v8.93

Thanks to xet7 !

Fixes #6276

.github/workflows/docker-publish.yml

@@ -55,7 +55,7 @@ jobs:
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
       - name: Build and push Docker image
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/release-all.yml

@@ -1,36 +1,122 @@
 name: Release All Platforms
 
-# Triggered when maintainer pushes a version tag, e.g.: git tag v8.43 && git push --tags
-# Does not work:
-#   Required GitHub Secrets:
-#   QUAY_USERNAME        - Quay.io username
-#   QUAY_PASSWORD        - Quay.io password or token
-#   DOCKERHUB_USERNAME   - Docker Hub username
-#   DOCKERHUB_TOKEN      - Docker Hub access token
-#   SNAP_STORE_LOGIN     - Snapcraft store credentials: run 'snapcraft export-login --snaps wekan --channels stable -' and base64-encode the output
+# Triggered manually via GitHub CLI or Actions UI.
+# Usage:
+#   gh workflow run release-all.yml -f old_version=8.42 -f new_version=8.43
+#
+# Or use the convenience script (commits pending changes, pushes, and triggers):
+#   ./releases/release-all.sh 8.42 8.43
+#
+# Required GitHub Secrets:
+#   GHCR_AUTH      - base64(username:token) for ghcr.io
+#   DOCKERHUB_AUTH - base64(username:token) for Docker Hub
+#   QUAY_AUTH      - base64(username:token) for Quay.io
+#   SNAP_AUTH      - Snapcraft store credentials
 
 on:
-  push:
-    tags:
-      - 'v*.*'
+  workflow_dispatch:
+    inputs:
+      old_version:
+        description: 'Previous version number (e.g. 8.42, without v prefix)'
+        required: true
+        type: string
+      new_version:
+        description: 'New version number (e.g. 8.43, without v prefix)'
+        required: true
+        type: string
 
 permissions:
   contents: write
   packages: write
+  pages: write
+  id-token: write
 
 jobs:
+  # ─── 0. Version bump, docs rebuild, and tag creation ────────────────────────
+  # Runs update-node-version.sh, rebuild-docs.sh, and sed-release-versions.sh,
+  # then commits, pushes, and creates the version tag.
+  # Skipped on re-run if the tag already exists.
+  version-bump:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Check if tag already exists
+        id: check
+        run: |
+          if git ls-remote --tags origin | grep -q "refs/tags/v${{ inputs.new_version }}$"; then
+            echo "existed=true" >> $GITHUB_OUTPUT
+            echo "Tag v${{ inputs.new_version }} already exists. Skipping version bump."
+          else
+            echo "existed=false" >> $GITHUB_OUTPUT
+          fi
+
+      - uses: actions/setup-node@v6
+        if: steps.check.outputs.existed == 'false'
+        with:
+          node-version: '24.14.1'
+
+      - name: Install Python dependencies for API doc generation
+        if: steps.check.outputs.existed == 'false'
+        run: python3 -m pip install --break-system-packages esprima
+
+      - name: Delete GitHub Actions caches
+        if: steps.check.outputs.existed == 'false'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh cache delete --all || true
+
+      - name: Update Node.js to latest 24.x
+        if: steps.check.outputs.existed == 'false'
+        run: ./releases/update-node-version.sh
+
+      - name: Rebuild API docs
+        if: steps.check.outputs.existed == 'false'
+        run: ./releases/rebuild-docs.sh "${{ inputs.new_version }}"
+
+      - name: Update version numbers in release files
+        if: steps.check.outputs.existed == 'false'
+        run: ./releases/sed-release-versions.sh "${{ inputs.old_version }}" "${{ inputs.new_version }}"
+
+      - name: Commit and push version bump
+        if: steps.check.outputs.existed == 'false'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add --all
+          if git diff --cached --quiet; then
+            echo "No changes to commit."
+          else
+            git commit -m "v${{ inputs.new_version }}"
+          fi
+          git push
+
+      - name: Create and push tag
+        if: steps.check.outputs.existed == 'false'
+        run: |
+          git tag -a "v${{ inputs.new_version }}" -m "v${{ inputs.new_version }}"
+          git push origin "v${{ inputs.new_version }}"
+
   # ─── 1. Extract version and release notes ───────────────────────────────────
   prepare:
+    needs: version-bump
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.version.outputs.version }}
       changelog: ${{ steps.changelog.outputs.content }}
     steps:
       - uses: actions/checkout@v6
+        with:
+          ref: refs/tags/v${{ inputs.new_version }}
 
-      - name: Extract version from tag
+      - name: Set version from input
         id: version
-        run: echo "version=${GITHUB_REF_NAME#v}" >> $GITHUB_OUTPUT
+        run: |
+          VERSION="${{ inputs.new_version }}"
+          VERSION="${VERSION#v}"
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
 
       - name: Extract release notes from CHANGELOG.md
         id: changelog
@@ -74,6 +160,8 @@ jobs:
       VERSION: ${{ needs.prepare.outputs.version }}
     steps:
       - uses: actions/checkout@v6
+        with:
+          ref: refs/tags/v${{ inputs.new_version }}
 
       - name: Cache Meteor installation
         uses: actions/cache@v5
@@ -108,15 +196,10 @@ jobs:
 
       - name: Build WeKan bundle
         run: |
-          rm -rf .build node_modules .meteor/local/bundler-cache
-          meteor npm install
+          rm -rf .build node_modules .meteor/local
+          (meteor update --npm 2>/dev/null || true) && meteor npm install
           meteor build .build --directory
 
-      - name: Install dependencies in bundle
-        run: |
-          cd .build/bundle/programs/server
-          meteor npm install
-
       - name: Create amd64 zip
         run: |
           cd .build
@@ -157,6 +240,20 @@ jobs:
       - name: Rebuild native modules for arm64
         run: |
           unzip wekan-${VERSION}-amd64.zip
+          # Fix: bcrypt 5.0.1 (Meteor accounts-password) ships node-addon-api@3
+          # which fails to compile on Node.js 24. Replace with bcrypt 6.0.0.
+          BCRYPT_DIR="$(pwd)/bundle/programs/server/npm/node_modules/meteor/accounts-password/node_modules/bcrypt"
+          if [ -d "$BCRYPT_DIR" ]; then
+            rm -rf "$BCRYPT_DIR"
+            TMP=$(mktemp -d)
+            pushd "$TMP" > /dev/null
+            npm pack bcrypt@6.0.0
+            mkdir bcrypt && tar xzf bcrypt-*.tgz --strip-components=1 -C bcrypt
+            cd bcrypt && npm install --ignore-scripts && cd ..
+            cp -a bcrypt "$BCRYPT_DIR"
+            popd > /dev/null
+            rm -rf "$TMP"
+          fi
           cd bundle/programs/server
           rm -rf node_modules
           npm install
@@ -201,6 +298,20 @@ jobs:
         run: |
           unzip wekan-${VERSION}-amd64.zip
           rm -rf bundle/programs/server/node_modules
+          # Fix: bcrypt 5.0.1 (Meteor accounts-password) ships node-addon-api@3
+          # which fails to compile on Node.js 24. Replace with bcrypt 6.0.0.
+          BCRYPT_DIR="$(pwd)/bundle/programs/server/npm/node_modules/meteor/accounts-password/node_modules/bcrypt"
+          if [ -d "$BCRYPT_DIR" ]; then
+            rm -rf "$BCRYPT_DIR"
+            TMP=$(mktemp -d)
+            pushd "$TMP" > /dev/null
+            npm pack bcrypt@6.0.0
+            mkdir bcrypt && tar xzf bcrypt-*.tgz --strip-components=1 -C bcrypt
+            cd bcrypt && npm install --ignore-scripts && cd ..
+            cp -a bcrypt "$BCRYPT_DIR"
+            popd > /dev/null
+            rm -rf "$TMP"
+          fi
           # node:24.14.1-slim s390x — same Node.js version as Meteor 3.5-beta.7 bundled
           docker run --rm --platform linux/s390x \
             -v "$(pwd)/bundle:/bundle" \
@@ -246,6 +357,20 @@ jobs:
         run: |
           unzip wekan-${VERSION}-amd64.zip
           rm -rf bundle/programs/server/node_modules
+          # Fix: bcrypt 5.0.1 (Meteor accounts-password) ships node-addon-api@3
+          # which fails to compile on Node.js 24. Replace with bcrypt 6.0.0.
+          BCRYPT_DIR="$(pwd)/bundle/programs/server/npm/node_modules/meteor/accounts-password/node_modules/bcrypt"
+          if [ -d "$BCRYPT_DIR" ]; then
+            rm -rf "$BCRYPT_DIR"
+            TMP=$(mktemp -d)
+            pushd "$TMP" > /dev/null
+            npm pack bcrypt@6.0.0
+            mkdir bcrypt && tar xzf bcrypt-*.tgz --strip-components=1 -C bcrypt
+            cd bcrypt && npm install --ignore-scripts && cd ..
+            cp -a bcrypt "$BCRYPT_DIR"
+            popd > /dev/null
+            rm -rf "$TMP"
+          fi
           # node:24.14.1-slim ppc64le — same Node.js version as Meteor 3.5-beta.7 bundled
           docker run --rm --platform linux/ppc64le \
             -v "$(pwd)/bundle:/bundle" \
@@ -263,51 +388,62 @@ jobs:
           path: wekan-${{ needs.prepare.outputs.version }}-ppc64le.zip
           retention-days: 1
 
-  # ─── 4c. Build armhf bundle (rebuild native modules via QEMU container) ──────
-  # Meteor 3.5-beta.7 does NOT support arm/v7 (armhf). Installer explicitly rejects it.
-  # GitHub Actions has no native arm/v7 runners.
-  # Solution: QEMU emulation + node:24.14.1-slim (arm/v7 variant) for npm rebuild.
-  # arm/v7 under QEMU is slowest — timeout set to 120 min.
-  build-armhf:
-    needs: [prepare, build-amd64]
-    runs-on: ubuntu-latest
-    timeout-minutes: 120
-    env:
-      VERSION: ${{ needs.prepare.outputs.version }}
-    steps:
-      - name: Set up QEMU for arm/v7
-        uses: docker/setup-qemu-action@v4
-        with:
-          platforms: arm
-
-      - name: Install unzip/zip
-        run: sudo apt-get update && sudo apt-get install -y unzip zip
-
-      - name: Download amd64 bundle
-        uses: actions/download-artifact@v8
-        with:
-          name: bundle-amd64
-
-      - name: Rebuild native modules for armhf in container
-        run: |
-          unzip wekan-${VERSION}-amd64.zip
-          rm -rf bundle/programs/server/node_modules
-          # node:24.14.1-slim arm/v7 — same Node.js version as Meteor 3.5-beta.7 bundled
-          docker run --rm --platform linux/arm/v7 \
-            -v "$(pwd)/bundle:/bundle" \
-            -w /bundle/programs/server \
-            node:24.14.1-slim \
-            sh -c "apt-get update -qq && apt-get install -y -q build-essential python3 && npm install"
-
-      - name: Clean up and create armhf zip
-        run: |
-          zip -r wekan-${VERSION}-armhf.zip bundle
-
-      - uses: actions/upload-artifact@v7
-        with:
-          name: bundle-armhf
-          path: wekan-${{ needs.prepare.outputs.version }}-armhf.zip
-          retention-days: 1
+  # ─── 4c. Build armhf bundle — COMMENTED OUT ─────────────────────────────────
+  # No official Node.js binaries exist for armhf (arm/v7).
+  #build-armhf:
+  #  needs: [prepare, build-amd64]
+  #  runs-on: ubuntu-latest
+  #  timeout-minutes: 120
+  #  env:
+  #    VERSION: ${{ needs.prepare.outputs.version }}
+  #  steps:
+  #    - name: Set up QEMU for arm/v7
+  #      uses: docker/setup-qemu-action@v4
+  #      with:
+  #        platforms: arm
+  #
+  #    - name: Install unzip/zip
+  #      run: sudo apt-get update && sudo apt-get install -y unzip zip
+  #
+  #    - name: Download amd64 bundle
+  #      uses: actions/download-artifact@v8
+  #      with:
+  #        name: bundle-amd64
+  #
+  #    - name: Rebuild native modules for armhf in container
+  #      run: |
+  #        unzip wekan-${VERSION}-amd64.zip
+  #        rm -rf bundle/programs/server/node_modules
+  #        # Fix: bcrypt 5.0.1 (Meteor accounts-password) ships node-addon-api@3
+  #        # which fails to compile on Node.js 24. Replace with bcrypt 6.0.0.
+  #        BCRYPT_DIR="$(pwd)/bundle/programs/server/npm/node_modules/meteor/accounts-password/node_modules/bcrypt"
+  #        if [ -d "$BCRYPT_DIR" ]; then
+  #          rm -rf "$BCRYPT_DIR"
+  #          TMP=$(mktemp -d)
+  #          pushd "$TMP" > /dev/null
+  #          npm pack bcrypt@6.0.0
+  #          mkdir bcrypt && tar xzf bcrypt-*.tgz --strip-components=1 -C bcrypt
+  #          cd bcrypt && npm install --ignore-scripts && cd ..
+  #          cp -a bcrypt "$BCRYPT_DIR"
+  #          popd > /dev/null
+  #          rm -rf "$TMP"
+  #        fi
+  #        # node:24.14.1-slim arm/v7 — same Node.js version as Meteor 3.5-beta.7 bundled
+  #        docker run --rm --platform linux/arm/v7 \
+  #          -v "$(pwd)/bundle:/bundle" \
+  #          -w /bundle/programs/server \
+  #          node:24.14.1-slim \
+  #          sh -c "apt-get update -qq && apt-get install -y -q build-essential python3 && npm install"
+  #
+  #    - name: Clean up and create armhf zip
+  #      run: |
+  #        zip -r wekan-${VERSION}-armhf.zip bundle
+  #
+  #    - uses: actions/upload-artifact@v7
+  #      with:
+  #        name: bundle-armhf
+  #        path: wekan-${{ needs.prepare.outputs.version }}-armhf.zip
+  #        retention-days: 1
 
   # ─── 5. Build win64 bundle (rebuild native modules on Windows) ───────────────
   build-win64:
@@ -334,10 +470,28 @@ jobs:
         with:
           name: bundle-amd64
 
+      - name: Fix bcrypt for Node.js 24
+        shell: bash
+        run: |
+          7z x wekan-${VERSION}-amd64.zip
+          # Fix: bcrypt 5.0.1 (Meteor accounts-password) ships node-addon-api@3
+          # which fails to compile on Node.js 24. Replace with bcrypt 6.0.0.
+          BCRYPT_DIR="$(pwd)/bundle/programs/server/npm/node_modules/meteor/accounts-password/node_modules/bcrypt"
+          if [ -d "$BCRYPT_DIR" ]; then
+            rm -rf "$BCRYPT_DIR"
+            TMP=$(mktemp -d)
+            pushd "$TMP" > /dev/null
+            npm pack bcrypt@6.0.0
+            mkdir bcrypt && tar xzf bcrypt-*.tgz --strip-components=1 -C bcrypt
+            cd bcrypt && npm install --ignore-scripts && cd ..
+            cp -r bcrypt "$BCRYPT_DIR"
+            popd > /dev/null
+            rm -rf "$TMP"
+          fi
+
       - name: Rebuild native modules for Windows
         shell: cmd
         run: |
-          7z x wekan-%VERSION%-amd64.zip
           cd bundle\programs\server
           rmdir /s /q node_modules
           npm install
@@ -355,7 +509,7 @@ jobs:
 
   # ─── 6. Create GitHub Release and upload all bundles ────────────────────────
   release:
-    needs: [prepare, build-amd64, build-arm64, build-s390x, build-ppc64le, build-armhf, build-win64]
+    needs: [prepare, build-amd64, build-arm64, build-s390x, build-ppc64le, build-win64]
     runs-on: ubuntu-latest
     env:
       VERSION: ${{ needs.prepare.outputs.version }}
@@ -367,8 +521,9 @@ jobs:
           merge-multiple: true
 
       - name: Create GitHub Release with all bundles
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
+          tag_name: v${{ needs.prepare.outputs.version }}
           name: v${{ needs.prepare.outputs.version }}
           body: ${{ needs.prepare.outputs.changelog }}
           files: |
@@ -376,106 +531,165 @@ jobs:
             wekan-${{ needs.prepare.outputs.version }}-arm64.zip
             wekan-${{ needs.prepare.outputs.version }}-s390x.zip
             wekan-${{ needs.prepare.outputs.version }}-ppc64le.zip
-            wekan-${{ needs.prepare.outputs.version }}-armhf.zip
             wekan-${{ needs.prepare.outputs.version }}-win64.zip
 
   # ─── 7. Build and push multi-platform Docker image ──────────────────────────
-  #docker:
-  #  needs: [prepare, release]
-  #  runs-on: ubuntu-latest
-  #  env:
-  #    VERSION: ${{ needs.prepare.outputs.version }}
-  #  steps:
-  #    - uses: actions/checkout@v6
-  #
-  #    - name: Set up QEMU
-  #      uses: docker/setup-qemu-action@v4
-  #
-  #    - name: Set up Docker Buildx
-  #      uses: docker/setup-buildx-action@v3
-  #
-  #    - name: Log in to Docker Hub
-  #      uses: docker/login-action@v4
-  #      with:
-  #        username: ${{ secrets.DOCKERHUB_USERNAME }}
-  #        password: ${{ secrets.DOCKERHUB_TOKEN }}
-  #
-  #    - name: Log in to Quay.io
-  #      uses: docker/login-action@v4
-  #      with:
-  #        registry: quay.io
-  #        username: ${{ secrets.QUAY_USERNAME }}
-  #        password: ${{ secrets.QUAY_PASSWORD }}
-  #
-  #    - name: Log in to GitHub Container Registry
-  #      uses: docker/login-action@v4
-  #      with:
-  #        registry: ghcr.io
-  #        username: ${{ github.actor }}
-  #        password: ${{ secrets.GITHUB_TOKEN }}
-  #
-  #    - name: Build and push Docker image to all registries
-  #      uses: docker/build-push-action@v7
-  #      with:
-  #        context: .
-  #        platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/ppc64le,linux/s390x
-  #        push: true
-  #        build-args: VERSION=${{ needs.prepare.outputs.version }}
-  #        tags: |
-  #          #wekanteam/wekan:v${{ needs.prepare.outputs.version }}
-  #          #wekanteam/wekan:latest
-  #          quay.io/wekan/wekan:v${{ needs.prepare.outputs.version }}
-  #          quay.io/wekan/wekan:latest
-  #          ghcr.io/wekan/wekan:v${{ needs.prepare.outputs.version }}
-  #          ghcr.io/wekan/wekan:latest
-  #        cache-from: type=gha
-  #        cache-to: type=gha,mode=max
+  docker:
+    needs: [prepare, release]
+    runs-on: ubuntu-latest
+    env:
+      VERSION: ${{ needs.prepare.outputs.version }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: refs/tags/v${{ inputs.new_version }}
 
-  # ─── 8. Build and publish snap packages (all architectures via Launchpad) ────
-  # Uses snapcraft remote-build on Launchpad's native builders (more reliable
-  # than QEMU for snap builds). Each architecture bundles its own database:
-  #   amd64, arm64         — MongoDB 7.x prebuilt native binary
-  #   armhf, s390x, ppc64el — MongoDB 7.x amd64 binary run via qemu-x86_64-static
-  #                           (no prebuilt MongoDB binaries exist for these arches)
-  #snap:
-  #  needs: [prepare, release]
-  #  runs-on: ubuntu-latest
-  #  env:
-  #    VERSION: ${{ needs.prepare.outputs.version }}
-  #  steps:
-  #    - uses: actions/checkout@v6
-  #
-  #    - name: Install snapcraft
-  #      run: sudo snap install snapcraft --classic
-  #
-  #    - name: Remote-build snap for all architectures via Launchpad
-  #      env:
-  #        SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_STORE_LOGIN }}
-  #      run: |
-  #        snapcraft remote-build \
-  #          --build-for=amd64,arm64,armhf,s390x,ppc64el \
-  #          --launchpad-accept-public-upload
-  #
-  #    - name: Upload all snap files as artifacts
-  #      uses: actions/upload-artifact@v7
-  #      with:
-  #        name: snaps-all-arches
-  #        path: "*.snap"
-  #        retention-days: 30
-  #
-  #    # Publish to edge — NOT stable.
-  #    # Stable channel holds the old WeKan version until database migrations are ready.
-  #    # Promote to stable manually via the Snap Store dashboard when migrations exist.
-  #    - name: Publish all snaps to Snap Store (candidate, beta, edge)
-  #      env:
-  #        SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_STORE_LOGIN }}
-  #      run: |
-  #        for snap_file in *.snap; do
-  #          echo "Publishing $snap_file ..."
-  #          snapcraft upload --release=edge "$snap_file"
-  #        done
-  #
-  #    - name: Upload all snaps to GitHub Release
-  #      uses: softprops/action-gh-release@v2
-  #      with:
-  #        files: "*.snap"
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Create Docker config with registry credentials
+        run: |
+          mkdir -p ~/.docker
+          cat > ~/.docker/config.json <<EOF
+          {
+            "auths": {
+              "ghcr.io": {
+                "auth": "${{ secrets.GHCR_AUTH }}"
+              },
+              "https://index.docker.io/v1/": {
+                "auth": "${{ secrets.DOCKERHUB_AUTH }}"
+              },
+              "quay.io": {
+                "auth": "${{ secrets.QUAY_AUTH }}"
+              }
+            }
+          }
+          EOF
+
+      - name: Create and use buildx builder
+        run: |
+          docker buildx create --name mybuilder --driver docker-container --use
+          docker buildx inspect --bootstrap
+
+      - name: Build and push Docker image to all registries
+        run: |
+          docker buildx build \
+            --platform linux/amd64,linux/arm64,linux/s390x,linux/ppc64le \
+            -t wekanteam/wekan:v${VERSION} \
+            -t wekanteam/wekan:latest \
+            -t quay.io/wekan/wekan:v${VERSION} \
+            -t quay.io/wekan/wekan:latest \
+            -t ghcr.io/wekan/wekan:v${VERSION} \
+            -t ghcr.io/wekan/wekan:latest \
+            --push .
+
+  # ─── 8. Build and publish snap packages ──────────────────────────────────────
+  # Build snap with snapcraft pack (like releases/snap-build.sh) using LXD,
+  # then push to Snap Store edge channel (like releases/snap-push-to-store.sh).
+  # Promote to stable manually via the Snap Store dashboard when ready.
+  snap:
+    needs: [prepare, release]
+    runs-on: ubuntu-latest
+    env:
+      VERSION: ${{ needs.prepare.outputs.version }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: refs/tags/v${{ inputs.new_version }}
+
+      - name: Install snapcraft
+        run: sudo snap install snapcraft --classic
+
+      - name: Build snap
+        run: sudo snapcraft pack --destructive-mode
+
+      - name: Upload snap files as artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: snaps
+          path: "*.snap"
+          retention-days: 30
+
+      - name: Push all snaps to Snap Store edge channel
+        env:
+          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_AUTH }}
+        run: |
+          for snap_file in *.snap; do
+            echo "Publishing $snap_file ..."
+            snapcraft upload --release=edge "$snap_file"
+          done
+
+      - name: Upload all snaps to GitHub Release
+        uses: softprops/action-gh-release@v3
+        with:
+          tag_name: v${{ needs.prepare.outputs.version }}
+          files: "*.snap"
+
+  # ─── 9. Update Helm charts and deploy to GitHub Pages ─────────────────────────
+  # Chart source is in helm/wekan/, published packages + index.yaml in helm/charts/.
+  # GitHub Pages deploys helm/charts/ via Actions, serving at https://wekan.github.io/wekan/
+  helm:
+    needs: [prepare, docker]
+    runs-on: ubuntu-latest
+    env:
+      VERSION: ${{ needs.prepare.outputs.version }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: refs/tags/v${{ inputs.new_version }}
+
+      - name: Install Helm
+        run: |
+          curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
+
+      - name: Update Chart.yaml and values.yaml with new version
+        run: |
+          cd helm/wekan
+          # Chart.yaml: update appVersion and version
+          sed -i "s/^appVersion: .*/appVersion: \"${VERSION}\"/" Chart.yaml
+          sed -i "s/^version: .*/version: ${VERSION}.0/" Chart.yaml
+          # values.yaml: update image tag
+          sed -i "s/^  tag: v.*/  tag: v${VERSION}/" values.yaml
+
+      - name: Build Helm dependencies
+        run: |
+          cd helm/wekan
+          helm repo add mongo https://groundhog2k.github.io/helm-charts/
+          helm dependency update
+          helm dependency build
+
+      - name: Package chart and update index
+        run: |
+          helm package helm/wekan -d helm/charts/
+          helm repo index helm/charts/ --url https://wekan.github.io/wekan/
+
+      - name: Commit updated chart
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add helm/
+          git commit -m "Helm chart ${VERSION}.0"
+          git push origin HEAD:refs/heads/main
+
+      - name: Upload helm/charts/ as Pages artifact
+        uses: actions/upload-pages-artifact@v4
+        with:
+          path: helm/charts/
+
+  # ─── 10. Deploy Helm chart to GitHub Pages ───────────────────────────────────
+  deploy-pages:
+    needs: helm
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4

.meteor/packages

@@ -18,14 +18,6 @@ aldeed:schema-index@4.0.0-beta.5
 reywood:publish-composite
 mongo@2.3.0-beta350.7
 
-# The holy trifecta - this is a replacement for subs-manager
-# for IndexedDB persistence and auto-sync
-jam:offline 
-# for optimistic methods with offline queuing
-jam:method 
-# global subscription caching
-jam:pub-sub
-
 # Account system
 accounts-password@3.2.3-beta350.7
 communitypackages:core

.meteor/versions

@@ -45,9 +45,6 @@ htmljs@2.0.1
 http@1.4.4
 id-map@1.2.0
 inter-process-messaging@0.1.2
-jam:method@1.9.1
-jam:offline@0.4.1
-jam:pub-sub@0.5.1
 jquery@3.0.2
 lai:collection-extensions@1.0.0
 localstorage@1.2.1

CHANGELOG.md

@@ -26,6 +26,199 @@ Versions:
 - WeKan 8.00-8.06 had wrong raw database directory setting /var/snap/wekan/common/wekan and some cards were not visible,
   it was fixed at WeKan 8.07 where database directory is back to /var/snap/wekan/common and all cards are visible.
 
+# v8.93 2026-04-16 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Fix SSO Login broken. Part 2](https://github.com/wekan/wekan/commit/4aa7b6aa2034f27efeb67d5dfa8f6acbe0005786).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.92 2026-04-16 WeKan ® release
+
+This release adds the following updates:
+
+- [Updated Helm Charts versions](https://github.com/wekan/wekan/commit/24ebb4ba45344ad152747c31e7df76217e5b8909).
+  Thanks to xet7.
+- [GitHub Actions: Added missing sudo to snap build](https://github.com/wekan/wekan/commit/2c8a6c8ec6e24b6b6bb153da3edd089e0f0087cc).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.91 2026-04-16 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Fix building Snap at GitHub Actions](https://github.com/wekan/wekan/commit/89de05ee91612cef4f13fa8ad32d112dca5bdb43).
+  Thanks to xet7.
+- [Updated Helm Chart URL at readme](https://github.com/wekan/wekan/commit/529e0d25ef2ea84953d1c1e6a23b5798d34583fb).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.90 2026-04-16 WeKan ® release
+
+This release adds the following updates:
+
+- [Added GitHub Actions builds for Docker and Snap. Moved Helm Charts from charts repo to wekan repo](https://github.com/wekan/wekan/commit/f57ce521984f6f358410863c71fcaee342bb8107).
+  Thanks to xet7.
+- [Changed ArtifactHub from wekan/charts repo to wekan/wekan repo](https://github.com/wekan/wekan/commit/99519af83adc45eca7beb40a4e82f5b73764b7fc).
+  Thanks to xet7.
+- [Release scripts: Moved more steps to GitHub Actions](https://github.com/wekan/wekan/commit/357f63d01fc013ea412501dabbdd977e5f1efa61).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Removed jam:offline jam:method jam:pub-sub, because they are not used, and they cause too much database usage](https://github.com/wekan/wekan/commit/0dd924f14889100e74fbd5e8d17bb3a7209025ca).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.89 2026-04-15 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Disable jam:offline keepAll BEFORE any collections are created. Part 2](https://github.com/wekan/wekan/commit/f6a851a3d887ce9fa2fa5f62aad2a2ecf326c863).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.88 2026-04-15 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Disable jam:offline keepAll to prevent full-collection COLLSCAN queries and Ensure standard GridFS index on attachments.chunks for efficient chunk lookups](https://github.com/wekan/wekan/commit/ec0c1bc9afd6e3fd8b60f9f17f96dc5df52dbfc2).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.87 2026-04-15 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Try to fix Snap](https://github.com/wekan/wekan/commit/fc02a15753badc8d06d020aa97daae28ac05a310).
+  Thanks to xet7.
+- [Improve handling of ROOT_URL as an environement variable](https://github.com/wekan/wekan/pull/6286).
+  Thanks to FlorentDotMe.
+- [UI: Enable the horizontal scroll in the quick access menu boards list](https://github.com/wekan/wekan/pull/6287).
+  Thanks to FlorentDotMe.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.86 2026-04-15 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Try to fix Snap](https://github.com/wekan/wekan/commit/10f801d31b7e2b1a8c562bf24f65c4cc6efe6013).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.85 2026-04-15 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Try to fix Snap](https://github.com/wekan/wekan/commit/0e13bfc50eadc72adccfe785a1b47c30d0ba5429).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.84 2026-04-15 WeKan ® release
+
+This release adds the following new features:
+
+- [Helm Chart: Make readiness, liveness and startup probes configurable](https://github.com/wekan/charts/pull/51).
+  Thanks to snowsky.
+
+and fixes the following bugs:
+
+- [Fix SSO Login OIDC and OpenID Connect](https://github.com/wekan/wekan/pull/6284).
+  Thanks to sbaecker and nebulade.
+- [Try to fix Snap Candidate](https://github.com/wekan/wekan/commit/bc92978fa9c9373947de40fe9ca584e133825610).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.83 2026-04-14 WeKan ® release
+
+This release adds the following updates:
+
+- [Release scripts: Removed armhf, there is no official Node.js binary for it](https://github.com/wekan/wekan/commit/d0a9fa9a71029a5586cf5bc87488619c7db9d0e3).
+  Thanks to xet7.
+- [Release scripts: Docker not for armhf, no official Node.js binary for it](https://github.com/wekan/wekan/commit/41db7b4ad18359283602b8bfdb42b15acf51782d).
+  Thanks to xet7.
+- [Release scripts: Fix Node.js 24.x download URL for Snap builds](https://github.com/wekan/wekan/commit/2c43aa463a0baadcae3db9f34066a9ddf6e77594).
+  Thanks to xet7.
+- [Changed start-wekan.sh and start-wekan.bat to not use Change Streams](https://github.com/wekan/wekan/commit/da4459304fe7d068b1db91938f7fd4ffd04c5bcb).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.82 2026-04-14 WeKan ® release
+
+This release adds the following updates:
+
+- [Release scripts: Added script for deleting repo git tag](https://github.com/wekan/wekan/commit/11672a13f7b102b764978600a8fce2f757c9401a).
+  Thanks to xet7.
+- [Bump softprops/action-gh-release from 2 to 3](https://github.com/wekan/wekan/pull/6281).
+  Thanks to dependabot.
+- [Bump docker/build-push-action from 7.0.0 to 7.1.0](https://github.com/wekan/wekan/pull/6282).
+  Thanks to dependabot.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.81 2026-04-14 WeKan ® release
+
+This release adds the following updates:
+
+- Updated dependencies
+  [Part 1](https://github.com/wekan/wekan/commit/7b91439b0f9ec0e409c14ecebab389d41b40a990),
+  [Part 2](https://github.com/wekan/wekan/commit/1637a9c938134ef26846ba3c0cd53c065f434e3e).
+  Thanks to developers of dependencies.
+- [Docs: Added History of Schema Migration Systems](https://github.com/wekan/wekan/commit/2e7565f9eb744bc59e454745e06fd43a85a02f97).
+  Thanks to xet7.
+- [Release scripts: Comment out build for armhf because no official Node.js 24.x binaries exist for armhf (arm/v7)](https://github.com/wekan/wekan/commit/5462fb06477bc3a83f1d5c754ecd60ebe7643ee6).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Fix activities are not showing](https://github.com/wekan/wekan/pull/6272).
+  Thanks to snowsky.
+- [Fix Link Card modal overflow in Docker environment](https://github.com/wekan/wekan/pull/6273).
+  Thanks to AymenHassini19.
+- [Fix/readme node version and changes made](https://github.com/wekan/wekan/pull/6271).
+  Thanks to YosserDerbali.
+- [Clarify board drag tooltip text in Remaining and Workspaces](https://github.com/wekan/wekan/pull/6268).
+  Thanks to YosserDerbali.
+- [Add migration for v7.95 due dates](https://github.com/wekan/wekan/pull/6262).
+  Thanks to Raawen-dev.
+- [Fix: include historical comments and activities in board exports](https://github.com/wekan/wekan/pull/6275).
+  Thanks to KhaoulaMaleh.
+- [Fix Exporter: Attachments always empty in board JSON export](https://github.com/wekan/wekan/pull/6279).
+  Thanks to kolaente.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.80 2026-04-10 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Try to fix GitHub Actions builds with custom newer bcrypt](https://github.com/wekan/wekan/commit/2ebefdd0bf1cf482548319e130baf2b633ba259b).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.79 2026-04-09 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Fix 8.78: WeKan build Error: Could not find rspack config. Using MongoDB Change Streams
+  at start-wekan.sh start-wekan.bat bundle, docker-compose.yml and Snap Candidate](https://github.com/wekan/wekan/commit/2d4170a9bfc58b8e6504abf122aea505e55802ef).
+  Thanks to nachocodoner and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
 # v8.78 2026-04-09 WeKan ® release
 
 This release adds the the following updates:

Dockerfile

@@ -7,7 +7,7 @@ LABEL org.opencontainers.image.source="https://github.com/wekan/wekan"
 # TARGETARCH and TARGETVARIANT are automatically provided by Docker Buildx
 ARG TARGETARCH
 ARG TARGETVARIANT
-ARG VERSION=8.78
+ARG VERSION=8.93
 ARG DEBIAN_FRONTEND=noninteractive
 
 ENV BUILD_DEPS="apt-utils gnupg wget bzip2 g++ curl libarchive-tools build-essential git ca-certificates python3 unzip"
@@ -190,7 +190,7 @@ rm -f "node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz" SHASUMS256.txt.asc
 ln -s "/usr/local/bin/node" "/usr/local/bin/nodejs"
 
 # NPM configuration
-npm install -g npm@${NPM_VERSION} --production
+npm install -g npm@${NPM_VERSION} --omit=dev
 chown --recursive wekan:wekan /home/wekan/
 
 # Temporary Tar swap for Meteor bundle
@@ -203,7 +203,7 @@ cd /home/wekan/app
 wget "https://github.com/wekan/wekan/releases/download/v${VERSION}/wekan-${VERSION}-${WEKAN_ARCH}.zip"
 unzip "wekan-${VERSION}-${WEKAN_ARCH}.zip"
 rm "wekan-${VERSION}-${WEKAN_ARCH}.zip"
-npm install --production --no-audit --prefix ./bundle/programs/server
+npm install --omit=dev --prefix ./bundle/programs/server
 mv /home/wekan/app/bundle /build
 
 # Restore original tar

README.md

@@ -47,12 +47,13 @@ See bottom of https://github.com/wekan/wekan/issues/3874
 ## FAQ
 
 **NOTE**:
+
 - Please read the [FAQ](https://github.com/wekan/wekan/blob/main/docs/FAQ/FAQ.md) first
 - Please don't feed the [trolls](https://github.com/wekan/wekan/blob/main/docs/FAQ/FAQ.md#why-am-i-called-a-troll) and [spammers](https://github.com/wekan/wekan/blob/main/docs/FAQ/FAQ.md#why-am-i-called-a-spammer) that are mentioned in the FAQ :)
 
 ## About WeKan ®
 
-WeKan ® is an completely [Open Source][open_source] and [Free software][free_software]
+WeKan ® is a completely [Open Source][open_source] and [Free software][free_software]
 collaborative kanban board application with MIT license.
 
 Whether you’re maintaining a personal todo list, planning your holidays with some friends,
@@ -76,15 +77,15 @@ that by providing one-click installation on various platforms.
 - 1 GB RAM minimum free for WeKan ®. Production server should have minimum total 4 GB RAM.
   For thousands of users, for example with [Docker](https://github.com/wekan/wekan/blob/main/docker-compose.yml): 3 frontend servers,
   each having 2 CPU and 2 wekan-app containers. One backend wekan-db server with many CPUs.
-- Enough disk space and alerts about low disk space. If you run out disk space, MongoDB database gets corrupted.
+- Enough disk space and alerts about low disk space. If you run out of disk space, MongoDB database gets corrupted.
 - SECURITY: Updating to newest WeKan ® version very often. Please check you do not have automatic updates of Sandstorm or Snap turned off.
   Old versions have security issues because of old versions Node.js etc. Only newest WeKan ® is supported.
   WeKan ® on Sandstorm is not usually affected by any Standalone WeKan ® (Snap/Docker/Source) security issues.
 - [Reporting all new bugs immediately](https://github.com/wekan/wekan/issues).
   New features and fixes are added to WeKan ® [many times a day](https://github.com/wekan/wekan/blob/main/CHANGELOG.md).
-- [Backups](https://github.com/wekan/wekan/blob/main/docs/Backup/Backup.md) of WeKan ® database once a day miminum.
+- [Backups](https://github.com/wekan/wekan/blob/main/docs/Backup/Backup.md) of WeKan ® database once a day minimum.
   Bugs, updates, users deleting list or card, harddrive full, harddrive crash etc can eat your data. There is no undo yet.
-  Some bug can cause WeKan ® board to not load at all, requiring manual fixing of database content.
+  Some bugs can cause WeKan ® board to not load at all, requiring manual fixing of database content.
 
 ## Roadmap and Demo
 
@@ -92,7 +93,7 @@ that by providing one-click installation on various platforms.
 
 [Developer Documentation][dev_docs]
 
-- There is many companies and individuals contributing code to WeKan ®, to add features and bugfixes
+- There are many companies and individuals contributing code to WeKan ®, to add features and bugfixes
   [many times a day](https://github.com/wekan/wekan/blob/main/CHANGELOG.md).
 - [Please add Add new Feature Requests and Bug Reports immediately](https://github.com/wekan/wekan/issues).
 - [Commercial Support](https://wekan.fi/commercial-support/).
@@ -102,12 +103,75 @@ By working directly with WeKan ® you get the benefit of active maintenance and
 
 ## Getting Started with Development
 
-The default branch uses [Meteor 2 with Node.js 14](https://wekan.fi/install/).
+The default branch uses Meteor 3.5-beta.7 with Node.js 24.x.
+See [CHANGELOG.md](https://github.com/wekan/wekan/blob/main/CHANGELOG.md) for the latest runtime updates.
 
 To contribute, [create a fork](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#2-create-fork-of-httpsgithubcomwekanwekan-at-github-web-page) and run `./rebuild-wekan.sh` (or `./rebuild-wekan.bat` on Windows) as detailed [here](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#3-select-option-1-to-install-dependencies-and-then-enter). Once you're ready, please test your code and [submit a pull request (PR)](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#7-test).
 
 Please refer to the [developer documentation](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Developer-Documentation.md) for more information.
 
+## First-Time Setup for Development
+
+### Prerequisites
+
+Before building WeKan from source, ensure you have:
+
+- **Git** - for cloning the repository
+- **Node.js 24.x** - WeKan requires Node.js 24.x
+- **Meteor** - the JavaScript framework WeKan is built with
+
+### Installing Node.js 24.x
+
+```bash
+# Using nvm (recommended)
+curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash
+source ~/.zshrc  # or ~/.bashrc
+nvm install 24
+nvm use 24
+```
+
+### Installing Meteor
+
+```bash
+curl https://install.meteor.com/ | sh
+```
+
+### Building WeKan
+
+The `rebuild-wekan.sh` script guides you through a three-stage process:
+
+1. **Install dependencies (Option 1)** - Downloads all required Meteor packages and npm modules
+2. **Build WeKan (Option 2)** - Compiles the application
+3. **Run WeKan (Option 3)** - Starts the development server at http://localhost:4000
+
+```bash
+# Clone your fork
+git clone git@github.com:YOUR_USERNAME/wekan.git
+cd wekan
+
+# Make the script executable
+chmod +x rebuild-wekan.sh
+
+# Step 1: Install dependencies
+./rebuild-wekan.sh
+# Press 1 and Enter
+
+# Step 2: Build WeKan (after dependencies complete)
+./rebuild-wekan.sh
+# Press 2 and Enter
+
+# Step 3: Run WeKan in development mode
+./rebuild-wekan.sh
+# Press 3 and Enter
+```
+ 
+
+### WSL Users
+
+WSL users can use Snap Candidate. See [install docs](https://wekan.fi/install/).
+
+The development server will start at http://localhost:4000. Any changes you make to the source code will automatically trigger a rebuild and refresh your browser.
+
 ## Screenshot
 
 [More screenshots at Features page](https://github.com/wekan/wekan/tree/main/docs/Features)

SECURITY.md

@@ -1,4 +1,4 @@
-## About money
+## About Money
 
 See [CONTRIBUTING](CONTRIBUTING.md)
 
@@ -8,13 +8,13 @@ See [CONTRIBUTING](CONTRIBUTING.md)
 2. Send info about security issue ONLY to security@wekan.fi . NOT TO ANYWHERE ELSE. NO CC, NO BCC.
 3. Wait for new WeKan release that fixes security issue to appear to top of
    https://github.com/wekan/wekan/blob/main/CHANGELOG.md
-4. We will thank you by adding you to Hall of Fame: https://wekan.fi/hall-of-fame/
+4. We will thank you by adding you to Hall the of Fame: https://wekan.fi/hall-of-fame/
 5. All vulnerability details will be private to security@wekan.fi ,
    unless you help all WeKan platforms to have a way to upgrade, like sending
    database migrations code to security@wekan.fi or PRs to https://github.com/wekan/wekan/pulls .
-   There is no benefit to Wordwide Security Community to have more details about vulnerabilities,
+   There is no benefit to the Wordwide Security Community to have more details about vulnerabilities,
    if Worldwide Security Community does not help to make upgrades possible.
-6. If there some day becomes available a way to upgrade all WeKan platforms,
+6. If some day a way becomes available to upgrade all WeKan platforms,
    this page will be updated to add permission for security researchers
    to request new GHSA or CVE ID and publish your vulnerability details at your blog, talks, etc,
    and send that info also to security@wekan.fi to be added to
@@ -32,7 +32,7 @@ See [CONTRIBUTING](CONTRIBUTING.md)
 - If you forget to include vulnerability details.
 - If you send info about security issue to somewhere else than security@wekan.fi
 
-## How should reports be formatted?
+## How Should Reports Be Formatted?
 
 ```
 Name: %name
@@ -57,13 +57,13 @@ added to the WeKan Hall of Fame https://wekan.fi/hall-of-fame/
 No public domains, because all those are donated to Wekan Open Source project,
 and we don't have any permissions to do security scans on those donated servers.
 
-Please don't perform research that could impact other users. Secondly, please keep
-the reports short and succinct. If we fail to understand the logics of your bug, we will tell you.
+Please don't perform research that could impact other users. Second, please keep
+the reports short and succinct. If we fail to understand the logic of your bug, we will tell you.
 
-You can [Install Wekan](https://github.com/wekan/wekan/releases) to your own computer
+You can [Install Wekan](https://github.com/wekan/wekan/releases) on your own computer
 and scan it's vulnerabilities there.
 
-## About Wekan versions
+## About Wekan Versions
 
 There are only 2 versions of Wekan: Standalone Wekan, and Sandstorm Wekan.
 
@@ -74,8 +74,8 @@ like Snap and Docker have their own specific sandboxing etc features.
 
 Standalone Wekan by default does not load any files from Internet, like fonts, CSS, etc.
 This also means all Standalone Wekan functionality works in offline local networks.
-WeKan is used at most countries of the world https://snapcraft.io/wekan
-and by by companies that have 30k users.
+WeKan is used in most countries of the world https://snapcraft.io/wekan
+and by companies that have 30k users.
 
 - Wekan private board attachments are not accessible without logging in.
 - There is feature to set board public, so that board is visible without logging in in readonly mode, with realtime updates.
@@ -90,19 +90,19 @@ and by by companies that have 30k users.
 
 ## XSS
 
-- Dompurify https://www.npmjs.com/package/dompurify
-  - WeKan uses dompurify npm package to filter for XSS at fields like cards, as you can see from
+- DOMpurify https://www.npmjs.com/package/dompurify
+  - WeKan uses DOMpurify npm package to filter for XSS at fields like cards, as you can see from
     [package.json](https://github.com/wekan/wekan/blob/main/package.json). Other used versions can be seen from
     [Meteor versions file](https://github.com/wekan/wekan/blob/main/.meteor/versions).
   - Forms can include markdown links, html, image tags etc like you see at https://wekan.github.io .
   - It's possible to add attachments to cards, and markdown/html links to files.
-  - Dompurify cleans up viewed code, so Javascript in input fields does not execute
+  - Dompurify cleans up viewed code, so JavaScript in input fields does not execute
     - https://wekan.github.io/hall-of-fame/fieldbleed/
 - Reaction in comment is now checked, that it does not have extra added code
   - https://wekan.github.io/hall-of-fame/reactionbleed/
 - https://github.com/wekan/wekan/blob/main/packages/markdown/src/template-integration.js#L76
 
-## QA about PubSub
+## QA About PubSub
 
 Q:
 
@@ -115,32 +115,32 @@ A:
 
 ## PubSub
 
-- It is not security issue to show some text or image, that user has permission to see. It is a security issue, if browserside is some text or image that user should not see.
-- Meteor has browserside minimongo database, made with Javascript, updated with Publish/Subscribe, PubSub.
+- It is not a security issue to show text or images that the user has permission to see. It is a security issue, if browserside is some text or image that user should not see.
+- Meteor has browserside minimongo database, made with JavaScript, updated with Publish/Subscribe, PubSub.
 - Publish/Subscribe means, that realtime web framework reads database changes stream, and then immediately updates webpage,
-  like like dashboards, chat, kanban. That is the point in any realtime web framework in any programming language.
+  like like dashboards, chat, kanban. That is the point of any realtime web framework in any programming language.
 - Yes, you should check with Meteor DevTools Evolved Chromium/Firefox extension that at minimongo is only text that user has permission to see.
-- Do checking as logged in user, and logged out user.
+- Check as a logged-in user and as a logged-out user.
 - Check permissions and sanitize before allowing some change, because someone could modify content of input field,
   PubSub/websocket data (for example with Burp Suite Community Edition), etc.
-- If you have REST API, also check that only those that have login token, and have permission, can view or edit text
+- If you have a REST API, also check that only those who have a login token and permission can view or edit text.
 - You should not include any data user is not allowed to see. Not to webpage text, not to websockets/PubSub, etc.
 - Minimongo should not have password hashes PubSub https://wekan.github.io/hall-of-fame/userbleed/
-- PubSub uses Websockets, so you need those to be enabled at webserver like Caddy/Nginx/Apache etc, examples of settings
+- PubSub uses WebSockets, so you need those to be enabled on the webserver like Caddy/Nginx/Apache etc, examples of settings
   at right menu of https://github.com/wekan/wekan/wiki
-- Clientside https://github.com/wekan/wekan/tree/main/client/components subscribes to 
+- Clientside https://github.com/wekan/wekan/tree/main/client/components subscribes to
   PubSub https://github.com/wekan/wekan/tree/main/server/publications or calls meteor methods at https://github.com/wekan/wekan/tree/main/models
 - For Admin:
   - You can have input field for password https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
   - You can save password to database https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
   - Check that only current user or Admin can change password https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
     - Note that currentUser uses code like Meteor.user() in .js file
-  - Do not have password hashes in PubSub https://github.com/wekan/wekan/blob/main/server/publications/users.js
+  - Do not include password hashes in PubSub https://github.com/wekan/wekan/blob/main/server/publications/users.js
   - Only show Admin Panel to Admin https://github.com/wekan/wekan/blob/main/client/components/settings/settingBody.jade#L3
-- If there is a lot of data, use pagination https://github.com/wekan/wekan/blob/main/client/components/settings/peopleBody.js
-- Only have limited amount of data published in PubSub. Limit in MongoDB query in publications how much is published. Too much could make browser too slow.
-- Use Environment variables for any email etc passwords.
-- But what if you would like to remove minimongo? And only use Meteor methods for saving? In that case, you don't have realtime updates,
+- If there is a large amount of data, use pagination https://github.com/wekan/wekan/blob/main/client/components/settings/peopleBody.js
+- Only publish a limited amount of data in PubSub. Limit in MongoDB query in publications how much is published. Too much could make browser too slow.
+- Environment variables for email and other passwords.
+- But what if you would like to remove Minimongo and only use Meteor methods for saving? In that case, you don't have realtime updates,
   and you need to write much more code to load and save data yourself, handle any multi user data saving conflicts yourself,
   and many Meteor Atmospherejs.com PubSub using packages would not work anymore https://github.com/wekan/we
 
@@ -152,10 +152,10 @@ A:
 
 ## Permissions and Roles
 
-- For any user permissions, it's best to use Meteor package package https://github.com/Meteor-Community-Packages/meteor-roles .
-- Currently WeKan has custom hardcoded permissions, WeKan does not yet use that meteor-roles package.
+- For any user permissions, it's best to use Meteor package https://github.com/Meteor-Community-Packages/meteor-roles .
+- Currently, WeKan has custom hardcoded permissions and does not yet use the meteor-roles package.
   - Using permissions at WeKan sidebar https://github.com/wekan/wekan/blob/main/client/components/sidebar/sidebar.js#L1854-L1875
-  - List of roles https://github.com/wekan/wekan/wiki/REST-API-Role . Change at board or Admin Panel. Also Organizations/Teams.
+  - List of roles: https://github.com/wekan/wekan/wiki/REST-API-Role . Change at board or Admin Panel. Also Organizations/Teams.
   - Worker role: https://github.com/wekan/wekan/issues/2788
   - Not implemented yet: Granular Roles https://github.com/wekan/wekan/issues/3022
 - Check is user logged in, with `if (Meteor.user()) {`
@@ -164,8 +164,8 @@ A:
 
 ## Environment variables
 
-- For any passwords, use environment variables, those are serverside
-- Do not copy environment variable to public variable that is visible browserside https://github.com/wekan/wekan/blob/main/server/max-size.js
+- For any passwords, use environment variables; those are serverside
+- Do not copy environment variables to public variables that are visible on the browserside https://github.com/wekan/wekan/blob/main/server/max-size.js
 
 ```
 Meteor.startup(() => {
@@ -176,13 +176,13 @@ Meteor.startup(() => {
 ```
 
 - For serverside, you can set Meteor.settings.variablename, without text public
-- For WeKan kanban, there is feature for setting board public, it can be viewed by anyone, there is realtime updates. But 
+- For WeKan kanban, there is a feature for setting a board to public; it can be viewed by anyone, with realtime updates. But
 - Some of those permissions are checked at users.js models at https://github.com/wekan/wekan/tree/main/models
 - Environment variables are used for email server passwords, etc, at all platforms https://github.com/wekan/wekan/commit/a781c0e7dcfdbe34c1483ee83cec12455b7026f7
 
 ## Escape HTML comment tags so that HTML comments are visible
 
-- Someone reported, that it is problem that content of HTML comments in edit mode, are not visible at at view mode, so this makes HTML comments visible.
+- Someone reported that it was a problem that the content of HTML comments in edit mode was not visible in view mode, so this change makes HTML comments visible.
 - https://github.com/wekan/wekan/commit/167863d95711249e69bb3511175d73b34acbbdb3
 - https://wekan.github.io/hall-of-fame/invisiblebleed/
 
@@ -249,18 +249,16 @@ Meteor.startup(() => {
 
 ### Sandstorm Wekan Security
 
-On Sandstorm platform using environment variable Standalone Wekan features like Admin Panel etc are
-turned off, because Sandstorm platform provides SSO for all apps running on Sandstorm. 
+On the Sandstorm platform, Standalone WeKan features like the Admin Panel are turned off using environment variables, because Sandstorm platform provides SSO for all apps running on Sandstorm.
 
-[Sandstorm](https://sandstorm.io) is separate Open Source platform that has been
+[Sandstorm](https://sandstorm.io) is a separate Open Source platform that has been
 [security audited](https://sandstorm.io/news/2017-03-02-security-review) and found bugs fixed.
-Sandstorm also has passwordless login, LDAP, SAML, Google etc auth options already.
-At Sandstorm code is read-only and signed by app maintainers, only grain content can be modified.
-Wekan at Sandstorm runs in sandboxed grain, it does not have access elsewhere without user-visible
-PowerBox request or opening randomly-generated API key URL.
+Sandstorm also has passwordless login, LDAP, SAML, Google, and other auth options already.
+On Sandstorm, code is read-only and signed by app maintainers; only grain content can be modified.
+WeKan on Sandstorm runs in a sandboxed grain; it does not have access elsewhere without a user-visible PowerBox request or opening a randomly-generated API key URL.
 Also read [Sandstorm Security Practices](https://docs.sandstorm.io/en/latest/using/security-practices/) and
 [Sandstorm Security non-events](https://docs.sandstorm.io/en/latest/using/security-non-events/).
-For Sandstorm specific security issues you can contact [kentonv](https://github.com/kentonv) by email. 
+For Sandstorm specific security issues you can contact [kentonv](https://github.com/kentonv) by email.
 
 ## What Wekan bugs are eligible?
 
@@ -276,14 +274,14 @@ a security issue, we'd like to know about it, and also how to fix it:
 
 ## What Wekan bugs are NOT eligible?
 
-Typical already known or "no impact" bugs such as:
+Typical already-known or 'no impact' bugs such as:
 
 - [Wekan API old tokens not replaced correctly](https://github.com/wekan/wekan/issues/1437)
 - Missing Cookie flags on non-session cookies or 3rd party cookies
 - Logout CSRF
 - Social engineering
 - Denial of service
-- SSL BEAST/CRIME/etc. Wekan does not have SSL built-in, it uses Caddy/Nginx/Apache etc at front.
+- SSL BEAST/CRIME/etc. WeKan does not have SSL built-in; it uses Caddy/Nginx/Apache, etc., on the front end.
   Integrated Caddy support is updated often.
 - Email spoofing, SPF, DMARC & DKIM. Wekan does not include email server.
 

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v8.78.0"
+appVersion: "v8.93.0"
 files:
   userUploads:
     - README.md

client/components/boards/boardsList.jade

@@ -130,7 +130,7 @@ template(name="boardList")
                     if BoardMultiSelection.isActive
                       .materialCheckBox.multi-selection-checkbox.js-toggle-board-multi-selection(
                         class="{{#if BoardMultiSelection.isSelected _id}}is-checked{{/if}}")
-                    span.board-handle(title="{{_ 'drag-board'}}")
+                    span.board-handle(title="{{boardWorkspaceDragHint}}")
                       span.emoji-icon
                         i.fa.fa-arrows
 
@@ -158,13 +158,13 @@ template(name="boardList")
                     if BoardMultiSelection.isActive
                       .materialCheckBox.multi-selection-checkbox.js-toggle-board-multi-selection(
                         class="{{#if BoardMultiSelection.isSelected _id}}is-checked{{/if}}")
-                    span.board-handle(title="{{_ 'drag-board'}}")
+                    span.board-handle(title="{{boardWorkspaceDragHint}}")
                       span.emoji-icon
                         i.fa.fa-arrows
 
                     a.js-open-board(href="{{pathFor 'board' id=_id slug=slug}}")
                       span.details
-                        span.board-list-item-name(title="{{_ 'board-drag-drop-reorder-or-click-open'}}")
+                        span.board-list-item-name(title="{{boardOpenAndMoveHint}}")
                           +viewer
                             = title
                         unless currentSetting.hideBoardMemberList

client/components/boards/boardsList.js

@@ -539,6 +539,26 @@ Template.boardList.helpers({
   hasBoardsSelected() {
     return BoardMultiSelection.count() > 0;
   },
+  boardWorkspaceDragHint() {
+    const drag = TAPi18n.__('drag-board') || 'Drag board';
+    const remaining = TAPi18n.__('allboards.remaining') || 'Remaining';
+    const workspaces = TAPi18n.__('allboards.workspaces') || 'Workspaces';
+    return `${drag}: ${remaining} <-> ${workspaces}`;
+  },
+  boardOpenAndMoveHint() {
+    const remaining = TAPi18n.__('allboards.remaining') || 'Remaining';
+    const workspaces = TAPi18n.__('allboards.workspaces') || 'Workspaces';
+    return (
+      TAPi18n.__(
+        'board-open-and-move-between-remaining-and-workspaces',
+        {
+          remaining,
+          workspaces,
+        },
+      ) ||
+      `Click board icon to open board. Drag board between ${remaining} and ${workspaces}.`
+    );
+  },
 });
 
 Template.workspaceTree.helpers({

client/components/main/header.css

@@ -177,7 +177,6 @@
 }
 #header-quick-access ul.header-quick-access-list {
   transition: opacity 0.2s;
-  overflow: hidden;
   white-space: nowrap;
   padding: 10px;
   margin: -10px;
@@ -185,16 +184,18 @@
   min-width: 0; /* Allow shrinking below content size */
   display: flex; /* Use flexbox for better control */
   align-items: center;
+  overflow-x: auto;
+  scrollbar-color: white #2573a7;
 }
 
 /* Hide scrollbar completely */
 #header-quick-access ul.header-quick-access-list::-webkit-scrollbar {
-  display: none;
+  display: flex;
 }
 
 #header-quick-access ul.header-quick-access-list {
-  -ms-overflow-style: none; /* IE and Edge */
-  scrollbar-width: none; /* Firefox */
+  -ms-overflow-style: thin; /* IE and Edge */
+  scrollbar-width: thin; /* Firefox */
 }
 #header-quick-access ul.header-quick-access-list li {
   display: inline-block; /* Keep inline-block for proper spacing */

client/components/main/header.jade

@@ -70,10 +70,6 @@ template(name="header")
           else
             li.current.empty(title="{{_ 'quick-access-description'}}")
             | {{_ 'quick-access-description'}}
-        #header-new-board-icon
-      // Next line is used only for spacing at header,
-      // there is no visible clickable icon.
-      #header-new-board-icon
       //
         Hide duplicate create board button,
       //

client/components/main/popup.css

@@ -78,23 +78,32 @@
   overflow-x: hidden;
 }
 
-/* Allow dynamic max-height to override default constraint */
+/* Bounded height: flex column + clip so inline max-height cannot spill past the shell.
+   Class pop-over--bounded matches popup.tpl.jade when max-height is set (more reliable
+   than attribute substring matching on the style attribute alone). */
+.pop-over.pop-over--bounded,
 .pop-over[style*='max-height'] {
   overflow: hidden;
   display: flex;
   flex-direction: column;
+  min-height: 0;
+  box-sizing: border-box;
 }
 
+.pop-over.pop-over--bounded .header,
 .pop-over[style*='max-height'] .header {
   flex: 0 0 auto;
 }
 
+.pop-over.pop-over--bounded .content-wrapper,
 .pop-over[style*='max-height'] .content-wrapper {
-  flex: 1 1 auto;
+  /* 0% basis: use remaining space under header, scroll inside (not past white bg) */
+  flex: 1 1 0%;
   min-height: 0;
   max-height: none;
   overflow-y: auto;
   overflow-x: hidden;
+  background: inherit;
 }
 .pop-over .content-container {
   width: 100%;
@@ -103,6 +112,7 @@
 }
 
 /* Allow dynamic max-height to override default constraint for content-container */
+.pop-over.pop-over--bounded .content-container,
 .pop-over[style*='max-height'] .content-container {
   max-height: none;
 }

client/components/main/popup.tpl.jade

@@ -2,6 +2,7 @@
   class="{{#unless title}}miniprofile{{/unless}}"
   class=currentBoard.colorClass
   class="{{#unless title}}no-title{{/unless}}"
+  class="{{#if offset.maxHeight}}pop-over--bounded{{/if}}"
   data-popup="{{popupName}}"
   style="left:{{offset.left}}px; top:{{offset.top}}px;{{#if offset.maxHeight}} max-height:{{offset.maxHeight}}px;{{/if}}")
   .header

docker-compose.yml

@@ -289,7 +289,9 @@ services:
       # remove port mapping if you use nginx reverse proxy, port 8080 is already exposed to wekan-tier network
       - 80:8080
     environment:
-      #-------------------- CHANGE STREAMS --------------------
+      #-------------------- USING MONGODB CHANGE STREAMS WITH REPLICA SETS AT CURRENT DATABASE --------------------
+      # If you would not like to use Change Streams and replica set for improving speed, change to use polling:
+      #- METEOR_REACTIVITY_ORDER=polling
       # https://forums.meteor.com/t/meteor-3-5-beta-change-streams-performance-improvements/64461#change-streams-setup-3
       # https://github.com/meteor/meteor/blob/release-3.5/v3-docs/docs/performance/change-streams-observer-driver.md#choosing-the-reactivity-driver-order
       - METEOR_REACTIVITY_ORDER=changeStreams,oplog,polling

docs/ImportExport/History-of-Schema-Migrations-Systems.md

@@ -0,0 +1,33 @@
+# History of Schema Migration Systems
+
+1. At `server/migrations.js` was changes to database schema, but making modifications to thousands
+   of cards did take many hours, it is too much time.
+2. There was Admin Panel options to migrate attachments from MongoDB GridFS to filesystem, but that could
+   cause WeKan to become unresponsive, it did take too much resources.
+3. There was separate migration script to change database schema, but it was incomplete, some data was not migrated.
+4. Migrations were moved to opening of board, but that caused opening board to take too much time
+5. Migrations were moved to Right Sidebar/Board Settings/Migrations, but there was complains that
+   it is too much try to get users to learn using those migrations, and it could take
+   many hours for migrations to run at big board. Also, there was Responsible Security Disclosure
+   that Board Admins have too much rights to change board structure so much, so migrations were moved
+   to Admin Panel to be used only by Admins.
+6. At Admin Panel/Cron, migrations did not show progress of migrations well enough, it looked like no
+   migrations were happening, migrations did take too much time, and WeKan did slow down while migrations
+   were in progress, as was seen at increased CPU and RAM usage.
+7. Migrations were commented out, so that they would not slow down WeKan anymore.
+8. WeKan was migrated to Meteor 3.x.
+9. Someone added datetime migrations, to convert previous date strings to Date Objects, that PR was merged,
+   but questions still is, does it cause too much slowdown. It should have been changed to detect and show
+   any current date, detecting is it a string or Date Object.
+10. There was added code, that could show all Swimlanes/Lists/Cards without migrations, showing both
+   previous Shared Lists and newest Per-Swimlane Lists, and also orphaned Swimlanes/Lists/Cards.
+   But there was bug that something still disappeared when moving. It remains to be seen,
+   can there continue to be showing all data without migrations, can that code be made to work,
+   or is it really necessary to reintroduce migrations that take too much time.
+
+How should migrations work?
+
+a) Separate migrations script, that would be run before starting WeKan?
+b) Reading any database structure and showing data, without needing to migrate any data?
+c) Migrating while WeKan is running, that could cause slowdown?
+d) Some other way?

docs/Platforms/Propietary/Windows/Offline.md

@@ -10,7 +10,7 @@ This is without container (without Docker or Snap).
 
 Right click and download files 1-4:
 
-1. [wekan-8.78-win64.zip](https://github.com/wekan/wekan/releases/download/v8.78/wekan-8.78-win64.zip)
+1. [wekan-8.93-win64.zip](https://github.com/wekan/wekan/releases/download/v8.93/wekan-8.93-win64.zip)
 2. [node.exe](https://nodejs.org/dist/latest-v24.x/win-x64/node.exe)
 
 3. [mongodb-windows-x86_64-7.0.31-signed.msi](https://fastdl.mongodb.org/windows/mongodb-windows-x86_64-7.0.31-signed.msi)
@@ -21,7 +21,7 @@ Right click and download files 1-4:
 
 6. Double click `mongodb-windows-x86_64-7.0.31-signed.msi` . In installer, uncheck downloading MongoDB compass.
 
-7. Unzip `wekan-8.78-win64.zip` , inside it is directory `bundle`, to it copy other files:
+7. Unzip `wekan-8.93-win64.zip` , inside it is directory `bundle`, to it copy other files:
 
 ```
 bundle (directory)

helm/charts/artifacthub-repo.yml

@@ -0,0 +1,6 @@
+repositoryID: f6dde1c7-7cc4-4053-870c-0dc6a73d9ac9
+owners:
+  - name: wekan
+    email: support@wekan.fi
+  - name: xet7
+    email: x@xet7.org