Turning the NODE_DEBUG=module trace off for EVERYTHING alone was not
enough: a dev build from the build.sh menu wrote 1.1 GB, three million
lines, in its first three minutes, before it was interrupted. The trace
is now opt-in in build.sh and build.bat alike, and the diagnostics line
says whether it is on and how to turn it on. The other build diagnostics
(resolver commands, npm verbose, METEOR_PROFILE) are unchanged.
Thanks to xet7 !
The build's NODE_DEBUG=module trace wrote over 12 GB in the first half
hour of an EVERYTHING run on macOS - twice, through tee - and slowed the
build it traced, so the run would fill the disk before reaching the tests.
A build from the menu still traces by default; WEKAN_BUILD_TRACE_MODULES=0
turns it off, and EVERYTHING sets that unless the caller asked for 1. The
other build diagnostics (resolver commands, npm verbose, METEOR_PROFILE)
are unchanged.
Thanks to xet7 !
CHANGELOG.md showed only the five newest releases, so what was about to be
released was only in CHANGELOG-big.md. changelog-short.mjs now puts the
unreleased # Upcoming WeKan ® release first - its In short and a link to
its full section - and the five newest releases below it; right after a
release, when there is no Upcoming yet, none is invented.
CLAUDE.md and AGENTS.md say what "update wekan changelog" means: find the
commits not in the changelog yet, add an Upcoming section when a release
was cut meanwhile, write the entries and the In short into
CHANGELOG-big.md, run changelog-short.mjs, run the changelog tests, and
commit both files.
tests/changelogShort.test.cjs: Upcoming first, whole, above the releases,
its link resolves, and no Upcoming appears after a release.
Thanks to xet7 !
CHANGELOG-big.md is the changelog as it was: # Status, # Upcoming and every
release in full, with its <details> entries. Everything that writes or edits
the changelog uses it - release-all.sh, release-notes.sh and the release
workflow, the commit-link repair in build.sh and fix-changelog-hashes.sh,
the archive, the wrapper, the version scripts - and the release notes'
"More details at ChangeLog" link goes to its section. remote-release.py,
shared with FerretDB and the patch repositories, takes the file from its
config, and only WeKan's names CHANGELOG-big.md.
CHANGELOG.md is new: no Status and no Upcoming, only the In short paragraph
of each of the five newest releases and a link to its full section, in plain
Markdown - no <details>, <summary>, </summary> or </details>, and HTML links
written as Markdown links. releases/changelog-short.mjs writes it;
release-all.sh runs it right after naming the release, so it is in the
release commit, and changelog.sh does too. The Sandstorm App Market keeps
embedding CHANGELOG.md, now the short one.
old-CHANGELOG/'s headers say they moved out of CHANGELOG-big.md. References
to Upcoming or TODO Later in code comments and docs name CHANGELOG-big.md.
CLAUDE.md and AGENTS.md describe both files: CHANGELOG-big.md is written,
CHANGELOG.md is generated and never edited by hand.
tests/changelogShort.test.cjs: CHANGELOG.md is exactly what the generator
writes, the five newest releases with their whole In short, links that
resolve, and none of the four tags or an HTML link; the changelog tests
read CHANGELOG-big.md.
Thanks to xet7 !
v12.69's build-sandstorm in release-all.yml stopped because the
certificate of install.sandstorm.io had expired. It fetches the installer
from install.sandstorm.org, as sandstorm.yml and sandstorm-store.yml
already did, and so does releases/install-sandstorm.sh. That installer
downloads Sandstorm from dl.sandstorm.org and configures a development
server at local.sandstorm.org, so the docs follow: docs, apps, dl, install
and local.sandstorm.io links and addresses become sandstorm.org in the docs,
SECURITY.md, code comments and the accounts-sandstorm README, each URL
checked to answer there. demo.sandstorm.io stays, as it has no sandstorm.org
name; released CHANGELOG sections are records and stay as they are. The
release audit's baseline allows the two code comments' docs.sandstorm.org.
tests/sandstormOrgHosts.test.cjs: every Sandstorm build installs from
install.sandstorm.org, and no tracked file names a sandstorm.io host
outside those kept on purpose; it fails on the old release-all.yml.
Thanks to xet7 !
An opened card shows only the fields it has data in, plus its
description, attachments and comments, empty or not, and its cover when
it has one. "+ Add", under the cover, opens a popup with the Admin
Panel's own left menu and pane title: the sections (Date, Members,
Labels, Description, Checklists, Attachments, Time, Custom Fields,
Voting, Scrum settings, Comments, Card) on the left, the open section's
fields on the right - the items of Board Settings / Card - each with a
checkbox. Ticking an empty field shows it on this card; unticking a field
hides it from this card, also when it has data. The card keeps its
choices in shownFields and hiddenFields, which accept only field keys.
Board Settings / Card still decides what a card CAN show: a field turned
off there is on no card and not offered. The opened card and its section
templates get their own currentBoard, the card's view of the board with
the flags of the fields it does not show reading false, so the existing
template checks apply without being edited; the minicard is unchanged.
The design is docs/Features/Cards/Card-Fields.md. Seeded e2e cards show
every field, as the specs written before expect.
Thanks to xet7 !
- Three snap set lines named keys the snap does not have, which snapd
stores without a word: MONGO_OPLOG_URL (the key is mongo-oplog-url),
oauth-enabled (oauth2-enabled) and "snap set wekan set disable-mongodb".
tests/docsSnapKeysExist.test.cjs checks every snap set in the docs
against the KEY_ names in snap-src/bin/config.
- Adding-new-Snap-settings-to-code.md used setting names that do not
exist (LDAP_ENABLED, LDAP_SEARCH_FILTER, a wrong KEY_ line), the edge
branch and Travis CI. It now follows the real config and wekan-help
entries, says that a login setting goes through the Admin Panel catalog
and authEnv(), and lists the other platform files a setting belongs in.
- The LDAP and Traefik Docker examples ran MongoDB 3.2/4.0 with
--smallfiles, which MongoDB 4.2 removed, and WeKan images from 2018. They
use mongo:7 and ghcr.io/wekan/wekan:latest; Traefik stays at v1.7, since
that guide's labels and traefik.toml are v1 syntax.
- The Windows page no longer sets RICHER_CARD_EDITOR, which WeKan does not
read, and points to build.bat for building from source.
Thanks to xet7 !
A feature's guide now sits under the menu it is used from, read from the
templates rather than from where somebody once put it: Header-Bar,
All-Boards, Pages, Board-Header (search and every Board View), Board-Sidebar
(Board Settings, Filter, Members, Labels, Archive), Rules, Swimlanes, Lists,
Cards, Member-Settings, Admin-Panel and Login-Page. Topics used from several
menus (editor, history, theme, translations, email, troubleshooting) are in
General.
- Each area has a README mapping its menu entries to their guides and to the
template or server module that implements them. Board-Header/README.md
lists all 40 Board View entries with the template boardBody.jade renders;
five views (Table, Calendar Mode, Time, Timeline, Map) have no guide of
their own yet and say so.
- Board-View.md listed 25 views while BOARD_VIEWS has 40; it now lists all
of them with their English labels.
- Pages keep their file names. Where a released changelog links an old path,
a "# Moved" page stays there and points to the new one; test-menu.sh skips
folders holding only those.
- Undo was filed under Login; it is General/Undo now.
- Every link in docs, code comments, scripts and tests follows the move;
docsLinksResolve checks them all.
Tests that read a doc follow it to its new place. boardViewSettings now fails
when Board-View.md or Board-Header/README.md differs from BOARD_VIEWS, or
names a template boardBody.jade does not render.
Thanks to xet7 !
- syncHistoryAdmission pinned the line that walked successors to the
chain's tip inside appendSyncHistoryRow; 66dd9b0938 moved that walk to
historyChainTip and made the append take turns, so it pins those.
- The write-back's injectable GitLab read was a parameter named fetch,
which syncBleed's "no new platform fetch()" guard rightly could not
tell from the real one; it is readIssues now.
- syncClosedByWeKan, the card field the write-back added, is in the card
e-mail field inventory as internal provenance, excluded like the other
sync fields.
Thanks to xet7 !
Each was checked for which side was wrong:
- The LibreJS labels page sent Cache-Control: public; it is private now,
as fileCacheHeaders requires of every response.
- Closing a card marks it seen (#2111): that code moved below the #6686
popup handling, which labelsPopupStaleCardContext reads from the top of
onDestroyed; unreadChanges now finds it anywhere in onDestroyed.
- The shared header helper (#2805) moved below the swimlane's currentUser
helper, where largeBoardDataLoading pins it.
- The Story/Task kind, column set places and drawing strokes (#2012, #211,
#1178) get their rule e-mail dispositions: none is e-mail content.
- Guards updated for deliberate changes, each saying why: the Rules group
in Admin Panel Visibility (#2217), the rule under the team tabs in All
Boards (#802, the two around Workspaces still pinned where they are),
and a linked list's card clearing the title draft only after it was
added (#2809, every clear checked against the add before it).
Thanks to xet7 !
Version Control shows the board as a GitHub or Gitea issue tracker in the
board's own theme: cards are issues (open, or closed when archived, in a
Closed or Done list, or closed upstream), the board's labels are labels,
labels with a due date and the importers' milestone: labels are
milestones, comments are the conversation and attachments are the files.
The issue list takes GitHub's search words (is:open, label:, milestone:,
author:, assignee:@me, no:label, sort:). New issue, Close and Reopen write
through the ordinary collections, so the History tab - the board's
history table - shows them and Restore undoes them. Import links open the
GitHub, GitLab, Gitea and Forgejo importers, and each synced list has a
Sync now button.
The GitHub, GitLab, Gitea and Forgejo importers bring each issue's files:
user-attachments and user-images links, GitLab uploads, and Gitea and
Forgejo assets, downloaded through the import's SSRF guard and stored as
card attachments in Admin Panel / Attachments / Default Storage.
List sync has a new option, Comments, labels, state and files, off by
default: comments come from one paged repository-wide list (GitHub,
Gitea) or each issue's notes (GitLab), keyed by the tracker's ids, so a
second run writes only what changed, and nothing written in WeKan is
changed. Gitea issues are fetched without pull requests, and a rate
limited answer is waited out once or ends the run with the time to retry.
A public board's Show on / Default on Public Board settings are for the
public: visitors and non-members get them, read-only, and the board's own
members get the private side, so any view - Version Control, Email, Chat
and the rest - can be the read-only public view.
The card menu has a QR code of the card's link, drawn in the browser by
WeKan's own encoder, which the tests check module for module against
qrcode-svg.
The new strings are translated in every locale.
Thanks to xet7 !
Fixes#2015.
An email to a member's personal board address, board+<token>@<domain>,
becomes a card on that board, as Trello's email-to-board does (#794,
#3948). The subject is the title; the body (quoted replies stripped, HTML
as text) is the description, with a From line; attachments are attached
(no SVG, as for uploads). The author is the address's member, never the
From address, and they must still have write access when the email
arrives. A reply whose In-Reply-To/References matches a card's thread
becomes a comment on it.
Notification Settings, at three levels: the Admin Panel turns it on and
holds the domain, the provider webhook secret and the IMAP mailboxes with
their passwords (never published, never sent back to a browser); a board
admin turns the board on and picks the list and swimlane; board and
member choose which parts of an email are used. The member sees and
replaces their own address.
It arrives by POST /api/inbound-email (Mailgun, SendGrid, Postmark, JSON,
forms, multipart with attachments, raw MIME), by IMAP polling with
imapflow and mailparser under a database lease so one replica polls, or
on Sandstorm through the grain's own address: the bridge's Maildir is
read, a member's board token in the subject routes it, and WeKan's
outgoing email goes through HackSessionContext.send, since a grain has no
network. The email and hack-session capnp schemas are generated with the
other Sandstorm bindings.
Unknown addresses, wrong webhook secrets and over-limit addresses are
logged under authn.inbound-email. Rate limit per address, size limits,
Message-ID deduplication. The new strings are translated in every locale.
Thanks to xet7 !
At 2.1 MB, GitHub showed "Sorry about that, but we can't show files that
are this big right now" for CHANGELOG.md. GitHub renders Markdown up to
500 KiB, shows only plain text above that, and nothing above about 2 MB;
the July to September archives, 683 KB to 2 MB, were shown as text only.
releases/changelog-archive.mjs now cuts by size instead of by month:
CHANGELOG.md keeps Status, Upcoming and the newest releases that fit in
450,000 bytes (345 KB now, two releases), and the rest move to
old-CHANGELOG/<year>/<MM>.md, a month over the same budget continuing in
<MM>-part2.md and on, whose parts link each other. Every archive part now
renders, except v12.13, one release of 537 KB in a part of its own. No
release section is changed: all 1,225 are where they were, byte for byte.
release-all.sh runs the archive after renaming Upcoming, keeping the newest
release, which release-notes.sh reads. tests/changelogArchive.test.cjs fails
when CHANGELOG.md or a part is over the budget. CLAUDE.md and AGENTS.md
describe the size rule instead of the current month.
Thanks to xet7 !
From a card's Custom Fields menu, "Link fields to another card" links it to
another card by a pasted card link or a title search, both ways or one way
(this card sends to a main card). Fields match by name and type; a dropdown
value is carried by its item name, a multi-select only when the other field
has every item, and fields on one card only (such as Remarks) stay there.
Linking fills only the other card's empty matching fields once.
A link is held on both cards and counts only when both sides match. Linking
needs read and edit rights on both cards; a card the user cannot read is "not
found". A carried value is written as the link's creator, recorded in
Activities and History, and only while that user may still read and edit both
cards; admin-only fields never take part. A loop guard stops echoes and rings,
with a depth limit and a write budget per change. A copied, imported or
restored card starts unlinked, a deleted card's links are removed from the
others, and a direct client write of the links is refused and trips a canary.
The new strings are in English in every locale, pending Transifex.
Thanks to MarcusDger and xet7 !
Fixes#5681.
The attach-card work left four node suites failing: the Attach card popup had
no attachCardPopup-title, so it rendered with no header and no close button;
its submit button was missing from the menu action inventory; the new
attachedCardIds card field had no email content disposition; and a comment
carried a full Trello URL, which the release URL audit reports as a new
origin. The title is added in English to every locale, pending Transifex.
Thanks to xet7 !
The maintainer suggested adding the users to an organization or team and
giving the board to it. Admin Panel / People adds a page of selected users
to a team in one step, organizations gain users by email domain, and
"propagate members to boards" makes the team's or organization's members
members of its boards, later members included.
Thanks to rjl9 and xet7 !
Fixes#5050.
A rule's trigger and actions are edited in place (rules.updateRule), and the
send-email rule action includes the card's content and live attachments,
with SMTP delivery tested against a local server. Live external mail
providers were not tested.
Thanks to kabi178 and xet7 !
Fixes#2713.
`snap set wekan bind-ip=127.0.0.1` makes WeKan listen on loopback only
(snap-src/bin/config, snap-src/bin/wekan-control export BIND_IP, which
Meteor honours); the bundle and Docker take the BIND_IP environment
variable.
Thanks to galletl and xet7 !
Fixes#4403.
The checklist menu has Move Checklist and Copy Checklist with a board /
swimlane / list / card picker (client/components/cards/checklists.jade,
checklists.js).
Thanks to qiutian00 and xet7 !
Fixes#4250.
The Bigboard board view shows several boards on one page
(client/components/boards/bigboardView.*,
docs/Features/Board/Bigboard.md), and cards can be dragged between
boards in it.
Thanks to Jieiku and xet7 !
Fixes#4223.
Boards on All Boards are reordered by drag and drop into each user's
own order (client/components/boards/boardsList.js,
models/lib/boardSortReorder.js, sortBoardsForUser), boards have colours
(boardChangeColorPopup), and the All Boards table view lists boards as
rows.
Thanks to compumatter and xet7 !
Fixes#2796.
Board WIP limit groups share one limit across several lists
(wipLimitGroups in models/boards.js,
models/lib/wipLimitGroupDecision.js), set in the sidebar popup, and the
list headers highlight a group over its limit
(client/components/lists/listHeader.js).
Thanks to aviertio and xet7 !
Fixes#2489.
Auth0 signs in through the OAuth2/OIDC service, whose login style can
be `redirect` (OAUTH2_LOGIN_STYLE, also in Admin Panel / People /
OAuth2); with OIDC_REDIRECTION_ENABLED=true the login page goes
straight to the provider (client/components/main/layouts.js,
server/models/settings.js).
Thanks to xet7 !
Fixes#2211.
Admin Panel / Settings / Email Templates customizes the subject and
body of invitation and activity emails, with {board} {card} {list}
{username} {url} {comment} {action} variables escaped on the server
(client/components/settings/settingBody.jade,
server/notifications/email.js).
Thanks to hingerlanton and xet7 !
Fixes#2148.
A custom field of type date is shown on the minicard as a compact date
badge, its label can be hidden (showLabelOnMiniCard), and the date
formats include date-only variants that drop the time
(client/components/cards/cardDate.jade, client/lib/dateDisplay.js).
Thanks to gerroon and xet7 !
Fixes#2145.
Board reports have ten charts - dashboard, burndown, burnup, cumulative
flow, control chart, cycle time, flow efficiency, lead time, throughput
and WIP run (client/components/boards/charts/,
server/lib/boardChartData.js) - with PDF and Excel export
(models/server/ExporterChartPDF.js, ExporterChartExcel.js).
Thanks to xet7 !
Fixes#2043.
Subtask helper boards (titles wrapped in ^...^) are filtered out of All
Boards, the board publications, Bigboard and the multi-board calendar
by notHelperBoardTitle() (models/lib/helperBoards.js), tested by
tests/helperBoards.test.cjs.
Thanks to nmd3 and xet7 !
Fixes#1990.
An administrator can mark an email address verified in Admin Panel /
People / edit user (client/components/settings/peopleBody.jade,
setEmailVerified in server/models/users.js), and the verify-email and
resend-verification routes exist (config/accounts.js).
Thanks to lucg71 and xet7 !
Fixes#1921.
Global Search (/global-search, config/router.js) matches free text in
titles, descriptions, comments, custom fields, checklists and
attachments (server/publications/cards.js), and finds archived cards
with `status:archived` / `status:all` (config/search-const.js).
Thanks to usmcamp0811 and xet7 !
Fixes#1844.
Thumbnails and covers are rotated from EXIF on the server with sharp's
`.rotate()` (server/lib/imageThumbnail.js, server/lib/imageGif.js).
Full-size originals are shown by the browser, which applies EXIF
orientation by default, and no WeKan CSS overrides `image-orientation`.
Thanks to CWempe and xet7 !
Fixes#1758.
The list menu has Move and Copy with a board picker
(client/components/lists/listHeader.jade, listHeader.js), and the
server move checks the right to change both boards
(server/models/lists.js, requireBoardMutation for source and
destination). Multi-Selection can move or copy several lists to another
board (client/components/sidebar/sidebarFilters.jade).
Thanks to h0jeZvgoxFepBQ2C and xet7 !
Fixes#1704.
The person who made a change is never notified of it, except when they
@mention themselves: server/models/activities.js filters `user._id !==
userId` from the recipients. The requested behaviour is the fixed
default.
Thanks to gpelouze and xet7 !
Fixes#1631.
A rule does it: trigger "card moved to" a list
(client/components/rules/triggers/boardTriggers.jade) with the action
"add acting user as member"
(client/components/rules/actions/cardActions.jade,
models/lib/ruleActingUser.js, server/rulesHelper.js). The mover is
added to the card's members, shown on the minicard, and can be removed.
Thanks to xet7 !
Fixes#793.
Eighteen rows of Board Settings / Card had only one column. Each now has
both. On the minicard: Location, Requested by, Assigned by, Flowtime and
Pomodoro while running, the attachment names, the text-note count, when
the card last changed, the description title, and the checklist title
and due date. On the opened card: the collapse caret's own switch, labels
above the title, labels text (with the user's own override, like the
minicard's), the card's List title, the swimlane name and the comment
count. A side that already drew something stays on; a new element is
off until chosen. The new minicard elements are last in the minicard
order by default and reorder like the rest.
The rows' switches are plain board flags handled by one generic toggle
that reads each row's declared default. The List title row is offered
only when the popup was opened for a card, since from Board Settings
there is no card for it to change.
Thanks to xet7 !
"A must be done before B and C can start, so A is a subtask of both." A card
now keeps every parent in parentIds, with parentId still the primary one
(parentIds[0]), so everything that reads one parent keeps working and a card
written before this has its one parent. Picking an existing card as a
subtask adds this card as a further parent instead of replacing the one it
had; Card -> More lists the other parents and removes one, and choosing the
primary parent keeps the others. Children are found under any parent - the
subtask list and counter, the parent filter, rule email Details and the
exports - and the loop guard and the board publication walk every parent.
Archiving or deleting a card takes only the subtasks it is the one parent
of; a shared subtask just loses it. Every parent written must be on a board
the writer can see (GHSA-jvv9-498p-hxrg), and board copy and WeKan import
remap all of them. The old single-parent walker is removed.
Thanks to ikomhoog and xet7 !
Fixes#3626,
A board admin uploads an image - a floor plan, a site map, a drawing - and
the board's cards become markers on it, coloured by their first label and
numbered like the card. Members who can edit place a card by dragging it
from the "Not on the map" list, or by choosing it and clicking where it
belongs, and move a marker by dragging it; a click opens the card. A place
is stored as percentages of the image (card.mapX, card.mapY, 0-100), so a
marker stays on its spot at any size; the image is a board attachment
served under the board's own access rules. Read-only members see the map
but cannot change it. New strings are English, pending Transifex.
Fixes#3256,
Thanks to javen9881 and xet7 !
Add a UTC annual archive grid with count shading, colored label tooltips,
year selection and keyboard/touch details. Scope counts and labels to the
board and each assigned-only viewer, and exclude restored or undated cards.
Verify calendar aggregation with unit tests and real MongoDB/DDP/Chromium
coverage for the UI, all assigned-only roles, invalid input and isolation.
Document current-archive semantics and the remaining issue-audit work.
Thanks to xet7 !
Fixes#5444,
Retain an immutable operator decision before repairing the exact attempt receipt. Preserve dispatch guards and never send or reset mail. Cover interruption, conflicting decisions and real MongoDB CLI recovery. Other operator recovery remains unfinished.
Thanks to xet7.
Discover comment owners before reading prose, enforce card and assigned-only access, and retain each included source chain for stored dispatch checks. Reuse public comment rendering without exporting target checklists or files; reject oversized captures instead of truncating.
Thanks to kabi178, bbyszio and xet7 !
Include local archive state and lifecycle timestamps under the linked-card local section. Keep card number and color on the source selected by existing display getters.
Thanks to kabi178, bbyszio and xet7 !
Reuse ordinary Details rendering for explicitly local fields, including custom-field visibility and definition fingerprints, public names, notes, locations and authorized relationships. Persist related-source evidence in the existing email binding.
Thanks to kabi178, bbyszio and xet7 !
Read archive, due completion and overtime from the target board. Resolve only public names for unique active members, matching linked-board Members and Assignees getters, and recheck target access.
Thanks to kabi178, bbyszio and xet7 !
Classify all 71 top-level schema fields with an AST-backed inventory guard. Record remaining linked-board display and per-card discussion gaps explicitly.
Thanks to kabi178, bbyszio and xet7 !
Remove the duplicate spent-time setter that shadowed linked-board support. Await time credit before clearing sessions, and isolate automatic Pomodoro transitions from Tracker with one pending transition per view.
Thanks to xet7 !
Separate wrapper placement, persisted timers and visible Scrum metadata from authorized source content. Recheck local access, link identity and Scrum visibility before returning the snapshot.
Thanks to kabi178, bbyszio and xet7 !
Exercise authenticated REST moves with filesystem and GridFS attachments, all content choices, and negative authorization and destination matching cases.
Thanks to kabi178, bbyszio and xet7 !
Group readable targets while retaining distinct relationship types and source-access checks. Cover malformed legacy arrays and real SMTP rendering.
Thanks to kabi178, bbyszio and xet7 !
Describe captured filenames, actual sizes, MIME types, cover status, upload dates and public uploader names. Recheck card access and cover state after metadata reads and reject deleted cards or foreign attachment rows.
Thanks to kabi178, bbyszio and xet7 !
Share related-source resolution between Details and checklist discussion. Retain reference evidence for stored messages even when Details is disabled, and omit inaccessible targets.
Thanks to kabi178, bbyszio and xet7 !
Resolve related link titles through current readable sources and retain their chains in immutable command evidence. Recheck related access, admin rights and custom-field definitions before stored dispatch. Refuse legacy Details snapshots without related evidence.
Thanks to kabi178, bbyszio and xet7 !
Lauri Ojansivu