v9.02

Thanks to sbaecker !

Fixes #6320

.github-old-workflows/release-all.yml

@@ -32,79 +32,9 @@ permissions:
   id-token: write
 
 jobs:
-  # ─── 0. Version bump, docs rebuild, and tag creation ────────────────────────
-  # Runs update-node-version.sh, rebuild-docs.sh, and sed-release-versions.sh,
-  # then commits, pushes, and creates the version tag.
-  # Skipped on re-run if the tag already exists.
-  version-bump:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-
-      - name: Check if tag already exists
-        id: check
-        run: |
-          if git ls-remote --tags origin | grep -q "refs/tags/v${{ inputs.new_version }}$"; then
-            echo "existed=true" >> $GITHUB_OUTPUT
-            echo "Tag v${{ inputs.new_version }} already exists. Skipping version bump."
-          else
-            echo "existed=false" >> $GITHUB_OUTPUT
-          fi
-
-      - uses: actions/setup-node@v6
-        if: steps.check.outputs.existed == 'false'
-        with:
-          node-version: '24.14.1'
-
-      - name: Install Python dependencies for API doc generation
-        if: steps.check.outputs.existed == 'false'
-        run: python3 -m pip install --break-system-packages esprima
-
-      - name: Delete GitHub Actions caches
-        if: steps.check.outputs.existed == 'false'
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: gh cache delete --all || true
-
-      - name: Update Node.js to latest 24.x
-        if: steps.check.outputs.existed == 'false'
-        run: ./releases/update-node-version.sh
-
-      - name: Rebuild API docs
-        if: steps.check.outputs.existed == 'false'
-        run: ./releases/rebuild-docs.sh "${{ inputs.new_version }}"
-
-      - name: Update version numbers in release files
-        if: steps.check.outputs.existed == 'false'
-        run: ./releases/sed-release-versions.sh "${{ inputs.old_version }}" "${{ inputs.new_version }}"
-
-      - name: Commit and push version bump
-        if: steps.check.outputs.existed == 'false'
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add --all
-          # GITHUB_TOKEN cannot push workflow file changes; exclude them
-          git reset HEAD -- .github/workflows/ || true
-          git checkout -- .github/workflows/ || true
-          if git diff --cached --quiet; then
-            echo "No changes to commit."
-          else
-            git commit -m "v${{ inputs.new_version }}"
-          fi
-          git push
-
-      - name: Create and push tag
-        if: steps.check.outputs.existed == 'false'
-        run: |
-          git tag -a "v${{ inputs.new_version }}" -m "v${{ inputs.new_version }}"
-          git push origin "v${{ inputs.new_version }}"
 
   # ─── 1. Extract version and release notes ───────────────────────────────────
   prepare:
-    needs: version-bump
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.version.outputs.version }}
@@ -112,12 +42,12 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
-          ref: refs/tags/v${{ inputs.new_version }}
+          ref: refs/tags/v${{ needs.prepare.outputs.version }}
 
       - name: Set version from input
         id: version
         run: |
-          VERSION="${{ inputs.new_version }}"
+          VERSION="${{ needs.prepare.outputs.version }}"
           VERSION="${VERSION#v}"
           echo "version=$VERSION" >> $GITHUB_OUTPUT
 
@@ -154,13 +84,14 @@ jobs:
   # Therefore the full Meteor build always runs here on x86_64.
   # All other Linux architectures then rebuild only the native npm modules
   # from this bundle (much faster than a full Meteor build).
-  # Node.js version must match what Meteor 3.5-beta.7 bundles: 24.14.1 (ABI 143).
+  # Node.js version must match what Meteor 3.5-beta.7 bundles (detected automatically).
   build-amd64:
     needs: prepare
     runs-on: ubuntu-24.04
     timeout-minutes: 180
     env:
       VERSION: ${{ needs.prepare.outputs.version }}
+      NODE_VERSION: ${{ needs.prepare.outputs.version }}
     steps:
       - uses: actions/checkout@v6
         with:
@@ -184,11 +115,11 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y build-essential g++ make python3 curl wget zip unzip
 
-      # Pin to Node 24.14.1 — the exact version bundled by Meteor 3.5-beta.7.
+      # Pin to detected latest Node.js 24.x — must match Meteor's bundled version.
       # Using the same version for build and npm rebuild ensures consistent native module ABI.
       - uses: actions/setup-node@v6
         with:
-          node-version: '24.14.1'
+          node-version: '${{ needs.prepare.outputs.version }}'
 
       - name: Install Meteor
         run: |
@@ -225,22 +156,26 @@ jobs:
     timeout-minutes: 60
     env:
       VERSION: ${{ needs.prepare.outputs.version }}
+      NODE_VERSION: ${{ needs.prepare.outputs.version }}
+      NODE_VERSION_ARM64: ''
     steps:
       - name: Install dependencies
         run: |
           sudo apt-get update
           sudo apt-get install -y build-essential g++ make python3 curl unzip zip
 
-      - uses: actions/setup-node@v6
-        with:
-          node-version: '24.14.1'
+
+      - name: Set Node.js version for arm64
+        id: node_arm64
+        run: |
+          echo "NODE_VERSION_ARM64=24" >> $GITHUB_ENV
 
       - name: Download amd64 bundle
         uses: actions/download-artifact@v8
         with:
           name: bundle-amd64
 
-      - name: Rebuild native modules for arm64
+      - name: Rebuild native modules for arm64 in container
         run: |
           unzip wekan-${VERSION}-amd64.zip
           # Fix: bcrypt 5.0.1 (Meteor accounts-password) ships node-addon-api@3
@@ -257,10 +192,12 @@ jobs:
             popd > /dev/null
             rm -rf "$TMP"
           fi
-          cd bundle/programs/server
-          rm -rf node_modules
-          npm install
-          cd ../..
+          # Use the latest available Node.js 24.x slim image for arm64
+          docker run --rm --platform linux/arm64 \
+            -v "$(pwd)/bundle:/bundle" \
+            -w /bundle/programs/server \
+            node:24-slim \
+            sh -c "apt-get update -qq && apt-get install -y -q build-essential python3 && npm install"
 
       - name: Clean up and create arm64 zip
         run: |
@@ -275,14 +212,15 @@ jobs:
   # ─── 4. Build s390x bundle (rebuild native modules via QEMU container) ───────
   # Meteor 3.5-beta.7 does NOT support s390x (installer exits with error on that arch).
   # GitHub Actions has no native s390x runners.
-  # Solution: QEMU emulation + node:24.14.1-slim (s390x variant) for npm rebuild.
-  # node:24.14.1-slim is pinned to match Meteor 3.5-beta.7's bundled Node.js version exactly.
+  # Solution: QEMU emulation + node:<version>-slim (s390x variant) for npm rebuild.
   build-s390x:
     needs: [prepare, build-amd64]
     runs-on: ubuntu-latest
     timeout-minutes: 90
     env:
       VERSION: ${{ needs.prepare.outputs.version }}
+      NODE_VERSION: ${{ needs.prepare.outputs.version }}
+      NODE_VERSION_S390X: ''
     steps:
       - name: Set up QEMU for s390x
         uses: docker/setup-qemu-action@v4
@@ -297,6 +235,11 @@ jobs:
         with:
           name: bundle-amd64
 
+      - name: Set Node.js version for s390x
+        id: node_s390x
+        run: |
+          echo "NODE_VERSION_S390X=24" >> $GITHUB_ENV
+
       - name: Rebuild native modules for s390x in container
         run: |
           unzip wekan-${VERSION}-amd64.zip
@@ -315,11 +258,11 @@ jobs:
             popd > /dev/null
             rm -rf "$TMP"
           fi
-          # node:24.14.1-slim s390x — same Node.js version as Meteor 3.5-beta.7 bundled
+          # Use the latest available Node.js 24.x slim image for s390x
           docker run --rm --platform linux/s390x \
             -v "$(pwd)/bundle:/bundle" \
             -w /bundle/programs/server \
-            node:24.14.1-slim \
+            node:24-slim \
             sh -c "apt-get update -qq && apt-get install -y -q build-essential python3 && npm install"
 
       - name: Clean up and create s390x zip
@@ -335,13 +278,15 @@ jobs:
   # ─── 4b. Build ppc64le bundle (rebuild native modules via QEMU container) ────
   # Meteor 3.5-beta.7 does NOT support ppc64le (installer exits with error on that arch).
   # GitHub Actions has no native ppc64le runners.
-  # Solution: QEMU emulation + node:24.14.1-slim (ppc64le variant) for npm rebuild.
+  # Solution: QEMU emulation + node:<version>-slim (ppc64le variant) for npm rebuild.
   build-ppc64le:
     needs: [prepare, build-amd64]
     runs-on: ubuntu-latest
     timeout-minutes: 90
     env:
       VERSION: ${{ needs.prepare.outputs.version }}
+      NODE_VERSION: ${{ needs.prepare.outputs.version }}
+      NODE_VERSION_PPC64LE: ''
     steps:
       - name: Set up QEMU for ppc64le
         uses: docker/setup-qemu-action@v4
@@ -356,6 +301,11 @@ jobs:
         with:
           name: bundle-amd64
 
+      - name: Set Node.js version for ppc64le
+        id: node_ppc64le
+        run: |
+          echo "NODE_VERSION_PPC64LE=24" >> $GITHUB_ENV
+
       - name: Rebuild native modules for ppc64le in container
         run: |
           unzip wekan-${VERSION}-amd64.zip
@@ -374,11 +324,11 @@ jobs:
             popd > /dev/null
             rm -rf "$TMP"
           fi
-          # node:24.14.1-slim ppc64le — same Node.js version as Meteor 3.5-beta.7 bundled
+          # Use the latest available Node.js 24.x slim image for ppc64le
           docker run --rm --platform linux/ppc64le \
             -v "$(pwd)/bundle:/bundle" \
             -w /bundle/programs/server \
-            node:24.14.1-slim \
+            node:24-slim \
             sh -c "apt-get update -qq && apt-get install -y -q build-essential python3 && npm install"
 
       - name: Clean up and create ppc64le zip
@@ -431,11 +381,11 @@ jobs:
   #          popd > /dev/null
   #          rm -rf "$TMP"
   #        fi
-  #        # node:24.14.1-slim arm/v7 — same Node.js version as Meteor 3.5-beta.7 bundled
+  #        # node:<version>-slim arm/v7 — same Node.js version as Meteor bundled
   #        docker run --rm --platform linux/arm/v7 \
   #          -v "$(pwd)/bundle:/bundle" \
   #          -w /bundle/programs/server \
-  #          node:24.14.1-slim \
+  #          node:${NODE_VERSION}-slim \
   #          sh -c "apt-get update -qq && apt-get install -y -q build-essential python3 && npm install"
   #
   #    - name: Clean up and create armhf zip
@@ -458,7 +408,7 @@ jobs:
     steps:
       - uses: actions/setup-node@v6
         with:
-          node-version: '24.14.1'
+          node-version: '${{ needs.prepare.outputs.version }}'
 
       ## With Node 24 these are already preinstalled at GitHub Windows runners
       #- name: Install node-gyp and build tools
@@ -551,7 +501,7 @@ jobs:
         uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Create Docker config with registry credentials
         run: |
@@ -632,8 +582,8 @@ jobs:
           files: "*.snap"
 
   # ─── 9. Update Helm charts and deploy to GitHub Pages ─────────────────────────
-  # Chart source is in helm/wekan/, published packages + index.yaml in helm/charts/.
-  # GitHub Pages deploys helm/charts/ via Actions, serving at https://wekan.github.io/wekan/
+  # Chart source is in helm/wekan/, published packages + index.yaml in docs/wekan/.
+  # GitHub Pages deploys docs/wekan/ via Actions, serving at https://wekan.fi/wekan/
   helm:
     needs: [prepare, docker]
     runs-on: ubuntu-latest
@@ -650,42 +600,75 @@ jobs:
 
       - name: Update Chart.yaml and values.yaml with new version
         run: |
-          cd helm/wekan
-          # Chart.yaml: update appVersion and version
-          sed -i "s/^appVersion: .*/appVersion: \"${VERSION}\"/" Chart.yaml
-          sed -i "s/^version: .*/version: ${VERSION}.0/" Chart.yaml
-          # values.yaml: update image tag
-          sed -i "s/^  tag: v.*/  tag: v${VERSION}/" values.yaml
+          CHART_PATH=docs/wekan
+          CHART_FILE=$CHART_PATH/Chart.yaml
+          VALUES_FILE=$CHART_PATH/values.yaml
+          CHARTS_DIR=docs/charts
+          INDEX_FILE=$CHARTS_DIR/index.yaml
+          VERSION=${VERSION}
+          # Update Chart.yaml (appVersion and version)
+          sed -i "s/^appVersion: .*/appVersion: \"$VERSION\"/" "$CHART_FILE"
+          sed -i "s/^version: .*/version: $VERSION.0/" "$CHART_FILE"
+          # Update values.yaml (image.tag)
+          sed -i "s/^  tag: v.*/  tag: v$VERSION/" "$VALUES_FILE"
 
       - name: Build Helm dependencies
         run: |
-          cd helm/wekan
-          helm repo add mongo https://groundhog2k.github.io/helm-charts/
+          cd docs/wekan
+          helm repo add mongo https://groundhog2k.github.io/helm-charts/ || true
           helm dependency update
           helm dependency build
 
-      - name: Package chart and update index
+      - name: Package chart to docs/charts and update index.yaml
         run: |
-          helm package helm/wekan -d helm/charts/
-          helm repo index helm/charts/ --url https://wekan.github.io/wekan/
+          CHART_PATH=docs/wekan
+          CHARTS_DIR=docs/charts
+          INDEX_FILE=$CHARTS_DIR/index.yaml
+          VERSION=${VERSION}
+          cd $CHARTS_DIR
+          helm package ../wekan -d .
+          ARCHIVE=wekan-$VERSION.0.tgz
+          SHA256=$(sha256sum "$ARCHIVE" | awk '{print $1}')
+          CREATED=$(TZ='Europe/Helsinki' date '+%Y-%m-%dT%H:%M:%S.000000000%:z')
+          if [ -f "$INDEX_FILE" ]; then
+            awk '/^- apiVersion: v2/{flag=1;print;next}/^- apiVersion: v2/{flag=0}flag' "$INDEX_FILE" | head -n 30 > /tmp/topentry.yaml
+            sed -i "s/appVersion: .*/appVersion: \"$VERSION\"/" /tmp/topentry.yaml
+            sed -i "s/created: .*/created: \"$CREATED\"/" /tmp/topentry.yaml
+            sed -i "s/digest: .*/digest: $SHA256/" /tmp/topentry.yaml
+            sed -i "s|urls:.*|urls:\n    - https://wekan.github.io/wekan/wekan-$VERSION.0.tgz|" /tmp/topentry.yaml
+            sed -i "s/version: .*/version: $VERSION.0/" /tmp/topentry.yaml
+            awk 'NR==1{print;system("cat /tmp/topentry.yaml");next} /^  - apiVersion: v2/ && !p{p=1;next} 1' "$INDEX_FILE" > /tmp/index.yaml
+            mv /tmp/index.yaml "$INDEX_FILE"
+            rm /tmp/topentry.yaml
+          else
+            echo "index.yaml not found, skipping index update."
+          fi
 
-      - name: Update created time to Finland time
+      - name: Commit updated chart and index
         run: |
-          FINLAND_TIME=$(TZ='Europe/Helsinki' date '+%Y-%m-%dT%H:%M:%S.000000000%:z')
-          sed -i "0,/^    created: .*/s/^    created: .*/    created: \"${FINLAND_TIME}\"/" helm/charts/index.yaml
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add docs/wekan/ docs/charts/
+          git commit -m "${VERSION}.0"
+          git push origin HEAD:refs/heads/main
+
+      - name: Upload docs/charts/ as Pages artifact
+        uses: actions/upload-pages-artifact@v5
+        with:
+          path: docs/charts/
 
       - name: Commit updated chart
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add helm/
-          git commit -m "Helm chart ${VERSION}.0"
+          git add docs/wekan/
+          git commit -m "${VERSION}.0"
           git push origin HEAD:refs/heads/main
 
-      - name: Upload helm/charts/ as Pages artifact
-        uses: actions/upload-pages-artifact@v4
+      - name: Upload docs/wekan/ as Pages artifact
+        uses: actions/upload-pages-artifact@v5
         with:
-          path: helm/charts/
+          path: docs/wekan/
 
   # ─── 10. Deploy Helm chart to GitHub Pages ───────────────────────────────────
   deploy-pages:
@@ -700,4 +683,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github-old-workflows/test_suite.yml

@@ -127,7 +127,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '24.14.1'
+          node-version: '24.15.0'
 
       - name: Setup meteor
         uses: meteorengineer/setup-meteor@v3

.meteor/packages

@@ -59,3 +59,6 @@ ejson@1.2.0-beta350.7
 logging@1.3.6
 wekan-fullcalendar
 wekan-fontawesome
+jam:offline
+jam:method
+jam:pub-sub

.meteor/versions

@@ -45,6 +45,9 @@ htmljs@2.0.1
 http@1.4.4
 id-map@1.2.0
 inter-process-messaging@0.1.2
+jam:method@1.9.1
+jam:offline@0.4.1
+jam:pub-sub@0.5.1
 jquery@3.0.2
 lai:collection-extensions@1.0.0
 localstorage@1.2.1
@@ -73,7 +76,7 @@ ordered-dict@1.2.0
 ostrio:cookies@2.9.1
 ostrio:cstorage@4.0.1
 ostrio:files@3.0.1
-ostrio:flow-router-extra@3.12.1
+ostrio:flow-router-extra@3.13.0
 ostrio:i18n@3.2.1
 promise@1.0.0
 quave:synced-cron@2.4.0

CHANGELOG.md

@@ -26,6 +26,130 @@ Versions:
 - WeKan 8.00-8.06 had wrong raw database directory setting /var/snap/wekan/common/wekan and some cards were not visible,
   it was fixed at WeKan 8.07 where database directory is back to /var/snap/wekan/common and all cards are visible.
 
+# v9.02 2026-04-28 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Fix mongodb in snap 9.01 on Ubuntu 24.04 crashes because of missing libcrypto.so.1.1](https://github.com/wekan/wekan/commit/a4b5ac6c4e2cfba6983b81ff0282e1c787576d06).
+  Thanks to sbaecker.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v9.01 2026-04-28 WeKan ® release
+
+This release adds the following updates:
+
+- [Updated Docker platforms for what currently builds successfully](https://github.com/wekan/wekan/commit/fdb477f3517383eb17169b1dfff2ef94c12b6296).
+  Thanks to xet7.
+- [Docs: Updated s390x page](https://github.com/wekan/wekan/commit/855cb86088c7c54734eddb1ddc5a007b432a0d91).
+  Thanks to xet7.
+- [Removed charts, that are moved back to github.com/wekan/charts](https://github.com/wekan/wekan/commit/b49aa050e91b4bd560512af1beece791c6e39114).
+  Thanks to xet7.
+- [Moved website to separate repo. Moved docs2 back to docs](https://github.com/wekan/wekan/commit/f6d8befb56c88eb0867c70bac708f867fe731a5a).
+  Thanks to xet7.
+- [Disable not working GitHub workflows](https://github.com/wekan/wekan/commit/58de6bb73714e6c6d4010de5c72499f429bd9a41).
+  Thanks to xet7.
+- [Fix Snap mongodb port wrong](https://github.com/wekan/wekan/commit/11a2c95ea70a3dcf9243369f8feeaea301a93bb6).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v9.00 2026-04-27 WeKan ® release
+
+This release adds the following updates:
+
+- [Bump actions/upload-pages-artifact from 4 to 5](https://github.com/wekan/wekan/pull/6304).
+  Thanks to dependabot.
+- [Bump docker/setup-buildx-action from 3 to 4](https://github.com/wekan/wekan/pull/6305).
+  Thanks to dependabot.
+- [Bump actions/deploy-pages from 4 to 5](https://github.com/wekan/wekan/pull/6306).
+  Thanks to dependabot.
+- [Update release scripts](https://github.com/wekan/wekan/commit/db2701f1d731898c80b44606a985d5d132f7f6ed).
+  Thanks to xet7.
+- [Added back jam packages. Updated dependencies](https://github.com/wekan/wekan/commit/bf5ca3d3ebef7f00778eb1a518fcfaf5b5fc5d5c).
+  Thanks to xet7.
+- [Updated dependencies](https://github.com/wekan/wekan/commit/16832124ce169c823ab1f95a43a85bec22d5556f).
+  Thanks to xet7.
+- [Update security.md etc](https://github.com/wekan/wekan/commit/7700efde1fba8483a78c67d03e3a0d214cedb67b).
+  Thanks to xet7.
+- [Updated HoF](https://github.com/wekan/wekan/commit/675c6611146a4a47eee1e513b83152007e3b9aee).
+  Thanks to xet7.
+- [Update releases scripts](https://github.com/wekan/wekan/commit/64f58455ff471b5a5567d7230850124cf0afacb0).
+  Thanks to xet7.
+- [Update release and version scripts](https://github.com/wekan/wekan/commit/699b9a9c712f01068324c051be4fb149dfc6f100).
+  Thanks to xet7.
+- Updated dependencies.
+  [Part 1](https://github.com/wekan/wekan/commit/b459151798d9808b4243d230ff6759a58d4016f5),
+  [Part 2](https://github.com/wekan/wekan/commit/74965f5f95ba4e4dfd7381becd55184731a60fca).
+  Thanks to developers of dependencies.
+- [Updated website](https://github.com/wekan/wekan/commit/ef4161889af58827f105749362196fd471e3e38c).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Update cards.js](https://github.com/wekan/wekan/pull/6299).
+  Thanks to snowsky.
+- [Fix MongoDB replicaset setup at docker-compose.yml](https://github.com/wekan/wekan/commit/c4e084ffbbc5870a13e79f80a2982d2eb7f2f04e).
+  Thanks to C0rn3j.
+- [Add permission checks to list width method](https://github.com/wekan/wekan/pull/6303).
+  Thanks to Raawen-dev.
+- [Fix UI hangs and data loss by disabling changeStreams, until there is new Meteor release that included bugfix to changeStreams](https://github.com/wekan/wekan/commit/c47eb013b4d8d0f2dea7b801adc60151f6e3aee1).
+  Thanks to bcook-konza and italojs.
+- [Fix list actions popup overflow](https://github.com/wekan/wekan/pull/6310).
+  Thanks to Raawen-dev.
+- [Fix mycards subscription](https://github.com/wekan/wekan/pull/6314).
+  Thanks to aminsaidane.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.99 2026-04-16 WeKan ® release
+
+This release adds the following updates:
+
+- [Release scripts: Update versions](https://github.com/wekan/wekan/commit/32e1ec9d2251840dc2d57ffa7976f2c60546ca9d).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v8.98 2026-04-16 WeKan ® release
+
+This release adds the following updates:
+
+- [Release scripts: Detect newest Node.js 24.x version](https://github.com/wekan/wekan/commit/fde59148dc8bd712e30cbf969d4007b2a7f01e6f).
+  Thanks to xet7.
+- [Release scripts: Update versions at website with release-website.sh script](https://github.com/wekan/wekan/commit/9174001862f1545626730b9a51754ab77b645338).
+  Thanks to xet7.
+- [Release scripts: Detect newest MongoDB 7.x stable version and update to use it](https://github.com/wekan/wekan/commit/72f6d96dbc3becc2767eb6f88b0f218679d1ac78).
+  Thanks to xet7.
+- [Moved website from repo wekan/wekan.fi to wekan/wekan/docs](https://github.com/wekan/wekan/commit/3c36db33e91e504722edc60faec5d6b4aa301850).
+  Thanks to xet7.
+- [Moved docs to docs2, and wekan.fi to docs, to be able publish with GitHub Pages](https://github.com/wekan/wekan/commit/1c0d8e9964af40be91eda9668dfeebd01b3a5720).
+  Thanks to xet7.
+- [Update markdown docs links from docs to docs2](https://github.com/wekan/wekan/commit/c1639ea58973efcae0758385cc5d8d7ffbf1e8d9).
+  Thanks to xet7.
+- [Commented out requirement to update website manually](https://github.com/wekan/wekan/commit/64d351d835628dad80062e3c362701b35ae5bb33).
+  Thanks to xet7.
+- [Moved Helm Charts from helm directory to docs/wekan and docs/charts to be at wekan.fi/wekan and wekan.fi/charts](https://github.com/wekan/wekan/commit/38e488ee4a63d61159d8efcddb6e454347bce91a).
+  Thanks to xet7.
+- [Release scripts: Fix indentation at release-all.yml](https://github.com/wekan/wekan/commit/10f009f5b15fd077577a71504b0e0c89c4e6fd95).
+  Thanks to xet7.
+- [Release scripts: Use latest available Node.js slim docker images when building](https://github.com/wekan/wekan/commit/d998e8cb4a5280c93448d144ab01335ce29b43dc).
+  Thanks to xet7.
+- [Release scripts: Fix updating version numbers](https://github.com/wekan/wekan/commit/7b0e2213cfbf0e2a17a143aa7ad9f979fb0fbf07).
+  Thanks to xet7.
+- [Release scripts: Require only newest version number when releasing](https://github.com/wekan/wekan/commit/052d8c15844dfc709dc3ac281795629c175869e0).
+  Thanks to xet7.
+- [Release scripts: Use 24-slim fallback](https://github.com/wekan/wekan/commit/a0c190137dfe9fd8da71380f6c67344812561f9f).
+  Thanks to xet7.
+- [Release scripts: use node:24-slim directly](https://github.com/wekan/wekan/commit/51ad6ed99df7ecdc925d314a6c5fab345f75d549).
+  Thanks to xet7.
+- [Fix Helm Chart parts to docs/wekan and docs/charts](https://github.com/wekan/wekan/commit/1820804b9f46e510c4bf05324755a5eeec5a3b13).
+  Thanks to xet7.
+- [Release scripts: Updated creating Helm Charts to docs/wekan and docs/charts](https://github.com/wekan/wekan/commit/f6198dee30ed6514974d2e821997d340e67fc954).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
 # v8.97 2026-04-16 WeKan ® release
 
 This release adds the following updates:

Dockerfile

@@ -7,7 +7,7 @@ LABEL org.opencontainers.image.source="https://github.com/wekan/wekan"
 # TARGETARCH and TARGETVARIANT are automatically provided by Docker Buildx
 ARG TARGETARCH
 ARG TARGETVARIANT
-ARG VERSION=8.94
+ARG VERSION=9.02
 ARG DEBIAN_FRONTEND=noninteractive
 
 ENV BUILD_DEPS="apt-utils gnupg wget bzip2 g++ curl libarchive-tools build-essential git ca-certificates python3 unzip"

SECURITY.md

@@ -1,36 +1,19 @@
-## About Money
+## About Money: No bounty
 
-See [CONTRIBUTING](CONTRIBUTING.md)
+There is no bounty, like described at [CONTRIBUTING.md](CONTRIBUTING.md),
+because WeKan is NOT Big Tech. WeKan is FLOSS.
 
 ## Responsible Security Disclosure
 
-1. To send email, if possible, use PGP key [security-at-wekan.fi.asc](security-at-wekan.fi.asc)
-2. Send info about security issue ONLY to security@wekan.fi . NOT TO ANYWHERE ELSE. NO CC, NO BCC.
-3. Wait for new WeKan release that fixes security issue to appear to top of
+1. Please email info about security issue to security@wekan.fi .
+   If possible, include code for fixing security issue.
+   Optional PGP key is at [security-at-wekan.fi.asc](security-at-wekan.fi.asc)
+2. Wait for new WeKan release that fixes security issue to appear to top of
    https://github.com/wekan/wekan/blob/main/CHANGELOG.md
-4. We will thank you by adding you to Hall the of Fame: https://wekan.fi/hall-of-fame/
-5. All vulnerability details will be private to security@wekan.fi ,
-   unless you help all WeKan platforms to have a way to upgrade, like sending
-   database migrations code to security@wekan.fi or PRs to https://github.com/wekan/wekan/pulls .
-   There is no benefit to the Wordwide Security Community to have more details about vulnerabilities,
-   if Worldwide Security Community does not help to make upgrades possible.
-6. If some day a way becomes available to upgrade all WeKan platforms,
-   this page will be updated to add permission for security researchers
-   to request new GHSA or CVE ID and publish your vulnerability details at your blog, talks, etc,
-   and send that info also to security@wekan.fi to be added to
-   Hall of Fame: https://wekan.fi/hall-of-fame/ to get Upgrade Bonus Point Stars.
-   In that case, it will become possible for security@wekan.fi to publish all
-   remaining private security details, and publicly thank Worldwide Security Community.
-
-## Bonus Points
-
-- If you include code for fixing security issue
-
-## Losing Points
-
-- If you ask about [bounty](CONTRIBUTING.md). There is no bounty. WeKan is NOT Big Tech. WeKan is FLOSS.
-- If you forget to include vulnerability details.
-- If you send info about security issue to somewhere else than security@wekan.fi
+3. We will thank you by adding you to 
+   Hall the of Fame: https://wekan.fi/hall-of-fame/
+4. If you get CVE number assigned, please send it to security@wekan.fi, it will be added to
+   Hall the of Fame: https://wekan.fi/hall-of-fame/
 
 ## How Should Reports Be Formatted?
 
@@ -60,12 +43,12 @@ and we don't have any permissions to do security scans on those donated servers.
 Please don't perform research that could impact other users. Second, please keep
 the reports short and succinct. If we fail to understand the logic of your bug, we will tell you.
 
-You can [Install Wekan](https://github.com/wekan/wekan/releases) on your own computer
+You can [Install Wekan](https://wekan.fi/install/) on your own computer
 and scan it's vulnerabilities there.
 
 ## About Wekan Versions
 
-There are only 2 versions of Wekan: Standalone Wekan, and Sandstorm Wekan.
+There are 2 versions of Wekan: Standalone Wekan, and Sandstorm Wekan.
 
 ### Standalone Wekan Security
 
@@ -78,7 +61,8 @@ WeKan is used in most countries of the world https://snapcraft.io/wekan
 and by companies that have 30k users.
 
 - Wekan private board attachments are not accessible without logging in.
-- There is feature to set board public, so that board is visible without logging in in readonly mode, with realtime updates.
+- There is feature to set board public, so that board is visible without logging
+  in readonly mode, with realtime updates.
 - Admin Panel has feature to disable all public boards, so all boards are private.
 
 ## SSL/TLS
@@ -107,7 +91,8 @@ and by companies that have 30k users.
 Q:
 
 Hello,
-I have just seen the Meteor DevTools Evolved extension and was wondering if anyone had asked themselves the question of security.
+I have just seen the Meteor DevTools Evolved extension and was wondering if anyone
+had asked themselves the question of security.
 Insofar as all data is shown in the minimongo tab in plain text.
 How can data be hidden from this extension?
 
@@ -115,11 +100,14 @@ A:
 
 ## PubSub
 
-- It is not a security issue to show text or images that the user has permission to see. It is a security issue, if browserside is some text or image that user should not see.
+- It is not a security issue to show text or images that the user has permission to see.
+  It is a security issue, if browserside is some text or image that user should not see.
 - Meteor has browserside minimongo database, made with JavaScript, updated with Publish/Subscribe, PubSub.
-- Publish/Subscribe means, that realtime web framework reads database changes stream, and then immediately updates webpage,
-  like like dashboards, chat, kanban. That is the point of any realtime web framework in any programming language.
-- Yes, you should check with Meteor DevTools Evolved Chromium/Firefox extension that at minimongo is only text that user has permission to see.
+- Publish/Subscribe means, that realtime web framework reads database changes stream,
+  and then immediately updates webpage, like dashboards, chat, kanban.
+  That is the point of any realtime web framework in any programming language.
+- Yes, you should check with Meteor DevTools Evolved Chromium/Firefox extension that
+  at minimongo is only text that user has permission to see.
 - Check as a logged-in user and as a logged-out user.
 - Check permissions and sanitize before allowing some change, because someone could modify content of input field,
   PubSub/websocket data (for example with Burp Suite Community Edition), etc.
@@ -129,7 +117,8 @@ A:
 - PubSub uses WebSockets, so you need those to be enabled on the webserver like Caddy/Nginx/Apache etc, examples of settings
   at right menu of https://github.com/wekan/wekan/wiki
 - Clientside https://github.com/wekan/wekan/tree/main/client/components subscribes to
-  PubSub https://github.com/wekan/wekan/tree/main/server/publications or calls meteor methods at https://github.com/wekan/wekan/tree/main/models
+  PubSub https://github.com/wekan/wekan/tree/main/server/publications or calls meteor methods
+  at https://github.com/wekan/wekan/tree/main/models
 - For Admin:
   - You can have input field for password https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
   - You can save password to database https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
@@ -276,14 +265,9 @@ a security issue, we'd like to know about it, and also how to fix it:
 
 Typical already-known or 'no impact' bugs such as:
 
-- [Wekan API old tokens not replaced correctly](https://github.com/wekan/wekan/issues/1437)
-- Missing Cookie flags on non-session cookies or 3rd party cookies
-- Logout CSRF
 - Social engineering
 - Denial of service
-- SSL BEAST/CRIME/etc. WeKan does not have SSL built-in; it uses Caddy/Nginx/Apache, etc., on the front end.
-  Integrated Caddy support is updated often.
-- Email spoofing, SPF, DMARC & DKIM. Wekan does not include email server.
+- SSL BEAST/CRIME/etc. WeKan does not have SSL built-in; it uses Caddy/Nginx/Apache on the front end.
 
 Wekan is Open Source with MIT license, and free to use also for commercial use.
 We welcome all fixes to improve security by email to security@wekan.fi

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v8.94.0"
+appVersion: "v9.02.0"
 files:
   userUploads:
     - README.md

client/components/main/popup.css

@@ -767,3 +767,124 @@ body.mobile-mode .pop-over .content-wrapper {
   overflow-y: auto !important;
   overflow-x: hidden !important;
 }
+
+/* ============================================
+   FIX: List actions popup overflow (Issue #6221)
+   Prevents menu from overflowing outside viewport
+   ============================================ */
+
+/* General fix for all popups with many items */
+.pop-over .pop-over-list {
+  max-height: 60vh;
+  overflow-y: auto;
+  overflow-x: hidden;
+}
+
+/* Specific fix for list actions menu */
+.pop-over[data-popup="listActionsPopup"] {
+  max-height: 85vh !important;
+  overflow-y: auto !important;
+}
+
+.pop-over[data-popup="listActionsPopup"] .content-wrapper {
+  max-height: calc(85vh - 50px) !important;
+  overflow-y: auto !important;
+}
+
+/* Prevent any popup from overflowing viewport */
+.pop-over {
+  max-height: 90vh !important;
+  display: flex !important;
+  flex-direction: column !important;
+}
+
+.pop-over .content-wrapper {
+  flex: 1 1 auto !important;
+  overflow-y: auto !important;
+  min-height: 0 !important;
+}
+
+.pop-over .content-container {
+  flex: 1 1 auto !important;
+  display: flex !important;
+  flex-direction: column !important;
+  min-height: 0 !important;
+}
+
+.pop-over .content {
+  flex: 1 1 auto !important;
+  overflow-y: auto !important;
+  min-height: 0 !important;
+}
+
+/* Keep header fixed while content scrolls */
+.pop-over .header {
+  flex-shrink: 0 !important;
+}
+
+/* Mobile-specific adjustments */
+@media screen and (max-width: 800px) {
+  .pop-over[data-popup="listActionsPopup"] {
+    max-height: 100vh !important;
+  }
+  
+  .pop-over[data-popup="listActionsPopup"] .content-wrapper {
+    max-height: calc(100vh - 48px) !important;
+  }
+}
+/* STRONGER FIX - Override inline styles */
+.pop-over[style*="height"],
+.pop-over[style*="max-height"] {
+  max-height: 80vh !important;
+  height: auto !important;
+  overflow-y: auto !important;
+}
+
+.pop-over[style*="height"] .content-wrapper,
+.pop-over[style*="max-height"] .content-wrapper {
+  max-height: calc(80vh - 60px) !important;
+  height: auto !important;
+  overflow-y: auto !important;
+}
+
+/* Force list popups to have a max height and scroll */
+.pop-over .pop-over-list {
+  max-height: 300px !important;
+  overflow-y: auto !important;
+}
+
+/* Make sure the popup doesn't grow too tall */
+.pop-over:has(.pop-over-list) {
+  max-height: 400px !important;
+  height: auto !important;
+}
+
+/* For the list actions menu specifically */
+[data-popup="listActionsPopup"] .pop-over-list,
+.js-open-list-menu + .pop-over .pop-over-list {
+  max-height: 350px !important;
+  overflow-y: auto !important;
+}
+
+/* ============================================
+   FIX: List actions popup overflow (Issue #6221)
+   ============================================ */
+
+/* Force list popups to have a max height and scroll */
+.pop-over .pop-over-list {
+  max-height: 300px !important;
+  overflow-y: auto !important;
+}
+
+/* Make sure the popup doesn't grow too tall */
+.pop-over:has(.pop-over-list) {
+  max-height: 400px !important;
+  height: auto !important;
+}
+
+/* For the list actions menu specifically */
+[data-popup="listActionsPopup"] .pop-over-list,
+.js-open-list-menu + .pop-over .pop-over-list {
+  max-height: 350px !important;
+  overflow-y: auto !important;
+}

docker-compose.yml

@@ -171,7 +171,7 @@ services:
   # Leave it unset or empty to skip migration.
   #-------------------------------------------------------------------------------------
   #wekan-migrate:
-  #  image: node:24.14.1-slim
+  #  image: node:24.15.0-slim
   #  container_name: wekan-migrate
   #  restart: "no"
   #  networks:
@@ -229,12 +229,31 @@ services:
     #command: mongod --logpath /dev/null --oplogSize 128 --replSet rs0 --quiet
     #command: mongod --oplogSize 128 --replSet rs0 --quiet
     command: >
-      sh -c "
-        mongod --oplogSize 128 --replSet rs0 --quiet --bind_ip_all &
-        until mongosh --eval 'rs.initiate()' > /dev/null 2>&1; do
+      sh -c '
+        mongod --oplogSize 128 --replSet rs0 --bind_ip_all --quiet &
+        until mongosh --host 127.0.0.1 --quiet --eval "
+          try {
+            const status = rs.status();
+            quit(status.ok === 1 ? 0 : 1);
+          } catch (e) {
+            if (
+              e.codeName === \"NotYetInitialized\" ||
+              e.message.includes(\"no replset config has been received\") ||
+              e.message.includes(\"not yet initialized\")
+            ) {
+              rs.initiate({
+                _id: \"rs0\",
+                members: [{ _id: 0, host: \"wekandb:27017\" }]
+              });
+              quit(1);
+            }
+            quit(1);
+          }
+        " >/dev/null 2>&1; do
           sleep 2
-        done;
-        wait"
+        done
+        wait
+      '
     networks:
       - wekan-tier
     expose:
@@ -294,7 +313,10 @@ services:
       #- METEOR_REACTIVITY_ORDER=polling
       # https://forums.meteor.com/t/meteor-3-5-beta-change-streams-performance-improvements/64461#change-streams-setup-3
       # https://github.com/meteor/meteor/blob/release-3.5/v3-docs/docs/performance/change-streams-observer-driver.md#choosing-the-reactivity-driver-order
-      - METEOR_REACTIVITY_ORDER=changeStreams,oplog,polling
+      # Use oplog,polling to fix performance until changeStreams is fixed at next release of Meteor 3.5 Beta:
+      # https://github.com/wekan/wekan/issues/6307#issuecomment-4299349231
+      # Later change to: METEOR_REACTIVITY_ORDER=changeStreams,oplog,polling
+      - METEOR_REACTIVITY_ORDER=oplog,polling
       #-----------------------------------------------------------------
       # ==== WRITEABLE PATH FOR FILE UPLOADS ====
       - WRITABLE_PATH=/data

docs/Platforms/FOSS/s390x.md

@@ -1,3 +1,20 @@
+## From xet7, WeKan at s390x
+
+- https://www.openmainframeproject.org/blog/2020/11/20/wekan-open-source-kanban-on-s390x
+
+[xet7](https://github.com/xet7), as maintainer of [WeKan](https://wekan.fi), got access
+to mainframe at IBM LinuxOne Community Cloud.
+Access to those servers is monitored, it's running on a real mainframe.
+
+Previously xet7 had ssh access. At 2023-09 xet7 got web console access,
+and IBM bumped quota to 2 VMs with 8 GB of memory, 200 GB disk and 4 CPUs each.
+At web console it is possible to create and remove VMs, and select distro
+like RHEL/SUSE/Ubuntu. xet7 did do-release-upgrade to upgrade newest Ubuntu.
+
+## Download
+
+- https://github.com/wekan/wekan/releases
+
 ## About s390x
 
 - Dave's Garage at 2023-10: Why Do Mainframes Still Exist? What's Inside One? 40TB, 200+ Cores, AI, and more! https://www.youtube.com/watch?v=ouAG4vXFORc
@@ -106,22 +123,12 @@ Transfer/sec:     70.23MB
 Ported by others, not xet7:
 - PostreSQL https://news.ycombinator.com/item?id=38398305
 
-
-## From xet7, WeKan at s390x
-
-- https://www.openmainframeproject.org/blog/2020/11/20/wekan-open-source-kanban-on-s390x
-
-[xet7](https://github.com/xet7), as maintainer of [WeKan](https://wekan.fi), got access to mainframe at IBM LinuxOne Community Cloud. Access to those servers is monitored, it's running on a real mainframe.
-
-Previously xet7 had ssh access. At 2023-09 xet7 got web console access, and IBM bumped quota to 2 VMs with 8 GB of memory, 200 GB disk and 4 CPUs each. At web console it is possible to create and remove VMs, and select distro like RHEL/SUSE/Ubuntu. xet7 did do-release-upgrade to upgrade newest Ubuntu 23.10.
-
-## Download
-
-- wekan-VERSION-s390x.zip at https://releases.wekan.team/s390x/
-
 ## Installing MongoDB for s390x
 
-This Snap package https://snapcraft.io/juju-db , created by Canonical, has MongoDB for various CPU architectures . It is internal package for Canonical's Juju service https://jaas.ai . Snap repo at https://github.com/juju/juju-db-snap and copy at https://github.com/wekan/mongodb-snap
+This Snap package https://snapcraft.io/juju-db , created by Canonical,
+has MongoDB for various CPU architectures .
+It is internal package for Canonical's Juju service https://jaas.ai .
+Snap repo at https://github.com/juju/juju-db-snap and copy at https://github.com/wekan/mongodb-snap
 
 Install Snap for your distro https://snapcraft.io/docs/installing-snapd
 

docs/Platforms/Propietary/Windows/Offline.md

@@ -10,7 +10,7 @@ This is without container (without Docker or Snap).
 
 Right click and download files 1-4:
 
-1. [wekan-8.94-win64.zip](https://github.com/wekan/wekan/releases/download/v8.94/wekan-8.94-win64.zip)
+1. [wekan-9.02-win64.zip](https://github.com/wekan/wekan/releases/download/v9.02/wekan-9.02-win64.zip)
 2. [node.exe](https://nodejs.org/dist/latest-v24.x/win-x64/node.exe)
 
 3. [mongodb-windows-x86_64-7.0.31-signed.msi](https://fastdl.mongodb.org/windows/mongodb-windows-x86_64-7.0.31-signed.msi)
@@ -21,7 +21,7 @@ Right click and download files 1-4:
 
 6. Double click `mongodb-windows-x86_64-7.0.31-signed.msi` . In installer, uncheck downloading MongoDB compass.
 
-7. Unzip `wekan-8.94-win64.zip` , inside it is directory `bundle`, to it copy other files:
+7. Unzip `wekan-9.02-win64.zip` , inside it is directory `bundle`, to it copy other files:
 
 ```
 bundle (directory)

helm/charts/artifacthub-repo.yml

@@ -1,6 +0,0 @@
-repositoryID: f6dde1c7-7cc4-4053-870c-0dc6a73d9ac9
-owners:
-  - name: wekan
-    email: support@wekan.fi
-  - name: xet7
-    email: x@xet7.org