wekan

Split shared models from Meteor 3 server runtime

2026-03-24 01:50:39 +02:00

[Fixed BoardBleed: broken access control lets any authenticated user move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)](https://github.com/wekan/wekan/security/advisories/GHSA-gm7v-pc38-53jr )

2026-06-11 17:13:06 +03:00

methods

Split shared models from Meteor 3 server runtime

2026-03-24 01:50:39 +02:00

migrations

Fix [CloneBleed](https://wekan.fi/hall-of-fame/clonebleed/) and other security issues. Added more security tests to test suite.

2026-06-05 21:40:24 +03:00

models

Fix Incorrect link in invite email.

2026-06-11 20:44:25 +03:00

notifications

Fix [CloneBleed](https://wekan.fi/hall-of-fame/clonebleed/) and other security issues. Added more security tests to test suite.

2026-06-05 21:40:24 +03:00

permissions

[Fixed BoardBleed: broken access control lets any authenticated user move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)](https://github.com/wekan/wekan/security/advisories/GHSA-gm7v-pc38-53jr )

2026-06-11 17:13:06 +03:00

publications

Add pagination and search to Admin Panel / Reports. Fix pagination at Admin Panel / Organizations and Teams.

2026-06-12 01:12:38 +03:00

routes

- **Fixed Admin Panel / Attachments / Move Attachment doing nothing / crashing.**

2026-06-06 02:06:16 +03:00

00checkStartup.js

Split shared models from Meteor 3 server runtime

2026-03-24 01:50:39 +02:00

00waitForMongo.js

Fixed upgrade crash.

2026-06-06 02:53:58 +03:00

accounts-common.js

Split shared models from Meteor 3 server runtime

2026-03-24 01:50:39 +02:00

accounts-lockout-config.js

Migrate accounts-lockout server files to async for Meteor 3.0

2026-01-29 21:29:56 +02:00

apiAuthRoutes.js

Split shared models from Meteor 3 server runtime

2026-03-24 01:50:39 +02:00

apiMiddleware.js

Split shared models from Meteor 3 server runtime

2026-03-24 01:50:39 +02:00

attachmentApi.js

**Fixed OpenAPI REST API documentation generation**, which had been broken

2026-06-05 23:44:04 +03:00

attachmentBulkMove.js

New features:

2026-06-06 07:21:59 +03:00

attachmentMigration.js

Convert upsert calls to async in authentication.js .

2026-04-06 02:36:45 +03:00

attachmentMigrationStatus.js

Fixed upgrade crash.

2026-06-06 02:53:58 +03:00

authentication.js

Convert upsert calls to async in authentication.js .

2026-04-06 02:36:45 +03:00

boardMigrationDetector.js

Split shared models from Meteor 3 server runtime

2026-03-24 01:50:39 +02:00

card-opened-webhook.js

Fix Card Opened Webhook can not be disabled.

2020-02-13 14:58:19 +02:00

cors.js

Meteor 3.4 migration: Phases 0-3

2026-03-22 17:17:48 +02:00

cronJobStorage.js

Fixed upgrade crash.

2026-06-06 02:53:58 +03:00

cronMigrationManager.js

Convert upsert calls to async in authentication.js .

2026-04-06 02:36:45 +03:00

header-login.js

Add Header Login.

2026-05-27 20:51:44 +03:00

import-users-for-methods.js

Delete workspace etc. In Progress.

2026-03-21 11:32:56 +02:00

imports.js

Fixed upgrade crash.

2026-06-06 02:53:58 +03:00

initializeDirs.js

Fix Bug: WeKan v8.50 WRITABLE_PATH.

2026-04-03 20:16:32 +03:00

main.js

Removed jam:offline jam:method jam:pub-sub, because they are not used, and they cause too much database usage.

2026-04-16 00:50:58 +03:00

max-image-pixel.js

Add env setting to image resizer, part 1.

2019-07-18 04:27:03 +03:00

max-size.js

Add some info about allowed filesizes and filetypes for attachments and avatars.

2023-03-26 12:41:44 +03:00

mongodb-driver-startup.js

Reverted New UI Design of WeKan v8.29 and added more fixes and performance improvements.

2026-02-08 00:48:39 +02:00

policy.js

Removed browser contect policy so that attachments would be visible. Part 2.

2022-04-08 18:37:51 +03:00

richer-editor-setting-helper.js

Revert: Fix Pasting text into a card is adding a line before and after

2020-03-23 22:23:31 +02:00

rulesHelper.js

Fix Email notifications show "undefined" instead of username.

2026-05-14 02:53:31 +03:00

saml.js

Added some CAS and SAML settings. Not tested. Please test and send pull requests if it does not work.

2020-09-14 19:57:50 +03:00

spinner.js

-conflits resolve

2021-06-14 15:11:21 +02:00

statistics.js

Fix Admin Panel / Version not showing name of MongoDB storage engine and status of MongoDB Oplog enabled.

2026-04-06 05:05:19 +03:00

triggersDef.js

Split shared models from Meteor 3 server runtime

2026-03-24 01:50:39 +02:00