literals and every named and positional token remain exact, and invariant coverage leaves 766 values.

Label and board sorting, card completion, stickers, dependency relationships and JSON/SVG imports, board backgrounds and location fields now use Bambara. Import counts and the background-size placeholder remain exact, and invariant coverage leaves 716 values.

Map detection, server troubleshooting, card and swimlane sorting, string templates, file, security, speed, test, CPU, database, rule, board, card, impersonation, recovery and Office reports now use Bambara. Commands, entities, format placeholders and IP names remain exact, and invariant coverage leaves 666 values.

Office, REST API and recovery reports, recovery maintenance, swimlane copying, wait indicators, card sizing, organization and team deletion guards, tickets, requests, sorting and card details now use Bambara. Technical flags and service names remain literal, and invariant coverage leaves 616 values.

Team and organization assignment, invitations, Node heap and memory diagnostics, legal notices, checklist and subtask actions and filesystem, GridFS and S3 attachment movement now use Bambara. Technical storage and runtime names remain recognizable, and invariant coverage leaves 566 values.

Attachment and avatar storage migration and location repair, storage defaults, progress and statistics, identifiers and MongoDB GridFS compaction now use Bambara. Storage, replica, oplog and identifier terminology remains recognizable, and invariant coverage leaves 516 values.

Board status and time summaries, upload progress and restrictions, login fields, PDF preview, workspace dragging, custom translations, checklist collapsing, support and accessibility now use Bambara. The workspace token and technical format names remain exact, and invariant coverage leaves 466 values.

Accessibility content, brute-force account lockout settings and user controls, Admin Panel people filters, scheduled jobs, attachment and avatar paths and board archive, backup and cleanup scheduling now use Bambara. Whole-locale invariant coverage leaves 416 values.

Scheduled-job and migration controls, filesystem, S3 and Azure storage, MongoDB-to-FerretDB text-data migration and Sandstorm migration status now use Bambara. URLs, ports, environment names, commands, product names, paths and the database placeholder remain exact, and invariant coverage leaves 366 values.

Sandstorm cleanup, card-loading performance, safe rich-text rendering, global import, export, avatar, activity, notification and watch controls, user anonymization and instance or organization backups now use Bambara. Environment variables, markup examples, paths and counter examples remain exact, and invariant coverage leaves 316 values.

Backup schedules and restores and GCS, S3 and Azure storage configuration now use Bambara, including the provider-console guidance for MinIO, R2, B2, Wasabi and Spaces. Time formats, ranges, JSON and CSV names, console paths, roles, keys and product names remain exact, and invariant coverage leaves 266 values.

GridFS enablement, CollectionFS movement, S3 settings, archive, backup and cleanup schedules, attachment monitoring and board migration controls now use Bambara. Paths and technical storage names remain recognizable, and invariant coverage leaves 216 values.

Comprehensive board migration, duplicate-list cleanup, lost-card and archive restoration, missing-list repair, avatar and attachment URL repair and migration progress now use Bambara. The swimlaneId and listId identifiers remain exact, and invariant coverage leaves 166 values.

Board conversion and repair steps, cleanup, CPU and memory diagnostics, filesystem and GridFS monitoring, schedules and job details now use Bambara. Technical storage and runtime names remain recognizable, and invariant coverage leaves 116 values.

Attachment-storage migration targets, resource thresholds, batch tuning, monitoring exports, schedules, progress controls and storage totals now use Bambara. Numeric ranges and technical storage names remain exact, and invariant coverage leaves 66 values.

OTP and account access, repository management, problem summaries, broken-card repair, CPU status and event metadata now use Bambara. Named repair counters remain exact, and invariant coverage leaves 16 values.

IP labels, filesystem integrity, scoped board import and export guidance and the number-search operator now use Bambara. The named operator, markup, file formats and product names remain exact. The final 16-value batch completes all 2,166 source values, with whole-locale token and tag regression coverage.

Board, card, list and swimlane activity, attachments, subtasks, labels, checklists, comments, custom fields and archive/import actions now use Bengali. New whole-locale regression coverage checks all token and tag inventories and leaves 2,116 values.

Card movement, membership, compact activity and checklist messages and All Boards workspace controls now use Bengali. Named and positional placeholders remain exact, and whole-locale invariant coverage leaves 2,066 values.

Workspace settings, board selection and Home-board controls now use Bengali, along with list and swimlane sizing, keyboard shortcuts and common card, checklist and member actions. Positional placeholders remain exact, and whole-locale invariant coverage leaves 2,016 values.

Archive operations, attachments, templates, board backgrounds, All Boards settings, member and assignee labels and private-board messaging now use Bengali. Named and positional placeholders and the strong-emphasis tags remain exact, and whole-locale invariant coverage leaves 1,966 values.

Board appearance and view modes, zoom and calendar controls, card and list archive guidance and common card editing labels now use Bengali. Named and positional placeholders, percentages and emphasis tags remain exact, and whole-locale invariant coverage leaves 1,916 values.

Voting, Planning Poker, card dependencies, organizations, teams, account and background administration and import/export popup titles now use Bengali. Whole-locale invariant coverage leaves 1,866 values.

Popup labels, archived-item restoration, imported-member mapping, themes, fonts, avatars, language selection and permission controls now use Bengali. Whole-locale invariant coverage leaves 1,816 values.

Automatic list width, card aging, keyboard navigation, accessible close labels, board restoration guidance and the first color-name set now use Bengali. Whole-locale invariant coverage leaves 1,766 values.

Board roles and permissions, destructive confirmations, clipboard and linking actions, bulk-template copying and custom-field controls now use Bengali. The embedded JSON example retains valid syntax, and invariant coverage leaves 1,716 values.

Account enrollment, invitation, password-reset and verification emails now use Bengali, along with WIP controls and board, JSON, CSV, import and linked-card errors. Every email placeholder remains exact, and invariant coverage leaves 1,666 values.

Account-name conflicts, PDF and Excel card exports, attachment metadata, list sorting and date, label and member filters now use Bengali. Whole-locale invariant coverage leaves 1,616 values.

Advanced-filter help and Kanboard, Deck, OpenProject, issue, Asana, ZenKit, Trello, CSV, Jira, Excel and WeKan imports now use Bengali. Operators, regex, escapes, JSON fields, API paths and named placeholders remain exact, and invariant coverage leaves 1,566 values.

Trello API credentials, workspace and board selection, import-job lifecycle, member mapping, date and user validation, shortcuts and label controls now use Bengali. The API URL and positional placeholder remain exact, and invariant coverage leaves 1,516 values.

Board departure, list and card archive actions, user, team and organization settings, multi-selection, muted notifications and normal-role permissions now use Bengali. The board-title placeholder remains exact, and invariant coverage leaves 1,466 values.

Watch notifications, public and private pages, member removal, rescue dialogs, search and WIP controls, keyboard shortcuts, sidebars, signup and starred and default boards now use Bengali. Markup and all placeholders remain exact, and invariant coverage leaves 1,416 values.

Time tracking, assignee and label shortcuts, uploads, custom branding URLs, welcome and template boards, WIP errors and attachment limits now use Bengali. Whole-locale invariant coverage leaves 1,366 values.

Attachment and API size limits, registration, invitations, SMTP configuration, invitation emails, authorization, webhooks and diagnostic version labels now use Bengali. Every email token remains exact, and invariant coverage leaves 1,316 values.

Runtime, OS and memory diagnostics, time units, custom-field display controls, account and board visibility settings and organization tenancy, domains and administration now use Bengali. Environment names, modes and example hostnames remain literal, and invariant coverage leaves 1,266 values.

Received and end dates, assignment metadata, board and notification deletion, subtask and card settings, minicard fields, parent and source relationships and label activity now use Bengali. Named and positional placeholders remain exact, and invariant coverage leaves 1,216 values.

Attachment and custom-field activity, automation rule controls and the visual workflow and JSON, CSV and Trello Butler import/export paths now use Bengali. Every positional and named token remains exact, and invariant coverage leaves 1,166 values.

Workflow formats, scheduled, due, list and button triggers, relative dates, sorting and card-completion actions now use Bengali. The unmapped-count and time tokens remain exact, and invariant coverage leaves 1,116 values.

Card movement, archive, label, member, attachment, checklist and email conditions and actions now use Bengali. Whole-locale invariant coverage leaves 1,066 values.

Further automation actions, authentication, custom HTML/JSON configuration, assetlinks, layout and board-list settings now use Bengali. JSON and HTML names remain literal, and invariant coverage leaves 1,016 values.

Board duplication, swimlane and account deletion, date activities, reminders, mentions, card positioning, drag controls and editor behavior now use Bengali. HTML tags and every activity placeholder remain exact, and invariant coverage leaves 966 values.

Multi-window and editor behavior, organization, team and user dialogs, notification controls, board-role permissions, weekdays and linked-card deletion guards now use Bengali. Invariant coverage leaves 916 values.

Checklist display, domains, shared templates, My Cards, Due Cards and global search now use Bengali. Markdown emphasis and positional lookup placeholders remain exact, and invariant coverage leaves 866 values.

Search result counts and board, swimlane, list, label, user, status, date, sorting, organization, team, custom-field and existence operators and predicates now use Bengali. Named and positional count tokens remain exact, and invariant coverage leaves 816 values.

Operator validation, pagination and the complete global-search syntax and notes now use Bengali. Named tokens, angle-bracket fields, Markdown emphasis, code examples and line breaks remain exact, and invariant coverage leaves 766 values.

Card and board sorting, completion, stickers, dependency types and imports, board backgrounds and card locations now use Bengali. Named import counters and the background-size placeholder remain exact, and invariant coverage leaves 716 values.

Map detection, server troubleshooting, sorting, board activity, string-template fields and file, security, speed, test, CPU, database, rule, board, card, impersonation, recovery and Office reports now use Bengali. Commands, HTML entities and the value placeholder remain exact, and invariant coverage leaves 666 values.

Office, REST API and recovery reports, recovery maintenance, swimlane copying, wait indicators, card sizing, organization and team deletion guards, tickets, requests, sorting and card details now use Bengali. Technical flags and service names remain literal, and invariant coverage leaves 616 values.

Team and organization assignment, invitations, Node heap and memory diagnostics, legal notices, checklist and subtask actions and filesystem, GridFS and S3 attachment movement now use Bengali. Technical storage and runtime names remain recognizable, and invariant coverage leaves 566 values.

Attachment and avatar storage migration and location repair, storage defaults, progress and statistics, identifiers and MongoDB GridFS compaction now use Bengali. Storage, replica, oplog and identifier terminology remains recognizable, and invariant coverage leaves 516 values.

Board status and time summaries, upload progress and restrictions, login fields, PDF preview, workspace dragging, custom translations, checklist collapsing, support and accessibility now use Bengali. The workspace token and technical format names remain exact, and invariant coverage leaves 466 values.

Accessibility labels, brute-force login protection and locked-user controls, scheduled jobs, attachment and avatar paths and scheduled board operations now use Bengali. Storage and cron terminology remains recognizable, and invariant coverage leaves 416 values.

Scheduled-job and migration controls, filesystem, S3 and Azure storage and MongoDB, FerretDB and Sandstorm migration guidance now use Bengali. URLs, environment-variable names and the database placeholder remain exact, and invariant coverage leaves 366 values.

Sandstorm cleanup, adaptive card loading, safe rich-text rendering, disabled imports, exports, activities, notifications and watches, anonymized users and backup scope now use Bengali. HTML and technical configuration names remain exact, and invariant coverage leaves 316 values.

Backup schedules and restore modes plus Google Cloud, S3 and Azure credential, permission and console guidance now use Bengali. JSON, product names and menu paths remain recognizable, and invariant coverage leaves 266 values.

GridFS and S3 settings, migration lifecycle controls, scheduled board operations, writable storage paths and attachment and board migration settings now use Bengali. Product and protocol names remain exact, and invariant coverage leaves 216 values.

Board structure checks, duplicate-list cleanup, lost-card and archive recovery, missing-list repair, avatar and attachment URL repair and migration progress now use Bengali. Data identifiers remain exact, and invariant coverage leaves 166 values.

Board conversion and repair steps, cleanup, CPU and memory diagnostics, scheduled-job frequencies, export monitoring and filesystem and GridFS statistics now use Bengali. Technical identifiers remain exact, and invariant coverage leaves 116 values.

Bulk attachment migration, batch, CPU and delay tuning, migration logs and warnings, monitoring controls, schedules, progress and system-resource totals now use Bengali. Storage names and numeric ranges remain exact, and invariant coverage leaves 66 values.

OTP login, accounts, repository access, problem summaries, broken-card repair, CPU diagnostics and event details now use Bengali. Card-repair placeholders and technical names remain exact, and invariant coverage leaves 16 values.

IP-address labels, filesystem integrity, scoped card export and WeKan file and board import guidance now use Bengali. The global-search operator placeholder, format names and angle-bracket value remain exact. All 2,166 values are now translated and whole-locale invariant coverage reports zero placeholders.

Board, card, list and swimlane activity, attachments, labels, checklists, comments, custom fields, archives and imports now use Tibetan. Named and positional placeholders remain exact, and whole-locale invariant coverage leaves 2,116 values.

Card movement, membership, concise activity messages, checklist activity and workspace controls now use Tibetan. Named and positional placeholders remain exact, and whole-locale invariant coverage leaves 2,066 values.

Workspace deletion, multi-board selection, Home boards, templates, list widths, keyboard shortcuts, swimlane heights and common card controls now use Tibetan. Positional placeholders remain exact, and whole-locale invariant coverage leaves 2,016 values.

Administration announcements, public boards, archives, attachments, board appearance, member and assignee summaries and private-board guidance now use Tibetan. Named and positional placeholders and strong-emphasis tags remain exact, and whole-locale invariant coverage leaves 1,966 values.

Public-board guidance, appearance, desktop and mobile views, zoom, calendar and table views, archive guidance and common card editing labels now use Tibetan. The workspace token, positional placeholder and strong-emphasis tags remain exact, and whole-locale invariant coverage leaves 1,916 values.

Card membership and custom fields, voting, Planning Poker, dependencies, organization and team controls, account and background deletion and import and export dialogs now use Tibetan. Whole-locale invariant coverage leaves 1,866 values.

Member dialogs, archive restoration, CAS login, linked cards and boards, imported-member mapping, themes, fonts, avatars, language and permission controls now use Tibetan. Numeric preview text remains exact, and whole-locale invariant coverage leaves 1,816 values.

Star controls, automatic list widths, clipboard actions, card aging, movement, dialog navigation, board restoration guidance and the first color-name set now use Tibetan. Whole-locale invariant coverage leaves 1,766 values.

Board roles, destructive confirmations, list movement, clipboard actions, multi-card JSON examples, labels and custom-field types now use Tibetan. JSON structure remains valid, and whole-locale invariant coverage leaves 1,716 values.

Custom-field controls, permanent deletion, profile and WIP settings, account enrolment, invitation, password-reset and verification emails and board, import and linked-card errors now use Tibetan. Named placeholders and technical format names remain exact, and whole-locale invariant coverage leaves 1,666 values.

User and account errors, card PDF and Excel export fields and storage errors, list sorting and date, label and member filters now use Tibetan. Technical format names remain exact, and whole-locale invariant coverage leaves 1,616 values.

Assignee and custom-field filters, the complete advanced-filter syntax and Kanboard, Deck, OpenProject, issue, Asana, ZenKit, Trello, CSV, Jira, Excel and WeKan import guidance now use Tibetan. Operators, endpoints, JSON keys, paths and format names remain exact, and whole-locale invariant coverage leaves 1,566 values.

Trello archive safety, workspace placement, API credentials, board selection, import-job controls and results, member mapping, validation, invitations and labels now use Tibetan. The API URL, technical names and positional placeholder remain exact, and whole-locale invariant coverage leaves 1,516 values.

Board departure, card and list links, list archives, user, team and organization settings, swimlane actions, imports, selection movement and copying, muted and normal notification roles and archived-item states now use Tibetan. The board title token remains exact, and whole-locale invariant coverage leaves 1,466 values.

Watch notifications, private and public guidance, previews, member removal, card-description rescue, search, WIP settings, keyboard shortcuts, sidebars and Home-board controls now use Tibetan. The login link, positional placeholder and member tokens remain exact, and whole-locale invariant coverage leaves 1,416 values.

Time tracking, assignee and label shortcuts, uploads, custom branding URLs, watching, welcome content, card, list and board templates, WIP errors and attachment/API limits now use Tibetan. Technical names and numeric ranges remain exact, and whole-locale invariant coverage leaves 1,366 values.

Attachment and API transfer limits, avatar upload blocking, registration, invitations, SMTP configuration and test mail, webhooks and basic runtime version fields now use Tibetan. Email tokens and product and protocol names remain exact, and whole-locale invariant coverage leaves 1,316 values.

Database, FerretDB, reactivity, DDP and operating-system diagnostics, time units, custom-field display settings, account changes, visibility and organization and team tenancy administration now use Tibetan. Environment variables, hostnames and technical runtime names remain exact, and whole-locale invariant coverage leaves 1,266 values.

Received and end dates, colors, assignment provenance, destructive board and notification actions, duplicate-list cleanup, subtask and card settings, minicard fields, parent relationships and label activity now use Tibetan. Named and positional placeholders remain exact, and whole-locale invariant coverage leaves 1,216 values.

Attachment, label and custom-field activity, rule management, workflow and list views, trigger and action construction, card, label, member, checklist, attachment and daily triggers and JSON, CSV and Trello Butler import/export now use Tibetan. Tokens and technical format names remain exact, and whole-locale invariant coverage leaves 1,166 values.

n8n and Node-RED workflow imports, scheduled, due-date, list-duration and card and board button triggers, list sorting, card completion, bulk movement and relative-date actions now use Tibetan. The count token, technical names and numeric marker remain exact, and whole-locale invariant coverage leaves 1,116 values.

List, card, label, member, attachment, checklist and checklist-item trigger phrases plus card movement, archive restoration, color, member, checklist and email actions now use Tibetan. Whole-locale invariant coverage leaves 1,066 values.

Remaining automation actions, authentication, custom-head metadata, manifest and asset-link settings, board duplication and layout, card counters and member lists now use Tibetan. Technical metadata names remain exact, and whole-locale invariant coverage leaves 1,016 values.

Custom HTML placement, login errors, authentication display, duplication and deletion confirmations, date activity, due reminders, mentions, card positioning and drag, editor and multi-card settings now use Tibetan. HTML, named and positional placeholders remain exact, and whole-locale invariant coverage leaves 966 values.

Multi-card and inline-editor behavior, organization, team and user dialogs, notification management, board-role permissions and status, weekdays, activity metadata and linked-card deletion guards now use Tibetan. Keyboard and technical names remain exact, and whole-locale invariant coverage leaves 916 values.

Checklist visibility, tasks, domains, shared templates, My Cards, Due Cards, global search and missing-item errors now use Tibetan. Domain examples, emphasis markers and positional placeholders remain exact, and whole-locale invariant coverage leaves 866 values.

Missing-result messages, paginated result counts and the complete set of global-search operator and predicate labels now use Tibetan. Positional and named range placeholders remain exact, and whole-locale invariant coverage leaves 816 values.

Operator validation, pagination, search syntax, every operator explanation, status and field predicates, sorting and limit guidance and query-composition notes now use Tibetan. Backticked examples, emphasis, angle-bracket metavariables and named and positional placeholders remain exact, and whole-locale invariant coverage leaves 766 values.

Board and card sorting, completion, stickers, dependency relationships and imports, board backgrounds and the first location controls now use Tibetan. JSON and SVG names and named size and import placeholders remain exact, and whole-locale invariant coverage leaves 716 values.

Location detection, maps, server troubleshooting, activity controls, string templates, invisible-filename diagnostics and security, performance, database, impersonation, recovery and office reports now use Tibetan. Shell commands, template placeholders, HTML entities and IP protocol names remain exact, and whole-locale invariant coverage leaves 666 values.

Office and API reports, automatic recovery reporting and maintenance, swimlane copying, wait indicators, card sizing, organization and team deletion guards, tickets and card details now use Tibetan. REST API, MongoDB, environment configuration and mail-header notation remain recognizable, and whole-locale invariant coverage leaves 616 values.

Team and organization administration, invitations, Node heap and memory diagnostics, legal notices, checklist and subtask actions and filesystem, GridFS and S3 attachment moves now use Tibetan. Runtime, allocator, URL and storage names remain exact, and whole-locale invariant coverage leaves 566 values.

Attachment and avatar storage migration, location repair, default storage, progress and file statistics plus MongoDB GridFS compaction now use Tibetan. Storage names, IDs, replica-set, oplog and Meteor terminology remain recognizable, and whole-locale invariant coverage leaves 516 values.

Board timing, upload progress and limits, account prompts, PDF previews, workspace assignment, custom translations, Markdown and ZIP imports, checklist collapsing, support and accessibility now use Tibetan. Named placeholders, format names and standards remain exact, and whole-locale invariant coverage leaves 466 values.

Accessibility metadata, brute-force login protection and locked-user administration, people status filters, scheduled jobs, attachment and avatar paths and board archive, backup and cleanup scheduling now use Tibetan. Whole-locale invariant coverage leaves 416 values.

Scheduled-job results, migration errors and warnings, filesystem, S3 and Azure storage settings, MongoDB/FerretDB database migration and Sandstorm migration status now use Tibetan. MongoDB, FerretDB, SQLite, MinIO, AWS, URLs, environment variables and __db__ remain exact, and whole-locale invariant coverage leaves 366 values.

Sandstorm cleanup, adaptive card loading, plain-text rendering, import/export and activity/notification controls, identity anonymization and backup settings now use Tibetan. Markdown and HTML examples, environment variables, storage paths, product names and counter examples remain exact, and whole-locale invariant coverage leaves 316 values.

Backup frequency, restore modes, Google Cloud Storage credentials and permissions, AWS S3, Azure and GCS console paths, connection tests and cloud attachment moves now use Tibetan. Time formats, JSON field names, console menu names, storage products and secret-key terminology remain exact, and whole-locale invariant coverage leaves 266 values.

GridFS selection, migration lifecycle and progress, CollectionFS moves, S3 credentials and connection tests, scheduled board operations, writable paths and attachment/board migration settings now use Tibetan. MongoDB, GridFS, CollectionFS, AWS, MinIO, SSL/TLS and the example region remain exact, and whole-locale invariant coverage leaves 216 values.

Comprehensive board checks, duplicate-list cleanup, lost-card restoration, archive recovery, missing-list repair, avatar/file URL repair and migration progress now use Tibetan. swimlaneId, listId, IDs and URLs remain exact, and whole-locale invariant coverage leaves 166 values.

The remaining board-conversion steps, cleanup, database migrations, run intervals, export and attachment monitoring, filesystem/GridFS statistics, job queues, CPU and memory use now use Tibetan. ID, URL, CPU and GridFS remain exact, and whole-locale invariant coverage leaves 116 values.

Attachment storage targets, batch size, CPU thresholds and delays, migration logs and lifecycle, monitoring refresh/export, schedules, progress, resource totals and minicard list/checklist settings now use Tibetan. GridFS, S3, CPU, percent and millisecond ranges remain exact, and whole-locale invariant coverage leaves 66 values.

The final 66 values cover repository login, problem reporting, broken-card repair, CPU and event diagnostics, scoped import/export and search guidance. OTP, API, CPU, IP versions, file formats, __fixed__, __unfixable__, __operator_number__ and <number> remain exact. Zero-backlog and whole-file invariant coverage now protect all 2,166 Tibetan translations.

Board, card, list and swimlane deletion and creation, comments, due dates, attachments, subtasks, labels, checklists, custom fields, archiving and imports now use Buryat. Named and percent placeholders remain exact, and whole-locale invariant coverage leaves 2,116 values.

Card moves, activity history, checklist changes, board membership, dates, subtasks, custom fields and workspace creation and settings now use Buryat. Named and percent placeholders remain exact, and whole-locale invariant coverage leaves 2,066 values.

Workspace deletion, board selection and home boards, list widths, swimlane heights, keyboard shortcuts, dates, templates and checklist actions now use Buryat. Percent placeholders remain exact, and whole-locale invariant coverage leaves 2,016 values.

Administrator notices and permissions, board archives and restoration, attachments, templates, board backgrounds, member views and assignments now use Buryat. Named, percent and HTML placeholders remain exact, and whole-locale invariant coverage leaves 1,966 values.

Board visibility, backgrounds and views, desktop and mobile display, zoom, calendar navigation, card, list and swimlane archives and card editing now use Buryat. Named, percent and HTML placeholders remain exact, and whole-locale invariant coverage leaves 1,916 values.

Card membership and dates, voting and planning poker, dependencies, organizations, teams, backgrounds, accounts and board-element imports and exports now use Buryat. Whole-locale token and tag invariant coverage leaves 1,866 values.

Members, invitations, archived-item restoration, rule transfer, linked cards and boards, imported-member mapping, themes, fonts, text colors, avatars, languages and permissions now use Buryat. Whole-locale invariant coverage leaves 1,816 values.

Subtasks, starred boards and pages, automatic list widths, card aging, card and list movement, dialogs, board closure and 23 interface colors now use Buryat. Whole-locale token and tag invariant coverage leaves 1,766 values.

The remaining colors, restricted board roles, deletion confirmations, clipboard actions, card and list copying, template containers, labels and custom-field types and options now use Buryat. The translated JSON example remains valid, and whole-locale invariant coverage leaves 1,716 values.

Custom-field text, permanent deletion, profile and WIP controls, card dates, notifications, account enrollment, invitation, password and verification emails and board, user, JSON and CSV errors now use Buryat. All email tokens remain exact, and whole-locale invariant coverage leaves 1,666 values.

Account and name conflicts, attachment-free board exports, PDF and Excel card exports, attachment metadata, list sorting and date, label and member filters now use Buryat. Whole-locale token and tag invariant coverage leaves 1,616 values.

Assignee and custom-field filters, activities, imported members, advanced filter syntax and board imports from Kanboard, Deck, OpenProject, issue trackers, Asana, ZenKit, Trello, CSV, Jira, Excel and WeKan now use Buryat. Named tokens and filter operators remain exact, and whole-locale invariant coverage leaves 1,566 values.

ZIP validation, Trello workspaces and API credentials, board selection, progress, cancellation and results, imported-member mapping, date validation, keyboard shortcuts and label creation now use Buryat. The API URL, year example and percent placeholder remain exact, and whole-locale invariant coverage leaves 1,516 values.

Administrator safeguards, leaving and linking boards, list archiving and deletion, user, team and organization settings, element movement, multi-select, archive states, board roles and participation notifications now use Buryat. The board-title token remains exact, and whole-locale invariant coverage leaves 1,466 values.

Watch notifications, private and public pages, previews, board membership, unsaved-description recovery, search, WIP limits, keyboard shortcuts, sidebars, signup and default and starred boards now use Buryat. Named and percent tokens and the login link remain exact, and whole-locale invariant coverage leaves 1,416 values.

Starred boards, time tracking, assignee and label shortcuts, uploads, custom logos and links, URL schemes, watching, welcome and template boards and WIP and attachment limits now use Buryat. Numeric examples remain exact, and whole-locale invariant coverage leaves 1,366 values.

Attachment and API transfer limits, avatar blocking, registration and invitations, SMTP configuration and testing, authorization errors, outgoing and global webhooks and runtime version labels now use Buryat. Invitation email tokens remain exact, and whole-locale invariant coverage leaves 1,316 values.

Database, FerretDB, reactivity, DDP and operating-system diagnostics, time units, custom-field display, account and board visibility settings and team and organization tenancy, domains, administrators and member synchronization now use Buryat. Environment-variable names remain exact, and whole-locale invariant coverage leaves 1,266 values.

Received and end dates, card and selection colors, board and notification deletion, duplicate-list cleanup, subtask destinations, minicard fields, parent-card display and label activity now use Buryat. Named and percent tokens and count examples remain exact, and whole-locale invariant coverage leaves 1,216 values.

Attachment, label and custom-field activity, rule creation and editing, workflow and list views, card, label, member, checklist, attachment and daily triggers and JSON, CSV and Trello Butler rule transfer now use Buryat. Named and percent tokens remain exact, and whole-locale invariant coverage leaves 1,166 values.

Visual workflow formats, n8n and Node-RED imports, scheduled and button triggers, daily through monthly schedules, due-date and time-in-list triggers, list sorting, completion actions, relative dates and time units now use Buryat. The import count remains exact, and whole-locale invariant coverage leaves 1,116 values.

Card, label, member, attachment, checklist and checklist-item conditions, archive transitions, card movement, membership and color actions, checklist updates, email actions and their generated descriptions now use Buryat. Whole-locale token and tag invariant coverage leaves 1,066 values.

Generated email, archive, label, member and checklist actions, card creation, swimlanes, date-field actions, card links, authentication, product names, custom HTML, manifests, asset links and layout settings now use Buryat. Format names and comma-separated examples remain exact, and whole-locale invariant coverage leaves 1,016 values.

Custom body HTML, authentication display, board duplication, swimlane deletion, card placement, due-time reminders and mentions, account, team and organization deletion, minicard labels, drag handles and editor behavior now use Buryat. HTML and named and percent tokens remain exact, and whole-locale invariant coverage leaves 966 values.

Multi-card windows, Enter-key editor behavior, organization, team and user editing, notification state, rename and invitation permissions, board-role status, weekdays, ownership and linked-card deletion safeguards now use Buryat. Keyboard combinations remain exact, and whole-locale invariant coverage leaves 916 values.

Checklist visibility, tasks, domains, shared templates, people and time scopes, My Cards sorting, Due Cards and global-search views and missing board-element errors now use Buryat. Domain examples, Markdown emphasis and percent tokens remain exact, and whole-locale invariant coverage leaves 866 values.

Missing comment, organization and team results, card-result counts and search operators for board structure, people, state, dates, text, attachments and checklists and their archived, open, overdue and time predicates now use Buryat. Result-boundary tokens remain exact, and whole-locale invariant coverage leaves 816 values.

Public and private predicates, operator validation, pagination and the full global-search guide for board structure, people, dates, state, field presence, sorting, limits and operator composition now use Buryat. Search examples, named tokens and pseudo-tags remain exact, and whole-locale invariant coverage leaves 766 values.

Label metadata, board and card sorting, completion state, stickers, dependency types, filtering and JSON/SVG import, board backgrounds and location names, addresses and latitude now use Buryat. Import counts and the image-size token remain exact, and whole-locale invariant coverage leaves 716 values.

Longitude, map-link detection and providers, server-error troubleshooting, sorting, activity visibility, swimlane movement, string templates and file, security, speed, test, CPU, database, rule, board, card, impersonation, recovery and office reports now use Buryat. Shell commands and the template placeholder remain exact, and whole-locale invariant coverage leaves 666 values.

Office sharing, REST API usage, data recovery status and maintenance, swimlane copying, wait-spinner styles, organization and team deletion safeguards, support tickets and card sorting and details now use Buryat. API and database configuration names remain exact, and whole-locale invariant coverage leaves 616 values.

Team and organization assignment, invitations, Node heap and memory diagnostics, legal notices, checklist and subtask actions and filesystem, GridFS and S3 attachment moves now use Buryat. Runtime, allocator, URL and storage names remain exact, and whole-locale invariant coverage leaves 566 values.

Attachment and avatar storage migration, location repair, default storage, progress and file statistics plus MongoDB GridFS compaction now use Buryat. Storage names, IDs, replica-set, oplog and Meteor terminology remain recognizable, and whole-locale invariant coverage leaves 516 values.

Board timing, upload progress and limits, account prompts, PDF previews, workspace assignment, custom translations, Markdown and ZIP imports, checklist collapsing, support and accessibility now use Buryat. Named placeholders, format names and standards remain exact, and whole-locale invariant coverage leaves 466 values.

Accessibility metadata, brute-force login protection and locked-user administration, people status filters, scheduled jobs, attachment and avatar paths and board archive, backup and cleanup scheduling now use Buryat. Whole-locale token and tag invariant coverage leaves 416 values.

Scheduled-job results, migration errors and warnings, filesystem, S3 and Azure storage settings, MongoDB/FerretDB database migration and Sandstorm migration status now use Buryat. MongoDB, FerretDB, SQLite, MinIO, AWS, URLs, environment variables and __db__ remain exact, and whole-locale invariant coverage leaves 366 values.

Sandstorm cleanup, adaptive card loading, plain-text rendering, import/export and activity/notification controls, identity anonymization and backup settings now use Buryat. Markdown and HTML examples, environment variables, storage paths, product names and counter examples remain exact, and whole-locale invariant coverage leaves 316 values.

Backup frequency, restore modes, Google Cloud Storage credentials and permissions, AWS S3, Azure and GCS console paths, connection tests and cloud attachment moves now use Buryat. Time formats, JSON field names, console menu names, storage products and secret-key terminology remain exact, and whole-locale invariant coverage leaves 266 values.

GridFS selection, migration lifecycle and progress, CollectionFS moves, S3 credentials and connection tests, scheduled board operations, writable paths and attachment and board migration settings now use Buryat. MongoDB, GridFS, CollectionFS, AWS, MinIO, SSL/TLS and the example region remain exact, and whole-locale invariant coverage leaves 216 values.

Comprehensive board checks, duplicate-list cleanup, lost-card restoration, archive recovery, missing-list repair, avatar and file URL repair and migration progress now use Buryat. swimlaneId, listId, IDs and URLs remain exact, and whole-locale invariant coverage leaves 166 values.

The remaining board-conversion steps, cleanup, database migrations, run intervals, export and attachment monitoring, filesystem and GridFS statistics, job queues, CPU and memory use now use Buryat. ID, URL, CPU and GridFS remain exact, and whole-locale invariant coverage leaves 116 values.

Attachment storage targets, batch size, CPU thresholds and delays, migration logs and lifecycle, monitoring refresh and export, schedules, progress, resource totals and minicard list and checklist settings now use Buryat. GridFS, S3, CPU, percent and millisecond ranges remain exact, and whole-locale invariant coverage leaves 66 values.

The final 66 values cover repository login, problem reporting, broken-card repair, CPU and event diagnostics, scoped import/export and search guidance. OTP, API, CPU, IP versions, file formats, __fixed__, __unfixable__, __operator_number__ and <number> remain exact. Zero-backlog and whole-file invariant coverage now protect all 2,166 Buryat translations.

Board, card, list and swimlane deletion and creation, comments, due dates, attachments, subtasks, labels, checklists, custom fields, archiving and imports now use Cherokee syllabary. Named and percent placeholders remain exact, and whole-locale invariant coverage leaves 2,116 values.

and improves the following translations:

Cyrillic translations - the Office and REST API usage reports.

All twelve translatable report labels and descriptions now use distinct Macedonian and Serbian vocabulary in Cyrillic script. REST API, IPv4, IPv6 and WITH_API=true remain recognizable. Regression coverage checks every translated key, Cyrillic content, distinct vocabulary and the intentionally universal API labels. These direct translations have low confidence and welcome review by Macedonian and Serbian speakers.

All twelve translatable report labels and descriptions now use Mongolian vocabulary in Cyrillic script. REST API, IPv4, IPv6 and WITH_API=true remain recognizable. Regression coverage checks every translated key, Cyrillic content and the intentionally universal API labels. This direct translation has low confidence and welcomes review by Mongolian speakers.

Twenty-eight exact Russian copies in archive, template and board-view controls now use Mongolian vocabulary. The shared Архив loanword remains valid. Regression coverage compares the repaired values directly with Russian, checks established Mongolian board terms and rejects common Russian UI words. Another 1,146 exact-match candidates remain for later audited batches. This direct repair has low confidence and welcomes review by Mongolian speakers.

Forty-three exact Russian copies across card guidance, dates, editing controls, voting, templates, sorting and popup titles now use Mongolian. Regression coverage compares every repaired key with Russian, preserves placeholders and established card vocabulary, and rejects common Russian card terms. Another 1,103 exact-match candidates remain for later audited batches. This direct repair has low confidence and welcomes review by Mongolian speakers.

Fourteen exact Russian copies across attachment deletion, actions, storage moves and renaming now use Mongolian. The shared Файл loanword remains valid and GridFS remains recognizable. Regression coverage compares the repaired values with Russian and rejects common Russian attachment terms. Another 1,089 exact matches, including shared loanwords, remain for later audit. This direct repair has low confidence and welcomes review by Mongolian speakers.

Fifty exact Russian copies across activities, dialogs, settings, automation, search and export now use consistent Mongolian checklist and subtask vocabulary. Regression coverage compares every value with Russian, preserves named and printf placeholders, keeps the search operator space-free and rejects common Russian terms. Another 1,039 exact matches, including shared loanwords, remain for later audit. This direct repair has low confidence and welcomes review by Mongolian speakers.

Eleven exact Russian copies across date, list-title, label, member, assignee, custom-field, advanced and card-title filters now use consistent Mongolian filter vocabulary. Regression coverage compares every repaired value with Russian and rejects common Russian filter terms. Another 1,028 exact matches, including shared loanwords, remain for later audit. This direct repair has low confidence and welcomes review by Mongolian speakers.

Thirty exact Russian copies across label activities, deletion, multi-selection, automation, search, display settings and validation now use consistent Mongolian label vocabulary. Regression coverage compares every value with Russian and preserves named, printf and Markdown placeholders. Another 998 exact matches, including shared loanwords, remain for later audit. This direct repair has low confidence and welcomes review by Mongolian speakers.

Three email subjects now keep __siteName__ instead of substituting __url__, and the unknown-operator message keeps %s instead of malformed %1. Their surrounding Russian prose now uses Mongolian. Whole-file regression coverage compares every Mongolian placeholder inventory with en.i18n.json and rejects the repaired Russian wording. This direct repair has low confidence and welcomes review by Mongolian speakers.

Caucasian translations - the Office and REST API usage reports.

All twelve translatable report labels and descriptions now use Armenian or Georgian script and each language's own vocabulary. REST API, IPv4, IPv6 and WITH_API=true remain recognizable. Regression coverage checks every translated key, rejects the neighbouring script and preserves the intentionally universal API labels. These direct translations have low confidence and welcome review by Armenian and Georgian speakers.

Indic translations - the Office and REST API usage reports.

All twelve translatable report labels and descriptions now use Telugu or Tamil script and each language's own vocabulary. REST API, IPv4, IPv6 and WITH_API=true remain recognizable. Regression coverage checks every translated key, rejects the neighbouring script and preserves the intentionally universal API labels. These direct translations have low confidence and welcome review by Telugu and Tamil speakers.

All twelve translatable report labels and descriptions now use Odia or Gurmukhi script and each language's own vocabulary. REST API, IPv4, IPv6 and WITH_API=true remain recognizable. Regression coverage checks every translated key, rejects the neighbouring script and preserves the intentionally universal API labels. These direct translations have low confidence and welcome review by Odia and Punjabi speakers.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.10 2026-08-23 WeKan ® release

In short: a CRITICAL SECURITY ISSUE, ImportBleed, allowed a logged-out DDP client to write imported board data directly into the database; both import methods now reject unauthenticated callers after mandatory argument validation and before import processing. Below that: bounded legacy E2E login waits, restored Transifex locale aliases, Office and API report translations, visible obsolete English placeholders and focused regression coverage.

This release fixes the following CRITICAL SECURITY ISSUE of ImportBleed:

The importBoard method reached direct collection writers without first requiring an authenticated user, allowing a network client with no account or token to create imported board data and placeholder users. importBoard and importScoped now complete Meteor’s mandatory type checks, then reject logged-out callers before feature checks, parsers or creators can run. Scoped imports carry the authenticated method user explicitly. Denied attempts are attributed by connection address in Admin Panel / Problems. Source-level and logged-out browser regression tests cover the guard and no-write outcome. See GHSA-qp32-wqxw-wq3h and ImportBleed.

and has the following developer-tooling fix:

The Puppeteer list-regression suite now waits for a connected DDP session before resume-token login and bounds the token callback, reactive identity settlement and entire suite. A stalled fresh second session fails with its URL, DDP status, user id and login state instead of pausing all tests indefinitely. Regression coverage keeps every wait bounded and diagnostic.

and improves the following translations:

Translation tooling - placeholder safety and same-language vocabulary reuse.

The Khmer and Russian hyphenated locale aliases again point to their underscored Transifex targets. Translation pulls therefore update the files loaded by the app instead of leaving materialized copies stale. The former copies were byte-identical to their targets, so no translation was lost; lazy-loading and new-language wiring tests pin both aliases as symlinks.

The placeholder-only local-memory tool now derives versioned protocol labels from each language’s established IP-address translation, preserving its word order and changing only the universal protocol token. It filled 282 rendered labels across 141 language tags (268 stored values plus seven locale aliases). Two obsolete English sentences were reset to the current source so future fills can see them, and wrong-script analysis now ignores only exact IPv4 and IPv6 identifiers while continuing to inspect surrounding prose. Regression tests pin the ambiguity guard, placeholder protection and narrow protocol-token exception.

East Asian translations - the Office and REST API usage reports.

All twelve translatable report labels and descriptions now cover eleven Chinese language tags, using simplified or traditional script to match each existing locale. Product and protocol terms such as REST API, IPv4, IPv6 and WITH_API=true remain recognizable. Regression coverage checks every translated key, both scripts and the intentionally universal API labels.

All twelve report labels and descriptions now cover three Japanese and two Korean language tags, following each family’s established login and address vocabulary. REST API, IPv4, IPv6 and WITH_API=true remain recognizable. Regression coverage checks every translated key, both writing systems and the intentionally universal API labels.

Cyrillic translations - the Office and REST API usage reports.

All twelve report labels and descriptions now cover four Russian and two Ukrainian language tags, following each family’s established login and address vocabulary. REST API, IPv4, IPv6 and WITH_API=true remain recognizable. Regression coverage checks every translated key, both languages and the intentionally universal API labels.

All twelve report labels and descriptions now use distinct Belarusian and Bulgarian vocabulary in Cyrillic script. REST API, IPv4, IPv6 and WITH_API=true remain recognizable. Regression coverage checks every translated key, both languages and the intentionally universal API labels.

Right-to-left translations - the Office and REST API usage reports.

All twelve report labels and descriptions now cover the Arabic, Algerian, Egyptian and Moroccan tags in Arabic script. REST API, IPv4, IPv6 and WITH_API=true remain recognizable. Regression coverage checks every translated key, all four right-to-left tags, Arabic-script content and the intentionally universal API labels.

All twelve report labels and descriptions now cover two Hebrew and two Persian language tags in their respective right-to-left scripts. REST API, IPv4, IPv6 and WITH_API=true remain recognizable. Regression coverage checks every translated key, both scripts and the intentionally universal API labels.

Indic translations - the Office and REST API usage reports.

All twelve report labels and descriptions now cover two Hindi tags in Devanagari and one Gujarati tag in Gujarati script. REST API, IPv4, IPv6 and WITH_API=true remain recognizable. Regression coverage checks every translated key, both scripts and the intentionally universal API labels.

Greek translations - the Office and REST API usage reports.

All twelve report labels and descriptions now cover both Greek language tags in Greek script. REST API, IPv4, IPv6 and WITH_API=true remain recognizable. Regression coverage checks every translated key, Greek-script content and the intentionally universal API labels.

Khmer translations - the Office and REST API usage reports.

All twelve translatable report labels and descriptions now use Khmer vocabulary across the three Khmer language tags. API, REST API, IPv4, IPv6 and WITH_API=true remain recognizable. Regression coverage checks every translated key, Khmer script, variant consistency and the intentionally universal literals.

Vietnamese translations - the Office and REST API usage reports.

All twelve translatable report labels and descriptions now use Vietnamese across both language tags, following their established login, report and endpoint vocabulary. API, REST API, IPv4, IPv6 and WITH_API=true remain recognizable. Regression coverage checks every translated key, variant consistency and the intentionally universal literals.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.09 2026-08-23 WeKan ® release

In short: Playwright authentication now waits for the resumed user after navigation, and local WebKit runs retry once with a fresh worker after rare renderer failures. Below that: regression coverage for both safeguards.

This release improves the following developer tooling:

Token login now waits for the expected Meteor user after the final navigation, preventing an authorized method call from racing Accounts token resumption. Local WebKit runs retry once in a fresh worker when its renderer fails internally after many tests; persistent application and assertion failures still fail. Regression tests require the identity wait, its bounded timeout, the local retry and the unchanged two-retry CI policy.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.08 2026-08-23 WeKan ® release

In short: six coordinated reports harden REST authorization, board ownership, administrator token auditing and error responses. Build and release tooling now supports macOS zsh, Alpine, Arch, Fedora, RHEL and Oracle Linux, keeps companion data under the repository's ignored .tools directory, provides sandbox-local tools, bounds build, test and runtime resources across every platform, reports resource failures in Admin Panel Problems, offers three bounded, cleanly interruptible complete-test execution modes, and includes four dependency updates.

This release fixes the following HIGH AND MODERATE SECURITY ISSUES:

REST board mutations - cards, checklists, checklist items and comments.

Checklist and checklist-item create, edit and delete routes accepted read-only board members because they checked only whether the caller could view the board. Every mutation now requires the canonical board write capability; read-only members retain GET access. See GHSA-5r4m-5xx6-96jf and ChecklistWriteBleed.

Checklist, checklist-item and comment routes had drifted from the role capability table: some mutations needed only read access, while comment creation required full write access and incorrectly rejected Comment Only members. Mutation routes now require write access and comment creation uses the comment capability. See GHSA-cp24-5m9m-wm97 and RoleBleed.

Card and checklist creation reused the comment permission, allowing Comment Only members to create board content. Both single and bulk card creation and checklist creation now require the canonical write capability. See GHSA-qf5c-63jx-mpv4 and CommentWriteBleed.

Boards - ownership assigned by the board-creation API.

The board-creation route trusted the owner and role flags in the request body, so an authenticated caller could create a board attributed to another user. The authenticated caller is now always the initial active administrator and owner. See GHSA-6jvj-85q3-6q2m and OwnerBleed.

Administrator API - issuing login tokens for another account.

The administrator token endpoint could create a reusable login token for another user without producing the impersonation audit record used by the normal UI. It now requires a reason, verifies the target, records the administrator and target before inserting the login token, and rejects an unaudited request. See GHSA-5r57-9vj7-c64f and TokenAuditBleed.

REST responses - safe status codes and public error messages.

Board and user routes returned raw Error objects as successful HTTP 200 responses, which exposed implementation details and made failures look successful. Shared response handling now preserves expected 4xx statuses while replacing unexpected 5xx details with a generic message. Regression tests cover both paths and ensure raw errors do not return from the affected handlers. See GHSA-h59p-76c3-8345 and ErrorBleed.

and updates the following dependencies:

• @aws-sdk/client-s3 3.1113.0 → 3.1114.0 — the Amazon S3 client.
• @aws-sdk/lib-storage 3.1109.0 → 3.1114.0 — managed multipart uploads to S3.
• @google-cloud/storage 7.22.0 → 8.0.1 — Google Cloud Storage integration.
• dompurify 3.4.13 → 3.4.14 — HTML sanitization in the browser.

Thanks to dependabot.

and has the following developer-tooling improvements:

Build and release tooling - host setup and repository-local working data.

Source builds, Linux and Windows bundles, Docker, Snap and Sandstorm now derive Node and FerretDB limits from available host or cgroup memory while preserving explicit administrator overrides. Test and Go compiler floors no longer exceed small containers, Playwright installs repository-local browsers and uses a matching Docker fallback when immutable host libraries are missing, and build dependency stderr remains visible in both the console and timestamped log.

Runtime self-checks proactively report low disk space and V8 heap pressure in Admin Panel Problems. The database classifier now gives actionable reports for memory and file-descriptor exhaustion, read-only volumes, corruption and oversized documents. The remediation documents record which protections work on every platform and distinguish implemented FerretDB telemetry from follow-ups.

• Browser runs reuse cached binaries and report only their selected project. Thanks to xet7.

• Complete-mode wiring checks cover all three test schedules. Thanks to xet7.

The first three Tests menu choices in both build.sh and build.bat now run the whole matrix. The default runs one stage at a time with two Playwright workers per browser for a safe speed increase; one-by-one minimizes memory use; and at-once runs WeKan jobs concurrently. Database backends and FerretDB stages stay sequential in every mode to avoid port conflicts and overlapping compiler load. The Windows helper forwards the selected mode to the shared shell implementation, and parity tests pin the menu order, mode mapping and Playwright worker limit.

Every EVERYTHING run now owns a repository-local process lock. Starting another one first stops the older run and all descendants, frees and verifies ports 3000 and 3001, and removes tagged Playwright and database-conformance containers. Ctrl-C uses the same cleanup for the interrupted run. Cleanup tries graceful termination before a bounded forced stop; if a process, port or container still survives, the replacement exits with an actionable error before creating logs, building WeKan or starting any new tests. PID start tokens prevent stale lock files from targeting an unrelated reused PID on Linux, macOS and Windows.

The agent instructions now treat the repository-local, ignored .tools tree as the installation root when the Flatpak sandbox lacks a required command. Node.js and npm versions are read from Dockerfile, Meteor from .meteor/release, and other tools from their repository-owned version sources instead of stale copied examples. The instructions link the tested sandbox bootstrap, keep environment overrides scoped, and document a local RapidOCR virtual environment for reading timestamped screenshots when bubblewrap prevents the normal image viewer from creating a user namespace.

Fedora screenshots showed available memory falling from 28.6 GiB to 371 MiB while the CPU-exec negative regression created a large group of short-lived bash processes. The test now captures stdout and stderr from one direct helper invocation instead of launching a duplicate nested shell. The following FerretDB stages limit Go package compilation to two through four workers with a separate managed-heap target, and conformance no longer downloads the root, integration and tools module graphs before building its single binary. Focused positive and negative regressions pin these resource boundaries.

The adaptive 8-16 GiB heap ceiling needed while Meteor compiles WeKan was also inherited by the long-lived bundle server and every Node, E2E and Playwright process. A leaking test could therefore consume nearly all workstation RAM and swap before Linux killed it. Runtime processes now use a separate quarter-RAM allowance clamped to 2-4 GiB, while Meteor compilation retains the larger heap. WEKAN_TEST_NODE_OPTIONS provides a test-only override. Regression coverage pins both the bounded processes and the deliberately unbounded compiler.

Host-side dependency installers now choose Fedora's dnf commands and package names, including Fedora 44's 7zip, gcc-c++, glibc-langpack-en and snapd socket setup. Debian/Ubuntu continue to use apt and macOS continues to use Homebrew. Mocked installer-path tests cover both Fedora and Debian selection.

Host-facing shell installers now identify Linux families through /etc/os-release and select apk, pacman, dnf, yum or apt-get with each distribution's package names. Shared compiler and archive setup covers bundle conversion, docs, Sandstorm, release downloads, Snap prerequisites and forge tooling. Alpine and Arch report the manual Snap prerequisite instead of incorrectly running apt. RHEL and Oracle Linux configure their respective EPEL repositories before installing snapd. Mocked detection tests cover Alpine, Arch, Fedora, RHEL, Oracle Linux and Debian, and every migrated script is syntax-checked.

Host-facing Bash scripts now hand direct zsh invocation to macOS's system Bash before parsing Bash-specific syntax. The shared installer detects Darwin without depending on the caller's shell and maps command names to the correct Homebrew formulae for Python, GNU awk, GCC, 7-Zip and Node.js. Regression tests cover the handoff, Darwin detection and every differing formula name.

Shell and Windows batch scripts now use .tools/wekan.fi for the website companion checkout and .tools/log for build and test output. This removes the legacy sibling ../w/wekan.fi and parent ../log assumptions while preserving the CI environment-variable overrides.

A fresh shell did not include .tools/.meteor on PATH, so EVERYTHING stopped before building with meteor: command not found even though setup had installed the exact release there. build.sh now prefers the repository-local Meteor and the Node version and architecture named by the release configuration. The companion FerretDB test runner also generates current version metadata before unit packages initialize and writes standalone logs under .tools/log. Its unit, vet and SQLite integration stages pass together.

• The direct FerretDB test entry uses .tools/FerretDB. Thanks to xet7.

• Repository instructions use the same .tools paths. Thanks to xet7.

• The database-conformance regression test expects .tools/log. Thanks to xet7.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.07 2026-08-22 WeKan ® release

In short: the TenantBleed, AssignedBleed and CalendarBleed security fixes restrict Organization/Team writes to site admins and make REST and iCalendar card creation follow canonical board-role capabilities. Below that: card-history, destination-picker and riscv64 release-build fixes. The binary table is the v11.06 baseline and will be replaced by this release's verified provenance when its platform builds run.

This release fixes the following MODERATE SECURITY ISSUES:

Organizations and Teams - tenant configuration and its DDP permissions.

Any authenticated user could insert, update or remove an Organization or Team document over Meteor/DDP when its _id equalled their user id. The collection allow rules treated document identity as authority without requiring site-admin, tenant-admin or membership privileges, exposing tenant configuration and deletion. All six operations now share one site-admin-only decision; legitimate scoped and internal writes continue through their authorization-enforcing server methods. Refused authenticated attempts are rate-limited, attributed and shown in Admin Panel / Problems. See GHSA-p4cq-83j9-7g73 and TenantBleed.

REST authorization - the shared permission gate for board mutations.

An authenticated Only Assigned Comment member could modify any card through the REST API, even when not assigned to it. The shared REST authorization helper duplicated a list of excluded role flags and omitted isCommentAssignedOnly, so every card mutation route using it accepted a role whose canonical policy says write: false. The helper and both parallel attachment APIs now use the shared role-capability decision. All non-writing roles are denied, while No Comments and the other legitimate writing roles retain access. Refused attempts are rate-limited, attributed and shown in Admin Panel / Problems. See GHSA-f396-42fx-vr88 and AssignedBleed.

iCalendar import - creating cards from calendar events through DDP.

An authenticated Comment Only member could call importIcsToBoard over Meteor/DDP and create arbitrary cards. The method checked board membership and excluded only read-only roles, so Comment Only, Only Assigned Comment and Worker members reached card insertion despite the role policy denying them write access. The DDP path now uses the same canonical write-capability helper as its REST sibling. Regression coverage denies all five non-writing roles and confirms that the four legitimate writing roles retain access. Refused attempts are rate-limited, attributed and shown in Admin Panel / Problems. See GHSA-fpm6-r5fg-2mrg and CalendarBleed.

and fixes the following bugs:

Card details - activity history and destination selection.

The removed Activities eye left its old per-card showActivities: false value in control, so opening the new caret could still request comments only. Opening the section now always requests its complete history. The comments REST endpoint also validates the card against the requested board before selecting all records by their authoritative cardId, so older and imported comments with missing or stale denormalized board metadata are no longer omitted without weakening board isolation. Positive and negative regression tests cover both retrieval paths.

The destination picker treated a list without a swimlaneId as shared only by the default swimlane. It now combines board-global lists with the selected swimlane's own lists for every swimlane, while continuing to exclude lists owned by another swimlane. Regression tests cover both cases and the shared picker used by Move Card and Copy Card.

and fixes the following developer-tooling bug:

The Release All log showed no riscv64 compiler or recipe failure: Launchpad kept it pending until GitHub cancelled the runner at its six-hour limit. The workflow now gives its local waiter five hours, then leaves the named Launchpad build running and ends cleanly. Its flattened source commit has deterministic dates, so a later job re-run reconnects to that same build instead of adding another one to the queue. Store and GitHub Release publishing remain gated on a downloaded, architecture-checked squashfs snap. Regression tests cover the stable snapshot identity, the pending hand-off and the no-artifact publishing guard.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.06 2026-08-21 WeKan ® release

In short: card details once again offer every valid list and label, in every swimlane and through linked cards, and use compact accessible icons for person-field actions, while LDAP profiles consistently retain the directory's full display name. Below that: regression coverage for all four reported bugs, linked-card label writes and the icon controls, plus corrected Node and browser expectations for those controls and card dates.

This release fixes the following bugs:

Card details - choosing placement and labels on an opened card.

The list, move and copy selectors treated a legacy board-wide list as shared only in the default swimlane. They now include it for every swimlane. Activity logging also records a temporarily unavailable list or swimlane with an empty name instead of throwing after the valid card update.

The linked-card label refactor could resolve no source board and render only the Create label action. It now prefers the source board but falls back through the placement board to the current visible board, retaining existing labels and newly created ones.

The label row is a nested popup context, while the routed board contains the linked representation. The popup now retains the card as its explicit mutation target and resolves the label catalogue and new-label board from the source, so selecting or creating labels through a linked card works consistently.

Empty person fields now use the same compact icon-only language as description editing: a plus to add and a pencil to edit. Both states keep localized hover tooltips and accessible names, while the decorative icons stay hidden from screen readers.

LDAP profiles - directory names shown to signed-in users.

Active Directory attributes can arrive as a scalar, a one-element array or a buffer. The full-name sync now converts all three shapes to text, so the user header and profile do not fall back to sAMAccountName while the Admin Panel still sees directory data.

and updates the following developer tooling:

The all-tests run still expected visible Add text after those actions became icon-only controls, and one date test expected the direct context used before the v11.05 card-date repair. Node and Playwright coverage now checks the localized accessible name, tooltip and plus icon, and the date assertion matches the Card explicitly passed through the Blaze argument context. The complete plain-Node run passes all 495 suites.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.05 2026-08-19 WeKan ® release

In short: opened cards with saved dates render normally again, retain their labels and remain editable instead of stopping Blaze reactivity with a date-template context error. Launchpad snap builds now wait for their release bundles and preserve valid artifacts when Snapcraft only fails during post-download cleanup.

This release fixes the following bug:

Named Blaze arguments had replaced each opened-card date template's Card context with a plain argument object. Reactive date helpers then called Card methods on that object, stopping card-detail rendering and leaving the board in a refresh loop after a date save. Card details now passes the Card explicitly, while the shared date code accepts both that wrapped context and the direct context used by minicards and Table view. Browser coverage opens a labeled card with all four dates, verifies every badge and label, edits its title, and checks that no date-context exception occurs.

and fixes the following developer-tooling bug:

Launchpad snap jobs used to start alongside the extra-architecture bundle jobs, so s390x and ppc64el repeatedly downloaded release assets that did not exist yet. They now wait for those jobs and verify the exact architecture-specific asset before starting a remote build. A missing optional bundle is skipped with its real cause instead of spending hours retrying a permanent 404.

A Snapcraft SSL error during cleanup also used to discard an armhf snap that had already downloaded successfully. The workflow now keeps an artifact only after checking its minimum size and squashfs magic, regardless of the later cleanup status. Release-workflow tests cover the dependency, bundle-name mapping, missing-asset path, step gates, successful cleanup-failure path and invalid-artifact rejection.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.04 2026-08-19 WeKan ® release

In short: card date editors now preserve edited date and time values through reactive redraws and wait for persistence before closing, fixing an intermittent Chromium failure when changing an existing start date. Meteor moves to 3.5.2-beta.0 together with its matching Rspack integration and core package prereleases.

This release fixes the following bug:

The shared date editor now synchronizes valid native date and time input changes with its reactive draft and awaits every card, vote and planning-poker date write before closing. This prevents a redraw from restoring the old value between editing and submission. The Chromium start-date regression passed ten consecutive runs, and a node guard covers every asynchronous callback.

and updates the following dependencies:

• Meteor 3.5.1 → 3.5.2-beta.0 — the framework WeKan is built on. Its matching accounts-base, Babel, DDP client, ECMAScript, JavaScript minifier, MongoDB driver wrapper, Rspack, tools-core and TypeScript packages move to their beta352.0 builds, while @meteorjs/rspack moves from 2.1.0 to 2.2.0-beta.0. Update.

Thanks to Meteor developers.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.03 2026-08-19 WeKan ® release

In short: accessibility gives shared tabs, dialogs, images, password controls and card edit targets coherent names and keyboard order throughout WeKan, with one common keyboard utility keeping those behaviors consistent. Card details restore checkbox custom fields, keep their saved values separate from field visibility, save currency values, provide independent opened-card and minicard visibility settings, make every custom-field value copyable, use compact accessible pencil icons for Edit actions, restore the grid/one-per-row layout switch, restore cross-board card links, omit deleted custom fields from exports, and make attachment previews use the available viewport. JFIF image uploads receive portable JPEG download names. Linked cards mirror every visible source field across boards and authorized members can edit that shared content from either board. Card locations recognize both map URLs and plain coordinate pairs. Positive, negative and browser regression coverage keeps each interaction working. Existing boards also receive the new default-on opened-card custom-fields setting during schema upgrade. Opened cards can be resized wider as well as narrower on desktop. All Boards keeps the complete invitation message and its actions visible on phone-sized layouts. Developer tooling keeps long-running Rspack development watchers from retaining cache state until they exhaust the JavaScript heap, and lets Flatpak terminals run the Firefox/WebKit matrix through host Docker. Dependencies refresh S3 storage, build analysis, keyboard shortcuts, CSV parsing and browser automation. Admin Panel / Problems / Offices groups login addresses by person and shows each address family, available location, per-person login count and available initials instead of empty avatar circles. Admin Panel / People / People summarizes each person's login countries and opens country-by-country city, IPv4, IPv6 and login-time details. Problems pagination no longer mixes a specialized pane's state with the shared reports. The complete browser run restores inline title and date editing, popup focus, loading-state accessibility and phone board scrolling while bringing its selectors in step with the current UI.

This release fixes the following bugs:

The Admin Panel - reports about people and where they log in from.

The Offices report was inverted: each row represented an address and placed all people using it inside one cell. It now pages people and keeps every address for one person together. Each row has separate IPv4 and IPv6 columns, the latest country flag and city supplied by Cloudflare or another supported proxy, and that person's successful-login count and first/last times for that address.

Location is recorded when a login succeeds; existing address tallies are not retroactively geolocated. With Cloudflare, the proxied hostname must enable the Add visitor location headers Managed Transform so CF-IPCountry, CF-IPCity, CF-Region, CF-IPLatitude and CF-IPLongitude reach WeKan. Caddy passes these request headers through by default; any header_up override belongs inside its reverse_proxy block.

People sharing one address remain separate groups with separate counts. Search still matches names, addresses and locations, while location metadata for a page is fetched in one batch. Positive and negative coverage checks both IP families, shared addresses, supported location headers and absent geography.

The server already computed initials for every person, but person grouping dropped that field and the shared table tried to find the user again in the client cache. When the full user document was not published there, the fallback had no letters to draw and rendered an empty grey circle.

Initials now travel with the person through the response, grouped rows and shared table cell. The existing avatar template uses them directly and retains its reactive user lookup as the fallback everywhere else. Regression coverage checks both the Offices path and the generic table conversion.

A Location column immediately before Status now shows each person's country flags and successful-login counts. Selecting a counter opens that person's location report: countries are the left menu, busiest first, and the selected country's shared Table.md table lists city, IPv4, IPv6 and the person's first and last login times for every address.

The detail view has the shared search, pagination and Back controls. Location data is fetched once per People page and restricted through the same site-admin or tenant-admin scope as the People list. Unknown locations are not guessed, stale page responses are discarded, and new logins retain the available proxy location on the person's own address tally.

Positive and negative coverage checks country totals and ordering, both IP families, city rows, timestamps, menu and table wiring, authorization limits and absent geography.

Pagination events from specialized Problems panes bubbled into the containing shared report handler. Their pane ids intentionally have no shared report configuration, so clicking Next could try to read a count from undefined and stop the requested action with a browser exception.

Event-stream and Offices controls now keep their events inside their own pane. The shared Previous, Next and search handlers also safely ignore missing or transitional report state. Regression coverage exercises both specialized pagers and the defensive shared-handler path.

Card details - fields, attachments and links on an opened card.

The board schema made opened-card custom fields visible by default, but the schema-upgrade list omitted that new flag. Boards created before the setting therefore retained no stored default when their other default-on feature flags were repaired. The upgrade now backfills allowsCustomFields: true while still preserving an administrator's explicit false choice.

The complete 490-suite Node run also exposed guards that still described old custom-field, date-control, card-width, initials and publication layouts, plus a security scan entering a downloaded Go toolchain under .tools. Those guards now pin the current intended behavior and scan only maintained FerretDB source.

Content detection already identified a JFIF upload as JPEG, but the MIME database did not recognize the .jfif filename suffix. The generic correction therefore appended .jpeg and stored names such as photo.jfif.jpeg.

Detected JPEG content named with .jfif now replaces that suffix with .jpeg. Downloads consequently use a conventional filename that desktop file associations can open directly, while valid .jpg and .jpeg names remain unchanged. Positive and negative tests cover replacement, non-appending and the Security Report's sanitization reason.

Visible Edit controls on cards now use the same Font Awesome pencil-square icon as Description instead of repeating the word. This covers custom fields, Requested By, Assigned By and comments; Add remains text where it is a distinct action. Every icon is decorative to assistive technology, while its control retains the localized Edit tooltip and accessible name.

Focused coverage rejects textual Edit controls, checks the icon and accessibility attributes, and keeps the separate Add state intact.

The desktop card already had a bottom-right resize handle, but its 520px opening width was also a hard maximum, so dragging could only make the card narrower. It still opens at the compact 520px width and can now grow up to the viewport's eight-pixel margins. Mobile remains full-screen and non-resizable.

Placement and maximized-card regression coverage checks both resize directions, the initial width, viewport ceiling, mobile behavior and maximized geometry.

The toggle continued saving the user's customFieldsGrid preference after the card-section refactor, but the rendered container no longer read it, so nothing visibly changed. The off state now produces a compact wrapping grid and the on state makes each custom field occupy a full row, preserving the toggle's original behavior.

Focused positive and negative coverage checks both layout classes and the persisted method wiring. A browser regression switches the layout and reloads the card to verify that the selected mode remains active.

• Wider opened cards fit more compact-grid custom field columns. Thanks to xet7.

• The Custom Fields layout selector shows Grid and List icons. Thanks to xet7.

• The layout selector sits between the Custom Fields title and menu. Thanks to xet7.

• Changing the Custom Fields layout no longer collapses the section. Thanks to xet7.

Selecting a custom field and changing a checkbox now use acknowledged server methods with board-write and field-definition checks. A rejected optimistic client write can therefore no longer make a checkbox appear inert or make a deselected field spring back. PDF and Excel export also omit an orphan field whose definition has been deleted instead of exposing its internal ID.

Unit tests cover successful writes, authorization and field-type failures, and the orphan export case. The browser test checks a checkbox and removes its field from an opened card.

The checkbox rendered as a card field borrowed the checklist item's event class and derived its next state from the template context. It now has a dedicated control, reads the persisted field value, and saves its boolean without allowing the click to reach visibility or checklist handlers. The Custom Fields menu remains the separate place that shows or hides the field.

Static coverage keeps the value and visibility event paths distinct. The browser regression saves both true and false from the opened card and verifies that the field remains visible after each change.

Saving the checkbox already changed the card's boolean and its minicard badge, but the opened-card square read a nested template path that did not react to that change. It now reads the custom field's direct persisted value, so the opened card and minicard show the same checked state immediately.

The regression test requires every opened-card checkbox checkmark to bind to value and rejects the stale data.value path.

The checkbox editor calculated its second click from the Card object captured when the template was created, so it could keep saving true instead of unchecking. It now reads the reactive field context and saves either boolean.

Custom-field values also no longer appear automatically on minicards. Card menu / Show on Card gains a Custom Fields setting that defaults to enabled; Minicard menu / Show on Minicard gains its independent Custom Fields setting that defaults to disabled. Enabling the minicard option shows assigned fields without changing their values or the opened-card setting.

Positive and negative tests cover both defaults, both menu handlers, both rendering gates and repeated checkbox toggles. Existing browser coverage that expects minicard custom fields explicitly enables the opt-in setting.

The currency editor issued an unacknowledged direct card update and closed without knowing whether the value was accepted. It now parses dot or comma decimals, rejects non-finite input, and awaits a server method that verifies card-edit permission, the board's currency-field definition and the assigned field before storing the number. Linked cards use the same source-card route.

Its input reads the direct current value, and the standard X close control now sits immediately after Save. Static tests cover authorization, field type, finite-number validation and control order; the browser regression enters a comma-decimal amount and verifies the stored numeric value.

• Custom Field Dropdown places an X close control beside Save. Thanks to xet7.

• Custom Field Number places an X close control beside Save. Thanks to xet7.

• Custom Field Text places an X close control beside Save. Thanks to xet7.

• Custom Field String Template places an X close control beside Save. Thanks to xet7.

Text fields retain the copy button supplied by their rich-text editor. Number, checkbox, currency, date, dropdown and string-template fields now use a shared copy control beside their editable value. Date values are copied in ISO format and multi-part values are separated by newlines.

Focused interaction coverage verifies that every field type exposes a copy control and that the shared handler normalizes scalar, date and array values.

Clicking a custom field's title or displayed value now opens its value editor. Checkbox fields keep their square as an immediate on/off control, while their title and the empty area beside the square open a staged editor with Save and Close.

Copy is hidden while a field is only being viewed. Every field editor provides the action while editing, and it copies the currently edited input rather than the previously saved value. Focused positive and negative coverage checks the view/edit boundary; the browser regression checks its editing-only visibility.

• Custom field titles and values open editing while checkbox squares toggle. Thanks to xet7.

• Checkbox custom fields can be checked and unchecked while editing. Thanks to xet7.

• Non-Date custom field value clicks work across their nested Blaze templates. Thanks to xet7.

• Date custom fields restore their direct datetime popup opener. Thanks to xet7.

• The Date custom field popup keeps Date, Time and Copy on one row without a second X. Thanks to xet7.

• Dropdown custom fields preselect their saved value when editing. Thanks to xet7.

• Every custom field editor starts with its saved value. Thanks to xet7.

• Text custom fields align Convert to Markdown immediately left of Copy. Thanks to xet7.

Their Blaze helpers run inside each customFieldsWD, where the current context is already a custom-field row. They tried to call the Card method customFieldsWD() on that row, throwing on every render and interrupting the surrounding card UI. Both helpers now format the row's resolved trueValue directly, preserve numeric zero, leave empty values empty and use safe fallbacks for invalid definitions or values.

Focused regression coverage rejects the invalid Card call and checks the value, empty, numeric and String Template paths.

• Custom field Copy controls sit above editors' top-right corners. Thanks to xet7.

A linked card displayed the source fields but several editors still wrote its empty placement placeholder, while server methods required write access on the source board. A member who may edit the current board can now edit the shared source content through a visible, active link. Revoking source visibility, archiving the link, or assigning a read-only current-board role removes that delegation. Moving and archiving still affect only the linked representation.

The same source route covers titles, descriptions, dates, colors, people, labels, stickers, locations, dependencies, custom fields, checklists, subtasks, attachments, covers, watchers, minicard settings, votes and estimates. Label and custom-field definitions come from the source board, while permission to edit the card comes from the board on which the linked card is visible.

Positive and negative tests inventory the content mutators, method arguments and active-link authorization boundary. The browser regression edits the opened linked card, verifies both stored representations, then edits the source card from its own board.

Desktop PDF and text previews were fixed at 560 pixels wide, while a misplaced media query changed them to 840 pixels only on narrower screens. The overlay is now a viewport-filling flex layout: document viewers take the space between the navigation controls, images retain their aspect ratio, and mobile controls keep their compact layout. Static positive and negative tests reject another fixed desktop document width, and a browser test measures the rendered preview.

The Link dialog directly inserted its pointer card from the client, so a server rejection could undo the optimistic insert and leave the dialog open without an explanation. It now awaits one server-authoritative operation and closes only after success. The server verifies read access to the source, write access to the destination, the selected list and swimlane, and rejects archived, same-board, template and link-pointer targets.

Method tests cover the acknowledged path and invalid targets. The browser test follows the reported board, swimlane, list, card and position selection, then checks both the closed dialog and the stored linked card.

The linked-board confirmation asked Blaze for the popup's top or bottom position after awaiting the next card number. By then its event view was no longer current, so Blaze threw There is no current view before inserting the link. The popup now captures its position when it is created and its sort calculation uses only that stored value after asynchronous work. The board selector is scoped to the same popup as well.

The regression test rejects any later Template.currentData() call inside the sort calculation and covers both placement choices.

Detect location already recognized provider URLs such as Google Maps @latitude,longitude,zoom, but a coordinate pair copied directly from a map or GPS application produced no result. The same field now accepts a complete latitude, longitude pair with optional surrounding whitespace and retains its range checks. The match is anchored to the entire input so prose that happens to contain two numbers is not mistaken for a location.

Parser tests cover both supplied formats, exact precision and the prose negative case. The browser regression enters each format through the location popup and verifies the detected latitude and longitude fields.

A linked card mixed a few source-aware getters with raw fields from its empty placement placeholder. Titles, dates and comments worked, while labels, stickers, custom fields, locations, dependencies, subtasks, colors, creator details and other direct fields could disappear. After reload, the source board's label and custom-field definitions were also absent because only the source card document and children were published.

Linked cards now resolve displayed content through one live source-card path. The current-board publication supplies the authorized source metadata, definition records, relevant users, subtasks and dependency targets; all remain behind the existing source-board visibility check, and child-card queries are constrained to those authorized boards. Placement itself still belongs to the linked placeholder on the current board.

Parity tests cover every directly rendered collection and the negative publication boundaries. The browser regression adds a source label, sticker, custom field and location, then verifies them on both the linked minicard and its opened details.

Accessibility - keyboard order, control names and dialog focus across pages.

Shared tabs now expose tablist, tab and tabpanel relationships, keep only the active tab in normal Tab order, and support arrow, Home, End, Enter and Space keys. Popups and modals move focus inside, contain forward and reverse Tab navigation, and return focus to their opener when closed. Password visibility is no longer skipped by Tab, card and minicard edit targets are focusable, and all template images explicitly provide meaningful or intentionally empty alternative text.

Application-wide static coverage rejects positive tabindex values and images without alt, while focused tests pin names, roles, relationships, keyboard handlers and focus restoration. The browser regression audits representative pages for natural order, unnamed controls and missing image alternatives, and exercises both directions of the popup focus loop.

Popup, modal and board-menu focus previously discovered controls independently, while shared tabs and Archive tabs separately implemented the same six-key navigation rule. Focusable-element discovery, initial focus, Tab trapping and tab-key calculation now live together in client/lib/accessibility.js; each consumer supplies only its own state transition. The board-only menu observer also disconnects with its template instead of remaining attached after leaving a board.

Regression coverage requires both tab implementations and every dialog consumer to delegate to the shared helpers, and rejects copies of the old key and focus selector branches.

All Boards - the overview, its Archive actions and phone-sized layouts.

The archived-board half of #6608 is handled by the new Global-Admin-only, explicitly enabled and confirmed multi-selection Delete action. For cards, the sidebar previously fired direct client updates and closed immediately, so a refused write looked successful while every card stayed in place. It now sends one ordered selection to an awaited server method. The server validates the board, write access and every live card before archiving the first; a failure reports its reason and keeps the selection open. Unit tests cover positive and negative client/server paths, and a browser test selects and archives two cards from one list.

The compact phone layout forced every board icon to exactly four rem, including an invitation that also contains its explanatory message and two touch-size buttons. The board tile clipped that overflow, leaving only the title visible. Invitation tiles now carry an explicit state class and retain the ordinary four-rem floor while growing naturally around the message, Accept and Decline. Ordinary board icons remain compact and equal-height.

Static coverage keeps the invitation exception attached to its template state. The phone browser regression creates a real pending invitation and verifies that its message and both buttons remain visible and inside the tile.

Complete browser regression run - cross-page interactions exercised by all three browser engines.

The all-browser run exposed interactions that narrower source tests could not: the minicard wrapper stopped its sibling inline-title handler, shared opened-card date badges lost the explicit edit-permission argument, popup Tab handling used Blaze's inconsistent delegated event container, and the stock logo briefly lost its alternative text while settings loaded. Those paths now retain editing permission, focus containment and accessible loading states.

The shared table search has an accessible name and a phone's board list grows inside the single page scroller. Browser coverage now opens the attachment viewer where that template exists, scopes the linked-card and custom-field controls to their real DOM owners, waits for reactive options and fields, and checks the icon-only Edit control by its accessible name. Focused positive and negative source tests pin the permission, focus, table and scroll contracts.

Linked-card creation now restarts the board subscription so source labels, stickers and custom fields are available with the new link. Date writes are awaited and refresh the same subscription, popup focus trapping uses the real dialog element, and the phone board grid leaves vertical scrolling to the page.

The browser tests now use stable card identities and the actual interactive DOM targets after titles change, distinguish visible and compact label markup, seed existing dates before subscribing, and measure scroll ownership instead of relying on a browser's normalized overflow keyword. The complete Node suite and the modified Chromium browser group cover the positive and negative paths.

and updates the following dependencies:

• @aws-sdk/client-s3 3.1109.0 → 3.1113.0 — the AWS S3 client used by S3-compatible attachment storage.
• @rsdoctor/rspack-plugin 1.6.1 → 1.6.2 — the Rspack build-analysis plugin.
• hotkeys-js 4.0.4 → 4.0.5 — keyboard shortcut handling.
• papaparse 5.5.4 → 5.6.0 — CSV parsing and generation.
• puppeteer 25.6.0 → 25.8.0 — browser automation for exports and tests.

Thanks to dependabot.

and improves developer tooling:

Development builds - local builds and long-running watchers.

Rspack's experimental persistent cache retained JavaScript-side serialization state while meteor run repeatedly rebuilt WeKan's large Blaze graph. After a long development session that retained state could consume the full 16 GB V8 heap and abort the bundler.

Development client and server watchers now run without the persistent cache. Short-lived production builds keep caching, and unrelated Rspack experiments still merge normally. Focused coverage checks both watchers, the production negative case and the merge over Meteor's cache defaults.

Browser test containers - running the complete Playwright matrix from the documented VS Code sandbox.

The ARM64 browser runner correctly selected Playwright's official Docker image, but a VS Code Flatpak terminal could not see the host docker executable and reported that Docker was not installed. The build script now discovers Docker through flatpak-spawn --host and routes image pulls, browser containers and conformance cleanup through the same host-aware wrapper.

Regression coverage pins both direct and Flatpak-host discovery. The complete Firefox and WebKit matrices were run against a fresh production bundle; all 255 runnable tests passed in each engine, with the eight Chromium-only drag harness tests intentionally skipped.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.02 2026-08-18 WeKan ® release

In short: release metadata advances WeKan to v11.02 and records the binary provenance carried by its platform bundles.

This release updates release metadata:

The release preparation records v11.02 and carries forward the verified Node.js and FerretDB binary provenance for every built platform.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.01 2026-08-18 WeKan ® release

In short: Admin Panel / Problems gains the missing Delete settings pane, where a Global Admin can enable the existing, default-off permanent-delete gate. The pane sits above Notifications, has a stable address of its own, and explains that enabling the gate does not delete content by itself. Its checkbox also stays checked after saving because the reactive settings publication returns the stored value. Below that: regression coverage keeps the menu order, pane rendering, URL, setting handler and publication together, with the corresponding Admin Panel documentation and English source strings. The newest All Boards and permanent-delete controls are also translated into 69 languages and regional variants. Permanent-delete setting changes and board-purge attempts, including unauthorized and failed ones, are audited in Recovery with Boolean status, acting user, proxy-aware IP address, board IDs and titles; coloured icons distinguish success, failure and deleted data, and a dropdown filters the audit to All, Done, Failed or Deleted events. A second description below the database-recovery explanation names the permanent-delete events and fields recorded here. The Delete settings pane repeats that audit explanation below its existing text, so an administrator sees what Recovery will record before changing the gate. Board Archive removes permanent delete from individual board icons and offers it as one confirmed red action on a multi-selection, with the same gate enforced again on the server without Meteor argument-audit failures. When that gate is disabled, the sidebar explains where to enable it instead of showing an inapplicable selection instruction. Its enabled Delete button and server method both require the site-wide Global Admin flag. Select All and Select None above the icons make that selection explicit and quick. Dragging that archived selection now highlights only Remaining and existing Workspaces as valid restore targets. Archived tiles no longer show an action-looking archive glyph at their lower-left corner. The same themed controls now cover Remaining, Starred, Home and Templates, always following the visible section and search result. While that mode is on, its action sidebar now stays visible until Multi-Selection is turned off, and its actions remain available before the first board is checked. Closing that sidebar with its X also turns Multi-Selection off. Setting a Home board now requires exactly one checked board, and the Home section offers only the actions that make sense for its current board. Dragging a selection onto Home follows the same one-board rule. Remaining can now drag boards onto Starred or Archive as green targets. Home's empty state also states its one-board limit before dragging begins. All Boards and board loading now publish only dashboard board fields, keep templates separate, omit empty share branches, paginate in the database and snapshot lazy card windows on FerretDB. Workspace boards can also be dragged additively to Starred or, after confirmation, moved to Archive, and existing Workspace views now show Select All and Select None while Multi-Selection is active. Selected cards are now archived by one acknowledged server operation, so a failure remains visible and leaves the selection available to retry. The CPU governor also observes FerretDB before acting and never slows its read path when its configured cap is zero or an idle WeKan sees FerretDB itself busy.

This release adds the following features:

The Admin Panel - server-wide safety settings.

The removed Features page left no place to operate the existing enablePermanentDelete gate. Problems now has a directly linkable Delete pane whose checkbox exposes that default-off setting to Global Admins. Turning the gate on does not delete anything by itself; it only permits an explicit purge. Menu-order, pane-rendering, URL and setting-handler tests cover the addition.

Enabling or disabling Admin Panel → Problems → Delete now goes through a strict Global Admin server method and records the actual changed state in Recovery with the actor's username and user ID. Each successfully and permanently removed archived board records its ID and JSON-quoted title with the same actor. No-op setting writes, unauthorized calls and failed removals cannot create misleading success records. Tests pin the ordering of write before audit, stable event types and every required detail.

Unauthorized and failed setting changes or board purges are now audited beside successful ones, without swallowing the original error. Structured fields keep Boolean Done/deleted-data state, user ID, username, trusted-proxy-resolved IPv4 or IPv6, and bounded requested board IDs and titles. Done is the report's first column: success is a green check, failure a red warning, and a successful physical deletion adds a yellow trashcan. Partial batches show both the boards already deleted and the failed whole-batch attempt. Tests cover storage, address classification, negative paths, icon rendering and colours.

The shared controls row now offers All, Done, Failed and Deleted filters above the Recovery table. The server applies the selected outcome together with search before counting and pagination, so page totals and rows stay consistent. Legacy events without the newer Boolean field remain under Done. Positive, combined and negative selector tests cover the filter and its UI wiring.

A second description below the existing database-recovery explanation now tells admins that this report also logs permanent-delete setting changes and successful, failed or unauthorized purge attempts. It names the recorded Done status, user ID, username, trusted IPv4 or IPv6 address, and attempted board IDs and titles. A UI wiring test pins both the content and its position below the original paragraph.

The Recovery audit explanation now also appears below the existing text in Admin Panel → Problems → Delete, so the administrator sees exactly what will be recorded before enabling or disabling permanent deletion. Delete and Recovery use one shared sentence to prevent their descriptions from diverging. Tests pin its placement after the current Delete guidance and its reuse in both panes.

Board Archive - restoring or permanently removing archived boards.

Board icons no longer carry a trashcan that can permanently delete one board by accident. With Multi-Selection active, a Global Admin who enabled Admin Panel → Problems → Delete sees one red Delete button in the Archive's right sidebar. It shows the existing irreversible board-and-content warning before sending the whole selection to one server method.

The server trusts none of those display conditions: it independently requires a Global Admin, the enabled feature flag, a bounded string-id selection and only archived boards. It validates every selected board before deleting the first, so an invalid or live-board id cannot leave a half-applied batch. Positive and negative tests cover the missing per-board control, both UI gates, confirmation, successful reset, retained selection on failure and every server-side gate.

When permanent delete is disabled, Archive's Multi-Selection sidebar no longer shows "Click checkboxes to select boards" without an action beneath it. It instead explains that enabling Admin Panel → Problems → Delete makes the Delete button visible. When enabled for a Global Admin, the normal selection instruction and red Delete action return together. Positive and negative tests pin both branches, and the new ordered translation key is available in every language file without replacing human translations.

The Archive Delete action now requires the site-wide Users.isAdmin flag to be exactly true in both its sidebar helper and server method. A board-admin role, a missing flag or a truthy non-Boolean value can neither expose the button nor authorize a forged method call. The permanent-delete setting and archived-only validation remain additional required gates, with regression coverage for the strict client and server checks.

When Multi-Selection is active in Board Archive, two buttons now sit in the right page between its heading and board icons. Select All checks every icon in the exact Archive list currently rendered after searching; it does not silently select boards outside that visible result. Select None clears the shared board selection. Tests pin their Archive-only visibility, placement, translated names, compact layout and both selection operations.

Both Archive multi-selection controls now use the primary themed button style. The regression test requires the same class on both buttons, so one cannot fall back to the browser's unthemed grey while the other follows the site theme.

While Multi-Selection is active in Archive, only Remaining and existing Workspace rows receive the green valid-target highlight. Home, Archive, sharing targets and the other board sections refuse the drag before accepting an HTML5 drop. A Workspace drop restores every archived board and assigns it there; regression tests cover the allowed targets, rejected targets and green styling.

The archive glyph inside the "Archived at" metadata inherited broad board-tile hover styling, which moved it to the lower-left corner and made it look like a per-board action. Both tile variants now keep the useful archived date as plain text without that icon. Permanent deletion remains exclusively in the right sidebar, with regression coverage for the absent glyph and retained date.

All Boards - its named sections and their shared multi-selection controls.

Remaining, Starred, Home, Templates and Archive now show the same themed Select All and Select None buttons above their board icons while Multi-Selection is on. Select All reads the exact section/search result used to render those icons, so it cannot silently include a hidden board; Select None clears the shared board selection. Home deliberately keeps Multi-Selection too: Select All simply checks its one visible Home board when present. Tests cover all five sections, both entry points, both operations, placement and matching theme classes.

An existing Workspace now shows the same themed Select All and Select None buttons as Remaining, Starred, Home, Templates and Archive whenever Multi-Selection is active. Select All uses the exact Workspace/search result currently rendered by boardsForView, so hidden boards are not selected; Select None clears the shared selection. Positive tests cover visibility, rendered-board scope and clearing.

Close, toggle, Escape, Search and Home actions can no longer hide or replace the pane that operates selected boards. Every sidebar state change resolves back to the visible Multi-Selection view until the mode is turned off; its off controls then unlock and close the pane in that order. Positive and negative tests cover both sides of the transition.

The right-sidebar X previously called the guarded close operation while Multi-Selection was active, so the guard immediately kept the sidebar open. The X now disables selection mode first and then closes the unlocked sidebar, matching the explicit Multi-Selection Off action in one click. Other sidebar views retain their ordinary close behavior, and regression coverage pins the required operation order.

The instruction, every action applicable to the current section and the way to turn Multi-Selection off are now always present in the right sidebar. An action clicked with no checked boards reports "You did not select any boards" and stops before opening a confirmation or calling the server. One shared guard and regression tests cover star, Home, archive, duplicate and permanent delete.

The action no longer silently chooses the first board from a larger selection. Only one selected id reaches toggleDefaultBoard, matching the fact that login can open only one Home board. Regression tests cover the accepted single-board selection and both rejected selection counts.

Set and Unset as Home board now use the same "Please select only one board" message for both invalid counts: zero and several selected boards. The other bulk actions retain their separate empty-selection warning. The Home action still stops before calling the server unless exactly one board is checked.

Dropping several selected boards onto Home now reports "Please select only one board" instead of silently making the first one Home. The rejected drop changes nothing and keeps Multi-Selection intact so the user can narrow it. A one-board drag continues to set Home normally, with regression coverage for both paths.

Dragging one or several boards from Remaining now highlights Starred and Archive in green alongside its existing valid targets. A Starred drop adds only missing stars, so every board stays in Remaining and an already-starred board is not accidentally unstarred. An Archive drop keeps the existing confirmation and moves the whole drag into Archive. Tests cover the source marker, target hints, additive starring and confirmed archive path.

Dragging one or several boards from an existing Workspace now highlights Starred and Archive as green valid targets. A Starred drop adds only missing stars, leaves every board assigned to its current Workspace and makes it appear in Starred too. An Archive drop asks for confirmation and then archives every dragged board, removing it from the Workspace. Regression tests cover the source marker, both hints, additive stars, retained assignments, confirmation and batch archive calls.

The empty-state instruction now reads "Drag only one board here to open it after login", making Home's one-board limit visible before a drag starts. The existing translation key remains in place, and the Home regression suite pins the exact English wording.

The Home section's Multi-Selection sidebar now calls its toggle "Unset as Home board", matching what clicking its current Home board does. Move Board to Archive and Duplicate Board are hidden in that section while remaining available for the other live-board sections. A regression test pins both the Home-specific label and the absent actions.

and fixes the following bugs:

The Admin Panel - server-wide safety and performance settings.

The server accepted and stored enablePermanentDelete, but the settings publication omitted the field. The next reactive render therefore read undefined and immediately replaced the optimistic checkmark with an unchecked box. The publication now returns the stored value, with a negative regression test that ties the checkbox helper, update handler and published field together.

A high host-CPU event used to apply the first FerretDB delay before its status response could say which process was busy, and a maximum delay of zero still applied that first delay. The first request is now status-only. A zero cap is a clean monitoring-only setting, and an idle WeKan does not escalate delays while FerretDB's own process CPU is above its threshold. The existing backoff, recovery logging and labelled WeKan-operation mitigation remain in place.

All Boards - loading and filtering the overview.

The overview previously opened composite child cursors for every board, making its first paint wait for lists and cards it does not render. It now publishes a projected set of board documents only. Template-container boards have their own projected subscription, active in Templates and cross-category search, so the dashboard retains the appearance, access, ordering and sharing data it uses without turning into a second board view.

The shared board-visibility selector used to emit organization, team and domain branches even when the caller had no ids for them. Those empty branches could not match, but still complicated every dashboard query. They are now omitted; non-empty branches retain the same-element $elemMatch and isActive: true requirements, with negative coverage against revoked-share access.

The page method no longer fetches every visible board, filters and sorts the array in Node.js, and slices only at the end. Section, workspace and search conditions are encoded before a database count and a title/id-sorted query with skip and limit. Cross-category search subscribes to template summaries too, so moving the work into the database does not hide template results.

Archive actions - permanently deleting boards and archiving selected cards.

The bulk-delete method looked up its caller before handing boardIds to Meteor's check(). With audit-argument-checks enabled, that asynchronous boundary made Meteor report “Did not check() all arguments” and reject the operation even though validation appeared later in the method. Validation now runs before the first await; malformed attempts still resolve their actor in the failure path and are written to Recovery without masking the original error. Positive ordering and audit-path tests cover the regression.

Board views - lazy loading of a board's cards.

The lazy window publication previously returned a limited live card cursor. FerretDB's polling observer could repeatedly scan and diff that moving window, including while a board was otherwise idle. On FerretDB the bounded card batch is now fetched once and published as a snapshot; MongoDB keeps its live cursor, and the other child publications remain reactive on both databases.

and improves translations:

Seven new All Boards and permanent-delete strings are translated directly into Arabic, Chinese, Finnish, French, German, Italian, Japanese, Brazilian Portuguese, Russian and Spanish. They cover the permanent-delete setting and disabled hint, empty and one-board selection errors, unsetting Home, and Select None. The guarded fill writes only English placeholders, so it preserved each language's existing human translation of the Home-board drag instruction.

The same seven All Boards and permanent-delete strings now cover 69 locale files. The expansion adds Czech, Danish, Dutch, Greek, Hebrew, Hindi, Indonesian, Korean, Norwegian, Polish, Swedish, Turkish, Ukrainian and Vietnamese, plus the appropriate Arabic, Chinese, European, Japanese, Portuguese, Russian and other regional variants of the completed languages. Existing non-English values remain untouched. A regression test checks every string in every covered locale and distinguishes permanent deletion from ordinary archiving.

Thanks to above GitHub users for their contributions and translators for their translations.

v11.00 2026-08-17 WeKan ® release

In short: RouteBleed, found by GitHub CodeQL, removes an incompletely escaped dynamic regular expression from board-export route coverage. All Boards on phones uses one native page scroller in mobile and desktop UI modes, so ordinary boards, invitation controls and table rows remain reachable with the same vertical swipe; the shared layout extends that behavior to every page. Snap database recovery can read retained MongoDB 4.x, 5.0, 6 and 7 data and merge it into the live FerretDB without opening SQLite twice. Helm containers size the Node.js heap from their memory limit, and the official chart supplies enough memory for startup plus native allocations. Minicard titles save again from their inline editor, and card dates can be reopened, changed or deleted again after they have been saved. Full-suite repairs keep the shared date form registered before its events, preserve the one mobile page scroller in mobile-view mode, and make the standalone E2E browser selection architecture-safe. Translations reuse 3,838 unambiguous same-language values, and the new reports are complete in Finnish. Regression coverage now exercises inline minicard title editing in the browser and guards the Finnish Office and API report vocabulary directly. Requested By and Assigned By say Edit when their free-text value already exists and Add when it is empty.

This release fixes the following SECURITY ISSUES found by GitHub CodeQL code scanning:

RouteBleed - code scanning alert #434, rule js/incomplete-sanitization (CWE-20, CWE-80 and CWE-116), in tests/boardExportScope.test.cjs: an export path was interpolated into a dynamic regular expression after escaping only forward slashes. Backslashes and every actual regular-expression metacharacter remained active, so the test could match a different route, fail to match the intended one or fail to compile.

The code was test-only, read a hardcoded route table and is never shipped in a WeKan bundle, so there was no runtime or user-input exposure. There is no denied operation to attribute in Admin Panel → Problems. The fix removes the pattern rather than adding another sanitizer: the test wants an exact route literal and now checks that exact string with includes().

Positive and negative cases cover backslashes and the full metacharacter set, and a repository-wide guard rejects the reported slash-only escape shape in tracked JavaScript. The same sweep removed a second partial dynamic pattern from release-bundle coverage.

and fixes the following bugs:

All Boards - scrolling the overview on a phone.

The page had nested vertical overflow panes on #content, its wrapper, the left menu, the icon grid and the table view. A swipe could be captured by the wrong pane, and an invited-board tile's Accept and Decline controls made its grid row taller than the percentage-height chain expected, leaving boards below it unreachable.

#content is now the one native vertical scroller. The wrapper, both columns, the board grid and the table page contribute their natural height to it, so a gesture has one owner and invitation controls are not clipped. Regression tests cover ordinary tiles, invitations, table view, viewport sizing and reject a second nested vertical scroller.

The narrow-device rule made the body a viewport-sized, non-scrolling box, but made #content non-scrollable too. Mobile UI mode happened to restore its overflow through a more specific selector; explicitly selecting desktop UI mode did not, so the bottom of All Boards and other pages was clipped behind the browser controls.

The phone viewport and content-scroller contract now lives in the shared page layout rather than the All Boards stylesheet. The top header stays separate while #content scrolls in both UI modes on every route. All Boards continues to use that one scroll owner for Starred, Remaining, Public, Archived, Workspaces and every other left-menu section. Source and negative tests reject a hidden content pane, and the phone browser test toggles to desktop mode before checking that its final board remains visible.

Snap database recovery - comparing and merging the retained database copy.

database-compare and database-merge tried only the current MongoDB 7 executable, although the migration carries MongoDB 5.0 and 4.2 readers for older WiredTiger formats. A retained MongoDB 4.x or 5.0 database was therefore reported as unreadable, and merge had no source from which to recover the missing work.

Both recovery phases now use the same 7, 5.0 and 4.2 compatibility ladder as migration, safely skipping readers absent on an architecture and naming the startup log when all of them fail. Merge also reuses a running FerretDB target; it no longer starts a second FerretDB against the already-open SQLite database. Only temporary processes are stopped afterwards, so a live database borrowed for the operation remains running.

Helm containers - the memory available while the server starts.

The official chart limited WeKan to 1 GiB while its own comments claimed the Docker image supplied a 4 GiB heap setting. It did not: Node.js 24 derived a roughly 640 MiB V8 ceiling from the cgroup, and the v10.96+ server bundle could exhaust it while linking and creating startup indexes, before ordinary application logging began.

The container now gives V8 three quarters of its cgroup memory, from 768 MiB up to the documented 4 GiB ceiling, leaving one quarter for native allocations. An administrator's explicit NODE_OPTIONS always wins. The official chart now requests 512 MiB and limits the WeKan pod to 2 GiB, providing a 1536 MiB heap plus 512 MiB of native headroom by default.

Minicards - editing a card directly on the board.

The title editor is a nested inlinedForm, whose submit event receives the form arguments as this, not the Card document. Saving therefore called getTitle() on { classNames: "js-minicard-title-form" }, threw a TypeError and restored the old title.

The handler now takes the Card from its enclosing minicard template instance, compares and saves through that document, and never treats the nested event context as a Card. Empty and unchanged titles remain no-ops.

Opened cards - editing dates that are already stored on a card.

The common date form became a child Blaze template, but its Save, Delete and validation event map remained on each parent popup. Blaze does not dispatch a child template's events to its parent's event map, so the form rendered its existing value while every control inside it was inert.

The common form now owns its common event handlers and receives the parent popup's state and field-specific callbacks explicitly. Received, start, due, end, vote, planning-poker and custom-field dates retain one shared form, and a browser regression test changes a previously stored due date.

The first date could be added because its plus button lives directly in the opened card's data context. Once saved, however, the date became a shared badge whose child-template data contains only display arguments. Clicking that badge passed those arguments to the popup as though they were a Card, so calls such as getStart() and getReceived() threw and no editor appeared.

Every received, start, due, end, vote and planning-poker date badge now opens its popup explicitly with the surrounding date template's Card and stops the click before the opened-card handler can create a second popup. Source-level positive and negative tests cover all four ordinary card dates, and the browser suite adds a saved start date, reopens it, changes it and verifies the new date.

The free-text control previously said Add regardless of whether the field was empty or already displayed a value. Both opened-card fields now use the existing translated Edit label when text exists and retain Add only for an empty value; their separate plus button continues to open the board-member selector.

The source guard checks both branches for both fields, including the empty-value negative case. Browser coverage seeds populated Requested By text beside an empty Assigned By field and verifies that the two controls render Edit and Add respectively.

The full test run - client startup, mobile scrolling and portable test execution.

The shared date form registered its Blaze event map before its Jade template existed, throwing on client startup and leaving Node E2E and every browser test on a blank page. The forms feature now creates editDateForm before the datepicker library attaches its events, with an import-order regression guard.

On phone-sized All Boards pages, the more-specific .board-list.mobile-view rule overrode the new natural-height list and restored a nested vertical scroller. The phone rule now covers both selectors, so #content remains the one swipe owner in either view.

The standalone E2E runner now discovers current Playwright cache revisions and rejects a Chromium binary for the wrong CPU architecture. Failed page renders also report browser exceptions and failed requests instead of only an empty body. The remaining completed failures were stale guards updated for the shared export document, server-supplied download names, reorganized LDAP documentation, the translation-memory helper and explicit bundle-smoke Node binary.

and adds the following developer-facing test coverage:

The browser suite now edits a minicard title from the board and verifies that the card is renamed without opening its details. Its negative case submits only whitespace and verifies that the original title remains visible.

A plain Node.js suite inventories every Office and API report translation in Finnish, rejects missing, empty and unintended English placeholders, and keeps the universal API, REST API and WITH_API=true terms recognizable. The existing Upcoming tests continue to cover RouteBleed, phone scrolling, Snap recovery, container heap limits, card dates and same-language translation memory, including their negative cases.

and improves translations:

Translation completeness - filling only English placeholders, without an external translation service.

WeKan has many keys with identical English text. When a language already has exactly one non-English translation for that source, the same value can safely fill its still-English copies without guessing or crossing a language boundary. This filled 3,838 placeholders across 227 language files.

The reusable pass is dry-run by default, writes only when explicitly asked, never replaces an existing target translation, and leaves a source untouched when its translations disagree. Tests pin all four constraints; the human-preference and wrong-script checks remain clean.

All fourteen translatable strings added by the two Admin Panel → Problems reports now have Finnish labels, descriptions and empty-state messages. Product names, protocol acronyms, numbers and symbols remain unchanged because those values are already the same in Finnish.

Thanks to above GitHub users for their contributions and translators for their translations.

v10.99 2026-08-17 WeKan ® release

In short: the unified export dialog can finally be changed, visibly shows its selection with the Admin Panel's own checkbox, and passes that selection to every export format. PDF and Excel exports now share one card document, use the saved user language or browser fallback, keep the opened card's date format, preserve multilingual text, and name downloads for the localized board, swimlane, list or card exported. Their shared card layout now includes locations, stickers, dependencies and sort position; PDF also embeds JPEG and PNG attachment previews plus Unicode-plane fonts. Admin Panel / Problems keeps avatars at avatar size, and All Boards keeps its Add Board and Home placeholder tiles as tall as the boards beside them. Requested By and Assigned By can select board members while retaining their free-text fields. Below that: fourteen export fixes, one export-layout consolidation, one people-picker fix, two shared-checkbox fixes, two UI sizing fixes, restored subtask creation, and the documentation move into its feature and platform hierarchy with every local link checked.

This release adds the following new feature:

Opened cards - the people responsible for requesting and assigning work.

Their round + now opens a searchable board-member picker like Members and Assignee. Selected people appear as avatars, while the Add link stays below the + and continues to open the existing free-text editor. The two forms are independent, so a card can retain an external name or note beside its selected members.

Cards store selected people in requesters and assigners user-ID arrays, with assign, unassign and toggle operations matching assignees. WeKan JSON and scoped imports preserve them, whole-board imports remap their user IDs, and user removal cleans them up. PDF, detailed and table Excel, and CSV resolve the selected people beside the original text fields. The implementation completes the existing Requested By / Assigned By design document.

and fixes the following bugs:

Opened cards - the people responsible for requesting and assigning work.

Requested By and Assigned By opened headerless popups because their generated title keys did not exist. They now reuse the fields' existing translated names, so every language gets a title without adding a second English placeholder to all translation files.

The general popup geometry also chose whichever side of an opener had more space. That made Assigned By jump above the card while Members and Assignee happened to open below. All four card-people pickers now anchor directly below their + button, use the remaining space there, and retain the same member-list body and styling.

Subtasks - creating their hidden helper-board records.

Creating the first subtask also creates its hidden helper board and default swimlane. The server immediately looked for that swimlane through a reactive cache which could still hold the earlier empty result, so it returned without inserting the subtask and the form appeared to do nothing.

The async server lookup now reads the authoritative collection, and its default-swimlane self-heal falls back to that collection after inserting. The form retains the entered title and reports the actual error when creation really fails instead of silently clearing it.

Exporting - choosing what goes in the file.

The export popup sent the card-details layout choice, but the server's shared field allowlist omitted that key and silently removed it. Every board, swimlane and list Excel request therefore selected the old one-row-per-card streaming table even though Card details was checked.

The layout key now survives validation, so the detailed exporter draws each card with the same renderer as Export card to Excel. Attachment metadata and embedded image galleries are included along with the other selected card fields, while the existing Board → Swimlane → List → Card order remains. The streaming table is still available by deliberately unticking Card details for very large boards.

The shared card layout omitted locations, stickers, dependencies and numeric sort position. Locations now include place name, address, latitude and longitude for every current location entry, and retain the legacy single- location fields used by older and Trello-imported cards. The other missing fields have their own selectable sections or metadata row.

Because card, list, swimlane and board exports all draw this one document, the fix applies to both PDF and detailed Excel at every scope. The hierarchy is pinned as Board → Swimlane → List → Card, Swimlane → List → Card, and List → Card, without repeating an ancestor above a smaller export. The Excel and PDF format documentation now lists the complete shared card data.

A board export now reads in the same order as the board: board name, members, creation and modification times, then each swimlane, each list within it, and each card within that list. Even the only visible swimlane is named instead of being silently flattened away.

Smaller exports start at the level selected rather than repeating unrelated ancestors. A swimlane export begins with its swimlane and continues through its lists and cards; a list export begins with that list and its cards; a card export remains the card. PDF and detailed Excel use the same ordering, and the format documentation records it.

A swimlane export no longer arrives with the board title in PDF or Excel's generic default filename. Download names now use the localized object type and its number: for example, the first English swimlane is Swimlane-1.pdf or Swimlane-1.xlsx. Lists and cards follow the same convention, while a whole board pairs the localized board label with its title.

The saved profile language wins; when it is absent, the browser language sent with the export request supplies the label. The response includes the UTF-8 content-disposition filename, so scripts outside ASCII remain intact, and the browser no longer overrides it with a title-derived download attribute. The low-memory Excel table exporter also keeps list and swimlane scope while naming its result.

Reported as #6586: "with v10.98 we have that unified export dialog 👍 But I can't select/deselect those arrows here", and confirmed as "clicking a checked option, like labels, does not uncheck it". Two faults, and either one alone makes the list useless.

It could not be changed, and the first fix was not enough. The handlers were a template event map, and a click on a row did nothing; moving them onto exportScopeSelect — the template that actually draws the rows — did not help either, and that was built and shipped in both bundles before the answer came back that the list still could not be changed. What the built bundle shows is that the templates are registered, their helpers run and both event maps are attached; the click simply never arrives. This list is drawn inside FIVE popups, each rendered into its own Blaze view tree, so the toggle is now bound where nothing in that chain can drop it: one native listener on the document, in the capture phase — capture so a stopPropagation() between the row and the document cannot eat it, native so an absent window.jQuery cannot fail silently, and exactly one so it cannot toggle twice and cancel out.

And no row said whether it was ticked. Each drew an unconditional i.fa.fa-check on a li.active, which is the OTHER convention in popup.css: that tick is hidden and shown only for an active row by a selector needing a nested list carrying checkable, and this list was neither. So the tick was never hidden and active was never styled — every row looked ticked whatever it was. Each row now carries .materialCheckBox, the checkbox Admin Panel / Settings / Announcement uses, which needs no ancestor to be right, and the box aligns with the first line of a label that wraps.

What is ticked is what the file contains — checked rather than assumed. Every format builds its URL through one function that appends the selection, and every route parses it: the JSON, .zip and Kanboard exports, Excel, PDF, the CSV (where the selection lands on columns), and the ten external-tool exports, which share one handler. A test reads the format table, so a format added later is covered without editing it.

Not a broken PDF — WeKan's own page, saved as <card>.pdf. Every export in the interface is a download from an /api/… address, and the server refuses every /api request unless WITH_API is exactly true. It refused by answering 301 Location: /, so the browser followed it to the front page and the download link's download="<card>.pdf" wrote the HTML it got there to that name. Reproduced against a running instance: GET /api/boards/x/exportPDF answered 301.

Two faults, either one enough on its own. The bundle launchers did not set WITH_API — the snap has defaulted it to true for years and every docker-compose*.yml here sets it, so the bundle was the one platform where exporting was off by default, and therefore the one platform where an export came back as HTML. Both launchers now default it to true, overridable, and say why: the name reads like a developer feature, and somebody switching it off to harden an instance should know they are turning off every export in the interface.

And the refusal was a redirect. Whatever the setting, "the API is off" must not arrive as a page. It is now a 403 in plain text, saying that exports use the API too and naming the variable to set — an answer that cannot be mistaken for the file that was asked for.

PDF listed image attachments by name while Excel embedded their previews. Card and detailed board PDFs now read JPEG and PNG attachments from the configured file store and put real image XObjects into the document. JPEG keeps its original DCT-compressed bytes; PNG scanlines are decoded, their filters removed and their transparency composited onto white before the RGB pixels are deflated into the PDF. Images keep their aspect ratio and are only scaled down.

A missing object, unsupported format or corrupt image is still listed by name and cannot fail the rest of the export. Tests inspect both filters and the page's XObject references, exercise transparent PNG pixels, and pin that failure-safe path. The format design and current progress moved from TODO Later to reciprocal Excel and PDF documentation pages. The shared Excel renderer described there is completed by the multilingual export entry below.

PDF exports now subset and embed the OFL-licensed GNU Unifont BMP and supplementary-plane fonts. Finnish, Greek, Cyrillic, Hebrew, Arabic, Indic and CJK text, plus supplementary characters such as emoji, therefore remain visible, searchable and portable without fonts installed on the reader's device. The former WinAnsi writer remains as a failure-safe fallback.

Printable Excel cards now render every block from the same medium-independent card document as PDF while retaining their six-column metadata, colored labels, checklist progress, attachment table and image placement. Excel cells already store real Unicode text; .xlsx cannot portably embed an OpenType font, so the spreadsheet application chooses an installed font or fallback rather than turning editable cells into pictures.

Both formats now resolve locale in one explicit order: a logged-in user's saved language first, the current browser language when none is saved, then English. Public card Excel no longer hard-codes English. Their export links continue to carry the date format displayed by the opened card and the browser's timezone, and the routes validate that format before rendering it.

Tests parse and subset both shipped font files with multilingual text, pin the locale precedence and opened-card date-format handoff, and exercise the shared Excel renderer with ordinary metadata and enough colored labels to wrap onto a second row. The reciprocal Excel and PDF pages record the implementation and the .xlsx portability boundary.

The production bundle resolved markdown-it as an ES-module namespace, while bare Node resolved the same package as its constructor. The shared PDF and Excel Markdown parser constructed the value directly, so unit tests passed but the bundled server stopped during module initialization with is not a constructor, restarted, and repeated the same failure.

The parser now normalizes both module shapes before constructing MarkdownIt. A regression test supplies the CommonJS and Meteor production-bundle shapes and requires both to resolve to the same constructor.

Three metadata cells fit across the printable PDF width, but long translated labels and full date/time values were shortened with an ellipsis. Each cell now grows onto additional lines, keeping the complete value visible.

Attachment previews formerly occupied one full-width row each and carried a synthetic [image: filename] line. Up to three previews now share a row, with the real filename and human-readable file size above each image and no image: prefix. The row is one pagination unit: when its caption and previews do not fit, all of them move together to the next page.

Tests pin the complete translated dates, three-column captions, absence of the old prefix, multiple images in one row, image XObjects and atomic page break.

PDFKit initialized its built-in Helvetica before WeKan selected the bundled Unicode fonts. That reads data/Helvetica.afm relative to PDFKit's own module, but Meteor's production bundle rewrote the lookup to /_build/main-prod/data/Helvetica.afm, where no such application asset exists. Every Unicode export therefore logged the missing file and fell back to the WinAnsi writer.

PDFKit now starts with the already-loaded GNU Unifont buffer as its default font, so initialization performs no Helvetica AFM filesystem lookup. A regression PDF begins from that buffer, embeds its Unicode map and contains no Helvetica reference; the normal named BMP and supplementary-plane fonts remain available for all subsequent text runs.

An attachment image with a displayed preview was named in the bullet list and again in the caption above its image. Successfully loaded previews are now removed from that list and keep their filename and human-readable size in the caption.

The decision follows the preview that was actually loaded, not only the file's declared type. Non-image files and images whose stored object is missing, unreadable or corrupt therefore remain listed with filename and size instead of disappearing from the export. A regression card contains one previewed image and one ordinary file and pins that each is named in exactly its proper place.

Excel stacked every preview vertically despite having six worksheet columns. It now uses three two-column preview cells per row and starts the fourth image on the next row. PDF uses the same three-column arrangement. In both formats, only the filename appears below each image.

The attachment details above those previews include EVERY file, images included, in the same six fields: row number, filename, human-readable size, media type, upload date/time and uploader. PDF now resolves attachment uploaders alongside card members and comment authors, and the Excel headings use their real translated attachment keys instead of displaying uploaded-at and uploaded-by when those generic keys do not exist.

PDF also consumes the presentation data the shared card document already gives Excel: labels use their actual background and contrasting text colors, metadata keeps the same positions, and checklist completion is a six-part blue progress bar with its completed/total count. Tests exercise a real ExcelJS worksheet with four images and pin the corresponding PDF label, progress, detail-table, preview-caption and pagination objects.

This intentionally follows the preceding duplicate-name fix with the complete details requested here: an image is present in the all-attachments details table, while its filename-only preview caption identifies the image below.

The first shared attachment layout put three Excel previews in two-column cells, but the worksheet has six usable columns and the screenshots showed the images still consuming far more vertical space than necessary. Each preview now occupies one column: images one through six share an image row, their filenames sit in cells A through F directly below, and image seven begins the next image row followed by its filename row.

An actual ExcelJS worksheet test places seven PNGs, checks that the first six have the same row coordinate, the seventh has the next image-row coordinate, and verifies the filename cells below both rows. PDF keeps three previews on an A4 row because six would make them too small to read; the shared details, colors, field positions and progress styling remain the same.

Checkboxes - the one square WeKan draws everywhere.

In the export popup an unchecked box drew a thin vertical sliver beside a long label and a proper square beside a short one: the row is a flex container, the box is a flex item, and a flex item shrinks.

That is the third time this shape has broken — settingBody.css already carries a fix for a 41px min-height that "turns a 13px box into a tall rectangle", and another for a height: 100% that stretched it — so the fix goes in the rule that DEFINES the checkbox: flex: none, for all 90 of them across 19 templates, rather than one more local patch. The local patch went with it: it had set box-sizing: border-box, which would have made that one popup's boxes 13px including their border while every other checkbox in WeKan is 13px plus 2px.

The rest was audited rather than assumed: every rule in the client that sizes a checkbox gives it equal width and height, including the two "clean" board themes that deliberately draw theirs at 24px and 18px. A test now pins that for every rule, so the fourth one fails a suite instead of a screenshot.

The checkbox beside each custom-field name was two Font Awesome square icons, switched according to state. It looked like the browser's tiny native checkbox and had none of the behavior used by Admin Panel / Settings / Announcement.

The picker now uses the same .materialCheckBox element and is-checked state as those settings: a 13px grey square whose shared 0.2-second CSS transition morphs it into the rotated green tick. No local copy of its dimensions, colors or animation was added, so future changes to the common checkbox reach this picker too. Tests pin the shared markup and its transition, rotation and green checked-state borders, and reject the old icon imitation.

Admin Panel / Problems - how a person is shown.

Offices and the Impersonation Report drew a user's photograph at its NATURAL size — a 300px portrait in a table row, a screen tall, with the login counts scattered around it — and it was every pane that names a user, because they all draw one the same way.

Every avatar rule in userAvatar.css is scoped to .member, which is what makes an avatar 24px and round and crops the image to fill it. The shared table page's cells had no such box: the image and the initials had been copied, and the thing they belong in had not. The cells use .member now rather than a fourth private copy of "how big is an avatar" — there were already three, which is how the three came to disagree — with the two board-specific declarations it carries turned off for a table.

All Boards - the size of a tile.

On Starred, the grey "+ Add Board" tile hung short. min-height: 114px is a FLOOR, and a board whose title wraps to three lines grows past it; the grid stretches every other tile in that row to match, but the grey comes from the label INSIDE the list item rather than from the item itself, so it kept its 114px while its row grew. The item is a flex box now and the label grows into it.

On Home, "Drag a board here to open it after login" was padding around a line of text, about 85px, on a page whose entire content is that box. It stands where a board tile will be, so it is a board tile's height.

Templates and the workspaces were checked and were already right. Every view — Starred, Remaining, Home, Templates, Archive and each workspace — is the same list with a different set of boards in it, so they share one rule, and every tile variant computes to the same 114px border-box floor. A test pins that there is one list and that no variant sets a height of its own, so that question keeps having one answer instead of six.

and has the following developer-tooling improvement:

Board, swimlane, list and card hamburger menus already use one export popup, selection and URL builder, and the detailed board exporters reuse their card renderers. One duplicate layer remained: PDF and Excel separately converted database records into the shared card document, including separate people, date, checklist, comment, attachment and file-size mappings.

Both formats now call one pure adapter for every card at every scope. Scope only selects the surrounding Board → Swimlane → List → Card hierarchy; PDF-specific code draws pages and Excel-specific code draws worksheet cells. The Excel and PDF feature documents describe this design and its format-specific boundary.

and reorganizes the following documentation:

Feature documentation that had grown into separate top-level Date, DragDrop, Email, ImportExport, Login, Theme, Translations and Webhooks trees now lives under docs/Features; webserver documentation lives under docs/Platforms. The move also puts related pages and images beside their subject instead of in the broad Features directory.

All references were recalculated from their source page's old and new location, including links from pages that moved themselves. The documentation link test now walks every Markdown page recursively instead of checking only the flat DeveloperDocs directory, so a future move cannot silently leave links or images pointing at paths that no longer exist.

Thanks to above GitHub users for their contributions and translators for their translations.

v10.98 2026-08-16 WeKan ® release

In short: one CRITICAL fix, and the whole of logging in reworked around it. WeKan's brute-force lockout counted an attacker's failed logins against the victim's account rather than against the address they came from, so anyone who knew a username could lock its owner out from every address, repeatably — and a correct password was refused while the lock held, and counted as another failure. Usernames are public, so any account was a target and an administrator was as easy to lock out as anyone else. Reported by daniais as JamBleed. Two GitHub CodeQL alerts on one line of release tooling go with it. Around that fix: increasing delays after a wrong password, per source address rather than per account; a record of who logs in from where, both directions, which is what the new Problems / Offices pane groups into the offices an admin recognises — "London", with the flag, rather than 100.100.100.100; and the reason it exists, which is that blocking an ADDRESS would take a whole office off WeKan at once, so WeKan blocks the account. Admin Panel / Problems now keeps ONE summary row per problem — a count, a window, and who tried it how often — instead of a document per event that grew with the attack it was recording, and gains an API pane answering the opposite question: not what went wrong, but who called which REST endpoint and how often. Then: v10.97 shipped a bundle that could not start, the third release in a row stopped by the same habit. Trimming what a bundle carries is measured by a graph of what the server can reach, and that graph read require() only. Meteor compiles an ESM import to module.link(), so every ESM import in every Meteor package was invisible to it: it called live code dead, and the bundle shipped without nodemailer-openpgp, which packages/email.js links on its first tick. The reachable count goes from 211 to 450 with the fix — the measurement was wrong rather than merely optimistic — and the category it justified is withdrawn: 61.3 MiB becomes 40.0 MiB. What changes beyond that one fault is the check: a release now has to start the bundle it built and see it reach its database before it may carry it. That fix had a cost nobody saw for a day: its package loaded on the CLIENT too, so require('crypto') reached the browser bundle and every page died on load with Cannot find module 'stream' — fixed here, and the whole class is now guarded. CHANGELOG.md is 2.5 MB lighter of history, keeping the current MONTH while older months and years move to old-CHANGELOG/. And Build WeKan release bundle is a menu entry now, building what a release would publish rather than a plain meteor build — so "does it start at all" no longer takes a release to answer. Below that: the Sandstorm pack that was throwing its own trim away, Admin Panel / People showing who is locked again, a location in an admin table opening a map through the card's own chooser, the Problems route and template finally called what the menu calls them, and the documentation refiled to match the menu — including Directory-Structure.md, which had been describing the tree as it was in 2017.

This release fixes the following CRITICAL SECURITY ISSUE of JamBleed:

Logging in - who the brute-force lockout is protecting, and from whom.

wekan-accounts-lockout kept ONE counter per user — services.accounts-lockout.failedAttempts — with no notion of where the attempts came from. Any unauthenticated attacker who knew a username could spend three wrong passwords and lock that account out from every address, repeatably, for as long as they cared to keep going. Usernames are public in normal WeKan use — board and card members are listed — so choosing a target was trivial, and an administrator was as easy to lock out as anyone else. Reproduced on v10.91:

  attacker, address A : Incorrect / Incorrect / Too many attempts
  victim,   address B : (correct password) Too many attempts

Affected from v10.59, and not before, for a reason worth keeping in view. The flat counter is much older, but until the LockoutBleed fix (GHSA-2g94-9x3m-hv37) the hooks gated on English error strings that Meteor's ambiguousErrorMessages had already rewritten, so the counter never moved and no account ever locked. Making the lockout WORK is what made this reachable — a fix that turns on a mechanism inherits whatever that mechanism gets wrong.

Two faults, and the second is the one that hurts:

• the counter was global, so an attacker's failures were charged to the victim's account rather than to the attacker's address;
• a correct password was refused while the lock held, and counted as a further failure on the way. The old code allowed an attempt only when there was no error AND no lock, so the owner typing the right password fell through to the same throw as the attacker.

Both are fixed in the decision itself, now a pure module. The counter is per (user, source address): the address comes from X-Forwarded-For under HTTP_FORWARDED_COUNT, the same rule server/lib/loginAttemptThrottle.js uses so a lockout and a throttle cannot disagree about who somebody is, and only the position hops from the right is read, so a forged header cannot pick its own bucket. The key is a SHA-256 prefix — an IPv4 address is all dots and cannot be a Mongo field name, and a locked account should not carry a list of the addresses that attacked it.

A correct password is allowed FIRST, before anything reads the lock, and clears the state behind it — including the pre-fix flat fields, so an account left locked by the old counter is freed by its owner's next correct login rather than by a wait with no visible end. Hammering during a lock no longer extends it either, or the denial of service returns inside the mechanism meant to stop it.

The three methods that wrote the flat counter are removed rather than left unreachable. A lockout firing is now recorded and shows in Admin Panel → Problems — on the lock only, not on every refused attempt during one, or an attacker could fill that page by holding down a key. tests/lockoutPerSourceAddress.test.cjs is 19 tests, driving the decision as arithmetic rather than through a server: the reported attack, the correct password during a lock, that the lock still fires and still expires, the forwarded-header rules, that malformed state reads as nothing yet rather than throwing — a lockout that threw on an unexpected document would lock everybody out of a database that had one — and that every construction of AccountsLockout passes the reporter, since there are two and a reload that dropped it would stop recording attempts while the guard kept working.

and fixes the following SECURITY ISSUES found by GitHub CodeQL code scanning:

Two alerts on one line of releases/changelog-open-next.mjs, and both were right:

• #433, js/incomplete-sanitization — version.replace(/\./g, '\\.') escapes dots and not backslashes, which is the classic half-escape: a version containing a backslash would have escaped the backslash and left the next character bare.
• #432, js/regex-injection — the version is an argv value, so it reached new RegExp as a pattern.

Neither is exploitable with a version release-all.sh computed from the CHANGELOG, and the script is release tooling rather than anything a user reaches. But the fix worth making is the one that removes the question instead of answering it, which is CodeQL's own first recommendation: design so that sanitization is not needed. The heading is found with startsWith on the exact text now, so there is no pattern to escape and nothing to inject into, and a guard fails if a RegExp is built there again.

Shipped in the same commit as the JamBleed fix above.

and adds the following new features:

Logging in - what happens between a wrong password and the next attempt.

Checked before any of it was written, because a second mechanism beside an existing one is worse than no mechanism: the DDP login already has wekan-accounts-lockout, the REST login has server/lib/loginAttemptThrottle.js per address, and server/lib/loginTimingDefense.js equalises timing so a missing user cannot be told from a wrong password. Nothing anywhere did increasing delays. So this extends the lockout decision rather than adding a rival to it.

The lockout on its own is a STEP FUNCTION: two failures cost nothing, the third costs sixty seconds. A guesser spends the free attempts of every window and waits, and somebody who mistyped their password gets no sign they are one attempt from being locked out. A delay that GROWS - 1s, 2s, 4s, 8s, capped - costs a guesser far more than it costs a person, and it degrades instead of slamming shut: the account is never unavailable, only slower to try again.

It is per (user, source address), like the counter it sits beside and for the same reason - an attacker must not be able to slow down the account's owner - and a correct password is still allowed immediately, delay or no delay. Somebody who did not have to guess has proved they are not who this is for. An attempt refused as too early is not counted, either: letting it count would let an attacker lock an address out FASTER by trying faster.

Admin Panel / Problems - what the page records, and what it shows.

A guard on a path an attacker controls fires as fast as they can send. One document per event meant the database grew WITH the attack, the Problems page became a scroll of near-identical lines, and the one event that mattered was buried under ten thousand that did not. The admin's question is never "list every attempt" - it is what is happening, how much, since when, and who.

So each problem is ONE row that accumulates: a count, the firstAt … at window it covers, and the actors, each with a count of their own — username1 25, 100.100.100.100 30. The actor list is capped with an overflow count, so an attacker rotating addresses cannot turn the summary back into the log it replaced.

Existing per-event rows are folded into their summary on read, so an instance upgrading does not lose what it recorded, and does not keep paying for it.

Checked first, and reused rather than rewritten: the REST throttle and the lockout each already resolve a client address, models/users.js has getInitials() and profile.avatarUrl, the board sidebar and cards show members through +userAvatar / +userAvatarInitials, cardDetails.js builds "open in map" links for a dozen providers, and the Admin Panel tables already had an edit-user handler and a userId column. Only reading a location from CDN headers is new.

One successful login writes a tally in BOTH directions - which addresses this account uses, and which accounts use this address - because the second is what says an address is an office, a VPN or a carrier's NAT rather than one person. Both are capped with an overflow count.

The location comes from a header something in front of WeKan already set (Cloudflare, Fastly, CloudFront, Vercel, Google Cloud, or a hand-configured proxy). WeKan geolocates nothing itself: no database to ship, no lookup of a user's address against a third party. And because anything a client can send it can forge, a location is display only - a name beside an address and a map link, never a decision. Nothing blocks, allows or rate-limits on the strength of one.

A pane at /admin/problems/office, through the shared table page every other report here uses (Table.md) - same layout, same search, same paginator - so it needed no design of its own.

The columns are what an admin actually asks. Location: the country flag and the city, "London" rather than 100.100.100.100, so somebody recognises their own offices at a glance and the flag says WHICH London; empty when nothing resolved it. Address: the IPv4 or IPv6 it really is. People: each account as its initials, or its avatar where it has one, with its own login count beside it - the same way the board sidebar shows members, and clicking one opens the same edit-user popup as everywhere else. Logins and the window they fall in.

WHY IT EXISTS AT ALL: an address that many accounts log in from is an office, and anything that reacted to a security event by blocking the ADDRESS would take all of them off WeKan at once - the admin would see "one address blocked" rather than "eighty people locked out". WeKan blocks the ACCOUNT that caused the event. This pane is what lets an admin see the shape of their own users, and what would make an address-level action visibly reckless if one were ever proposed.

Every other pane under Problems answers what went WRONG. This one answers what is being DONE: POST /api/boards called 34 times by alice last month, 812 times yesterday by nobody with an account. Without it the only record of REST API use is whatever the reverse proxy happens to keep, and most instances keep none. The table is username, endpoint, calls, the window they fall in and the addresses, sorted by calls - a usage report's question is what is used most, where a problem report's is what happened last.

The name is the route pattern, not the path. /api/boards/:boardId/lists is one endpoint; /api/boards/abc123/lists and ten thousand of its siblings are that one endpoint being used. Naming rows after paths would put a row per board in the collection - the one-row-per-event cost this page exists to remove - and a request that matched NO route is counted under a single (no route) name rather than under the path it invented, because a 404 sweep is an attacker walking a wordlist and a row per guess would let them fill the database.

One row per account and endpoint, which makes the account part of a row's identity - the one deliberate exception to the rule every other stream follows. There the question is "what is happening" and the caller would multiply the rows; here "who called what" IS the report, and the cardinality is bounded by real accounts times real endpoints. The account is stored by ID, so a rename does not split its history in two.

Nothing per request. Ordinary API traffic is not rare the way a guard firing is rare, so calls are counted in memory and folded on a timer - a thousand requests become one write. Counting hooks the middleware chain rather than the routes, so a route cannot be added without being counted. The pane is the shared event-stream report with a different column list, not a second table page, and the api stream is deliberately not one of the "problem" streams: an instance serving its API would otherwise report thousands of new problems.

Also fixed while there: the summary rows have had ipv4 and ipv6 fields since the summaries were written, and not one of the four loggers ever filled them, so the two columns the design asked for could not have worked. The fold splits the address now, once, for every stream, and both reports use one shared pair of columns that falls back to classifying the stored ip - so rows written before today display correctly instead of showing two empty columns for all of history.

Offices names the places accounts log in from - "London", with the country's flag - and a name is only useful if it leads somewhere. Clicking one now asks which map to open it at, from the same eleven providers a card's location offers.

The same chooser, not a second one. The provider list was eleven options inside cardDetails.jade; it is one template both callers include now, with its helper and its styles, because two lists would be eleven places to add a provider to instead of one and they would disagree the first time only one was edited. What the two do NOT share is the rest: a card's popup EDITS a location, and an office's arrived in a CDN header - WeKan did not ask for it and cannot correct it.

A cell is a link only when the row HAS coordinates: a city name is not a position, and a map URL built from one would either search for the word or invent a place. The link follows the selection before it is saved, because choosing a provider and finding the link still pointing at the old one reads as broken.

The handler lives on the shared table page rather than on the report - which is also where "clicking a user opens the Edit user popup" went, from the three identical copies each report had written for itself.

and fixes the following bugs:

Logging in - and what the lockout was costing everybody else.

The JamBleed fix above hashes the source address of a login attempt with require('crypto'), and its package declared api.mainModule('accounts-lockout.js') with no architecture — which loads it into the CLIENT as well as the server. So the browser bundle pulled in crypto-browserify, which pulls in cipher-base, which does require('stream'), and the page died on load:

  Uncaught Error: Cannot find module 'stream'

before WeKan drew anything at all. The server started perfectly and answered HTTP 200 with a page that could not run.

It is server-only now, which it always should have been: nothing in client/ imports it, and shipping a brute-force lockout's decision to the browser would hand an attacker the rules even if it cost nothing. A rebuilt client bundle is 758 KB smaller and contains neither crypto-browserify nor cipher-base.

Why nothing caught it. bundle-smoke-boot.sh starts the bundle and waits for it to reach its database, which proves the SERVER image loads — every package linked, every map read. This was the client, and no check looked there. Both crashes that check was written for were server-side, so it answered the question it was asked and the question next door went unasked.

tests/packagesLoadOnTheRightArch.test.cjs pins the class rather than the one package: it reads each package.js for the entry files NOT restricted to the server, follows their imports, and fails when any requires a Node builtin — and does the same for every file under client/. Verified to fail on the real fault. Meteor's default being both architectures is what makes this silent: the code works, the tests pass, and the cost lands in a browser bundle nobody reads.

Bundles and images - what a build carries, and what it can start without.

Reported as #6602: a Docker instance upgraded from v10.91 to v10.97 would not come up at all. The entry above shipped in a bundle that crash-looped:

  Error: Cannot find module ".../nodemailer-openpgp/lib/nodemailer-openpgp.js"
    at packages/email.js:347

packages/email.js does not require() that package. Meteor compiles an ESM import to its own linker call:

  module.link('nodemailer-openpgp',{openpgpEncrypt(v){openpgpEncrypt=v}},6);

and the scanner only ever looked for require(). So it missed every ESM import in every Meteor package — which is most of them — and reported live code as dead. The reachable count goes from 211 to 450 with the fix: the measurement was badly wrong, not marginally. Four forms count now: require(), module.link(), module.watch(require()) and module.dynamicImport().

The safety worked, which is the one good part. With the corrected graph the policy still named openpgp, the graph VETOED it, and the tool refused and said so rather than deleting it. That entry is removed outright now rather than left to be vetoed every run — the reason is what grants the permission, and this reason was never true.

And the check that was missing both times. v10.96 died on a source map deleted but not un-named; this died on a linked module. Both were reasoned about by reading the code, and reading the code is how both mistakes were made. So releases/bundle-smoke-boot.sh starts the bundle with a database address that cannot answer and requires it to get as far as trying to reach it — which proves the whole server image loaded, because the database is the first thing WeKan needs that the check does not provide. The amd64 build runs it after the trim and the prunes, and every other architecture's bundle derives from that one.

It is verified against both real failures — a bundle with nodemailer-openpgp removed, and a manifest naming maps that are not there — and each fails with its own diagnosis, because the fix for each is a different one. A bundle that exits quietly or hangs is not a pass either: a smoke test whose failure mode is passing when it learned nothing is worth less than none.

v10.98's log shows the trim doing exactly what it was meant to, and then being thrown away:

  --- .meteor-spk/bundle: 856M total        (first pack, fails)
  bundle-trim: removed 5236 files, 355 MiB
  prune-unreachable-npm: removed 28 package(s), 49.9 MiB
  --- .meteor-spk/bundle: 424M total        (424M + 336M deps = 760M, under 1 GiB)
  Building Meteor app...                    <- pack rebuilds it
  App exceeds uncompressed size limit of 1 GiB

meteor-spk pack runs the Meteor build first, so the retry regenerated the bundle and packed the untrimmed one - 405 MiB of trimming discarded between the measurement and the pack. Sandstorm's own spk pack only packs what is there, so the retry prefers it and falls back to meteor-spk when it is not installed.

A comment in the retry claimed pack REUSED the bundle. It did not, and the log above is what disproved it.

The CHANGELOG and its tooling - a file that grew faster than it was read.

The maintenance loop here is build.sh option 1 (git pull + git push) and releases/release-all.sh with no arguments, several times a day when a fault is being chased. A release landing in the middle of a piece of work is the normal case, not a special one — and release-all.sh renamed # Upcoming WeKan ® release to # v<NEW> … and left nothing behind, so the next entry written had nowhere correct to go. It landed above the closing Thanks to above GitHub users … line, which is now INSIDE the release just published.

v10.96 and v10.97 both ended up that way. The second was worse than misplaced: an entry already published was EDITED afterwards, so the notes described a smaller, tidier change than the one that shipped — and the one that shipped was the one that stopped the bundle starting.

releases/changelog-open-next.mjs opens the next section as soon as a release is named, carrying the **In short:** placeholder and the binaries table the format guard requires, so the file is valid the moment release-all.sh finishes. Re-running it is a no-op, since release-all.sh can be run again after a failure. The format guard now allows an Upcoming that is empty AND still carries the placeholder — and fails one that has entries and still carries it, because that is a summary nobody replaced.

tests/changelogEntriesBelongToTheirRelease.test.cjs is the check that the home was used: git knows which commits a release contains, so an entry linking a commit that is not an ancestor of its release is in the wrong section. Scoped to the newest three releases on purpose — over the whole file it flags 83 entries back to v2.99, from old release practices and history rewrites, and a guard reporting 83 things nobody will act on is a guard people learn to skip.

CLAUDE.md says all of this where the release instructions are, including the rule the second mistake broke: a released section is a record, not a draft.

Reported as #6580: the file had reached 2.6 MB and 51,365 lines across 1,070 releases going back to 2015, which is slow to open and slower to read on the web.

The current year stays in CHANGELOG.md; every older year moves out whole to old-CHANGELOG/<year>.md, with a bullet in # Platforms linking each one. 798 releases move, 272 stay, and the file goes from 2.6 MB to 1.9 MB — 2026 is a big year on its own, because releases here are frequent.

Nothing is deleted and no entry is rewritten. An archived section reads exactly as it did before, for the same reason a released section is never edited in place: it is a record. That git blame is less useful on the split file is accepted rather than worked around — the history is still in git for anyone who wants it, through gitk, git-gui or git log --follow, and being small enough to open is worth more.

Each archive opens with a count of releases per month: a | 2025 | Releases | table over rows of 01, 02 and so on. How busy was 2019 is the first thing a year file is asked and the last thing 159 collapsed sections answer. Only months that had releases get a row: a fixed twelve rows would put ten zeroes in 2015's table. The table is regenerated from each file's own headings on every run, so it cannot drift from the sections beneath it, and tests/changelogArchive.test.cjs checks the two against each other.

releases/changelog-archive-years.mjs does it, and it is a January job: run it once when a year turns over. It is idempotent, so a stray run does nothing. Cutting by YEAR rather than by a count of releases is what makes a link into the archive stable — once a year is over, nothing in it moves again.

One thing the script had to learn: eleven years of headings do not agree on their own wording. Of 1,070, 539 say Wekan release, 524 say WeKan ® release, and the rest are one-offs — Sandstorm-only Wekan release, Wekan relase, and one that explains it was NOT released. Matching the strict modern form found only half of them and silently absorbed the others into the section above, so the version and the DATE are what is matched and whatever follows is left alone. Verified by counting headings before and after: 1,070 both times, none lost and none duplicated.

Moving whole years out left 1.9 MB, which was still too large, because releases here are FREQUENT: 2026 alone is 272 releases over eight months, and July was 80 on its own. A year is not a small enough unit when a year is that busy.

So the cut is by month. CHANGELOG.md holds the current month plus the Platforms, TODO Later and Upcoming sections; earlier months of the current year go to old-CHANGELOG/<year>/<MM>.md; years that are over stay one file each, because at 30 to 107 KB they are already small and splitting them further would trade a size problem for a "which of thirty files is it in" problem.

2.5 MB becomes 822 KB. Each archive opens with a table of how many releases it holds, per month, so the file says what is in it before a reader scrolls.

Admin Panel / People - who is locked out, and who can undo it.

Moving the lockout counter to one per (user, source address) - the JamBleed fix above - broke three readers still looking at the flat field it replaced: the People table's lock icon, its unlock click handler, and the lockedUsers methods behind them. Every account would have shown as unlocked, and no admin could have unlocked one.

That is the "and nowhere else" half of the rule this release adds to CLAUDE.md, missed on the very next fix. models/lib/accountLockout.js is now the one place that knows the shape - locked or not, since when, how many addresses and how many failures between them - so the client helper, the click handler and the server methods cannot drift apart again, and the negative test fails if anything reads the flat field.

The People row says which ADDRESSES are locked and until when, rather than a bare padlock, because "locked" now means something narrower than it used to and an admin should not have to guess how much narrower.

and has the following developer-facing changes:

Admin Panel / Problems - how a pane knows it is the open one.

Every pane on the Problems page had a ReactiveVar of its own - showSummary, showSecurity, showIntegrity and eight more - on top of activeReport, which already held the id of the open pane. Each one could only ever mean "activeReport equals my id", so they were forty-four lines restating one value, kept in step by hand: opening a pane reset all eleven and set one.

That made a pane four wiring points instead of one, and missing any of them failed SILENTLY. Filesystem integrity got three of the four - menu entry, setter and template branch - and no helper, and in Blaze an undefined helper is not an error but a falsy value, so the pane drew a blank page while Summary went on counting the problems it could not show. The Offices pane added in this release had the same hole somewhere else: it set no loading.set(false), so opening it would have spun for ever.

The template asks else if isPane 'report-integrity' now, against one helper. Panes that fetch through a method rather than a subscription are a list, and that list is also what fixes Offices. Adding a pane is a menu entry, a branch, and one line saying how it loads.

The guards moved with it. tests/adminPaneHelpers.test.cjs, written when the integrity pane was blank, pins both halves of the new mechanism: the helper must exist, and every id the template branches on must be an id the menu sets - a typo either way is dead template or a blank pane, and neither says anything at runtime. tests/problemsMenuOrder.test.cjs now checks EVERY pane rather than three named ones: each menu entry must be rendered, and must either load itself or have a report config, so a pane that spins for ever cannot ship again. A negative test fails if a per-pane ReactiveVar comes back.

The pane is called Problems in the menu, its address is /admin/problems, and docs/Features/Admin-Panel/Problems is where it is documented. Two things still called it Reports, from before it was renamed: the route NAME was admin-reports, where its three siblings are the bare page key setting, people and attachments - so the one route whose name did not match its own address - and the template and its three files were adminReports. Both are problems / adminProblems now, across 41 files.

What did NOT change is legacyBase: '/admin-reports'. That is an address people have in bookmarks, and it still redirects.

Security fixes - what one is required to come with.

Two rules added to CLAUDE.md, both learned from fixes in this repository rather than proposed in the abstract.

A test AND a negative test, written so the fault cannot exist ANYWHERE in the codebase rather than only where it was reported. A test that pins one call site leaves the same mistake free to live in the other five, and that is how most of these arrive: SignupBleed's guard read an option nothing sets and the same shape sat in a second endpoint; the source-map trim was safe on the client and fatal on the server. So the test proves the fix does what it claims - driving the decision itself, as arithmetic, where it can - and the negative test proves the fault is GONE rather than moved, by searching the tree for the shape of it.

And the attempt is visible in Admin Panel / Problems, whenever the fix is one that DENIES an operation. A vulnerability that is fixed silently tells an admin nothing about being attacked through it, and "nobody is trying" and "somebody tries every four seconds" are not the same instance to run. Recorded as a summary, never per event.

The local build - what build.sh produces, and what a release produces.

"Build WeKan" ran meteor build .build --directory and stopped there, and that bundle is not the one a release publishes. A release adds the server's npm modules, three prunes, the sockjs / legacy-client / source-map trim, a verified Node.js, FerretDB, the eight MongoDB Database Tools and a launcher — and three releases running broke in exactly that difference: v10.96 on a source map the trim deleted and left named, v10.97 on a package the prune's graph could not see, v10.98 on a Sandstorm pack that rebuilt the bundle and threw the trim away. None of it was reproducible locally, because locally there was only meteor build, so "does the bundle a release would publish start at all" took a release, a workflow run and a download.

releases/build-release-bundle.sh runs the workflow's OWN steps, in its order, with its arguments, for whichever platform it is run on. Not a second implementation of the release — the same scripts, so a fix to one is a fix to both. It makes no zip, no checksum and no provenance row, because those describe a published artifact and this one is a directory to start:

  cd .build/bundle && ./start-wekan.sh

Verified by running it on Linux arm64: an 850M bundle, trim −349 MiB, prune −40.0 MiB, the boot check passed, Node.js v24.19.0 verified against nodejs.org's SHASUMS256.txt, FerretDB and the eight tools fetched per-arch, 686M with all of it embedded — then started, with FerretDB on SQLite and WeKan answering HTTP 200 fifteen seconds later.

The Setup menu offers it as Build WeKan release bundle, beside Build WeKan development bundle — the plain meteor build that entry used to be, kept because the two answer different questions at very different cost, and the development one now says what it is NOT when it finishes.

Downloads are cached under .tools/bundle-binaries/, and a cache HIT re-checks the published SHA256 rather than trusting a file for having been there before. The test path is deliberately unchanged: it runs the bundle under its own node and mongod, so a hundred megabytes of binaries it will not use is the wrong trade. tests/releaseBundleMatchesWorkflow.test.cjs FINDS the release scripts the workflow runs rather than listing them, so a step added there and not here fails the suite instead of quietly putting the difference back.

and improves the documentation:

docs/ - where a page lives, and how a reader finds it.

A design that describes what WeKan already DOES belongs with the feature it describes, not in the folder for things being proposed. Fifteen docs move - Accessibility, Original-Positions, the thirteen Page/* designs that exist, and the Admin Panel Problems design.

What stays in docs/Design is what the folder is for: the principles (Design-Principles, Monkey-Proof-Software), the comparisons, the roadmap, and the proposals not yet built.

It described the tree at commit e2f768c and had gone on describing it for years. Fourteen links pointed at nothing - five files that had moved, seven that no longer exist anywhere - and every one of the fourteen was written as a full https://github.com/wekan/wekan/tree/main/… URL rather than a relative path, which is exactly why none was noticed: a broken relative link is visibly broken in an editor and on GitHub, while an absolute one looks like a link and 404s only for the reader who follows it. All 144 relative links were fine.

And two thirds of the repository was not mentioned at all — imports/, packages/, releases/, tests/, docs/, migrations/, server/lib, server/methods, server/routes, models/lib, client/features. The page walked through four directories out of twenty and did not say so, which left a reader unable to tell "not here" from "does not exist". It opens with a table of the whole tree now, and gains the sections those directories should have had.

tests/docsLinksResolve.test.cjs checks both link forms against the tree, and fails when the page stops mentioning a top-level source directory - the silence being the failure that lasted longest.

The menu is the structure a reader already has in their head, so the docs match it: one directory per tab, one page per pane, and a README in each listing the panes IN MENU ORDER with the URL slug beside them - so somebody with /admin/problems/integrity in the address bar can search for integrity and find the page.

Settings (7 panes) and People (9) already had a page each and were already in order; they gain the slug column. Problems (17) and Attachments (10) listed almost none of theirs, so their READMEs now index every pane.

WHAT IS NOT DONE is now visible instead of invisible: 15 of the 17 Problems panes and all 10 Attachments panes have no page of their own. They are dashes in the table, and tests/adminPanelDocsMatchMenu.test.cjs counts the dashes against the sentence that states how many there are - so the gap cannot grow quietly, and a pane added to the menu and not to the docs fails the suite.

Thanks to above GitHub users for their contributions and translators for their translations.

v10.97 2026-08-16 WeKan ® release

In short: v10.96 shipped a bundle that could not start. Trimming what a bundle carries went one file too far: boot.js reads every source map NAMED in programs/server/program.json, unconditionally, so removing the maps left 63 dangling names and the server died before opening its port. The names go with the files now, and the fix was checked by BOOTING a trimmed bundle rather than by reading the code again. Then the snap, which had been taking itself offline at every restart: the startup comparison of the two database copies ran unbounded with nothing on the web port, on an ambiguity that its own reading of MongoDB kept recreating. Below that: 61 MiB off every bundle from packages nothing can reach, and a guard that keeps all 246 translations loading one at a time.

This release fixes the following bugs:

Bundles and images - what a build carries, and what it no longer does.

The entry above removed the source maps from every platform. A released image then crash-looped:

  Error: ENOENT: no such file or directory,
    open '/build/programs/server/packages/ecmascript.js.map'
    at /build/programs/server/boot.js:101:29

"Nothing on any loading path reads a .map" was true of the client and false of the server. boot.js reads every map NAMED in programs/server/program.json, at boot, unconditionally:

  serverJson.load.forEach(function (fileInfo) {
    if (fileInfo.sourceMap) {
      var rawSourceMap = fs.readFileSync(
        path.resolve(serverDir, fileInfo.sourceMap), 'utf8');

63 of the 102 load entries name one — 60 MiB — so deleting the files left 63 dangling names and the server died before it opened its port.

The names now go with the files: the same pass deletes sourceMap and sourceMapRoot from every load entry. The client was never affected and still is not — its program.json names no maps at all (678 manifest entries, zero sourceMap fields) and webapp reads only program.json itself at startup.

Verified by BOOTING a trimmed bundle rather than by reading the code again: with uWebSockets.js, the legacy client and all 4766 maps removed, node main.js loads the whole server and reaches AccountsServer.init, failing only on the deliberately unreachable MONGO_URL it was given. That is the check that was missing the first time, and tests/bundleTrim.test.cjs now pins the invariant boot.js actually requires — every map the manifest names exists on disk — for both settings of --keep-maps.

The snap's two copies of the database - after a migration both stay on disk, and starting is where that gets decided.

An instance serving FerretDB printed this at every restart:

  WeKan: BOTH databases have been written to since the migration.
    MongoDB  last written 2026-08-16 01:41 (WiredTiger.wt)
    FerretDB last written 2026-08-16 01:38

Nothing had opened that MongoDB in a month. The giveaway is in the report itself: the MongoDB timestamp is the minute the snap started, three minutes AFTER the FerretDB it is being compared against.

bin/ferretdb-migration-stale decides MongoDB has been written to from the mtimes of the WiredTiger data files, and its own header admits an mtime cannot tell "somebody used this database" from "this database was started". bin/database-autopick is the answer to that — it reads both copies and compares their contents. But to read MongoDB it STARTS mongod, and starting mongod does recovery and a checkpoint, which stamps exactly the files the staleness check reads. So the diagnostic manufactured its own evidence: after one run, MongoDB looked freshly written forever and the ambiguity could never resolve, however long nobody touched it.

The read now notes the newest data-file mtime before mongod starts and puts anything newer back afterwards — files mongod CREATED during the read included, since a new journal file is the newest thing in the directory and reports as a write on its own. mongod does not use mtimes, and what it checkpointed is not user data, so the metadata is made to say what is true. Every way out of the read restores, including the failures, because a failing read is exactly when the ambiguity gets reported. A write that happened BEFORE the read still survives it: the point is to hide WeKan's own read, never somebody's work.

The same instance went OFFLINE at every restart. wekan-control ran the comparison synchronously and unbounded before anything opened the web port — and it starts each database on a temporary port to read it, which on a real instance is minutes. Until it returned a browser got a connection timeout, and the reason was in snap logs, the last place somebody whose site is down thinks to look.

That is #6592 one step earlier than where it was fixed. The database WAIT already serves a waiting for its database page; the helpers for it were defined 200 lines BELOW the comparison that needed them. They move up, and the comparison uses them — after the same grace period, so a comparison that finishes in seconds does not flash a page up and teach proxies to cache a 503 for a healthy site.

And a bound. WEKAN_AUTOPICK_TIMEOUT is 900 seconds by default; when it runs out WeKan says so, changes nothing, and starts on the database already selected. Stopping the comparison is safe — it never deletes anything on either side, and the merge it may be in the middle of only INSERTS what is missing, so a partial one is fewer documents copied and the next start finishes the job. Serving the site beats finishing the comparison.

WEKAN_AUTOPICK was an env var and nothing else, so an admin whose site was down had no supported way to skip the comparison. It is a snap config key now, with the bound beside it, and the timeout message names both — somebody reading it is somebody whose site just came up late:

  snap set wekan autopick=false
  snap set wekan autopick-timeout=1800

This is the other half of the entry above. Before that fix the comparison ran at EVERY start, so every restart took the site down for a comparison that could never conclude. One stops it recurring; this one makes it survivable.

and changes what every platform ships:

programs/server/npm/node_modules is 347 MB of an ~850 MB bundle, and measuring its require graph says 206 MB of that is unreachable from any server entry point. Two things cause it, neither a bug in Meteor:

• The tree is outside the bundler's graph. Meteor 3.5 compiles through rspack — the server output is minified, and programs/server/app/app.js requires only 76 bare specifiers because rspack inlined the app's real dependencies into it. But this tree is what Atmosphere packages declare with Npm.depends() and load through Npm.require(), which rspack cannot follow. It is largely the INPUT to a build whose OUTPUT ships beside it.
• It is a full npm install, devDependencies included.

Duplication is the smaller half: 586 distinct packages exist as 815 copies, but the redundant copies are only ~28 MB, because Meteor keeps per-package node_modules on purpose so packages can pin conflicting versions.

releases/prune-unreachable-npm.mjs removes 61.3 MiB, in four categories whose reason is PROVABLE rather than merely plausible — the standard the uWebSockets.js removal met: typescript (23.2 MiB, a devDependency of 196 packages here and a runtime dependency of none), openpgp with nodemailer-openpgp (21.3 MiB, reachable only through an optional nodemailer plugin nothing requires), @types/* (9.6 MiB across 24 copies, verified to contain no .js at all) and sinon (7.2 MiB, a test framework).

One of those four was wrong, and this release cannot start because of it. packages/email.js links nodemailer-openpgp on its first tick through module.link(), which the graph did not read as a reference — so the bundle ships without a package it needs and dies with Cannot find module. Withdrawn and fixed in the release above, where the whole story is.

The remaining 145 MB of unreachable packages STAYS. jquery, hotkeys-js and the @azure storage adapters are almost certainly dead too, but almost certainly is not the standard, and the tail of 590 packages is where a static scan is most likely to be wrong.

Two independent safeties, because this is riskier than the uws removal was. The reachable set is recomputed from the bundle every run and deliberately OVER-approximated — once a package is reached, every file in it is scanned and every require() string literal counts. The policy then only proposes; the graph has a VETO, so an entry whose package is actually required is refused and said out loud rather than applied. And after deleting, every path in the reachable set must still exist or the run fails. Verified on a real bundle: 473M to 410M, with the reachable count 211 before and after.

and adds the following guard:

WeKan ships 246 languages, 37 MB of JSON. What makes that affordable is one character in each of 246 near-identical blocks in imports/i18n/languages.js:

  load: () => import('./data/ace.i18n.json'),

A dynamic import() is a SPLIT POINT. rspack emits each language as its own chunk — measured on a built bundle, 238 chunks and 34 MiB of JS — and a browser fetches exactly one, about 145 KB for the language in use. Written instead as import data from './data/ace.i18n.json', or with require(), the same line stops splitting and 34 MiB joins the main bundle for every user, in every language. That edit is made by hand each time a language is added, which is why it wants a guard rather than a convention.

Seven checks: every entry has a load:, every load: is the dynamic form, none uses require(), no static import of a data file, nothing outside languages.js imports one, every file is claimed and every claim has a file, and a Transifex pull writes the file the app actually loads.

The last two are symlink-aware, and that is the point of them. .tx/config's lang_map renames most of Transifex's underscored locales to WeKan's hyphenated files; for the two it does not — km_KH and ru_RU — the hyphenated name is a SYMLINK to the file Transifex writes. Two names for one file, not two copies. Reading it the other way costs a language its real translations, so both checks compare through realpath and say so.

Thanks to above GitHub users for their contributions and translators for their translations.

v10.96 2026-08-16 WeKan ® release

In short: one CRITICAL fix. With registration turned OFF in the Admin Panel, POST /users/register created accounts anyway — for anybody who asked, on an instance whose administrator had decided nobody else may join. The guard that was supposed to stop it read a Meteor option WeKan never sets, so it was always false and the endpoint had never refused anyone. It was found while reviewing a pull request about the opposite symptom. Then the release workflow: pressing Cancel did not stop a run, so docker went on building an image for a release being abandoned, and the Sandstorm .spk gets under its 1 GiB limit at last, now that its size report says what filled the gigabyte. What that measurement found ended up changing every platform, not just Sandstorm: uws is not reliable enough yet, so every default is now sockjs, and no bundle carries uWebSockets.js (121M), the legacy client (81M) or source maps (152M) — around 354M a bundle. Below that: two AWS SDK updates for the S3 attachment path.

This release fixes the following CRITICAL SECURITY ISSUE of SignupBleed:

Account creation - who may make an account, and who decides.

Turning Registration off in the Admin Panel closes the sign-up form. It did not close POST /users/register, which went on creating accounts and handing back login tokens to anyone who asked. A closed instance was open.

The endpoint did have a guard. It asked Accounts._options.forbidClientAccountCreation — and nothing in WeKan ever sets that:

• the only Accounts.config() call, in server/accounts-common.js, sets loginExpirationInDays and nothing else;
• forbidClientAccountCreation: disableRegistration in config/accounts.js is passed to AccountsTemplates.configure(), which is the useraccounts package's own options object, not Meteor's Accounts;
• and that disableRegistration is only assigned inside an async Meteor.call('isDisableRegistration', …) callback that fires AFTER configure() has already run — something the file's own comment records, for a different reason, a few lines above.

Three near-misses, and the condition was always falsy. The guard read as though it worked, which is why it lasted: the name says exactly what it ought to do.

It reads the setting from where the setting lives now - the same getCurrentSetting().disableRegistration === true that the isDisableRegistration Meteor method behind the sign-up form uses, so the form and the API can no longer disagree about whether the door is open. An instance with no Settings document yet still allows registration rather than locking itself out.

Every call that reaches the refusal is recorded and shows in Admin Panel / Problems under authz.register. That is safe to log without drowning the page precisely because there is no legitimate caller: the administrator has turned registration off.

How it was found. #6598 by AhmedLukman changed this guard to read WeKan's setting, filed against #4774 — a 403 Forbidden from this endpoint that nobody had been able to reproduce, and which this line cannot produce, since it never returned 403 at all. The pull request was closed and the fix written here with a security log entry and the tests the route had never had; the finding is the reporter's.

Nine tests, four of them negative, on an endpoint that had none: that the setting is read where the Meteor method reads it, that the dead option is not consulted again AND is still set nowhere — so a later change cannot quietly reintroduce two sources of truth that disagree — that an enabled instance still creates the user and answers with its token, and that a missing Settings document does not refuse everybody.

and updates the following dependencies:

• @aws-sdk/client-s3 3.1108.0 → 3.1109.0 — the S3 client WeKan stores attachments through when S3 storage is configured.
• @aws-sdk/lib-storage 3.1104.0 → 3.1109.0 — the multipart upload helper beside it, which is what actually streams a large attachment to S3.

Thanks to dependabot.

and fixes the following build failures:

The release workflow - what a release builds, and who can stop it.

Pressing Cancel on a release-all run did not stop the docker job. It kept going for another twenty minutes and would have pushed a multi-arch image for a release that was being abandoned.

The cause is always(). It is true while a run is CANCELLING, which is exactly why it was chosen in v10.80: a build-mac-x64 queued on a runner label GitHub had retired sat for two hours, was cancelled by hand, and that cancellation SKIPPED charts, ucs and nextcloud — so the Helm chart for an already published WeKan was never pushed, and no error anywhere said why. always() fixed that by ignoring cancellation entirely, and ignoring cancellation is also what disabled the Cancel button on a job that takes hours.

!cancelled() keeps the half that matters — do not skip me because a SIBLING failed — and drops the half that overrides a person. Nine job-level conditions change, across release-all.yml, release-all-missing.yml, Flatpak.yml and AppImage.yml. The 22 step-level if: always() reporting steps do not: those correctly print CANCELLED.

That alone would reopen v10.80, so the other half of the fix is that no job needs a hand cancellation any more. The eight jobs that had no timeout-minutes now have one, and every job in the release workflow is bounded. A stuck job FAILS on its own, and a failure satisfies !cancelled() the same way always() let it through — Cancel is left meaning only what a person meant by it.

v10.93, v10.94 and v10.95 all failed to pack with App exceeds uncompressed size limit of 1 GiB. v10.95 was the first run whose size report worked, and it named the gigabyte: .meteor-spk/bundle 852M plus .meteor-spk/deps 336M, so 1188M against a 1024M ceiling. It also answered the question that report was written to ask — a second meteor-spk pack REUSES the bundle rather than rebuilding it, since the pruned tree stayed pruned across the retry (852M to 833M). So trimming between the two attempts works. 19M was simply never going to close a 165M gap.

Measuring the bundle rather than guessing at it turned up two passengers that are large, unreachable at runtime, and safe to drop:

• uWebSockets.js ships twenty prebuilt binaries — Linux/macOS/Windows times x64/arm64 times four Node ABIs, 121M — and its loader is one line: require('./uws_' + process.platform + '_' + process.arch + '_' + process.versions.modules + '.node'). A machine is one platform running one Node, so the other sixteen files can never be opened by it. Keeping every ABI of the target platform and CPU, so a Node major bump still finds its binary, frees ~93M. The entry below drops the remaining 28M as well.
• Source maps — 4766 files, 188M, over a fifth of the bundle. They exist for a debugger attached to the process. A packed app has none, and a missing .map degrades a stack trace at worst.

releases/bundle-trim.mjs does both, measured at 281 MiB on a real bundle, and the Sandstorm leg runs it beside the existing prune before the retry pack.

An architecture with NO uWebSockets.js prebuild at all — ppc64le, s390x, riscv64, where ddp-server falls back to sockjs — is left completely alone, since deleting the other platforms' files there would free nothing that matters and could only break the fallback. tests/bundleTrim.test.cjs pins that, the kept ABIs, that a directory merely ending in .map is not a source map, and that the trim runs before the retry pack rather than after it.

Trimming uWebSockets.js down to the prebuilds a grain's own platform can open freed 93M of its 121M. All of it can go, because a grain loads NONE of it.

The uws transport is OPTIONAL in Meteor 3. ddp-server's transports/index.js resolves the transport from Meteor.settings.packages['ddp-server'].transport, then DDP_TRANSPORT, then DISABLE_SOCKJS, and DEFAULTS to sockjs — and Npm.require('uWebSockets.js') sits inside the uws transport's setup(), which runs only for the transport that was actually chosen. sandstorm-pkgdef.capnp sets none of those, and its environ is, by its own comment, the app's ENTIRE environment. So a grain has been running sockjs all along while carrying 121M of a module it never required.

The pkgdef now PINS DDP_TRANSPORT=sockjs, because the removal should rest on a stated fact rather than on an upstream default staying put, and bundle-trim.mjs takes --transport sockjs, which removes the module whole instead of thinning its prebuilds. 120 MiB measured, 27 MiB more than the platform trim: 1188M becomes ~860M, with over 160M of headroom against the 1 GiB limit.

It is a flag rather than the default because WeKan asks for uws nearly everywhere else — docker-compose, start-wekan.sh, build.sh — and those bundles keep the module, trimmed to the prebuilds their own platform can open.

tests/bundleTrim.test.cjs ties the grain's pinned transport to the flag the .spk is trimmed with. If those two ever disagreed, the grain would require a module that was left out and fail to boot, which is the one way this can go wrong.

and changes what every platform ships:

Bundles and images - what a build carries, and what it no longer does.

uws is not reliable enough yet to be what a default points at, so nothing WeKan ships selects it any more, and nothing carries the module. Three halves, and each is useless or harmful without the others.

The defaults. Every docker-compose*.yml, start-wekan.sh, start-wekan.bat, build.sh, build.bat, the image's own ENV block, the snap config and the Sandstorm grain now say sockjs. The commented-out #- DDP_TRANSPORT=uws alternatives beside them are replaced by a note saying why there is no alternative, rather than advertising a value that no longer works.

The bundles. Every place a built bundle is post-processed — the amd64 build, each per-arch rebuild, the repack container, releases/install-node-for-arch.sh and the Dockerfile — now runs bundle-trim.mjs beside the prune it already ran, dropping two things:

• uWebSockets.js, 121 MiB, for the reason in the entry above: a sockjs server never requires the module at all.

• programs/web.browser.legacy, a whole second copy of the client built for browsers without modern JS. 81 MiB measured. Meteor supports running with architectures excluded and says so in webapp's categorizeRequest(): "If our preferred arch is not available, it's better to use another client arch that is available than to guarantee the site won't work". An old browser is served web.browser; the 404 branch below that is reached only when NO arch matches, which cannot happen while web.browser is there, and autoupdate iterates the programs that actually loaded rather than a fixed list.

  The files are only half of it. The arch is NAMED in programs/server/config.json and star.json, and boot.js builds a dynamic-import root for every name in the first — so the name is removed with the files. Those manifests are mode 444 as Meteor writes them, so they are made writable, rewritten, and set back: failing there would leave the one state that actually breaks a server, files gone and manifests still naming the arch.

The upgrade. An existing docker-compose.yml that says DDP_TRANSPORT=uws would ask the new image for a module it does not have and crash-loop on the require. So the Docker entrypoint and the bundle's own start-wekan.sh coerce uws back to sockjs before starting anything, and print why — a setting silently ignored is worse than one that fails.

tests/sockjsEverywhere.test.cjs pins the three halves together: a default without the coercion is an upgrade trap, a coercion without the trim is dead weight, and a trim without both is a crash.

The .zip bundles and the Docker image were trimmed with --keep-maps, so only Sandstorm — which had a 1 GiB ceiling to get under — dropped them. Every platform drops them now: 152 MiB per bundle, measured. That is 188 MiB across 4766 files, less the 36 MiB inside web.browser.legacy that the entry above already takes with it.

A source map translates a position in built code back to the source that produced it — this bundle's server side is one 117 MiB programs/server/app/app.js, and its 58 MiB app.js.map is what turns app.js:1284531 into a file and a line. It is read by browser devtools, which fetch the .map only while they are open, and by Node stack traces through source-map-support. A released bundle has neither attached to it.

A map the server manifest NAMES is not optional, and this release did not know it. boot.js reads every map listed in programs/server/program.json at boot, unconditionally, so removing the files without removing the names left the server unable to start — fixed in the release above, where the whole story is. The client is unaffected: its manifest names no maps at all, and a client .map is found through the //# sourceMappingURL comment, which is a comment — a missing target means devtools show compiled positions and a server stack trace prints bundle offsets. Debugging a production crash goes back to reproducing it against a development build, which is where the maps still are. The guard pins that no call site keeps them, so one platform cannot quietly drift back to carrying them.

Thanks to above GitHub users for their contributions and translators for their translations.

v10.95 2026-08-16 WeKan ® release

In short: the Sandstorm .spk still will not pack - Sandstorm refuses an app over 1 GiB uncompressed - and v10.94 was supposed to say what filled it. It said nothing, because the size report ran BEFORE meteor-spk pack, and pack is what builds the trees it was trying to measure. The sizes are taken after pack now, on failure and on success, dereferencing the symlink that hid most of them; and the bundle is pruned of its build-only toolchain and packed once more before the job gives up, which is the same pruning every other bundle already gets and the one reduction available without guessing.

This release fixes the following build failures:

The release workflow - the bundles a release is supposed to carry.

build-sandstorm fails with App exceeds uncompressed size limit of 1 GiB and nothing else. Because Sandstorm refuses to pack, no .spk is written, so there is no artifact to open and no list of what filled it.

The first attempt at that added a size report before meteor-spk pack, and the next run showed it printing nothing at all:

  --- packing (Sandstorm refuses over 1 GiB uncompressed)
  Building Meteor app...

meteor-spk pack is what BUILDS the Meteor app - Building Meteor app... comes after it starts - so .meteor-spk/deps and .meteor-spk/bundle do not exist until it has run. The report was measuring two directories that were not there, found neither, and skipped both silently. A diagnostic that runs before the thing it diagnoses says nothing at all.

The sizes are taken AFTER pack now: on failure, where they are the whole point, and on success, where the headroom against 1 GiB is worth knowing before the next thing is added. du -shL DEREFERENCES, because deps is a symlink to the tree sandstorm-src/build-deps.sh assembles and a plain du -sh on a symlink reports the link rather than the gigabyte behind it. The bundle's server packages are listed separately, because they are the part every other bundle prunes.

And one bounded RETRY, which is an attempt at the fix rather than more looking. meteor-spk pack runs npm install inside the bundle's programs/server - that is where [email protected] and node-gyp's tree come from in the log - and the Sandstorm leg is the only one that never removes them afterwards. prune-build-only-modules.mjs drops 83 of 120 packages everywhere else, and nothing in a packed app runs any of them. Whether it is enough turns on something no log has answered yet: does a second pack REUSE .meteor-spk/bundle, or rebuild it and undo the prune? Both answers are useful and neither is worse than the hard failure that is there now - if it rebuilds, the second failure is identical and the log says the prune was undone; if it reuses, the .spk packs. It runs once, only after a failure, and only if the bundle is actually there.

Thanks to above GitHub users for their contributions and translators for their translations.

v10.94 2026-08-16 WeKan ® release

In short: the Windows bundles are back. v10.93 built them, compiled their native modules, and then threw both away on one line: npm on Windows is npm.cmd, a batch script, and Node applies no PATHEXT when it spawns, so execFileSync('npm', …) in the bundle's security-bump step resolved to nothing and build-win64 and build-win-arm64 died with spawnSync npm ENOENT after all the work was done. npm's own CLI is run with the Node already running now, which needs no PATH lookup and no shell. The Sandstorm .spk also failed, on Sandstorm's 1 GiB uncompressed limit, and it failed silently - no list, no sizes, no .spk to inspect - so the pack step now says where the gigabyte is before it packs.

The table below carries only the four platforms this run recorded a complete, verified provenance for; the release job regenerates it from every build job's provenance.tsv.

This release fixes the following build failures:

The release workflow - the bundles a release is supposed to carry.

build-win64 and build-win-arm64 both failed in v10.93, and both had already built the bundle and compiled its native modules. What killed them was one line of releases/bump-bundle-npm-deps.mjs:

  Error: spawnSync npm ENOENT

npm on Windows is npm.cmd, a batch script, and Node applies no PATHEXT when it spawns - so execFileSync('npm', …) resolves to nothing. build-win32 was skipped that run for want of a published Node.js build, so it never reached this and looked fine; the fault was never architecture-specific.

npm's own CLI is run with the Node already running instead: execFileSync(process.execPath, [npm-cli.js, …]). No PATH lookup, no PATHEXT, no shell - and the same npm either way. shell: true would have found the .cmd and broken differently, because with a shell Node joins the arguments and quotes NOTHING, so the first Windows temp path containing a space would corrupt the install. A bare npm on PATH remains as the last resort, for a Node with no npm beside it, and on Windows it now says which case that is rather than letting ENOENT speak for itself.

Verified end to end: a bundle-shaped tree holding qs 6.0.0 is bumped to 6.15.3 through the new path, with the dependencies the new version needs copied in beside it.

Thanks to above GitHub users for their contributions and translators for their translations.

v10.93 2026-08-15 WeKan ® release

In short: Docker did not work in v10.92, and this is that fixed. The "waiting for database" page added in that release stood in front of a database that was answering everyone else: the probe behind it looked for the MongoDB driver where a production bundle does not keep one, so it never asked the database anything, and the login page did not load for the ten minutes the page was allowed to hold the web port. The snap was never affected - it serves its own page and never runs that probe. Two further faults found while proving it are fixed with it: the probe forced a connection option a replica-set URL refuses, and it said nothing at all about why it had failed, which is now printed and put on the page itself.

This release fixes the following bugs:

Starting up - what a browser sees while WeKan cannot yet serve.

Reported against this release, with a screenshot: the login page never loads, the container logs The database is not answering yet and serves the waiting page, while mongosh on the host talks to the same MongoDB without complaint - a Meteor 3 production setup from docs/Platforms/FOSS/Container/Docker/Meteor3, MongoDB 7.0.40, replica set rs0, network_mode: host, MONGO_URL a single host with authSource. 10.91 worked and this did not, which is the whole story: the page is new here, and it is what broke.

The database was never the problem. db-ready.mjs asked for the driver at programs/server/node_modules only - and mongodb is a devDependency, not a dependency, so a production bundle has NOTHING there. Meteor's own driver lives under programs/server/npm/node_modules/meteor/npm-mongo. require threw MODULE_NOT_FOUND on every ask, in every container, whatever the database was doing; the catch turned that into "not ready", the entrypoint sent the reason to /dev/null, and WeKan sat behind the page for the whole ten-minute window before starting.

The snap already carries this scar. Its db-eval.mjs says so in a comment - "made WeKan loop 'MongoDB not ready' forever" - and resolves the driver from a list of bundle paths; db-ready.mjs now uses the same list. That is also why the snap was unaffected by any of this: it serves its own page from wekan-control and never runs db-ready.mjs at all.

No driver no longer means a page. It exits 2, distinct from 1, and the entrypoint starts WeKan without the page: "I could not ask" is not evidence that anything is wrong, and a page shown on that basis hides a WeKan that would have served fine. Docker with an external MongoDB needs no waiting screen, and it no longer gets one it has not earned.

Two more faults were found while proving it, both of which could hold the page in front of a working database on their own:

• The probe forced directConnection: true. For one host that is harmless; a replica set is normally a SEED LIST, and the driver refuses that outright - MongoParseError: directConnection option requires exactly one host. The throw happened while the client was being CONSTRUCTED, outside the try, so the probe died with an unhandled error. The options come from the URL now, which is also the more correct question: WeKan connects with the URL as written, so a probe that quietly connects DIFFERENTLY can report ready for a database WeKan cannot reach - dropping the page and leaving the port closed, which is the exact fault the page exists to prevent.
• Nothing said why. The first probe's reason is printed now, the three-second poll stays quiet, the last one reports again if the window expires - and the reason is put on the page, because whoever is waiting is looking at a browser, not at docker logs. MongoServerSelectionError: connect ECONNREFUSED wekan-db:27017 names the host that could not be reached.

WEKAN_DB_WAIT_PAGE=false still turns the whole thing off.

Thanks to above GitHub users for their contributions and translators for their translations.

v10.92 2026-08-15 WeKan ® release

In short: this was tagged v10.92 and never published: its release job died before running a line of its own script, with Argument list too long, because the release notes had outgrown the size a single environment variable may hold — so the release, and every job that needs it, never happened. The amd64 and arm64 bundles built and verified; only the publishing failed. The notes now travel from file to file and never become a shell value, which is the one shape that neither runs a backtick as a command nor has a size limit at all. Everything below was written for v10.92 and ships here instead. It begins with what the published Docker image SHIPS, cleaned up against a container scan of ghcr.io/wekan/wekan:v10.91. That scan reported 80 findings against "Node.js", three of them CRITICAL, and not one of them was in code WeKan runs: npm and node-gyp are build tools that were left in the finished image, and their trees are where tar 6.2.1, sigstore, ip-address and the rest came from. Both go now, after the install that needs them - 83 of the 120 packages in programs/server, and npm itself. The rest of that list is the npm packages Meteor's own packages bundle, which no package.json here can reach: nodemailer, openpgp, svgo, postcss, nanoid, lodash, qs, body-parser, cookie, on-headers, tmp, diff, @babel/runtime and underscore are raised inside the built bundle, to fixed versions in the same major, by a manifest the release jobs and the Dockerfile share. Below that: the guard suites that keep both from coming back, and what could NOT be fixed and why. Then card export: the PDF and Excel exports of a card were two different answers to "what is on this card", and are now one - the same fields under the same translated labels, dates in the reader's own time zone and in the date format the opened card shows, and a description's markdown drawn as bold and italic rather than stripped. On top of that, #1173 after eight years: a board, a swimlane or a list exports to PDF and Excel in that same card layout, from one selection popup that says what to include. And titles are edited where they are written: a card's title on the board (#4990, asked in 2022), a board's by clicking its name in the header bar instead of a pencil beside it. Above all of it, though: five CRITICAL REST API fixes reported by ybsun0215, the worst of which let any user with write access to one board destroy the comments, checklists and history of every card on every board in the instance. Below that: twelve bug fixes - among them Custom Fields, which the browser tests caught being unreachable on a card that had none, which is exactly where it is needed, and a field made from a card that was silently never created - a test that pins that a browser downloads one language file and not all 246 of them, and 81 languages taken past the words on the board into the menus and the login page, beside the Export row that read as the lowercase key export in every one of them because that key had never existed. And then the translations turned out to have a much older problem than any missing string: 8,716 values were written in the wrong language entirely, which no count had ever reported because nothing was looking. Korean held Japanese, Georgian Russian, Hindi Gujarati, Tamil Telugu — and, once a second check asked about the Latin alphabet inside a language that is not written in it, Greek held Italian, Thai Vietnamese and Algerian Arabic French. All of it is translated now, and the scan that found it stays as the guard, reporting zero for both of its checks across all 246 files. Below that: the search operators a user TYPES, in the language they read; the one-letter shorthands beside them, each derived from that language's own word; and the panels a file never had because they were added after it was last touched. Then dependency updates, thirty-odd bug fixes, the developer-facing changes, and the rest of the translation work.

This release fixes the following CRITICAL SECURITY ISSUES:

The REST API - what an endpoint authorises, and what it then acts on.

PurgeBleed is the severe one of the five. DELETE /api/boards/{boardId}/lists/{listId}/cards/{cardId} authorised the caller on the board in the URL, and then fetched the card by its id ALONE.

The order is what makes it destructive. cardRemover runs BEFORE the card is removed - it has to, so the children's before.remove hooks still find their parent - and it removes strictly by card id: checklists, checklist items, comments, the activity history and the whole subcard tree. So it erased those for whatever card the bare lookup returned, which was any card in the instance, on boards the caller cannot read, irreversibly.

The removal that follows uses a triple key, {_id, listId, boardId}, which a foreign card never matches. The card SHELL therefore survived and the endpoint answered 200 with the card id - so nothing in the response said that the contents of somebody else's card had just been destroyed, and the attack is repeatable for every card id an attacker learns.

Any authenticated user with write access to ONE board - their own is enough - could reach every board on the instance. All deployments with WITH_API=true are affected.

The bulk endpoint had always constrained its lookup with {_id, boardId}; the single-card path is the sibling that was missed, the same shape as PassBleed. It uses the constrained lookup now, so a card outside the authorised board does not resolve, and cardRemover is never reached.

HashBleed: GET /api/users/{userId} and PUT /api/users/{userId} serialised the whole Meteor user document with no projection, so every answer carried services.password.bcrypt - an offline-crackable password hash - and services.resume.loginTokens, the hash of every live session with the time it began.

The authorisation was never the problem: both endpoints are admin-only and stay that way. The payload was. Walking the ids that GET /api/users returns harvested the credential material of the whole instance, and a password hash is an attack that continues offline long after the export.

The two sibling endpoints in the same file show what was intended: the list projects down to _id and username, and the self view runs delete data.services before answering. Nothing in the code, the CHANGELOG or the documentation ever said the subtree was meant to be exposed. One helper strips services and sessionData now, and both endpoints answer through it - the PUT as well, which returned the same unprojected document after every action.

GuestBleed is two paths that are each defensible alone. The members and assignees ARRAYS on card create and card update were stored exactly as given, with nothing checking that those ids belong to the card's board. And GET /api/user/cards answered by CARD membership, without re-checking the caller's access to the card's BOARD.

Together they are a channel: a member of a private board writes an outsider's id onto a card, and the outsider's own my cards feed then returns that card's title, its board, list and swimlane ids, its dates and its co-members - for as long as the id stays on the card. Their direct read of the board stayed Forbidden the whole time, which is what made it quiet.

The invariant already existed, documented on the merge endpoint POST .../cards/{cardId}/members/{memberId}, which has refused a non-member with 400 since #5998. It covers the array shapes now - single create, bulk create and update - and an id that may not be assigned is dropped rather than the request refused, so a bulk edit does not fail over one stale id. The listing is filtered by board visibility as well, because fixing only the write path would leave every card placed before this release still answering.

StaleBleed: GET /api/users/{userId}/boards selected boards with a dotted 'members.userId' match, which ignores the membership's isActive flag. Removing a board member does not delete their entry - it sets isActive: false and isAdmin: false and keeps it - so a removed member's own board listing went on showing that board's id and title, indefinitely.

Reading the board itself was already refused, which bounds this to the id and the title. The id is the part that matters, because it is what every other endpoint in the API is addressed by, and a private board's title is often the thing it is private about.

A dotted path cannot express this: in Mongo, 'members.userId' and 'members.isActive' may be satisfied by DIFFERENT entries of the array. $elemMatch is what ties them to the same entry, and it is what the rest of WeKan uses - the single builder introduced by the fix for GHSA-gwc4-fw7p-gw58, whose header note reads "A share entry counts only while it is active, everywhere". This listing predates that consolidation and was never converted.

AuthorBleed: six server paths took the actor's identity from the request body's authorId field, checking only that such a user exists. An existence check is not an authentication check - it confirms that the name in the envelope belongs to somebody, and says nothing about who wrote the letter.

So a board member could record "victim created this card" and "victim deleted this card" on any board they may write to, and the card document itself recorded the forged userId as its creator. The six are single card create, bulk card create, the linked-card form, single card delete, bulk card delete and custom-field create.

WeKan had already accepted this exact class as a vulnerability and fixed it for card comments in 8.19, and again for the card PUT handler - whose inline note still reads "use req.userId consistently (it previously read req.body.authorId here)". These six were missed, which makes it an incomplete fix rather than a decision. All six read req.userId now, the session the request authenticated as, which is the only identity the server can vouch for.

and fixes the following SECURITY ISSUES found by container scanning:

The published image - what it carries that it never runs.

Three CRITICAL findings and most of the HIGH ones were three copies of one package - tar 6.2.1 twice and tar 7.5.11 once - and none of them is reachable from boot.js:

• node-gyp and @mapbox/node-pre-gyp are dependencies of Meteor's meteor-dev-bundle, there to COMPILE native modules during the npm install in programs/server. WeKan compiles nothing at run time: uWebSockets.js, bcrypt and argon2 all ship prebuilt .node files that node-gyp-build picks at require time. Their tree is 83 of the 120 packages that install leaves behind, and it brought tar 6.2.1 (via node-gyp and cacache), brace-expansion, minimatch and npm's networking stack with it.
• npm itself runs exactly once in the image, for that install. The container starts bash /build/wekan-entrypoint.sh, which never calls it. Shipping it shipped its own bundled tar 7.5.11, sigstore 4.1.0, @sigstore/verify, @sigstore/core, ip-address 10.1.0 and brace-expansion 5.0.4 as image content no code path can reach.

releases/prune-build-only-modules.mjs removes the first, and it is a REACHABILITY walk rather than a list of 83 names - start from every dependency of programs/server/package.json except those two, follow each package's own dependencies, keep the closure - so it cannot go stale the next time Meteor changes its dev-bundle. The Dockerfile deletes npm and npx in its cleanup step; node stays, because that is what runs WeKan.

It runs in every place a bundle is made, not only in the image: the amd64 build, the arm64 container, the three Windows legs, both macOS legs, and install-node-for-arch.sh for the emulated arches - each one reinstalls programs/server, so each one has the tree to remove. The pruned bundle was booted before and after to prove nothing needs what it takes: identical failure at the database, no missing module.

The rest of that scan was nodemailer 8.0.3 and openpgp 5.11.1 (meteor/email), svgo 2.8.2, postcss 8.5.1 and nanoid 3.3.15 (meteor/minifier-css), qs 6.13.0, cookie 0.4.1, on-headers 1.0.2 and tmp 0.2.3 (meteor/webapp), lodash 4.17.21 and diff 3.5.0 (ostrio:files), body-parser 1.20.3 (meteor/oauth), @babel/runtime 7.20.7 and underscore 1.13.7.

Npm.depends names an EXACT version, and meteor build copies that version into programs/server/npm/node_modules/meteor/<package>/node_modules. Nothing in this repository's package.json is consulted for it - not a dependency, not an overrides entry - so the only place those versions can be raised is the bundle, after it has been built. releases/bump-bundle-npm-deps.mjs does that from the minimums in releases/bundle-npm-security-bumps.json, installing with --ignore-scripts so no prebuilt native module is rebuilt by a version bump, and replacing only copies BELOW the minimum.

A minimum stays inside the major the Meteor package was built against, and that rule was learned rather than assumed: uuid 8.3.2 and 9.0.1 are both affected and the lowest fixed release is 11.1.1, which moved its entry point to dist/cjs/index.js - the bundle records dist/index.js at build time, and the server died on boot with Cannot find module .../uuid/dist/index.js. It is in the manifest's notFixable list with that error, beside lodash.template, which has no fixed release at all.

One pass on the amd64 bundle reaches every architecture, because every other bundle is that bundle with programs/server reinstalled. That reinstall is also why every leg runs it again: meteor-dev-bundle pins underscore 1.13.7 (CVE-2026-27601) and puts it back over the bumped copy - including in the Dockerfile, which reinstalls from the .zip.

tests/imageBuildOnlyModules.test.cjs pins that the pruner is reachability-driven and never touches npm/node_modules, that the image prunes AFTER the install and before the bundle is moved, that npm and npx are removed and node is not, and that every leg which installs programs/server prunes afterwards. tests/bundleNpmSecurityBumps.test.cjs pins the manifest's versions, the --ignore-scripts install, the below-the-minimum-only replacement, and that uuid is NOT in minimums and says why.

Not everything in that report can be fixed here, and it is worth saying which:

• The debian 13.6 target's 176 findings are ALL Fixed in: - - unfixed upstream, in perl-base, util-linux, ncurses, glibc and the rest of a base system. No upgrade closes them; only carrying fewer packages helps, which is what the build-dependency purge and the pebble removal already do.
• lodash.template 4.5.0 has no fixed release; it reaches the bundle through aldeed:simple-schema.
• nodemailer's fifth advisory needs 9.0.1, a major the Meteor email package is not written against; 8.0.11 fixes the other four.
• The nine build/<tool> binaries and build/ferretdb are other repositories' builds - wekan/mongo-tools-patches and wekan/FerretDB - and are fixed there.

and adds the following new features:

The other direction of the same popup. Importing used to mean one thing: a whole new board, from the full-width page at All Boards. A swimlane's menu now imports a swimlane BELOW that swimlane, a list's menu imports a list after it - which is to its RIGHT in English and to its LEFT in Arabic - and a card's menu imports a card below it, into the board that is already open.

The RTL side of that is ONE rule and not two, which is worth saying because it looks like a missing branch: the page carries dir, so the board's row of lists mirrors itself and "after in sort order" is already "the other side". A direction branch in the placement would mirror it twice and put the list back where it started.

Placement is a FRACTION between the target's sort and the next one's, not a renumbering of every sibling - renumbering is what a board with ten thousand cards cannot afford, and what two clients doing it at once get wrong. Several imported items spread evenly through that gap, so importing a swimlane of ten lists does not put nine of them in the same position.

The file is what the export writes, at any scope, and the SAME checkboxes decide what comes in: a document full of comments imported with Comments unticked brings the cards and leaves the comments. A .zip is unpacked in the browser and its wekan.json handed to the same method, so there is one import path rather than two. Nothing is merged - everything created is new, because an import that half-updated a board would be an edit nobody could undo - and a custom field is matched by NAME, since an id from another board matches nothing here.

Importing WRITES, so unlike the exports beside it, it asks whether you may change the board rather than whether you may see it, and a read-only member is not offered it at all.

All Boards - the overview and the tiles in it.

In All Boards / Starred, a bookmark tile stood 8px taller than the board tile beside it and than the grey "+ Add Board" box, and pulled its whole row up with it.

Two of the four tiles in that grid carry border: 4px solid #fff - a bookmark and the Template Container - to say they are not an ordinary board. The tile's height was a 72px floor with 42px of padding added outside it, which comes to the same 114px for a plain tile and to 122px for a bordered one, because on a content-box element a border is added to the height rather than taken out of it. The heights all said 72px, so nothing in the stylesheet looked wrong.

The tile now states the height it actually renders at - 114px, with the padding and the border folded into it (box-sizing: border-box), which is what the mobile rules in the same file already do for the same reason. Nothing moves except the two bordered tiles, which lose the 8px they were never meant to have. The guard compares RENDERED heights now, borders included, instead of comparing the declared min-height of two tiles that were both content-box - which is how this went unnoticed while a test watched it.

The last piece of #1173: "combine all import options to same template". They were fourteen - a link per source in a pop-over, each going to its own address - and the page each one landed on never said which other sources existed, so "where do I import a Jira export" was answered by a menu somewhere else, if you knew it was there.

All Boards / + Add Board / Import is now one full-width page that lists every source it can read - Trello, Jira, CSV/TSV, Excel, Kanboard, NextCloud Deck, OpenProject, GitHub, GitLab, Gitea, Forgejo, Asana, Zenkit, and a previous export of this WeKan, named with the Product name this instance is branded with rather than with a product the reader has never seen.

Under the source picker are the same what to include checkboxes every export offers, from the same list, and on this side they say what comes IN. That works for every source without teaching five different creators a selection each: the parts that were not ticked are taken OUT of the parsed document before any creator sees it, and a creator that never sees a comment cannot import one. A section that was not ticked is EMPTIED rather than removed, because the creators read board.comments directly and an undefined array is a crash where an empty one is "there were none". A source's own name for a part is pruned with it - Trello calls its comments actions - and a key this list does not know about is left alone rather than silently dropped.

/import/:source still works, under its own route name, so every existing link, bookmark and back button lands exactly where it did.

The round trip was half a round trip: a card imported from a swimlane, list or card menu arrived with its checklists and comments and without its files.

A .json export carries each attachment's bytes as base64, and the importer now writes them the way the board import always has - the server-side Meteor-Files writeAsync, one attachment at a time. A .zip carries them as the files they are, named attachments/<id>-<name>; the archive is unpacked in the browser and each file is put back on the metadata row its id names, so the server sees the same document either way and there is one import path rather than one per container.

An attachment lands where its CARD landed - the list and swimlane it is in now, not the ones it was exported from - and one unreadable file is warned about and skipped rather than losing the rest of the import. A url attachment from an older export is still fetched through the downloader that validates and pins every hop, so FollowBleed stays fixed on this path too.

The whole-board import on the new import page takes a .json or a .zip the same way, through the same reader, which is the case the .zip exists for: a board whose attachments are too large to sit inside one JSON string.

Reading an archive in the browser and sending its attachments as base64 over DDP is fine for a card and wrong for a board: 2 GB of attachments become 2.7 GB in one message, in the browser's memory and then in the server's.

A .zip now goes to POST /api/import/zip as the file itself, and nothing is ever whole in memory on the way in. The request body is streamed to a temp file as it arrives; unzipper.Open.file reads the archive's central directory, so entries are opened on demand rather than inflated together - the same approach the backup restore already takes; and each attachment is piped from the archive into the attachments collection by addAttachmentFromStream, which writes it to a temp file and hands Meteor-Files the PATH rather than a Buffer. That helper is lifted out of the attachment-copy code that already did exactly this, so there is one way to add an attachment from a stream rather than two.

Where the files END UP is not decided by the import: addFile fires the collection's onAfterUpload, which validates the file and moves it to the default storage configured in the Admin Panel, exactly as an ordinary upload does.

The upload is capped as it ARRIVES rather than after (WEKAN_IMPORT_ZIP_MAX_BYTES, 5 GB by default), so an oversized archive never lands, and the temp file is removed whatever happens. An entry's name is data and never a path: only the attachment id before the first dash is read from it, the temp file is named by WeKan, and the path is built through the same safeEntryPath containment check the backup restore uses - so an entry called ../../etc/cron.d/x can only ever be an attachment with a strange name (ZipBleed).

A .json still travels as a document over DDP, which is what it is.

Three things about the page that lists the sources. The pop-over that opens it said "Import board (Trello, Jira, WeKan export, CSV, Excel, ...)" - a list of five of the fourteen sources, in a menu whose only job is to get to the page that lists all of them - and now says Import board and nothing else.

Import from: and Select what to include: were rows of grey ticks that were never anything else: a fa-check drawn once per row, the same shape whether that row was chosen or not, so the answer to "which one did I pick" was a shade of grey. Both are the app's own animated checkbox now (.materialCheckBox, the one Admin Panel / Announcement uses), which grows its green tick out of the empty square over 0.2s, so a click is visible as it happens. The box and its label are spaced apart by the same amount ticked or unticked - the checked box is a narrower shape shifted left, so the two margins differ by exactly that shift - and the row itself declares no alignment of its own, because the tick's rotation is written for the plain flow and an align-items: center on top of it lands the tick on the first word.

The two questions sit side by side when the window has room for two 280px columns and stack when it does not, so the second one is not below the fold on a page whose first list is fourteen rows long. No source is chosen to begin with, and choosing one un-chooses the last, because an import reads one file in one format; every part is ticked to begin with, because an import that silently left things out would be worse than one that asks.

And Import without mapping members (map later) is a primary button like the Import it sits beside. It was the one unstyled button on the page, which reads as disabled - and it is not a cancel, it is the same import with one question skipped.

A board on the clearpink theme was a pink rectangle floating inside a grey tile, while the flat-coloured board beside it filled its tile edge to edge.

Two lists decided what a tile is coloured with. boardColors.css painted .board-list .board-color-<name> a - the LINK inside the tile, which sits inside the tile's own 24px/18px padding and so can never reach its edges - and boardsList.css carried a hand-copied list of seventeen flat background colours on the tile itself, which is what made the flat themes look right. The five colour SLIDE themes added later were never copied into that list, so their tiles kept the default grey and only the inset link showed the slide. clearblue was in the list, flattened to one hex, so it did not show its slide either, and Clean Dark and Clean Light were in neither list.

There is one list now. Each theme paints .board-list li.board-color-<name> where it paints its header bar and its Public Boards row, the copy in boardsList.css is gone, and a tile is the whole tile at every theme.

The other half of a theme is the text on it. A tile writes its title in #f6f6f6, which is right on the fifteen dark themes and invisible on a light one: Apple Glass Pastel's tile is a pastel wash from #f6f7fb, so its name and description were white on near-white and only the tile's shape said a board was there. Both light themes now write their title, description and archive line in their own dark ink, and darken the card-count pill and the unstarred star that sit on the same tile - in ONE block, named as the place a third light theme goes, because a per-theme copy is what caused the first half of this.

The Clean Light theme's top bar is #F1F1F3, and header.css paints every icon in that bar white by id (#header-quick-access i.fa). The buttons inside a ul li escaped that through a more specific color: inherit and took the theme's own text colour; the house and the notification bell are in no ul li, so they stayed white on near-white - the bell's LABEL was readable beside a bell that was not there, which is how it was noticed.

Both are dark now, and so is everything beside them: the bar's labels were rgba(10, 10, 20, 0.5) and its board title full black, so fixing the two icons alone would have left the bar at three darknesses. There is ONE shade in it now. The current entry used to be the dark one among pale ones - a difference that no longer exists - so it is the full-black, heavier one instead. A bell with something to report keeps its white glyph, because it is on the red circle then and not on the bar.

The dividers between the bar's groups - the seam that separates the page's own controls from your account - are white too, a background in the first bar and a border in the second, so on this theme they were not there at all. They are in ink now, at the divider's own weight rather than the text's: a hairline as dark as the label beside it stops reading as a seam and becomes a stroke. The starred group's outline - the box around the caret, the count and the star - was white for the same reason, so the three sat loose on this theme; it is the same 0.7 in ink now, which is the dark outline the phone/desktop toggle beside it already draws for itself and why that one looked right and this one did not.

Hovering an icon lightens it - #header-quick-access i.fa:hover goes to #ccc - which on a dark bar reads as "brighter, so you know you are on it" and on this one made the house fade towards the bar it sits on. On this theme it goes the other way, to full black, which is the same message read the right way round for a light bar.

And with Member Settings / Change color / All Boards on, a tile is the theme's own fill rather than the accent under a flat white veil. The veil made every tile one shade lighter than the selected row in the left menu beside it, which reads as two colours rather than as one page. It reads --theme-accent-fill now, not --theme-accent: the accent is ONE colour - the solid end of a colour-slide theme - so on clearorange the tiles came out flat beside a menu row that slid. The fill is the theme's slide where it has one and its accent where it does not, which is what every other themed control already reads. The popup's own All Boards button is filled from the same variable, because the button and the tiles it turns on are one decision and were two looks.

On the Modern theme the popup that asks all this was a single narrow column of swatches. That theme set width: 260px on every popup's content, so any popup that asks for width by name - Change Color, Export board, Show on Card, Show on Minicard - was pinned to 260px whatever it had asked for. A theme decides what a popup looks like; how wide it is belongs to the popup, and the declaration is gone.

And on the Dark theme that popup had no title bar at all. That theme hid every popup's header outright, and the header is not decoration: it carries the popup's title, the back arrow into the popup it came from, and the X - so "Change Color" was an untitled panel that could only be left with Escape or a click outside. No other theme does that, and Dark no longer does either.

Picking Largest grew the page heading and the minicards and left the header bar, the left menu, the lists, the swimlane header and every popup exactly as they were - a setting that half-works, which is harder to use than one that does nothing.

The preset was a percentage on the root element, and a root percentage only reaches text whose size is written in a RELATIVE unit: rem is measured against the root, em against its parent. WeKan writes most of its sizes in px, and px is absolute - no root percentage moves it. So exactly the rem-sized parts scaled. The base rule made it worse: html, body, input, select, textarea, button re-stated font: 14px …, so the body took the stock size straight back off the scaled root, and everything inheriting from the body with it.

The preset is now published as a NUMBER as well (--wekan-ui-font-scale), and every px font-size and line-height in the client stylesheets - 433 declarations across 37 files - is written calc(14px * var(--wekan-ui-font-scale, 1)). One preset moves the whole interface. line-height scales with the size on purpose: 21px of type in an 18px line box is the same setting half-applied.

Nothing renders differently until a preset is chosen: the fallback in every one of those declarations is 1, and the variable is REMOVED for Default, so an instance where nobody touched the setting computes exactly the sizes it always did. The base font rule is split into font-family and font-size because the shorthand's size was the one thing the setting had to be able to move. A guard fails on any bare px font-size or line-height added later, so a new one cannot quietly opt out of the setting.

Colour is inherited, and it was set on <body> and the form controls, so it only ever reached text that had no colour of its own - and WeKan gives most of its text one: the header bar's buttons, the left menu's rows, a minicard's title, a list header. Choosing green recoloured the page heading and the menu and left the rest exactly as it was. It is set on every element now.

.fa is left out, because those are Font Awesome GLYPHS rather than text - a red alert and a green tick mean something by being that colour - and the icons that are meant to follow their label already say color: inherit, so they follow this anyway.

A colour painted behind the text needs elements to sit on, and neither choice of them looks good. On the boxes - which is what it did, from <body> - it painted the whole window: the board canvas and the empty space under the lists, which is a page background and not a text background. On the elements that actually carry text it striped every heading, menu row and paragraph with a full-width band. A setting nobody can make look good is worse than no setting, so it is removed rather than tuned a third time.

The wheel and its Unset button are gone from the popup, nothing reads profile.uiTextBgColor, and no stylesheet rule paints it. A profile that already HAS a colour is cleaned rather than left dormant: setUiColors unsets the field on every call, whatever it is passed - and it still accepts the argument, so an older client cannot fail against a newer server. The schema key stays declared for exactly one reason: a modifier touching a key SimpleSchema does not know is rejected, which would leave those profiles the only ones that could not be cleaned.

The text colour beside it stays.

All three places render the same picker, so the Custom color wheel was already written for all three - it was just never reachable in two of them. It appeared only once a named theme had been SELECTED, and a board always has a colour whose first entry is flat, so Board Settings / Change Color always showed it; Member Settings / Change Color and Admin Panel / Settings / Visibility open on Default (no override) with nothing selected, so both looked as though they had no custom colour at all.

The wheel is offered from that state too, as the flat category's single colour - which is what a custom colour means with no theme under it - and choosing one applies it over the first flat theme. That fallback was already in the code that saves; it is now written into the picker's own selection as well, because otherwise the wheel would store a theme the page did not show as chosen and the next click would read the selection back as none.

Picking a clear theme first still gives the two wheels its colour slide needs. One helper answers "which category's custom colours is this picker offering", so the wheel, the preview and what gets saved cannot disagree.

There were two export menus. The board popup wrote nineteen formats of its own under four subheadings, in two panes across the width of the window; the swimlane, list, card and checklist popups wrote five in one narrow column with no panes. So "the export popup" looked like two different features depending on which menu opened it, and a format added to one was missing from the other.

They are one template now, drawing one TABLE of formats. Each entry says what it is - an icon, a label, and either a path to download or a class to click - and which scopes it belongs to: BOARD_ONLY for the ones that only make sense for a whole board (the HTML archive, the dependency graph, the CSV columns and the exports written for Trello, Jira, Kanboard and the rest), and nothing at all for the ones that work anywhere, because exportUrl already carries the scope - a swimlane, a list and a card differ from a board by a query parameter, not by a route. The board popup is now the same one-line include the other four are, with no markup and no URL builders of its own; the nineteen helpers that built those URLs are gone with the list that called them.

All five get the board's panel: what to include in one pane and what to export it to in the other, side by side when the window has room and stacked when it does not, pinned to the viewport so the header and its X are always reachable. The layout is written against the panes' own class rather than against one popup's name, so it cannot be true of one menu and not another.

Which scope a popup is, is asked in ONE place - and every scope is named there, because a scope left out would be read as "a whole board" and offered a board's formats.

The card, list, swimlane and board menus each had ONE row, and each named itself differently: Export card, Export list / Import, Export swimlane / Import, Export board. Two of them mentioned an import that was a section inside the popup rather than a thing you could go to, and the card and board menus did not mention it at all - so importing into a list was discoverable and importing into a card was not.

Each of the four now has Export and Import, in that order. The rows are named for what they do and not for what they act on: the menu already says whether it is a card, a list, a swimlane or the board, so Export card inside the card menu said "card" twice.

Both rows open the same popup - the same panes, the same table of formats, the same what to include selection - with one difference: the second pane offers the formats to write out, or the file to read in. The selection means the same thing in both directions, which is why it is the pane they share.

Import writes, so it is offered only to somebody who may change the board. That question is asked once, in one function, registered as a helper the four menus use - and asked AGAIN inside the popup, because a row that is merely hidden is not a permission check.

Search - finding a card by what people call it.

#5006, open since 2023: "A customer has just hinted us that we are not able to search cards by its number (#)". A card carries a number, the board shows it, people quote it to each other in meetings and in tickets - and the one thing that could not be done with it was find the card again.

number:12 now does, in the global search and everywhere else that parses the same query. It is an EQUALITY match on a number rather than a regular expression on text, which is the whole difference between finding card 12 and finding cards 12, 120 and 312. number:abc is refused with the same "expected a number" error limit: already gives, because a string never equals a numeric field and a search that quietly finds nothing teaches nobody anything.

The issue's title says "number/#", and both of those forms work too: #12 and a bare 12 search for a label called 12 AND the card numbered 12. A board calls a card "#12" and a label can be called anything, so which of the two somebody means cannot be read off the text - answering with both is the only reading that never hides what they were looking for.

The two halves are joined with OR, which is what makes that safe rather than destructive: a search that used to find a label called 2024 still finds it, and the card numbered 2024 is ADDED to the answer instead of replacing it. An AND would have found nothing at all in almost every case and looked like the feature working. Only a term that is entirely digits gets the second half, so #red is the label red exactly as before. And #12 on a board with no label called 12 no longer reports "label not found" - the card-number half is a real answer, and a not-found message beside the card it just found contradicts the screen.

Board, swimlane and list export - printing a board, and what goes in it.

Two halves of the same menu.

The selection now reaches all of it. PDF, Excel, JSON and .zip took the parts checkboxes; CSV, TSV, Kanboard and the eleven JSON dialects built their own addresses and could not carry them, so ticking "no comments" changed four downloads out of nineteen. Every board export link is built by the one url helper now, so ?fields= rides along with all of them.

What a format can DROP depends on what it has, and that is the honest part. A CSV has no comments to leave out - what it has is columns, so the selection lands there: unticking People removes five of them, Dates removes eight, Custom Fields removes the trailing block. One mask filters the header and every row, so the two cannot drift apart. A Trello, Jira or GitHub export carries a title, a description, a due date and labels; those three parts are gated and nothing pretends to gate what is not there.

It is a full-width panel, and its X is always reachable. It was anchored to the button that opens it and clamped into the window using an assumed width - and the assumption and the stylesheet disagreed by a few percent, so on a narrow window the panel's trailing edge, with the pop-over's own X on it, ended up past the edge of the screen: Escape or a click away were the only ways to shut it. It is pinned to the top of the viewport now, at the 10px gutter every popup keeps, and is calc(100vw - 20px) wide - the whole window, less that gutter on each side - so the header, the X and both panes are always on screen.

And the menu is a menu again. Twenty-odd entries under three subheadings were a single column you scrolled past. On a window with room it is now TWO PANES - what to include on the left, what to export to on the right - each filling its own width with as many columns as fit, so the whole menu is visible at once. The panes are grid COLUMNS, which is what makes the right-to-left case free: a mirrored page puts the first column on the right, so the selection lands on the right and the formats on the left with no second rule to write or forget, and the divider between them is a border-inline-start for the same reason. Below 800px they stack, because popup.css already lays every popup out as a full-screen sheet there, which is what a phone should get. The 1100px width is mirrored in client/lib/popupOffset.js, which places a popup using its width: left at the default 380 a wide menu opened near the right edge lands most of the way off the screen.

A rule sits above each subheading, so a group's name says where the group before it ended - one rule per heading and no stray separators, which a test counts.

Template.exportScopeBody.helpers(...) runs at module scope, and it throws when that template is not defined YET. That does not break one popup - it stops the module evaluating, so every template registered after it never registers either. The visible symptom was the SIGN-IN page: a blank form and

Uncaught TypeError: can't access property "helpers", Template.exportScopeBody is
undefined
[UserAccounts] Warning no template passwordInput found!

The central lists in client/features/*.js import a component's .jade before its .js, which is enough for a component nobody else imports. The export popup body is imported by the sidebar, by the card details and by the import page, and whichever of those is reached first evaluates it - long before the feature list gets to the template. It imports its own .jade now, so the order is a fact rather than a hope.

A guard in tests/clientBundleImports.test.cjs checks the whole rule, and found a second component with the same fragility that had not fired yet - migrationProgress.js, imported by boardBody.js. Fixed the same way.

It was nineteen entries in one list, each spelling out its whole family: "Export / CSV (,)", "Export / CSV (;)", "Export / TSV", then eleven lines beginning "Export / JSON /". The part that differed - the only part worth reading - started two thirds of the way along every line.

A subheading names the family once and the entries under it say only what they are: PDF, Excel and HTML, then Dependencies (JSON, SVG), CSV ((,), (;), TSV) and JSON (JSON, JSON without attachments, .zip, Kanboard, Trello, Jira, NextCloud Deck, OpenProject, GitHub, GitLab, Gitea, Forgejo, Asana, Zenkit). The .zip sits with the JSON it is a container for.

The parts checkboxes stay at the top, from the shared popup body: the board passes hideFormats because it lays the formats out itself, and borrows the selection rather than growing a second copy of it. Its links are built by the same url helper every other menu uses, so a menu cannot send a different selection than the one on the screen. Nothing was dropped in the regrouping, and a test walks the whole list in order to say so.

The board's Export menu had JSON; nothing else did, and there was no .zip at all. Both are now offered wherever an export is - the board, a swimlane, a list, a card and a checklist - from the same popup, with the same checkboxes deciding what goes in.

They are the same export in two shapes, not two exports. The document is written by models/exporter.js's streaming writer either way, so a .zip's wekan.json and a .json download of the same scope are the same bytes. What differs is where the attachments are: base64 INSIDE the document for JSON - or omitted, with the existing "without attachments" option now offered at every menu - and beside it under attachments/ as the files they are for the .zip.

Both halves stream. The JSON writer already wrote a document at a time from raw cursors with backpressure; the .zip gives it a PassThrough that archiver compresses as it fills, and pipes every attachment from the file store rather than reading it into a Buffer. A board with a gigabyte of attachments costs a gigabyte of disk reads and not a gigabyte of RAM - which is what makes the .zip the shape to use when the JSON is too large to hold as one string.

A SCOPED export is the same wekan-board-1.0.0 document with fewer rows in it, plus the lists and swimlanes its cards refer to, so what comes out can be imported back into somewhere. A section the popup did not tick is an EMPTY array rather than a missing key, for the same reason. A checklist scope exports the card that holds it, because a checklist alone has nowhere to land.

#1173 "Add Feature: Print Board with Params" has been open since 2017, and two things were missing. There was no CHOICE of what to print: the board's Excel and PDF exports took everything they knew how to render and nothing else, while the card export already had a popup with a checkbox per section. And they did not LOOK like the card export - the board's Excel export was a spreadsheet table, one row per card and eighteen columns, which is a data dump rather than a printed board.

Both now render a board as the board's own header followed by every card as the CARD export's block, drawn by the card export's own code - cardBlockLines() for the PDF, ExporterExcelCard.renderCardBlock() for the Excel one - so a card looks the same whether it was exported alone or as part of its board, and the two cannot drift into two layouts again. Each card starts on its own page in the Excel export, because a printed board is read a card at a time.

The swimlane and list menus offer the same export, which is the board export with one more parameter saying which cards are in scope. They sit beside "Copy link" rather than below the permission checks, because exporting is reading. The file is named for what was exported - a PDF titled with the board that holds one list is a file nobody can place afterwards.

Rendering a card block needs the whole board in memory, and models/server/ExporterExcel.js STREAMS on purpose - it was rewritten that way after the in-memory version ate gigabytes on boards with thousands of cards. So that exporter is still there and still reachable: unticking Card details asks for it. That is a checkbox in the popup, not a silent fallback nobody can see.

The card export's popup had a list of sections, and the server had another one, under a comment reading "Must match ALL_FIELDS in models/server/ExporterExcelCard.js" - which is a comment, not a mechanism. A section added on one side and forgotten on the other is either a checkbox that does nothing or a section nobody can turn off.

Both now import models/lib/exportFields.js, and so do the board, swimlane and list popups, which are ONE shared body - exportScopeBody - included with a different scope each. The selection is remembered for the session, because somebody printing a board rarely wants a different shape for each list of it.

The same ?fields= gates the same sections in both formats: the card export's checkboxes used to be labelled "fields to include in Excel export" and did nothing to the PDF, so one popup meant two things. A section a request does not name is not rendered and, where the export is the only reason to read it, not even fetched.

Titles - renaming a thing where its name is written.

A list's title has always been edited in place: click the heading, type, save. A card's title could only be changed by opening the card, so correcting a typo on a board of forty cards was open, edit, close, forty times - which is what #4990 asked about, in 2022.

The minicard's title text is now an inlinedForm, the same component the list heading uses, with the same textarea, Save button and X. Only the TEXT opens it, and only for somebody who may write: the complete checkbox, the linked-card icons and the card number beside it keep doing what they did, and everything else on the card still opens the card. A title nobody may edit still opens it too.

The minicard sits inside the link to the card, so a click in the open editor would have navigated away mid-rename. That default is cancelled - except on the Save button, whose own default IS the submit, and which the browser picks over the link around it because the innermost element with an activation behaviour is the one that runs. An empty save is a no-op rather than a way to end up with a card that has nothing to click.

Half of the title edits; the other half drags. With drag handles OFF a card is dragged by its own body, so a title that is entirely an edit target leaves nowhere on that line to take hold of - a grab that moves a few pixels is a click, and the editor opens instead of the card moving. The edit target is the LEADING half (left in English, right in Arabic, from one logical edge) and the trailing half is there to drag from. With handles ON the handle is the only drag source, so nothing has to be reserved and the whole title edits.

The opened card's title splits the same way, and its drag handle now appears only when drag handles are on - with them off, the title bar is what moves the window. The drag surface there is the header ROW rather than the heading: a heading is only as wide as its own text, so on a short title "the trailing half" was a few pixels and the empty space beside it - the obvious place to take hold of - belonged to nothing. The heading fills the row now, and the handler steps aside for the buttons in it, for the drag handle when there is one, and for the half that edits.

The board's name in the first header bar had a pencil next to it. Two targets for one job, and the smaller of the two was the one that did it.

The name itself now opens the rename popup - the SAME boardChangeTitlePopup that the pencil opened, with the title and the description in it, so only what you click to get there changed. It is opened with the board as its data context, because that bar's context is the page rather than the board. Board admins only; everybody else sees a plain title, as before.

A board whose title is EMPTY renders no text at all, and an element with no content is zero pixels wide - so there would be nothing to aim at, and an empty title could never be given one. The clickable title carries a minimum width and height for exactly that.

Card and minicard menus - the settings about a thing, in that thing's menu.

What subtasks DO on a board - whether they are shown at all, which board and list a new one is deposited in, and how a parent is named on a minicard - was in Board Settings only: open the sidebar, open the board menu, find Subtasks Settings. Somebody who wants to change it is usually looking at a subtask on an opened card at that moment.

It is behind a hamburger at the end of the Subtasks heading on an opened card - where the card and the minicard already keep theirs - and clicking it opens the same popup Board Settings did. Board Settings no longer has the entry: the settings are where subtasks are.

The heading IS the control that folds the section, so the hamburger's click has to stop there. Without that, opening the menu would close the thing it was opened from.

It is the SAME template in both places, with its own state, helpers and handlers, so neither place needs code of its own and the two lists cannot drift. That is what the move needed: a template included in two places cannot reach its parent's helpers, because a helper is looked up on the template it is written in.

The heading row named the columns of a ROW - Show on Card over the checkbox and Description over the setting's name - which is what they labelled, but not what they looked like. The rows flow into as many columns as the window fits, so the two headings sat above the FIRST of three or four columns and read as if they named those: Show on Card over one column of settings and Description over another, when both columns hold the same kind of row.

The first heading also said what the popup's own title says. Show on Card opened a popup titled Show on Card and repeated it a line below, and the same for Show on Minicard.

Both are gone, and the two-pixel rule under them with them - one more line across a popup that is a list of lines. A row is a checkbox and the name of a setting, which needs no heading over it. One template serves both popups, so both lose it together, and the sticky positioning that existed only to keep those headings in view while the rows scrolled goes with it.

Board Settings / Card Settings is a table of twenty-four settings with two columns - what a card shows, and what a MINICARD shows - and it lived in one place only: the right sidebar, four clicks from the card whose fields it decides.

It is now also the first entry of the two menus it is about. The hamburger on an opened card offers Show on Card, the hamburger on a card on the board offers Show on Minicard, each followed by a rule like every other group in those menus. Both open the SAME popup with the other column hidden by a class, so there is still one list of settings and one set of handlers: a setting added to the table appears in all three places by itself, and none of them can drift from the others.

Both are wide, and lay their rows out in columns. Two dozen settings in one column is a list nobody sees the end of - "is Description on?" was somewhere below the fold. With one of the two checkbox columns hidden each row is half as wide as it was, so the popup is min(90vw, 900px) and the rows flow into as many columns as fit: one on a narrow window, three or four on a wide one, with the headings still spanning the width because they name the columns of a ROW rather than of the grid.

The permission is the one Board Settings already used - a board admin - asked in the menu and again where it acts. The one menu is opened from two places and its data context is the card either way, so the opener says which hamburger it was in client/lib/cardMenuSource.js: a module-level reactive value, not a field on the card document, which is gone the next time Blaze re-renders the popup with a fresh copy of it.

It was in the right sidebar under the People and Organizations tabs, which is not where anything else about a minicard is. It is a row of the same table now, directly under Labels, named "Labels text" with the Labels icon and the Description Text icon in front of it - because it is about what those labels look like on a minicard: coloured words, or coloured bars with the words left out.

It is ticked when the text is SHOWN, which is what a board does out of the box. The stored flag is a "hidden" one, so reading it straight through would have left the box unticked for the default behaviour, which reads as a broken checkbox.

It is the one PERSONAL row of a board-wide table - the user's own profile, or this browser when nobody is logged in - so it appears in the minicard's view and nowhere else, and it is offered to EVERYBODY. A reader who is not a board admin gets that row alone rather than a table of checkboxes the server would refuse.

The move found a bug. The setting was written out three times, and the minicard's own copy only ever wrote localStorage: a logged-in user toggling it set something nothing reads, because for a user the value is read from the profile. One module reads and writes it now (client/lib/minicardLabelText.js), so the two halves cannot disagree again.

The board's LIST of custom fields - where a field is created, renamed or deleted - was in Board Settings only, and the picker for which of those fields are on THIS card was down among Voting, Planning Poker and Spent time. Two halves of one subject, three groups apart.

They are one group now, under Watch and its rule: Custom Fields first, because a field has to exist before a card can be given it, then Edit custom fields, then a rule like every other group in that menu. A board admin's, the same as in Board Settings.

Card Settings is gone from Board Settings. Every setting in that table is in the menu of the thing it is about now, so a board-wide entry as well would be a third way to one list - and the way that is furthest from what it changes. The table itself is unchanged; the two menus include it.

Everything about custom fields is on the section that shows them. It was spread over three places: Board Settings had the board's LIST of fields behind a right-sidebar view, the card menu had an entry for that list and another for the picker of which fields are on this card, and the picker had a cog that jumped back to the sidebar - closing the menu and the card pane on the way.

One place now: the hamburger at the end of the card's own Custom Fields heading. It opens every field the board has, ticked when it is on THIS card, with a pencil each and, under a rule, Add custom field. Edit and Add open in the same pop-over on top of that list, so the back arrow returns to it and the card stays open behind; they are the board's own forms, not second copies of them. The card menu's entry and the Board Settings row are both gone, and so is the wrapper popup that nothing opened any more.

It was a line in the card's menu that read "Show list on minicard", or "Hide list on minicard" once it was on - a menu entry that changes its own name is the shape a checkbox has, drawn as a sentence. It is a checkbox now, the FIRST row of Show on Minicard, above Received, named List title and unchecked by default, which is what the field itself has always been.

It shows the name of the LIST the card is in on its minicard, which is worth having where a card is read away from the column it lives in: a swimlane, search results, My Cards. The board-wide "Show lists" row further down the same table turns that on for EVERY card; this one is for a single card that needs it, and either is enough for the name to show.

It belongs to the card rather than to the board, so it is drawn only in the minicard's own view - Board Settings has no card to act on - and only for somebody who may change that card, which is the permission the menu entry had. The card is passed into the popup and re-read from the collection when it is toggled: a minicard's menu is opened from the board, where there is no "current card" to fall back on.

On the minicard itself the name sits on its own line under the badges. It was landing BESIDE them: the badge row is float: inline-start, so the line after it shared its row and read as one more badge rather than as the line it is.

Two popups of the same menu answered one question. Change Background Image asked for a URL; Board backgrounds listed the images uploaded to this board and carried the upload button. So the popup that reads as the place to set a background had half of the ways to set one, and the other half was behind a different entry.

The upload is under the URL field now - a picture from the web and a picture from this machine, read together. Board backgrounds keeps what it is named for: the images already there, to set active, download or delete. The uploader moved as its own template, once, rather than being copied.

In the same popup, Unset was five blank lines and a rule below the Save it belongs beside. They are one row, Save first, sharing the width. Unset is type="button": inside that form a button with no type is a SUBMIT button, so beside Save it would have saved the URL it is meant to clear.

The two sections at the top of the right sidebar could not be folded at all. The People / Organizations / Teams / Domains tabs with their avatars, and every label of the board, were always open and pushed everything under them down the panel.

Both have a caret in front of their heading now, and the heading is the button

• the same control an opened card's sections use, and the same one Activities got below them. Folding Members hides the tabs and the avatars in them; folding Labels hides the labels and the + that creates one. Enter and Space do what a click does.

The choice is the reader's and lasts the session, not the board's: neither decides anything on the server, so folding them for yourself must not fold them for everybody. Activities is the exception and stays as it is - its caret writes board.showActivities, which also decides what the publication sends.

A caret leads the group, at its leading edge - left of the lock in a left-to-right page, right of it in Arabic, because its direction comes from the same rule every other caret uses. Folded, the seven controls after it are gone

• Private, Muted, Sort Cards, Filter, Search, Show dependencies and Multi-Selection - and the bar is the logo, the board's name and the caret.

The buttons a board's own Rules put in that bar are NOT folded with them: somebody added those to this board on purpose, so the standard controls fold around them. It is named by the words the app already has - Collapse and Uncollapse - so no key was added to 147 language files to say them again, and it answers Enter and Space like the button it says it is.

All three folds share one store, one helper and one class (client/lib/foldState.js): a caret in the header and a caret in the sidebar pointing different ways in one language is the bug that avoids.

The heading read "Activities" and beside it sat an eye and the words "Show activities" - one setting with two controls and its own name said twice. It is a caret in front of the heading now, and the heading is the button: click it and the activities appear under it, click it again and they are gone. That is the same control every collapsible section of an opened card has, from the same function (client/lib/sectionCaret.js), so the caret cannot point one way on a card and another in the sidebar of the same language - it points down when open, and toward the text when closed, which is right in English and left in Arabic. It carries role="button" and a tabindex, so Enter and Space do what a click does.

and fixes the following bugs:

The release workflow - what reaches the Release page.

v10.91's release run failed in four jobs, and three of them - s390x, ppc64el and riscv64 - had done all the work: each snap BUILT on Launchpad and each was published to the Snap Store. What failed was attaching it to the GitHub Release:

HTTP 404: Not Found (https://uploads.github.com/repos/wekan/wekan/releases/370103352/assets?label=&name=wekan_10.91_s390x.snap)

The step collected the file with two patterns - wekan_${VERSION}_<arch>*.snap and *_<arch>.snap - and a snap called wekan_10.91_s390x.snap matches BOTH, so the same path was passed to gh release upload --clobber twice. Asked to attach one name twice, it deletes the asset it has just uploaded and then 404s on it. The two other places in the same job that build this list were already deduplicated; this one was missed.

It is deduplicated now, and the attach is confirmed from the other side the way the native snap job already did it: read the release's assets back and fail if this snap is not among them. An upload that reports success and leaves nothing behind is the failure nobody notices until somebody's download 404s - and here every job that lost an architecture had already said the snap was built and published.

The fourth failure, armhf, is not this: snapcraft died with SSLEOFError while downloading the build log from Launchpad, on all three attempts, and produced no snap. That one is Launchpad's side of the wire.

v10.92's release job failed before running a line of its script, and with it every job that needs the release - snap, docker, AppImage, the Windows and macOS bundles - so nothing published at all:

  ##[error]An error occurred trying to start process '/usr/bin/bash' with
  working directory '/home/runner/work/wekan/wekan'. Argument list too long

Nothing in the step was wrong. The notes are the whole newest CHANGELOG section - prepare measured them at 172,458 characters - and they reached the step as env: CHANGELOG:. Linux caps a SINGLE argv/envp string at MAX_ARG_STRLEN, 128 KiB, so execve refused to start the shell. The amd64 and arm64 bundles had already built and verified; only the publishing died.

The environment was itself the fix for the PREVIOUS failure. Interpolated inline as ${{ }}, the notes become part of the shell SOURCE, so a backtick in any code span runs as a command: that is how v10.59 published nothing and printed Incorrect: command not found. One shape is unsafe and the other does not scale, and this release was the first big enough to find the second wall.

So the notes stop being a shell value at all. releases/release-notes.sh prints the CHANGELOG section for a version, reading the file itself and taking its arguments from the environment inside a QUOTED heredoc, and each job appends its stdout to release-notes.md. Only file PATHS are passed around, which has no size limit and leaves the text as data that no shell ever parses.

prepare keeps the validation - a missing section is still cheap to fix there - but no longer publishes the text as a job output, because an output nobody can safely consume is a trap for the next person to find. The release job and the notes-rewrite job check out ref: main, the same ref prepare read.

The guard test is rewritten around the new shape: no changelog job output, no CHANGELOG in an env:, no interpolation into a script, and the extraction script is what all three consumers run. It passed throughout this failure, because it only knew about the injection.

Starting up - what a browser sees while WeKan cannot yet serve.

"We upgraded to 10.91 ... Gateway timeout appears" - #6595, from the same reporter as #6592, whose fix shipped in 10.91. It could not reach them: that fix is the SNAP's, and this is a container.

WeKan does not open its web port until the database answers, and in a container nothing else was listening while it waited - so a reverse proxy in front returned a gateway timeout, and that is the same symptom for two completely different faults: WeKan is broken, or the database has not come up yet.

The entrypoint now asks whether the database answers (one ping, with the driver already in the bundle), and while it does not it serves the same bridge page the recovery case uses, saying WeKan is waiting for its database and where to look. What is bounded is the PAGE, not the wait: a database can take minutes to come up after an update, and giving up on it would be worse than waiting - so when the window ends the page stops, WeKan starts, and WeKan keeps waiting exactly as it did before. WEKAN_DB_WAIT_PAGE=false turns it off.

Performance - what the database is asked, and what it has to walk.

Reported by email against 10.91: "Still slow on loading cards. Test server with me as only user." One user is the part that says what it is NOT - with nobody else on the server there is no contention, no queue and no lock, so the time is going into the queries themselves.

It was. cards, activities, cardComments, checklists and checklistItems had no index at all - everything a board draws and everything an opened card pulls in. "The cards of this list", "the comments of this card", "the newest activities of this board" each walked the whole collection. That is invisible on a demo board and expensive on a real one, and worse on FerretDB, whose SQLite backend has to walk the same documents.

The activities publication even explains that it keeps its selector flat "so both push down to FerretDB v1 (SQLite)'s index instead of forcing a full-collection scan" - and there was no index for it to push down to.

Each new index matches a selector the app really makes WITH the sort it really uses, so it serves both the filter and the order: a filter-only index still leaves an in-memory sort of everything it matched, which on a board with a year of history is the slow half. They are created through the same idempotent ensureIndex every other index here uses, so a restart does not rebuild them and a backend that refuses one logs it instead of stopping the server.

Attachments and the snap's databases - what can be read, and what cannot.

Moving from MongoDB CollectionFS to File-System stopped on some attachments with FileNotFound: file 66336fc372e64200010f4832 was not found, and the reporter had it exactly: it is the identical files.

A CollectionFS filerecord points at its binary by copies.<coll>.key, the id of a file in the cfs_gridfs.<coll> bucket, and TWO filerecords can carry the SAME key - the same file attached twice, or a board copied with its attachments. The migration deleted the binary as soon as it had moved the FIRST of them, so the second read a file that was no longer there. The binary now goes only when no other filerecord still names it, and when the question cannot be asked the binary stays: a file left behind can be removed later, an attachment deleted out from under another record cannot be brought back.

A binary that really is missing - metadata restored without the chunks - is no longer a MongoDB stack trace naming a GridFS id. It names the attachment, says where it was looked for, and counts as SKIPPED rather than failed, because there was nothing to move. The Admin Panel's summary line shows how many were skipped and how many failed, so a run that leaves attachments behind cannot look like a run that moved everything.

An instance whose MongoDB data was written by a MongoDB older than any mongod the snap carries printed this at every start, before the site came up: BOTH databases have been written to since the migration and then [autopick] reading both databases to see which one holds the work ....

mongodb_has_data answers "are the files there", not "can anything here open them", and on that instance those are different answers - mongod 7, 5.0 and 4.2 each refused the files in turn. So the comparison ran on a copy that cannot be served, and it is not a cheap question: it starts a mongod that cannot open the data, and then a SECOND FerretDB against the SQLite directory the running one already holds.

migration-control has already tried every reader in the snap and left .mongodb-data-too-old behind when none could open the files. With that marker present the MongoDB copy is no longer a candidate, and WeKan serves the FerretDB that has the data. Nothing is deleted and the marker stays: it is true, and it is right again on a snap that can read those files.

snap run wekan.database-compare answered MongoDB: <unreadable> and FerretDB: <unreadable> on a live instance whose wekan.sqlite was 85 MB and whose site was up.

FerretDB was unreadable BECAUSE it was up: SQLite has one writer, so the second FerretDB the comparison started against the same directory did not get the data. The tool then reported the database it had been talking to all along as unreadable, and refused to choose.

The live one is asked first now - evidence only counts and sorts - and a second copy is started only for a database that is not running. Both speak the MongoDB wire protocol on the same port, so which one is answering is asked rather than assumed: FerretDB names itself in buildInfo and a mongod does not. Reading one as the other would be a wrong answer given with confidence, which is worse than "unreadable".

The page sidebar - the controls of a page that has no sidebar of its own.

Rules, My Cards, Due Cards and Global Search each keep their controls in the shared page sidebar, and each draws them as .board-header-btn - which is what they were when they lived in that page's own second header bar.

Every rule for that class is scoped to #header-quick-access, so inside the sidebar they had NO styling at all. On the Rules page that is three bare links jammed onto one line - "← Board 🔀 Workflow view ⇄ Import / export" - with the icons run into the words and nothing to click but the text itself.

They are rows now: one per line, the width of the panel, with the icon in a fixed column so every label starts at the same x, and a hover to click against - the shape the board sidebar's own rows have. Both sidebars built on that shell get it, All Boards' as well as the page one.

Minicards - what a click on one does.

A hundred and fifty icons, eight to a row, in a popup 380 pixels wide: a column taller than the screen, so choosing a sticker meant scrolling past most of them.

It is as wide as the colour pickers now - min(90vw, 720px) - and the picker is a grid that fits as many columns as the width allows instead of stopping at eight. The clamp that places a popup knows the new width too, or a popup opened near the right edge would have landed half off screen.

Clicking a label opened the card's labels popup AND the card details behind it: the click reached the minicard too, so one click did two things and the one nobody asked for was underneath the one they did.

It stops at the label now. A click in the labels AREA that is not on a label is still the card's, as before - and which label was clicked is read from the EVENT rather than from :hover, which answers about the pointer and on a touch screen can still be true for whatever was tapped last.

Card details - the card as it is opened and edited.

Everything about custom fields moved to the hamburger at the end of the card's own Custom Fields heading - the picker of which fields are on this card, a pencil each, and Add custom field - and the card menu's entry, the Board Settings row and the wrapper popup went with it. But the heading itself was drawn only when the card already HAD a custom field on it.

So the one way in existed only once you were already through it. A card with no custom field had no heading and therefore no hamburger; a board that had never used them had no way in anywhere, because the sidebar view that still holds the create and edit forms is opened by nothing. It is invisible on any board that already has a field - which is every board a developer tests on - and the browser tests found it on a seeded board that had none.

The heading is drawn for every card its reader may write to now, the same condition the rest of the editable card uses. The FIELDS below it still come from the card's own values, so a card with none shows an empty section rather than a phantom row per board definition, and a reader who may not write sees no heading at all.

The anchor that used to open the old popup went too: the move took away its label text and left the tag, so it rendered nothing, could not be clicked, and still had two handlers bound to it. tests/customFieldsSectionMenu.test.cjs gains the two checks that would have caught this - the heading is gated on who may write rather than on what the card already has, and no empty anchor or orphaned handler is left behind.

Two things wrong with the popup the Custom Fields heading opens.

A new field made from it never appeared. Add custom field sits OUTSIDE the list of fields, so its data context is the popup's own - which is the CARD - and the create and edit forms are one form that decided which it was doing by whether its context had an _id. A card has one, so creating a field from a card ran the UPDATE branch against a custom field whose id was a card's: no such document, nothing written, and nothing said so. The same form works from the board sidebar, where the context has no _id, which is why this only ever happened from a card.

Both halves are fixed. The popup hands the form an empty context, because a new field is made from nothing. And the form no longer trusts a bare _id: it asks whether that id NAMES a custom field, so a context arriving from anywhere cannot make it update one that is not there.

The pencil that edits a field sat on a line of its own under the field's name. Every other pop-over list has ONE anchor per row, so the row is a block and the anchor fills it - and two anchors in a block stack. This list has two by design, the name with the checkbox that puts the field on this card and the pencil that edits the field itself, so the row is the flex container now and the name takes the space the pencil does not. Scoped to this popup, so no other list moves.

A pop-over draws its header from its title, and with no title it renders as no-title: no header, no X, no back arrow - Escape or a click away are the only ways out. Noticed on the question "Are you sure you want to delete this background image?", which is the worst place for it.

Ten of them were in that state, and each is titled the way the other 151 already were: a <name>Popup-title key. Delete Background Image, Delete Duplicate Lists, Delete Account, Add Domain, Remove Domain, Map to existing user, Export swimlane, Export list, Export checklist, and the member popup.

They were added to EVERY language file at the same position, as the English placeholder a pull would produce - the files are one key order, and a key inserted in some and appended in others makes every later diff unreadable.

The other mechanism, Popup.open(name, { titleKey }), is not a second way but the same one pointed at a phrase the app HAS - "Custom Fields", "Sort Boards", "Show on Card" - so a word already translated 147 times is not copied into a new key that would start as English in all of them. tests/popupTitles.test.cjs walks every popup template and fails if one resolves no title at all, so the next one cannot ship without a header.

"Upload background image" picked a file and then nothing arrived. Two fields of an upload's config are not optional in the way they look, and the board background's config - written by hand - had neither:

• fileId, and the same id copied into meta.fileId. Attachments' namingFunction is what decides the name a file is STORED under, and on the client it reads that id out of meta and deletes it. Without it the name is undefined.
• transport. HTTP everywhere, because Meteor-Files' default DDP floods the WebSocket and makes Safari reconnect at ~95%; DDP on Sandstorm, whose http-bridge strips the x-* upload headers so every chunk comes back "Can't continue upload, session expired" [408].

Both come from one builder now, in attachmentUploadConfig.js, used by the card's file picker, the card's pasted image and the board background alike - so the next uploader gets them by asking for a config rather than by knowing two things nothing would have told it.

One popup answers the whole question now - the URL, the upload, and the pictures uploaded to this board - and Board Settings / Board backgrounds is gone with the popup it opened: a second entry to a list that is already on screen is a second place to look for one thing. Clicking a PICTURE, or its name, puts that one behind the board; it used to be a 14px check icon in the row under an 80px picture of the thing it applies, so the obvious click did nothing. Download and delete stay in that row, being the two things a picture cannot say.

Three things around the upload made the failure impossible to read, and are fixed with it. insertAsync can reject BEFORE there is an uploader to listen to, and that rejection went nowhere: the spinner stopped, no message appeared, and the picture simply never turned up. It is caught and shown now. Each picture is listed with its NAME, because two photos are the same picture at 80 pixels and nothing said which one had arrived. And a finished upload puts itself behind the board: "add background image" is asked for by somebody who wants that picture there, and an upload that only lands in a list, with the board unchanged, reads as one that did not work.

getInitials() ended with this.username[0], so a user document that arrived without a username threw a TypeError - from a Blaze helper, mid-render. Two helpers call it, so each avatar threw twice, and the second throw left the SVG's viewBox half-written (0 0 15), which Firefox refuses outright: the avatar drew nothing and took the rest of that render pass with it.

It is total now: initials, then a fullname, then the first letter of a username if there is one, then an empty string - a blank circle rather than a broken page. A fullname of only spaces used to spell the literal word "undefined" in the circle, because an empty word still contributed its missing first letter; empty words are skipped.

The dropdown that chooses a card's date format disappeared, and nothing brought it back - the Received, Start, Due and End dates under the same heading were there, but the selector above them was gone.

Two things were folding it. #1591 gave every FIELD of an opened card a caret on its own title and hid everything after that title when it was clicked, storing the fold per card in the user's profile. The section carets that replaced it put ONE handle on each section's heading - and that heading is drawn on the first field of the section, so a click on it was also a click on a field title. The old handler ran too, folded that field, and stored it. Reopening the section brought the dates back but not the field the heading sits on, and the per-field caret had been suppressed inside a group, so there was nothing left to open it: the Date Format select was hidden for good.

The #1591 half is gone - the handler, the caret it drew, the rule that hid the siblings, and the per-card state it re-applied on render. Every field lives in a section now, and the section's heading is the only handle. The same per-user store still belongs to the CHECKLISTS, which key their own entries by checklist id and are untouched; that is why the store itself stays.

Moving eleven sections with a script is how markup disappears without anything failing: the file still compiles, the tests still pass, and a card is quietly missing a row. Comparing the card against its state before the section work turned up four things, three of them lost:

• the card button row (+cardButtons) - a slice used it as a boundary and swallowed it;
• a custom field's name: +cardCustomField renders the value and nothing else, so a card with three custom fields showed three values with nothing to say what they were;
• the attachment count beside the Attachments heading, which the board setting for it still governs;
• and one thing GAINED that should not have been: a second, bare + beside the End date's add button.

All four now have a test of their own, because each was invisible to everything else.

The Copy card link to clipboard button carried only .btn, so it fell back to the plain grey button whose dark label is nearly unreadable on a dark theme. It is a .primary now - the board's accent with white text - named in the same rules as the other themed buttons rather than given a copy of them.

Grouping the fields gave each group a header LINE of its own, and for a group named after its first field that line said the same word twice, one above the other: "Labels" and then "Labels, Stickers, Location".

There is one row of titles now, with the caret at the start of it: Labels Stickers Location, Members Assignee Creator, and their + buttons on the row below. The caret belongs to the first field's title rather than to a header above it, and everything it folds - that field's own content and every field beside it - is behind the same switch, so a collapsed group is exactly one line.

The rule moved with it, from inside a field to the group, where it spans the card. The Checklists icon is a plain check again rather than a check in a box, which is what it was before it became a section.

Requested By and Assigned By were set by clicking the word "Add". They have the round + the two fields beside them use now, opening the same editor the text does.

Checking where else those two live turned up a round trip that lost them, which is the worst shape this kind of bug takes - the export file looks complete and the import reports success. They were exported by the card PDF, the card Excel and the board CSV, and imported by NOTHING: a card exported and imported back came home having forgotten who asked for it and who assigned it. Both importers put them back now, our own JSON and .zip and the per-menu one.

The board's Excel TABLE did not export them at all, so that one gained two columns - header and value together, since a header without its value shifts every column after it.

And from other trackers, where the same idea has another name: Jira's Reporter is who asked for the work, and an issue's author on GitHub, Gitea, Forgejo and GitLab is the same thing. Both arrive as Requested By, as free text, so they survive an import from a tracker nobody on this board has an account on. A source with no such field - Trello, CSV - gains nothing, which a negative test pins.

Grouping the fields left two things crooked. Members, Assignee and Creator were each a full-width row, so Assignee and Creator fell to the line below Members - the class that made a FIELD full width was from before the groups, and the group is the full-width row now. And a field whose title had been taken over by the group header had its + on the first line, level with its neighbours' titles, instead of on the second line with theirs.

Every field in a group keeps its own title again. The group's header names the family and folds it; the field's title names the field, and its content - the +, the avatars - starts on the line under it, level all the way across.

The caret beside Labels folded the Labels field and left Stickers and Location sitting under it, and every field had a caret of its own on the right - #1591 draws one on each .card-details-item - so a row could have two handles saying the same thing in two sizes.

The fields belong to FAMILIES, and the families are what fold now:

• Labels - Labels, Stickers, Location
• Date Format - the format, Received, Start, Due, End
• Members - Members, Assignee, Creator, Requested By, Assigned By
• Dependencies
• Sort - Sort, List, Spent time

One caret per group, on its title, at the reading direction's start. The fields inside a group have none: #1591's per-item caret is turned off there, and its title is no longer a handle. Outside a group it is untouched, so nothing that folded before stopped folding. A collapsed group is one line - the caret, the icon and the name - because everything else is inside the fold.

Members reads Members, Assignee, Creator, which is the order it was asked for. The loose rule the layout drew above the users block is gone with it: the group's own rule is above the whole group, so there is one line there instead of two.

Four small things about those separators, all of them visible at a glance and none of them visible in the source.

The rule drew a border of its own, darker than the line the card already had above Creator. It is that same lighter hr now - the section rule sets only its spacing, so there is one line style on the card rather than two.

Labels had a rule above it. It is the first section: there is nothing above it to be separated from. Members had one too, immediately under the rule the layout already draws above Creator - two lines with a heading between them. Neither draws one now, and every other section still does.

And the rule above Activities was to the LEFT of the heading rather than above it, because .activity-title is display: flex and a rule inside it is a flex item. The heading sits outside that row now.

Two things the collapsible sections got wrong the first time, both visible the moment a card was opened.

Short rules everywhere. .card-details-items is a wrapping flex row, and the rule was drawn INSIDE a section - so it was as wide as that box, which is a stub of a line beside a heading rather than a separator across the card. The six sections that live in that row are now rows of their own, so the rule in them spans the card, and the items that were laid out side by side on purpose - Stickers, Location, the four dates, Creator, Assignees - still share rows as they did.

Two headings for one section. The Checklists and Subtasks templates draw their own title, and the new section header drew it again, so a card showed each of those names twice, one above the other. The templates keep what belongs to the LIST - add a checklist, add a subtask - and the section header is the only thing that names the section.

A card had ONE caret, in its header, which collapsed the whole card - and Activities had an eye beside its heading. Every other section was a heading with no control at all, and the rules between them were written by hand wherever somebody remembered one.

Labels, Date Format, Members, Dependencies, Sort, Custom Fields, Description, Checklists, Subtasks, Attachments, Comments and Activities each carry a caret that collapses that section, and one rule above it. Both come from ONE template, so eleven sections cannot end up with ten separators and nine carets. The heading is a real button - it announces itself as one and Enter or Space works it - rather than a click target only a mouse can find. The caret points DOWN when a section is open and toward the way the reader reads when it is closed: right in English, left in Arabic, Hebrew and Persian.

Activities starts collapsed and everything else open, because a card is opened to read the card and its history is the thing you go looking for.

The eye is gone, and that needed one piece of care: it was NOT the same control as the caret. showActivities: false - its default - subscribed to activityType: 'addComment' only, so the eye chose between "comments" and "the whole history" as much as it showed and hid. Removing it without more would have quietly turned an opened Activities section into a comments-only list. So a card section that is OPEN now asks for the whole history, and one that is closed subscribes to nothing at all - which is the cheaper half of what the flag was for, without a second control to keep in step. A card that had the flag explicitly set to false keeps it.

Custom Fields is one section with one caret however many fields a card has: its header was briefly inside the loop that draws them, which would have been six sections sharing a caret on a card with six fields.

In an opened card's Dependencies section each row is an icon, the linked card's title and its controls, and the title was held on one line with an ellipsis. The card details pane is narrow and a card title is a sentence, so most of a real title - everything to the right of the coloured icon - could not be read at all.

It wraps now, and the row grows as tall as it needs to. Two properties, and the second is the one that is easy to miss: white-space: normal alone would have changed nothing, because a flex item's default min-width: auto refuses to shrink below its content, so the text overflowed the row instead of wrapping inside it. min-width: 0 is what lets it. A title that is one long token - a URL, an id - breaks inside itself rather than pushing the type, colour and remove controls off the row, and the icon and those controls now sit beside the FIRST line instead of floating halfway down a three-line block.