Bump versions for v11.78

The latest 11.77 report still shows the undefined-index error fixed locally in 2c5cdd78a. Exercise service-account binding followed by user search with unset and configured filters, and prove failed binding cannot proceed to search. The separately reported oplog observer error is not established as the authentication cause.

Thanks to Nissulya and xet7 !

Fixes #6692,

.github/workflows/release-all.yml

@@ -1063,7 +1063,7 @@ jobs:
           path: provenance
           merge-multiple: true
 
-      - name: Compose the release notes, provenance first
+      - name: Compose release notes from the changelog only
         # The notes go from FILE to FILE and never become a shell value. Two
         # earlier shapes each broke a release: inline `${{ … }}` put them in the
         # shell SOURCE, so a backtick in any `code` span ran as a command (v10.59
@@ -1073,8 +1073,7 @@ jobs:
         # from CHANGELOG.md, appended with cat, the text is data all the way.
         run: |
           set -euo pipefail
-          bash releases/provenance-table.sh > release-notes.md || true
-          bash releases/release-notes.sh "$VERSION" >> release-notes.md
+          bash releases/release-notes.sh "$VERSION" > release-notes.md
           echo "----- release notes -----"
           head -40 release-notes.md
 
@@ -5317,15 +5316,8 @@ jobs:
             echo "::error::nextcloud FAILED. The ::error:: line in this job's log, above, says which step and why."
           fi
 
-  # ── The provenance table, completed ─────────────────────────────────────────
-  #
-  # The release is CREATED before win64, mac-arm64 and the extra architectures
-  # are built - those jobs need a release to upload their bundles to - so the
-  # table it is created with can only cover amd64 and arm64. This runs after all
-  # of them and rewrites the notes with every bundle's rows in.
-  #
-  # always(): a platform that failed should not cost the release its table for
-  # the platforms that succeeded.
+  # Refresh the selected changelog notes after builds. Binary provenance remains
+  # in build artifacts and is never appended to release notes.
   release-notes:
     name: complete the release notes
     needs:
@@ -5359,7 +5351,7 @@ jobs:
           path: provenance
           merge-multiple: true
 
-      - name: Rewrite the notes with every bundle in the table
+      - name: Refresh release notes from the changelog only
         # File to file, never a shell value: see the "Compose the release notes"
         # step for the two ways that broke a release.
         env:
@@ -5367,10 +5359,7 @@ jobs:
           VERSION: ${{ needs.prepare.outputs.version }}
         run: |
           set -euo pipefail
-          rows=$(find provenance -name '*.tsv' 2>/dev/null | wc -l)
-          echo "Provenance files collected: $rows"
-          bash releases/provenance-table.sh > release-notes.md || true
-          bash releases/release-notes.sh "$VERSION" >> release-notes.md
+          bash releases/release-notes.sh "$VERSION" > release-notes.md
           gh release edit --repo "${GITHUB_REPOSITORY:-wekan/wekan}" "v${VERSION}" --notes-file release-notes.md
-          echo "Release notes updated with the provenance of every bundle built."
+          echo "Release notes updated from the changelog; binary provenance stays in build artifacts."
           head -40 release-notes.md

AGENTS.md

@@ -555,19 +555,17 @@ directly after the merge.
   `<details>` blocks below carry that information. Keep the paragraph current as
   topics change, and shorten it when added commits make it grow. A finished release
   keeps the paragraph it was written with.
-- **No release section carries a Platform/Binary/From/Version/SHA256 table, and
-  none ever should again.** It used to sit right under the `**In short:**`
-  paragraph, then moved to a `**Binaries in these bundles:**` label at the end
-  of the section — both tried and both removed, because CHANGELOG.md is not
-  where that data belongs: it made every release's entry mostly a giant table
-  nobody read, on top of what `<details>` entries already say. "Which Node.js
-  is in the arm64 bundle of 10.69, and was it checked" is answered by the
-  **GitHub Release notes** instead: `releases/provenance-table.sh` puts the
-  same table at the TOP of those, built fresh from the `provenance.tsv` rows
-  each build job records (see `releases/record-provenance.sh`), every time a
-  release is made — so it is never stale and never needs hand-editing into
-  CHANGELOG.md. Adding a binaries table back into a CHANGELOG entry, in any
-  shape, is reintroducing something the maintainer removed on purpose.
+- **Neither CHANGELOG.md nor release notes may contain a binaries provenance
+  section or a Platform/Bundle/Binary/From/Version/Checked/SHA256 table.**
+  Do not add "Binaries in these bundles" at the top or bottom of either.
+  Release notes summarize each Translations group as only a list of updated
+  languages. Add `**Languages updated:**` with comma-separated full language
+  names below the group label; keep detailed entries in the changelog and audit.
+  Release notes have only In short, Security, Translations (language list),
+  the standard thanks line and More details at ChangeLog with the release
+  anchor link. Other details stay in CHANGELOG.md. Keep download
+  verification and `provenance.tsv` build artifacts for diagnostics; do not
+  append their contents or `releases/provenance-table.sh` output to notes.
 - **Inside a subsection, entries are GROUPED BY TOPIC/AREA.** A release touches a handful
   of areas and repeating the area's name in every summary is the noise this
   removes — twelve entries that each begin "All Boards:" say "All Boards" twelve

CLAUDE.md

@@ -555,19 +555,17 @@ directly after the merge.
   `<details>` blocks below carry that information. Keep the paragraph current as
   topics change, and shorten it when added commits make it grow. A finished release
   keeps the paragraph it was written with.
-- **No release section carries a Platform/Binary/From/Version/SHA256 table, and
-  none ever should again.** It used to sit right under the `**In short:**`
-  paragraph, then moved to a `**Binaries in these bundles:**` label at the end
-  of the section — both tried and both removed, because CHANGELOG.md is not
-  where that data belongs: it made every release's entry mostly a giant table
-  nobody read, on top of what `<details>` entries already say. "Which Node.js
-  is in the arm64 bundle of 10.69, and was it checked" is answered by the
-  **GitHub Release notes** instead: `releases/provenance-table.sh` puts the
-  same table at the TOP of those, built fresh from the `provenance.tsv` rows
-  each build job records (see `releases/record-provenance.sh`), every time a
-  release is made — so it is never stale and never needs hand-editing into
-  CHANGELOG.md. Adding a binaries table back into a CHANGELOG entry, in any
-  shape, is reintroducing something the maintainer removed on purpose.
+- **Neither CHANGELOG.md nor release notes may contain a binaries provenance
+  section or a Platform/Bundle/Binary/From/Version/Checked/SHA256 table.**
+  Do not add "Binaries in these bundles" at the top or bottom of either.
+  Release notes summarize each Translations group as only a list of updated
+  languages. Add `**Languages updated:**` with comma-separated full language
+  names below the group label; keep detailed entries in the changelog and audit.
+  Release notes have only In short, Security, Translations (language list),
+  the standard thanks line and More details at ChangeLog with the release
+  anchor link. Other details stay in CHANGELOG.md. Keep download
+  verification and `provenance.tsv` build artifacts for diagnostics; do not
+  append their contents or `releases/provenance-table.sh` output to notes.
 - **Inside a subsection, entries are GROUPED BY TOPIC/AREA.** A release touches a handful
   of areas and repeating the area's name in every summary is the noise this
   removes — twelve entries that each begin "All Boards:" say "All Boards" twelve

Dockerfile

@@ -20,7 +20,7 @@ LABEL org.opencontainers.image.source="https://github.com/wekan/wekan"
 # TARGETARCH and TARGETVARIANT are automatically provided by Docker Buildx
 ARG TARGETARCH
 ARG TARGETVARIANT
-ARG VERSION=11.74
+ARG VERSION=11.78
 ARG DEBIAN_FRONTEND=noninteractive
 
 ENV BUILD_DEPS="apt-utils gnupg wget bzip2 g++ curl libarchive-tools build-essential git ca-certificates python3 unzip"

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v11.74.0"
+appVersion: "v11.78.0"
 files:
   userUploads:
     - README.md

build.bat

@@ -82,7 +82,7 @@ if /i "%PROCESSOR_ARCHITECTURE%"=="ARM64" set "PLATFORM_ARCH=arm64"
 if /i "%PROCESSOR_ARCHITEW6432%"=="ARM64" set "PLATFORM_ARCH=arm64"
 echo Platform: %PLATFORM_OS% %PLATFORM_ARCH%
 echo Repo: %REPO%
-echo Note: Logs use .tools\log\<operation>\YYYY-MM-DD\HH-MM-SS\.
+echo Note: Logs use .tools\log\<operation>\YYYY-MM-DD_HH-MM-SS\.
 
 :menu
 echo.
@@ -246,6 +246,8 @@ goto menu_releases
 
 REM ---------------------------------------------------------------------------
 :rel_release
+REM Release notes: In short, Security, translation languages, thanks and changelog link.
+REM Binary provenance stays in build artifacts.
 echo.
 echo -- Releases / Release --   ^(0 = Back^)
 echo   1^) Release ALL platforms: push CHANGELOG, trigger release-all.yml
@@ -1055,7 +1057,7 @@ set "S_mocha=RUN" & set "S_unit=RUN" & set "S_import=RUN" & set "S_e2e=RUN"
 set "S_chromium=RUN" & set "S_firefox=RUN" & set "S_webkit=RUN"
 set "C_mocha=0" & set "C_unit=0" & set "C_import=0" & set "C_e2e=0"
 set "C_chromium=0" & set "C_firefox=0" & set "C_webkit=0"
-REM Each run gets its own .tools\log\<operation>\YYYY-MM-DD\HH-MM-SS\ dir (stamped once at run start), so
+REM Each run gets its own .tools\log\<operation>\YYYY-MM-DD_HH-MM-SS\ dir (stamped once at run start), so
 REM logs are never overwritten and previous runs are kept. PowerShell gives a
 REM locale-independent yyyy-MM-dd_HH-mm-ss; %RUN_LOGDIR% is absolute so it works
 REM from any job's working directory (e.g. the browser job runs in tests\playwright).
@@ -1199,7 +1201,7 @@ set "S_mocha=RUN" & set "S_unit=RUN" & set "S_import=RUN" & set "S_e2e=RUN"
 set "S_chromium=RUN" & set "S_firefox=RUN" & set "S_webkit=RUN"
 set "C_mocha=0" & set "C_unit=0" & set "C_import=0" & set "C_e2e=0"
 set "C_chromium=0" & set "C_firefox=0" & set "C_webkit=0"
-REM Each run gets its own .tools\log\<operation>\YYYY-MM-DD\HH-MM-SS\ dir (stamped once at run start), so
+REM Each run gets its own .tools\log\<operation>\YYYY-MM-DD_HH-MM-SS\ dir (stamped once at run start), so
 REM logs are never overwritten and previous runs are kept. PowerShell gives a
 REM locale-independent yyyy-MM-dd_HH-mm-ss; %RUN_LOGDIR% is absolute so it works
 REM from any job's working directory (e.g. the browser job runs in tests\playwright).
@@ -1500,7 +1502,7 @@ echo Log directory: %LOG_DIRECTORY%
 exit /b 0
 
 :onelog
-REM Set ONELOG to .tools\log\<operation>\YYYY-MM-DD\HH-MM-SS\wekan-%1.log - the same place every other
+REM Set ONELOG to .tools\log\<operation>\YYYY-MM-DD_HH-MM-SS\wekan-%1.log - the same place every other
 REM test run writes, so "the newest test logs" is one directory whichever option
 REM produced them. A larger run (EVERYTHING) exports WEKAN_LOGDIR first, and then
 REM the whole run stays in that one directory. The Windows equivalent of build.sh's
@@ -1896,7 +1898,7 @@ REM there, and installing Go and the module dependencies if they are
 REM missing), then run the whole FerretDB v1 query catalogue against every
 REM database that has a Docker image for THIS CPU - one at a time, because they
 REM all use the same FerretDB port - and compare that they all answered the same.
-REM Results go to .tools\log\<operation>\YYYY-MM-DD\HH-MM-SS\ with every other test run's.
+REM Results go to .tools\log\<operation>\YYYY-MM-DD_HH-MM-SS\ with every other test run's.
 REM
 REM The orchestration is one bash script, shared with build.sh rather than
 REM rewritten here: a second implementation would drift, and Docker Desktop on
@@ -1919,7 +1921,7 @@ REM that .gitignore and .meteorignore already exclude, instead of one ignored
 REM subdirectory each at the repo root. It is cloned here when it is not there,
 REM the same as build.sh's ensure_tool_repo does, so neither script depends on
 REM the other having been run first. Its build.sh installs Go and the Go modules
-REM when they are missing, and writes its logs to .tools\log\<operation>\YYYY-MM-DD\HH-MM-SS\ with every
+REM when they are missing, and writes its logs to .tools\log\<operation>\YYYY-MM-DD_HH-MM-SS\ with every
 REM other test run's.
 where bash >nul 2>&1
 if errorlevel 1 (
@@ -1965,7 +1967,7 @@ goto test_everything
 :test_everything
 REM Every test WeKan and FerretDB have, one stage at a time: WeKan's own suite,
 REM then the database conformance run for every database with an image for this
-REM CPU, then all of FerretDB's tests. One .tools\log\<operation>\YYYY-MM-DD\HH-MM-SS\ directory for the
+REM CPU, then all of FerretDB's tests. One .tools\log\<operation>\YYYY-MM-DD_HH-MM-SS\ directory for the
 REM whole run, and nothing runs concurrently, which is what makes a failure
 REM readable.
 REM

build.sh

@@ -6,7 +6,7 @@ echo "Note1: If you use other locale than en_US.UTF-8 , you need to additionally
 echo "       with 'sudo dpkg-reconfigure locales' , so that MongoDB works correctly."
 echo "       You can still use any other locale as your main locale."
 echo "Note2: Console output is also logged to the operation-specific path printed below."
-echo "Note3: All logs use .tools/log/<operation>/YYYY-MM-DD/HH-MM-SS/."
+echo "Note3: All logs use .tools/log/<operation>/YYYY-MM-DD_HH-MM-SS/."
 echo "       .tools/log/ inside this repository. The path is printed when a run"
 echo "       starts."
 echo "Note4: Two build directories, and they are not the same thing:"
@@ -357,13 +357,13 @@ function build_stage(){
 # Used by menu option 2 and auto-invoked by option 9 when .build is missing.
 # Also clears the rspack dev-build caches (_build and node_modules/.cache) so the
 # next `meteor run` recompiles from scratch instead of serving stale modules.
-# Reserve one operation/type/date/time directory, including same-second collisions.
+# Reserve one operation/type/datetime directory, including same-second collisions.
 function log_directory(){
 	local type="$1" day dir suffix=1 candidate
 	case "$type" in ""|*[!a-zA-Z0-9_-]*) echo "ERROR: invalid log type: $type" >&2; return 1 ;; esac
-	day="${WEKAN_LOG_ROOT:-.tools/log}/$type/$(date '+%Y-%m-%d')"
+	day="${WEKAN_LOG_ROOT:-.tools/log}/$type"
 	mkdir -p "$day" || return $?
-	dir="$day/$(date '+%H-%M-%S')"
+	dir="$day/$(date '+%Y-%m-%d_%H-%M-%S')"
 	if ! mkdir "$dir" 2>/dev/null; then
 		while :; do
 			candidate="$dir-$suffix"
@@ -872,7 +872,7 @@ function run_playwright_parallel(){
 	read -p "Install Playwright test dependencies first? [y/N] " INSTALL_DEPS
 	case "$INSTALL_DEPS" in [Yy]*) ( cd "$pwdir" && meteor npm install ) ;; esac
 
-	# This run's own .tools/log/<operation>/<date>/<time>/ dir, so logs are never overwritten.
+	# This run's own .tools/log/<operation>/YYYY-MM-DD_HH-MM-SS/ dir, so logs are never overwritten.
 	local RUN_LOGDIR
 	RUN_LOGDIR="$(log_directory test-playwright-all)" || return $?
 	mkdir -p "$RUN_LOGDIR"
@@ -888,7 +888,7 @@ function run_playwright_parallel(){
 	local rc_chromium rc_firefox rc_webkit
 	local ts
 	# Stream live to the console with tee while also saving to this run's
-	# .tools/log/<operation>/<date>/<time>/ dir. PIPESTATUS[0] is run_pw_all_browser's exit code (the
+	# .tools/log/<operation>/YYYY-MM-DD_HH-MM-SS/ dir. PIPESTATUS[0] is run_pw_all_browser's exit code (the
 	# left side of the pipe), not tee's, so the pass/fail result stays accurate.
 	for entry in "chromium:Chromium" "firefox:Firefox" "webkit:WebKit"; do
 		browser="${entry%%:*}"; label="${entry#*:}"
@@ -1030,7 +1030,7 @@ function run_all_tests(){
 	local TEST_NODE_OPTIONS="${WEKAN_TEST_NODE_OPTIONS:---max-old-space-size=$TEST_HEAP_MB}"
 	echo "Node heap limit for test runtime processes: ${TEST_HEAP_MB} MB."
 	echo "  Override by exporting WEKAN_TEST_NODE_OPTIONS yourself."
-	# Each whole-suite run gets its own .tools/log/<operation>/<date>/<time>/ directory
+	# Each whole-suite run gets its own .tools/log/<operation>/YYYY-MM-DD_HH-MM-SS/ directory
 	# (stamped once, when the run starts), so logs are never overwritten and
 	# previous runs are kept.
 	local RUN_TS RUN_LOGDIR
@@ -2220,7 +2220,7 @@ function ask_dev_url(){
 function git_fix_changelog_links(){
 	local script="$WEKAN_DIR/releases/fix-changelog-hashes.sh"
 	[ -f "$script" ] || return 1
-	bash "$script" || true
+	bash "$script" || return 1
 	if [ -n "$(git status --porcelain -- CHANGELOG.md 2>/dev/null)" ]; then
 		git add CHANGELOG.md
 		git commit -q -m "CHANGELOG: repoint commit links after history moved.
@@ -2234,14 +2234,48 @@ Thanks to xet7 !"
 		echo "==> CHANGELOG commit links repointed and committed."
 		return 0
 	fi
-	return 1
+	return 0
+}
+
+# git pull: fast-forward or merge origin without rewriting local commit hashes.
+# Preserve actual content conflicts for explicit resolution.
+# Recover only Git's incomplete autostash-only setup, never an active rebase.
+function git_recover_orphan_autostash(){
+ local directory stash
+ directory="$(git rev-parse --git-path rebase-merge)"
+ [ -d "$directory" ] || return 0
+ [ -f "$directory/autostash" ] || return 0
+ [ "$(find "$directory" -mindepth 1 -maxdepth 1 | wc -l)" -eq 1 ] || return 0
+ [ ! -e "$(git rev-parse --git-path index.lock)" ] || return 0
+ if ps -eo args | grep -E '^git (rebase|merge|stash|commit)( |$)' >/dev/null; then
+  echo "ERROR: another Git operation is running; recovery deferred."; return 1
+ fi
+ stash="$(cat "$directory/autostash")"
+ git cat-file -e "$stash^{commit}" || return 1
+ git stash store -m 'Recovered build.sh interrupted pull autostash' "$stash" || return 1
+ rm -- "$directory/autostash" && rmdir -- "$directory" || return 1
+ echo "==> Preserved interrupted pull autostash in git stash list."
+}
+
+function git_operation_ready(){
+ local state
+ for state in rebase-merge rebase-apply MERGE_HEAD CHERRY_PICK_HEAD REVERT_HEAD index.lock; do
+  if [ -e "$(git rev-parse --git-path "$state")" ]; then
+   echo "ERROR: existing Git operation or lock: $state. Resolve it before pulling or pushing."
+   echo "       Run git status; do not delete a lock while another Git process is running."
+   return 1
+  fi
+ done
+ [ "$(git rev-parse --abbrev-ref HEAD)" != HEAD ] || {
+  echo "ERROR: detached HEAD; select a branch first."; return 1;
+ }
 }
 
-# git pull: fast-forward when that is all it takes, rebase when the branch has
-# diverged, and never end half-way through either.
 function git_pull(){
 	git rev-parse --git-dir >/dev/null 2>&1 || { echo "Not a git repository."; return 1; }
 	local branch upstream before ahead behind
+	git_recover_orphan_autostash || return 1
+	git_operation_ready || return 1
 	branch="$(git rev-parse --abbrev-ref HEAD)"
 	upstream="origin/$branch"
 	echo "== git pull - branch $branch =="
@@ -2269,26 +2303,18 @@ function git_pull(){
 		# Nothing of ours to replay: a fast-forward moves the branch pointer and
 		# rewrites no commit, so no link can go stale.
 		echo "--- fast-forward (no local commits to replay) ---"
-		git merge --ff-only "$upstream" || { echo "ERROR: fast-forward failed. Nothing changed."; return 1; }
+		git -c merge.autoStash=true merge --ff-only "$upstream" || { echo "ERROR: fast-forward failed. Nothing changed."; return 1; }
 	else
-		echo "--- rebase: replaying $ahead local commit(s) onto $upstream ---"
-		echo "    This gives them NEW hashes, which is why the CHANGELOG links are"
-		echo "    repaired straight after."
-		if ! git -c rebase.autoStash=true rebase "$upstream"; then
-			git rebase --abort 2>/dev/null
-			git stash list >/dev/null 2>&1
-			echo
-			echo "ERROR: the rebase hit a conflict, so it was ABORTED - this repo is"
-			echo "       exactly as it was before ($(git rev-parse --short "$before"))."
-			echo "       Resolve it by hand:"
-			echo "         git rebase $upstream        # then fix the conflicts"
-			echo "         git rebase --continue       # or: git rebase --abort"
-			echo "       and run this option again afterwards."
-			return 1
-		fi
+        echo "--- merge: integrating $upstream while preserving local commit hashes ---"
+        if ! git -c merge.autoStash=true merge --no-edit "$upstream"; then
+            echo "ERROR: merge did not finish. Your edits and conflict state are preserved."
+            git status --short
+            echo "Resolve the listed conflicts, git add the resolved files, then git merge --continue."
+            return 1
+        fi
 	fi
 
-	git_fix_changelog_links || echo "==> CHANGELOG commit links all resolve; nothing to repoint."
+	git_fix_changelog_links || return 1
 	echo "--- git status ---"
 	git status --short --branch
 	return 0
@@ -2299,6 +2325,8 @@ function git_pull(){
 function git_push(){
 	git rev-parse --git-dir >/dev/null 2>&1 || { echo "Not a git repository."; return 1; }
 	local branch ahead
+	git_recover_orphan_autostash || return 1
+	git_operation_ready || return 1
 	branch="$(git rev-parse --abbrev-ref HEAD)"
 	echo "== git push - branch $branch =="
 
@@ -2309,9 +2337,13 @@ function git_push(){
 
 	# Before publishing, not after: a stale link that reaches GitHub 404s for
 	# everyone who reads the release notes.
-	git_fix_changelog_links || echo "==> CHANGELOG commit links all resolve."
+	git_fix_changelog_links || return 1
 
-	git fetch origin "$branch" >/dev/null 2>&1 || true
+	git fetch origin "$branch" || { echo "ERROR: fetch failed; nothing pushed."; return 1; }
+    if git rev-parse --verify --quiet "origin/$branch" >/dev/null &&
+       [ "$(git rev-list --count HEAD.."origin/$branch")" -gt 0 ]; then
+        git_pull || { echo "ERROR: pull failed; nothing pushed."; return 1; }
+    fi
 	if git rev-parse --verify --quiet "origin/$branch" >/dev/null; then
 		ahead="$(git rev-list --count "origin/$branch"..HEAD)"
 		[ "$ahead" -eq 0 ] && { echo "==> Nothing to push; origin/$branch is already at this commit."; return 0; }
@@ -2400,6 +2432,10 @@ choose() {
 # (a helper other scripts source), ferretdb/* (they run INSIDE the built
 # snap/bundle, not on a maintainer's machine) and the superseded old-*.sh and
 # translations/fill_translations.py.
+# Release notes summarize translations as affected languages; other changelog
+# details stay in CHANGELOG.md. Notes include only In short, Security,
+# Translations language list, thanks and the changelog link. Binary provenance remains
+# a build artifact and must not be appended by any release entry point.
 RELEASE_SCRIPTS=(	"Release|Release ALL platforms: push CHANGELOG, trigger release-all.yml|releases/release-all.sh|||"
 	"Release|Release (older local flow), for one version|releases/release.sh|WeKan version, e.g. 10.50||"
 	"Release|Show the version numbers this checkout would release|releases/version.sh|||"
@@ -2469,7 +2505,7 @@ RELEASE_SCRIPTS=(	"Release|Release ALL platforms: push CHANGELOG, trigger releas
 	"Translations|Report English strings that regressed|releases/translations/report-english-regressions.mjs|||"
 	"Translations|Prove a pull keeps human translations (no network)|releases/translations/verify-human-preference.mjs|||"
 	"Translations|Merge a finished pull by hand|releases/translations/merge-translations.mjs|||"
-	"Git and repo|git pull - fetch, fast-forward or rebase, repoint moved CHANGELOG links|!git_pull|||git-pull"
+	"Git and repo|git pull - fetch, fast-forward or merge, repoint moved CHANGELOG links|!git_pull|||git-pull"
 	"Git and repo|git push - verify the CHANGELOG links, push, pull-and-retry once if origin moved|!git_push|||git-push"
 	"Git and repo|Commit with the editor open for a multi-line message|releases/commit.sh|||"
 	"Git and repo|Add everything, then revert it again|!git restore --staged|Path to unstage||git-add-revert"
@@ -2681,7 +2717,7 @@ while [ -z "$opt" ]; do
 					"Install dependencies|Install WeKan dependencies" \
 					"Build WeKan release bundle|Build WeKan release bundle" \
 					"Build WeKan development bundle|Build WeKan development bundle" \
-					"git pull|git pull: fetch, fast-forward or rebase onto origin, repoint the CHANGELOG commit links the rebase moved, and leave the repo unchanged if anything conflicts" \
+					"git pull|git pull: fetch, fast-forward or merge onto origin, repoint the CHANGELOG commit links the rebase moved, and preserve unresolved conflict state" \
 					"git push|git push: check the CHANGELOG commit links resolve before publishing them, push this branch to origin, and pull-then-retry once if origin moved meanwhile" ;;
 			"Dev server")
 				choose "Dev server" \
@@ -2867,7 +2903,7 @@ for _once in 1; do
 		break
 		;;
 
-    "git pull: fetch, fast-forward or rebase onto origin, repoint the CHANGELOG commit links the rebase moved, and leave the repo unchanged if anything conflicts")
+    "git pull: fetch, fast-forward or merge onto origin, repoint the CHANGELOG commit links the rebase moved, and preserve unresolved conflict state")
 		git_pull
 		break
 		;;

client/components/activities/activities.jade

@@ -19,58 +19,58 @@ template(name="cardActivities")
 template(name="activity")
   .activity(id=activityDomId data-id=activity._id)
     +userAvatar(userId=activity.user._id)
-    p.activity-desc
+    div.activity-desc
       span.activity-member
         +memberName(user=activity.user)
 
       //- attachment activity -------------------------------------------------
       if($eq activity.activityType 'deleteAttachment')
-        | {{{_ 'activity-delete-attach' cardLink}}}.
+        | {{{activityMessage 'activity-delete-attach' cardLink}}}.
 
       if($eq activity.activityType 'addAttachment')
-        | {{{_ 'activity-attached' attachmentLink cardLink}}}.
+        | {{{activityMessage 'activity-attached' attachmentLink cardLink}}}.
         if($neq mode 'board')
           if activity.attachment.isImage
             img.attachment-image-preview(src=activity.attachment.url alt="")
 
       //- board activity ------------------------------------------------------
       if($eq activity.activityType 'createBoard')
-        | {{{_ 'activity-created' boardLabelLink}}}.
+        | {{{activityMessage 'activity-created' boardLabelLink}}}.
 
       if($eq activity.activityType 'importBoard')
-        | {{{_ 'activity-imported-board' boardLabelLink sourceLink}}}.
+        | {{{activityMessage 'activity-imported-board' boardLabelLink sourceLink}}}.
 
       if($eq activity.activityType 'addBoardMember')
-        | {{{_ 'activity-added' memberLink boardLabelLink}}}.
+        | {{{activityMessage 'activity-added' memberLink boardLabelLink}}}.
 
       if($eq activity.activityType 'removeBoardMember')
-        | {{{_ 'activity-excluded' memberLink boardLabelLink}}}.
+        | {{{activityMessage 'activity-excluded' memberLink boardLabelLink}}}.
 
       //- card activity -------------------------------------------------------
       if($eq activity.activityType 'createCard')
         if($eq mode 'card')
-          | {{{_ 'activity-added' cardLabelLink (sanitize activity.listName)}}}.
+          | {{{activityMessage 'activity-added' cardLabelLink (activityValue activity.listName)}}}.
         else
-          | {{{_ 'activity-added' cardLabelLink boardLabelLink}}}.
+          | {{{activityMessage 'activity-added' cardLabelLink boardLabelLink}}}.
 
       if($eq activity.activityType 'importCard')
-        | {{{_ 'activity-imported' cardLink boardLabelLink sourceLink}}}.
+        | {{{activityMessage 'activity-imported' cardLink boardLabelLink sourceLink}}}.
 
       if($eq activity.activityType 'moveCard')
-        | {{{_ 'activity-moved' cardLabelLink (sanitize activity.oldList.title) (sanitize activity.list.title)}}}.
+        | {{{activityMessage 'activity-moved' cardLabelLink (activityValue activity.oldList.title) (activityValue activity.list.title)}}}.
 
       if($eq activity.activityType 'moveCardBoard')
-        | {{{_ 'activity-moved' cardLink (sanitize activity.oldBoardName) (sanitize activity.boardName)}}}.
+        | {{{activityMessage 'activity-moved' cardLink (activityValue activity.oldBoardName) (activityValue activity.boardName)}}}.
 
       if($eq activity.activityType 'archivedCard')
-        | {{{_ 'activity-archived' cardLink}}}.
+        | {{{activityMessage 'activity-archived' cardLink}}}.
 
       if($eq activity.activityType 'restoredCard')
-        | {{{_ 'activity-sent' cardLink boardLabelLink}}}.
+        | {{{activityMessage 'activity-sent' cardLink boardLabelLink}}}.
 
       //- checklist activity --------------------------------------------------
       if($eq activity.activityType 'addChecklist')
-        | {{{_ 'activity-checklist-added' cardLink}}}.
+        | {{{activityMessage 'activity-checklist-added' cardLink}}}.
         if($eq mode 'card')
           .activity-checklist
             +viewer
@@ -81,114 +81,114 @@ template(name="activity")
               = activity.checklist.title
 
       if($eq activity.activityType 'removedChecklist')
-        | {{{_ 'activity-checklist-removed' cardLink}}}.
+        | {{{activityMessage 'activity-checklist-removed' cardLink}}}.
 
       if($eq activity.activityType 'completeChecklist')
-        | {{{_ 'activity-checklist-completed' (sanitize activity.checklist.title) cardLink}}}.
+        | {{{activityMessage 'activity-checklist-completed' (activityValue activity.checklist.title) cardLink}}}.
 
       if($eq activity.activityType 'uncompleteChecklist')
-        | {{{_ 'activity-checklist-uncompleted' (sanitize activity.checklist.title) cardLink}}}.
+        | {{{activityMessage 'activity-checklist-uncompleted' (activityValue activity.checklist.title) cardLink}}}.
 
       if($eq activity.activityType 'checkedItem')
-        | {{{_ 'activity-checked-item' (sanitize checkItem) (sanitize activity.checklist.title) cardLink}}}.
+        | {{{activityMessage 'activity-checked-item' (activityValue checkItem) (activityValue activity.checklist.title) cardLink}}}.
 
       if($eq activity.activityType 'uncheckedItem')
-        | {{{_ 'activity-unchecked-item' (sanitize checkItem) (sanitize activity.checklist.title) cardLink}}}.
+        | {{{activityMessage 'activity-unchecked-item' (activityValue checkItem) (activityValue activity.checklist.title) cardLink}}}.
 
       if($eq activity.activityType 'addChecklistItem')
-        | {{{_ 'activity-checklist-item-added' (sanitize activity.checklist.title) cardLink}}}.
+        | {{{activityMessage 'activity-checklist-item-added' (activityValue activity.checklist.title) cardLink}}}.
         .activity-checklist(href="{{ activity.card.originRelativeUrl }}")
           +viewer
             = activity.checklistItem.title
 
       if($eq activity.activityType 'removedChecklistItem')
-        | {{{_ 'activity-checklist-item-removed' (sanitize activity.checklist.title) cardLink}}}.
+        | {{{activityMessage 'activity-checklist-item-removed' (activityValue activity.checklist.title) cardLink}}}.
 
       //- comment activity ----------------------------------------------------
       if($eq activity.activityType 'deleteComment')
-        | {{{_ 'activity-deleteComment' (sanitize activity.commentDisplayText)}}}.
+        | {{{activityMessage 'activity-deleteComment' (activityValue activity.commentDisplayText)}}}.
 
       if($eq activity.activityType 'editComment')
-        | {{{_ 'activity-editComment' (sanitize activity.commentDisplayText)}}}.
+        | {{{activityMessage 'activity-editComment' (activityValue activity.commentDisplayText)}}}.
 
       if($eq activity.activityType 'addComment')
-        | {{{_ 'activity-on' cardLink}}}
+        | {{{activityMessage 'activity-on' cardLink}}}
         a.activity-comment(href="{{ activity.card.originRelativeUrl }}")
           +viewer
             = activity.comment.text
 
       //- date activity ------------------------------------------------
       if($eq activity.activityType 'a-receivedAt')
-        | {{{_ 'activity-receivedDate' (sanitize receivedDate) cardLink}}}.
+        | {{{activityMessage 'activity-receivedDate' (activityValue receivedDate) cardLink}}}.
 
       if($eq activity.activityType 'a-startAt')
-        | {{{_ 'activity-startDate' (sanitize startDate) cardLink}}}.
+        | {{{activityMessage 'activity-startDate' (activityValue startDate) cardLink}}}.
 
       if($eq activity.activityType 'a-dueAt')
-        | {{{_ 'activity-dueDate' (sanitize dueDate) cardLink}}}.
+        | {{{activityMessage 'activity-dueDate' (activityValue dueDate) cardLink}}}.
 
       if($eq activity.activityType 'a-endAt')
-        | {{{_ 'activity-endDate' (sanitize endDate) cardLink}}}.
+        | {{{activityMessage 'activity-endDate' (activityValue endDate) cardLink}}}.
 
       if($eq activity.activityType 'a-changedTitle')
-        | {{{_ 'activity-changedTitle' (sanitize activity.value) cardLink}}}.
+        | {{{activityMessage 'activity-changedTitle' (activityValue activity.value) cardLink}}}.
 
       if($eq activity.activityType 'a-changedDescription')
-        | {{{_ 'activity-changedDescription' cardLink}}}.
+        | {{{activityMessage 'activity-changedDescription' cardLink}}}.
 
       //- customField activity ------------------------------------------------
       if($eq activity.activityType 'createCustomField')
-        | {{_ 'activity-customfield-created' customField}}.
+        | {{{activityMessage 'activity-customfield-created' (activityValue customField)}}}.
 
       if($eq activity.activityType 'setCustomField')
-        | {{{_ 'activity-set-customfield' (sanitize lastCustomField) (sanitize lastCustomFieldValue) cardLink}}}.
+        | {{{activityMessage 'activity-set-customfield' (activityValue lastCustomField) (activityValue lastCustomFieldValue) cardLink}}}.
 
       if($eq activity.activityType 'unsetCustomField')
-        | {{{_ 'activity-unset-customfield' (sanitize lastCustomField) cardLink}}}.
+        | {{{activityMessage 'activity-unset-customfield' (activityValue lastCustomField) cardLink}}}.
 
       //- label activity ------------------------------------------------------
       if($eq activity.activityType 'addedLabel')
-        | {{{_ 'activity-added-label' (sanitize lastLabel) cardLink}}}.
+        | {{{activityMessage 'activity-added-label' (activityValue lastLabel) cardLink}}}.
 
       if($eq activity.activityType 'removedLabel')
-        | {{{_ 'activity-removed-label' (sanitize lastLabel) cardLink}}}.
+        | {{{activityMessage 'activity-removed-label' (activityValue lastLabel) cardLink}}}.
 
       //- list activity -------------------------------------------------------
       if($neq mode 'card')
         if($eq activity.activityType 'createList')
-          | {{{_ 'activity-added' (sanitize listLabel) boardLabelLink}}}.
+          | {{{activityMessage 'activity-added' (activityValue listLabel) boardLabelLink}}}.
 
         if($eq activity.activityType 'importList')
-          | {{{_ 'activity-imported' (sanitize listLabel) boardLabelLink sourceLink}}}.
+          | {{{activityMessage 'activity-imported' (activityValue listLabel) boardLabelLink sourceLink}}}.
 
         if($eq activity.activityType 'removeList')
-          | {{{_ 'activity-removed' (sanitize activity.title) boardLabelLink}}}.
+          | {{{activityMessage 'activity-removed' (activityValue activity.title) boardLabelLink}}}.
 
         if($eq activity.activityType 'archivedList')
-          | {{_ 'activity-archived' (sanitize listLabel)}}.
+          | {{{activityMessage 'activity-archived' (activityValue listLabel)}}}.
 
         if($eq activity.activityType 'changedListTitle')
-          | {{_ 'activity-changedListTitle' (sanitize listLabel) boardLabelLink}}
+          | {{{activityMessage 'activity-changedListTitle' (activityValue listLabel) boardLabelLink}}}
 
       //- member activity ----------------------------------------------------
       if($eq activity.activityType 'joinMember')
         if($eq user._id activity.member._id)
-          | {{{_ 'activity-joined' cardLink}}}.
+          | {{{activityMessage 'activity-joined' cardLink}}}.
         else
-          | {{{_ 'activity-added' memberLink cardLink}}}.
+          | {{{activityMessage 'activity-added' memberLink cardLink}}}.
 
       if($eq activity.activityType 'unjoinMember')
         if($eq user._id activity.member._id)
-          | {{{_ 'activity-unjoined' cardLink}}}.
+          | {{{activityMessage 'activity-unjoined' cardLink}}}.
         else
-          | {{{_ 'activity-removed' memberLink cardLink}}}.
+          | {{{activityMessage 'activity-removed' memberLink cardLink}}}.
 
       //- swimlane activity --------------------------------------------------
       if($eq activity.activityType 'createSwimlane')
-        | {{{_ 'activity-added' (sanitize activity.swimlane.title) boardLabelLink}}}.
+        | {{{activityMessage 'activity-added' (activityValue activity.swimlane.title) boardLabelLink}}}.
 
       if($eq activity.activityType 'archivedSwimlane')
-        | {{{_ 'activity-archived' (sanitize activity.swimlane.title)}}}.
+        | {{{activityMessage 'activity-archived' (activityValue activity.swimlane.title)}}}.
 
 
       //- I don't understand this part ----------------------------------------
@@ -198,7 +198,7 @@ template(name="activity")
         i(title=currentData.timeValue).activity-meta {{ displayDate currentData.timeValue 'LLL' }}
         if (currentData.timeOldValue)
           = ' '
-            | {{{_ "previous_as" }}}
+            | {{{activityMessage "previous_as" }}}
             = ' '
             i(title=currentData.timeOldValue).activity-meta {{ displayDate currentData.timeOldValue 'LLL' }}
         = ' @'

client/components/activities/activities.js

@@ -1,8 +1,10 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { ReactiveVar } from 'meteor/reactive-var';
 import { Template } from 'meteor/templating';
-import DOMPurify from 'dompurify';
-import { sanitizeHTML, sanitizeText } from '/imports/lib/secureDOMPurify';
+import { Blaze } from 'meteor/blaze';
+import { HTML } from 'meteor/htmljs';
+import { titleViewerHtml } from '/client/lib/titleViewer';
+import { sanitizeHTML } from '/imports/lib/secureDOMPurify';
 import { TAPi18n } from '/imports/i18n';
 import { Utils } from '/client/lib/utils';
 import { getSidebarInstance } from '/client/features/sidebar/service';
@@ -287,16 +289,9 @@ Template.activity.helpers({
       // Only render a link for an http(s) URL; otherwise show the plain (sanitized)
       // source name with no href.
       if (source.url && /^https?:\/\//i.test(String(source.url))) {
-        return Blaze.toHTML(
-          HTML.A(
-            {
-              href: source.url,
-            },
-            sanitizeHTML(source.system),
-          ),
-        );
+        return linkedActivityValue(source.system, source.url, 'action-source');
       }
-      return sanitizeHTML(source.system);
+      return titleViewerHtml(source.system);
     }
     return null;
   },
@@ -317,16 +312,9 @@ Template.activity.helpers({
       (attachment &&
         attachment.path &&
         attachmentUrl &&
-        Blaze.toHTML(
-          HTML.A(
-            {
-              href: `${attachmentUrl}?download=true`,
-              target: '_blank',
-            },
-            sanitizeText(attachment.name),
-          ),
-        )) ||
-      sanitizeText(this.activity.attachmentName)
+        linkedActivityValue(attachment.name,
+          `${attachmentUrl}?download=true`, 'action-attachment', '_blank')) ||
+      titleViewerHtml(this.activity.attachmentName)
     );
   },
 
@@ -338,8 +326,17 @@ Template.activity.helpers({
 });
 
 Template.activity.helpers({
-  sanitize(value) {
-    return sanitizeHTML(value);
+  activityValue(value) {
+    return titleViewerHtml(value == null ? '' : String(value));
+  },
+  activityMessage(key, ...values) {
+    const setting = ReactiveCache.getCurrentSetting();
+    // Spacebars appends helper options; only rendered values belong in sprintf.
+    const lastValue = values[values.length - 1];
+    if (lastValue && typeof lastValue === 'object' && 'hash' in lastValue) values.pop();
+    return sanitizeHTML(TAPi18n.__(key, { sprintf: values }), {
+      stripLinks: !!(setting && setting.renderLinksAsPlainText),
+    });
   },
 });
 
@@ -433,36 +430,30 @@ function createCardLink(activity, card, boardTitle) {
     // Nothing named the card - an old activity from before the titles were
     // recorded, on a card this client cannot see. Say "this card" rather than
     // leaving a gap in the middle of a sentence.
-    return sanitizeHTML(TAPi18n.__('this-card'));
+    return titleViewerHtml(TAPi18n.__('this-card'));
   }
   let text = link.title;
   if (link.archived) text = `${text} [${TAPi18n.__('archived')}]`;
   if (boardTitle) text = `${boardTitle} > ` + text;
-  if (!link.url) return sanitizeHTML(text);
-  return Blaze.toHTML(
-    HTML.A(
-      {
-        href: link.url,
-        class: 'action-card',
-      },
-      sanitizeHTML(text),
-    ),
-  );
+  return linkedActivityValue(text, link.url, 'action-card');
+}
+
+// Keep rich user links separate from application navigation: nested anchors
+// cause browsers to move title fragments outside the activity link.
+function linkedActivityValue(value, url, className, target) {
+  const rendered = sanitizeHTML(titleViewerHtml(value));
+  if (!url) return rendered;
+  const content = HTML.Raw(rendered);
+  const attributes = { href: url, class: className };
+  if (target) attributes.target = target;
+  return Blaze.toHTML(/<a\b/i.test(rendered)
+    ? HTML.SPAN(content, ' ', HTML.A(attributes, '↗'))
+    : HTML.A(attributes, content));
 }
 
 function createBoardLink(board, list) {
+  if (!board) return '';
   let text = board.title;
   if (list) text += `: ${list}`;
-  return (
-    board &&
-    Blaze.toHTML(
-      HTML.A(
-        {
-          href: board.originRelativeUrl(),
-          class: 'action-board',
-        },
-        sanitizeHTML(text),
-      ),
-    )
-  );
+  return linkedActivityValue(text, board.originRelativeUrl(), 'action-board');
 }

client/components/boards/charts/boardCharts.css

@@ -2,7 +2,7 @@
    - export buttons, then a Chart.js canvas, then the full data table, reusing
    statsView.css's .stats-view/.stats-view-content shell. */
 .chart-view-content {
-  max-width: 1100px;
+  max-width: none;
 }
 
 .chart-export-buttons {

client/components/boards/groupByAssigneeView.js

@@ -1,5 +1,5 @@
 import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
-import moment from 'moment';
+import { format } from '/imports/lib/dateUtils';
 import { Template } from 'meteor/templating';
 import { Meteor } from 'meteor/meteor';
 import { Session } from 'meteor/session';
@@ -63,7 +63,7 @@ Template.groupByAssigneeView.helpers({
     return translateGroupLabel(label, key => TAPi18n.__(key));
   },
   formatDueAt(dueAt) {
-    return dueAt ? formatDateForDisplay(dueAt, true, date => moment(date).format('llll')) : '';
+    return dueAt ? formatDateForDisplay(dueAt, true, date => format(date, 'llll')) : '';
   },
   cardUrl(cardId) {
     const boardId = Session.get('currentBoard');

client/components/boards/statsView.css

@@ -9,8 +9,10 @@
 }
 
 .stats-view-content {
-  max-width: 900px;
-  margin: 0 auto;
+  width: 100%;
+  max-width: none;
+  box-sizing: border-box;
+  margin: 0;
   padding: 24px;
 }
 

client/components/cards/cardDetails.jade

@@ -1117,10 +1117,7 @@ template(name="cardDetailsActionsPopup")
                 a.js-save-card-as-template
                   i.fa.fa-clone
                   | {{_ 'save-card-as-template'}}
-              li
-                a.js-link-card-to-board
-                  i.fa.fa-link
-                  | {{_ 'linkCardToBoardPopup-title'}}
+
           unless currentUser.isWorker
             ul.pop-over-list
               li

client/components/gantt/frappeGantt.js

@@ -142,10 +142,14 @@ export function translatedViewModes(GanttLib) {
 function translateFrappeChrome(container, templateInstance) {
   const apply = () => {
     const today = container.querySelector('.today-button');
-    if (today && today.textContent === 'Today') today.textContent = TAPi18n.__('today');
+    const todayLabel = TAPi18n.__('today');
+    if (today && today.textContent === 'Today' && today.textContent !== todayLabel) {
+      today.textContent = todayLabel;
+    }
     const placeholder = container.querySelector('.viewmode-select option[disabled]');
-    if (placeholder && placeholder.textContent === 'Mode') {
-      placeholder.textContent = TAPi18n.__('gantt-view-mode');
+    const modeLabel = TAPi18n.__('gantt-view-mode');
+    if (placeholder && placeholder.textContent === 'Mode' && placeholder.textContent !== modeLabel) {
+      placeholder.textContent = modeLabel;
     }
   };
   if (!templateInstance.chromeObserver) {

client/components/main/popup.css

@@ -237,7 +237,7 @@
   /* Auto-filling columns so as many languages as possible are visible at once when
      there is browser width; collapses to a single column on narrow windows. */
   display: grid;
-  grid-template-columns: repeat(auto-fill, minmax(170px, 1fr));
+  grid-template-columns: repeat(auto-fill, minmax(min(100%, 280px), 1fr));
   align-content: start;
   column-gap: 4px;
 }
@@ -389,12 +389,11 @@
   position: fixed !important;
   bottom: 0 !important;
   top: auto !important;
-  inset-inline-start: auto !important;
-  inset-inline-end: 20px !important;
-  /* Wide enough for multiple language columns when the browser is wide, but never
-     wider than ~90% of the viewport (falls back to a single narrow column). */
-  width: min(90vw, 1100px) !important;
-  max-width: 90vw !important;
+  inset-inline-start: 0 !important;
+  inset-inline-end: 0 !important;
+  box-sizing: border-box;
+  width: 100vw !important;
+  max-width: 100vw !important;
   height: 100vh !important;
   max-height: 100vh !important;
   min-height: 300px !important;
@@ -1295,10 +1294,36 @@ body.mobile-mode .pop-over .content-wrapper {
 }
 
 .pop-over[data-popup='changeLanguagePopup'] .language-label {
-  display: inline-flex;
+  display: flex;
+  flex-direction: column;
+  gap: 0.15em;
+  min-width: 0;
+  width: 100%;
+}
+.pop-over[data-popup='changeLanguagePopup'] .language-main-line {
+  display: flex;
   align-items: baseline;
   gap: 0.25em;
 }
+.pop-over[data-popup='changeLanguagePopup'] .pop-over-list li > a {
+  display: flex;
+  align-items: flex-start;
+  white-space: normal;
+  overflow: visible;
+  text-overflow: clip;
+  height: auto;
+}
+.pop-over[data-popup='changeLanguagePopup'] .pop-over-list li,
+.pop-over[data-popup='changeLanguagePopup'] .language-name {
+  min-width: 0;
+  overflow-wrap: anywhere;
+}
+.pop-over[data-popup='changeLanguagePopup'] .language-region {
+  display: block;
+  white-space: normal;
+  overflow-wrap: anywhere;
+}
+
 .pop-over[data-popup='changeLanguagePopup'] .language-region {
   unicode-bidi: isolate;
 }

client/components/users/userHeader.jade

@@ -244,8 +244,9 @@ template(name="changeLanguagePopup")
       li(class="{{# if isCurrentLanguage}}active{{/if}}")
         a.js-set-language(href="#" dir="{{languageDirection}}" data-language="{{tag}}")
           span.language-label
-            span.emoji-icon.language-flags(dir="ltr" aria-hidden="true") {{languageFlag}}
-            bdi.language-name {{languageName}}
+            span.language-main-line
+              span.emoji-icon.language-flags(dir="ltr" aria-hidden="true") {{languageFlag}}
+              bdi.language-name {{languageName}}
             if countryFlag
               span.language-region
                 | (

client/lib/utils.js

@@ -12,6 +12,7 @@ import { computeBoardBackground } from '/models/lib/boardBackground';
 import { buildCardAttachmentMeta } from '/models/lib/attachmentMeta';
 import { resolveShowDragHandles, readDragHandlesPreference } from '/models/lib/dragHandles';
 const { memberCan } = require('/models/lib/boardRoleCapabilities');
+const { sourceRoleBlocksDelegation } = require('/models/lib/linkedWritePolicy');
 
 // One key for both pages: they draw one menu. docs/Features/Page/Left-Menu.md
 const LEFT_MENU_COLLAPSED_KEY = 'leftMenuCollapsed';
@@ -238,6 +239,11 @@ export const Utils = {
     return !!(board && memberCan(board.members, userId, capability));
   },
   canModifyCard(card = Utils.getCurrentCard()) {
+    if (card && card.type === 'cardType-linkedCard') {
+      const source = ReactiveCache.getCard(card.linkedId);
+      const sourceBoard = source && ReactiveCache.getBoard(source.boardId);
+      if (!sourceBoard || sourceRoleBlocksDelegation(Meteor.userId(), sourceBoard)) return false;
+    }
     const board = card && typeof card.board === 'function'
       ? card.board()
       : Utils.getCurrentBoard();

docs/DeveloperDocs/Build-from-source.md

@@ -236,8 +236,8 @@ Or alternatively, delete wekan repo (if you did not need any changes you made),
 The `build.sh` development bundle option announces cache removal, compilation to resolve Meteor plugin npm
 dependencies, dependency installation and compilation before each starts.
 Each stage streams its output to the terminal and the printed build log:
-`.tools/log/build-dev-bundle/YYYY-MM-DD/HH-MM-SS/dev.txt` for development bundles and
-`.tools/log/build-release-bundle/YYYY-MM-DD/HH-MM-SS/release.txt` for release bundles.
+`.tools/log/build-dev-bundle/YYYY-MM-DD_HH-MM-SS/dev.txt` for development bundles and
+`.tools/log/build-release-bundle/YYYY-MM-DD_HH-MM-SS/release.txt` for release bundles.
 Both scripts print the selected build log path again when the build finishes, including
 failed builds. Successful shell builds also append that completion message to the log.
 Each build gets its own time directory, keeping earlier runs separate. Same-second
@@ -264,7 +264,7 @@ results. Both terminal and build log receive this output. Command arguments reda
 common credential fields; the tracer does not print the process environment.
 
 All logging managed by `build.sh` and `build.bat` uses
-`.tools/log/<operation>/YYYY-MM-DD/HH-MM-SS/`. Both honor `WEKAN_LOG_ROOT`.
+`.tools/log/<operation>/YYYY-MM-DD_HH-MM-SS/`. Both honor `WEKAN_LOG_ROOT`.
 Same-second runs reserve a numeric suffix; previous run directories stay intact.
 
 | Operation | Directory type | Main log |
@@ -281,3 +281,12 @@ Same-second runs reserve a numeric suffix; previous run directories stay intact.
 commands stream through PowerShell to the selected log; command exit status is
 retained. Native Windows execution was not available for this change; directory
 reservation logic and Windows menu/logger wiring are tested locally.
+
+Log directory naming is shared by Unix and Windows builds and release tools:
+`.tools/log/<operation>/YYYY-MM-DD_HH-MM-SS/`, using local time. Same-second
+starts reserve distinct directories with `-1`, `-2`, etc. to preserve earlier
+logs. Translation upload reports use `translations-push`, mirror archive/sync
+reports use `mirror-data`, mirror launcher output uses `mirror`, database
+conformance uses `test-db-conformance`, and speed diagnostics use `debug-speed`.
+Existing log directories remain where they were written. Dates inside JSON
+records retain their data format; this naming rule applies to log directories.

docs/DeveloperDocs/Changelog-Upcoming-Template.md

@@ -31,13 +31,14 @@ pins.
 </details>
 ```
 
-**No Platform/Binary/From/Version/SHA256 table belongs here, in any shape.**
-It was tried twice - right under the summary, then moved to a `**Binaries in
-these bundles:**` label at the end - and removed both times: it made the
-entry mostly a giant table nobody read. That data lives in the **GitHub
-Release notes** instead, built fresh by `releases/provenance-table.sh` from
-`releases/record-provenance.sh`'s recordings every time a release is made -
-see CLAUDE.md's/AGENTS.md's CHANGELOG section.
+**Do not add a binaries provenance section or table to the changelog or
+release notes.** Release notes list only updated languages for each Translations group.
+Add `**Languages updated:** Esperanto, Galician` below that group label
+with the actual affected full language names. Detailed entries stay here;
+release notes include only In short, Security, translation languages,
+the standard thanks line and a More details at ChangeLog release anchor link.
+Keep checksum verification and `provenance.tsv` build artifacts separately;
+never append `releases/provenance-table.sh` output to release notes.
 
 ## Why this exists instead of an auto-created empty section
 
@@ -62,3 +63,12 @@ Upcoming section existed to catch the entry first. That test is the real guard
 and needed no empty placeholder to work. So: write the section yourself when
 there is something to put in it, using the skeleton above, and let the test
 catch the mistake if an entry still ends up in the wrong place.
+
+## Read-only release preflight
+
+Run `bash releases/check-upcoming-release.sh` to check release notes without
+changing files or contacting a forge. Exactly one Upcoming section containing
+a linked release entry is required. Missing, empty or duplicate sections fail
+with an error. `release-all.sh` performs this check before installing tools or
+changing files; explicit version arguments also require Upcoming notes. An
+existing released heading is no longer reused when Upcoming notes are absent.

docs/DeveloperDocs/LDAP-6692.md

@@ -0,0 +1,29 @@
+# LDAP bind investigation — issue 6692
+
+Reviewed 2026-09-14. The complete issue and all three current comments were read.
+Snap 11.76 on Ubuntu reports a service-account LDAPS bind failure;
+ldapsearch succeeds and reverting to 11.72 did not help.
+
+Local commit `5f5822f7d` fixes the confirmed empty diagnostic: Error name
+and message were lost by Object.keys-based sanitization. Diagnostics now
+retain name, message, code and reason through existing secret redaction.
+Certificate and invalid-credential tests pass; encryption, connection-release
+and REST login suites also pass. TLS verification remains enabled.
+
+The reporter's new 11.77 diagnostic identifies a TypeError reading index 0.
+Local commit `2c5cdd78a` fixes the matching post-bind failure: an unset
+optional LDAP_USER_SEARCH_FILTER was indexed in getUserFilter before the
+user search. Undefined/null/empty now omit only the optional filter;
+configured restrictions remain active and invalid types fail explicitly.
+The reproduction and encryption, connection-release and error-logging suites
+pass. No live external directory or browser login was available; deployment
+confirmation remains necessary. TLS verification remains unchanged.
+
+Latest comment still uses 11.77, before the local post-bind fix. Regression
+commit `dad65fb6c` exercises actual bindIfNecessary/searchUsers methods,
+verifying successful UPN service binding reaches the correct user query,
+configured filters remain active, and invalid credentials stop before search.
+A separate oplog observer duplicate-insert error is reported one second later;
+its connection to login is unproven and no database repair was guessed.
+Deploy a release containing `2c5cdd78a` and confirm the LDAP login separately
+from that observer error. No live directory or browser login was run.

docs/Features/BoardViews/Activity-Rendering.md

@@ -0,0 +1,20 @@
+# Activity rendering
+
+Opened-card activities and the right sidebar share the same activity template.
+Activity titles, checklist text, labels, custom-field values, comment excerpts,
+source names and attachment names use the existing Markdown/emoji viewer.
+HTML allowed by the existing sanitizer is rendered with the same restrictions
+as other viewer fields. No new HTML tags or URL schemes are permitted.
+
+Admin Panel → Problems → Security controls apply:
+
+- Plain-source mode displays literal source, including Markdown and HTML.
+- Render links as plain text removes clickable links from activity sentences.
+- Normal mode renders Markdown, emoji and permitted HTML after sanitization.
+
+Imported source URLs retain their HTTP/HTTPS check. When a rich title contains
+its own link, activity navigation is shown beside it to avoid nested anchors.
+
+Focused activity-link, viewer, source-URL and Jade compilation checks pass.
+Browser regressions cover both feeds, permitted HTML, unsafe event attributes
+and all three display modes. They are syntax-checked; live execution is pending.

docs/Features/Translations/Audit.md

@@ -4,64 +4,83 @@ Audit date: **2026-09-12**. Last updated: **2026-09-14**.
 
 | Status | Flagged keys |
 | --- | ---: |
-| Corrected | 15,149 |
-| Restored pre-pull; awaiting validation | 4,058 |
-| Reviewed; retained unchanged | 179 |
-| Pending review or repair | 695 |
+| Corrected | 15,571 |
+| Restored pre-pull; awaiting validation | 466 |
+| Reviewed; retained unchanged | 3,736 |
+| Pending review or repair | 308 |
 | Total tracked | 20,081 |
 
-**Resumed at the maintainer’s request on 2026-09-13.** Reviewing and repairing the remaining local findings, beginning with Klingon. All **361** originally flagged Klingon findings are repaired. The broader check of **829** German-identical values is reviewed: **829** repaired, including the mistaken German `cron` retention corrected to the actual tool name **Cron**. Restored and unflagged translations still need validation.
+Review is ongoing. The [correction ledger](../../../releases/translations/audited-corrections.json)
+contain **18,173** exact before/after values, including unflagged repairs.
+[Detailed evidence](Audit-Evidence.md) retains categorized findings,
+source references, confidence limits and archived progress notes.
 
-Fixed: wrong-language text, terminology, warnings, placeholders and JSON/calendar/search formatting. [Correction records](../../../releases/translations/audited-corrections.json) contain **17,356** exact before/after values, including unflagged repairs.
+Latest translation fix: **2026-09-14**, local commit `2a22a42a9` —
+corrected Basque rule archive/restore terminology, preserving direction.
+All **18,173** correction and **3,736** review records pass.
+Shared Spanish `r-is` and composed trigger grammar remain unresolved.
+Attachment/member rule participles still need context-specific agreement.
+Three Esperanto restored findings remain: lime color and two Complete labels.
+Broader language and browser verification remain open; nothing pushed.
+Latest unchanged review: **2026-09-14**, commit `ffde8e84e` — retained
+17 Basque rule action and date-field labels. Shared `r-is` still contains
+Spanish `es`; repair requires coordinated Basque trigger phrase composition.
+Compound trigger phrases and relational top/bottom wording remain open.
+Basque free wording and nine Galician restored findings remain context-dependent.
+Galician export free wording remains open pending context.
+Galician Complete and migration-complete wording remain open pending context.
+Card-show-lists context is verified against its settings row and toggle.
 
-Latest translation fix: **2026-09-14**, local commit `47796391a` — replaced three French Tamazight due-date labels, preserving due-date versus completion and today versus tomorrow distinctions. CLDR attests the relative-day names; native date/last components support the existing final-date adaptation. Full deadline terminology and relative-filter usage remain **low confidence** pending fluent review. All **17,353** correction/rendering checks pass. One originally flagged and two unflagged values are repaired: **696** originals remain pending, including **553** Tamazight. Earlier composed wording and restored/unflagged values still need validation. Live browser verification was not run; no translations were pushed.
 
-**Language validation (2026-09-14), local commit `e4e3aa590`:** Wiktionary’s Veps transitive inflection tables confirm `surenda` (make larger) and `penenda` (make smaller) as second-person singular commands. Their imperative morphology is now reference-supported; screen-zoom usage remains open. The original keyboard findings remain unresolved: searches and the cached dictionary did not establish reliable keyboard-shortcut terminology. Counts are unchanged. References and the remaining scope are recorded per key in the correction ledger.
 
-**Kashmiri reference review (2026-09-14), local commit `0db69cf6c`:** CLDR marks Islamic/civil names provisional and has no Saudi-sighting or astronomical-tabular names. Existing civil wording also lacks explicit tabular/civil-epoch qualifiers. Keep these technical terms pending further research; no values changed and counts are unchanged. All 17,236 correction checks pass.
+Fixed categories include wrong-language prose, terminology, warnings,
+placeholders and JSON/calendar/search formatting. All 361 originally flagged
+Klingon findings and the broader 829 German-identical values were repaired;
+the cron label retains the actual tool name Cron. Danish restored review
+validated 611 values: 606 retained unchanged and five meanings repaired.
+Four Danish context-dependent labels remain: free, Complete, Schedule and Days Old.
+Esperanto lime-color wording
+remains open.
+Reviewed subtask actions/settings retain correct subordinate-task compounds.
 
-**Tamazight calendar reference review (2026-09-14), local commit `dd2aaa19a`:** Current CLDR marks the Islamic name provisional and supplies no Buddhist or Hijri variant display names. Calendar terms and full variant qualifiers require additional research. No values changed; counts remain unchanged and all 17,273 correction checks pass.
+| Pending locale | Findings |
+| --- | ---: |
+| zgh — Standard Moroccan Tamazight | 173 |
+| iu — Inuktitut | 50 |
+| nah — Nahuatl | 17 |
+| tig — Tigre | 17 |
+| wal — Wolaytta | 17 |
+| ve-PP — Veps | 10 |
+| kl — Greenlandic | 7 |
+| dz — Dzongkha | 3 |
+| gv — Manx | 3 |
+| bm — Bambara | 2 |
+| ff — Fulah | 2 |
+| ks — Kashmiri | 2 |
+| ee — Ewe | 1 |
+| qu — Quechua | 1 |
+| rup — Aromanian | 1 |
+| sc — Sardinian | 1 |
+| szl — Silesian | 1 |
 
-**Manx calendar reference review (2026-09-14), local commit `669be8895`:** Current CLDR supplies no calendar display names. Coptic terminology was not established by dictionary searches; full tabular/civil/astronomical-epoch qualifiers and the composed sighting phrase remain open. No values changed; three Manx originals remain pending. All 17,276 correction checks pass.
+Completion also requires reviewing all restored and unflagged values and
+previous low-confidence repairs. In particular, 98 Tamazight correction
+records have invalidated Moroccan provenance: CNAM MCΓ denotes Tuareg,
+not Moroccan. Corrected source notes are not full dialect/grammar validation.
+Calendar civil/astronomical epochs and moon-sighting distinctions, memory
+and authentication diagnostics, migration labels, archive/logo terminology,
+search-case instructions and full command grammar retain the evidence's
+recorded limits. Obsolete migration strings remain in translation scope.
+Veps filter syntax repairs preserve literal examples; Finnish prose still
+needs full Veps translation. [Veps review](Veps-Review.md) records limits.
 
-**Silesian reference review (2026-09-14):** [Native MediaWiki messages](https://raw.githubusercontent.com/wikimedia/mediawiki/master/languages/i18n/szl.json) use `bazy danych` in database errors and locking instructions, and both `pliki` and `zbiory` for files. These shared technical terms alone do not establish wrong-language text. No reference for the full raw-database-file label was established; `sandstorm-raw-mongodb` remains pending, with no value or count changes. Further review should focus on the raw-file qualifier and the complete phrase, preserving accepted terminology.
+Placeholder, JSON and key-order checks verify structure, not fluency.
+Preserve every English interpolation/format token exactly and retain correct
+translations unchanged. No external translation service is used.
 
-**Language popup follow-up, 2026-09-14:** local commit `c8d17877e` places
-language flags beside language names and country flags inside regional
-parentheses, reversing visual placement for RTL. All 245 registry/helper
-checks and Jade compilation pass; LTR/RTL browser regressions are added and
-syntax-checked but not run live. Translation repair counts are unchanged.
-
-**Board View Settings follow-up, 2026-09-14:** local commit `3b74d2c3c`
-keeps the wide popup visible and enables title dragging and bottom-right
-resizing. Geometry, pointer and Jade checks pass; browser coverage is added
-and syntax-checked, with live execution pending. Translation counts are
-unchanged; the translation audit remains active.
-
-**Remaining validation:** all restored/unflagged values and low-confidence replacements remain open. Detailed per-key caveats are retained in the correction ledger and source commits. These include Veps composed UI, card, notification, calendar, timing, file/archive, metric and legal terminology/inflection; Neapolitan technical checklist usage; Fulah/Bambara calendar composition; and CLDR-provisional Ewe civil-calendar and Tongan tabular-calendar/astronomical-epoch phrase composition, and Sakha civil/astronomical-calendar/era-to-epoch and sighting-phrase composition. Field sums, parent-card terminology, keyboard shortcuts, remaining migration/search messages and other calendar variants need further language research. Wrong-language/script and fluent-speaker checks remain unfinished.
-
-**Security interruption (2026-09-14):** `c1246d720` reviews both saved `.tools/wekansec20` alerts and hardens exact archive-host checks and shell-free mirror dispatch, including direct Windows Node execution. All 25 focused mirror test entries pass; native Windows and remote CodeQL rescanning remain unverified. Translation counts and remaining validation are unchanged.
-
-**Time view interruption (2026-09-14):** local commit `dc0855711` renders card titles through the shared Markdown/emoji viewer, respecting Admin Panel plain-text security mode. The report regression passes; both browser modes are added and syntax-checked, not run live. The shared viewer also obeys Admin Panel plain-link mode; `a7b333dad` adds both clickable/non-clickable browser regressions, syntax-checked but not run live. Timeline, DHTMLX Gantt and shared report viewers are also repaired (`457614a2a`, `5ca16f32e`); Control chart coverage is explicit (`ca8d59978`). Combined focused verification passes 33 Node entries; browser tests remain syntax-checked only. Authenticated legacy avatar prefix fallback is repaired (`c2a390928`); the production attachment 404 remains undiagnosed. Translation counts remain unchanged.
-
-**Calendar interruption (2026-09-14):** local commit `ef12548a9` replaces the rejected FullCalendar 5 `isRTL` option with `direction` in both board calendars. Four focused calendar test entries pass, including RTL/LTR and negative legacy-option checks. Browser regressions are added and syntax-checked, not run live. Translation counts and remaining language validation are unchanged.
-
-**Build logging update (2026-09-14):** `5f8f22f8c` unifies build.sh/build.bat logger directories; `3fedee2b9` prints completion log paths and fixes read-only server manifests in local release preparation. Linux arm64 development and release builds and release startup smoke check pass; 13 targeted test entries pass. Native Windows execution was unavailable. Translation counts and remaining review work are unchanged; translation repairs remain unfinished.
-
-**Build interruption (2026-09-13):** local commit `6cd193879` repairs the Meteor 3.6/Rspack 2 build's undeclared body-parser import using Meteor's existing Express parsers. Seven HTTP/build regressions pass. Meteor 3.6-beta.0/Rspack 2.2 and matching Docker metadata are committed locally (`35082f7d7`), and both previously failing version checks pass. All **1,015** Node suites pass. The actual Meteor bundle build remains under verification: the local beta tool is still starting before compilation. Translation counts and the latest translation commit remain unchanged.
-
-**Mirror interruption completed (2026-09-13):** local commit `02383540a` adds organization management, destination namespaces, host/organization/repository archives, linked comment attachments/webpage HTML, static HTML/CSV indexes and rate limits for all forges with tokenless public GitHub reads. Full Node verification: **1,014 suites, zero failures**; final targeted checks and Chromium/Firefox static checks pass. WebKit is unavailable locally (ICU 74/Docker). Translation repairs subsequently resumed; current counts and latest fix are above.
-
-**Language workflow (2026-09-13):** all 245 popup locales are wired and country-then-language flags are checked (`8549b6c4c`). Browser preference ordering, legacy/script aliases, delayed saved profiles and no automatic profile writes pass runtime checks (`1666a2012`, `37ae64fa8`); actual browser execution remains pending. Uzbek Arabic (`uz-AR`) still contains Latin core labels and needs repair.
-
-**Upload workflow (2026-09-13):** Colombian/French/Khmer/Guarani/Portuguese/Russian mappings are repaired, with 241 distinct targets and reported local aliases. All nine Colombian differences were reviewed (`6db460891`), retaining seven valid alternatives. Timestamped terminal/error logs and failure exit codes pass offline checks (`196c0addc`). Chinese script mapping now uses supported `zh-Hans` (`c2a9168c4`). Manx, Ladin, Aromanian, Tigre and Wolaytta remain unsupported catalogue failures; no substitution by different languages or remote uploads was performed.
-
-**Maintainer-run upload (2026-09-13):** inspected local report `translations-push-2026-09-13T19-02-29-845Z/report.json`: **237 successful uploads**, including English source, and **five failures** (`gv`, `lld`, `rup`, `tig`, `wal`). All eight formerly failing mappings succeeded; the latest saved run confirms the same outcome. The trailing catalogue list, including `wuu-Hant`, `xcl`, `yue`, `zh_MO`, `zh_TW.Big5` and `zza`, lists supported codes without local upload targets, not failed uploads. Catalogue discovery completed: zero supported-but-failed targets, five unsupported local codes and 500 supported catalogue codes without local upload targets. Those 500 codes need suitable local translations/mappings before upload. This verifies the saved report, not current remote contents; no uploads were run here. The outcome/support summary (`637dbebd6`) passes offline regressions. Retry regression (`ad294f707`) verifies all five missing codes are added and fully uploaded on a later run once supported; prior reports never suppress retries.
-
-**Verification (2026-09-13):** **1,014 Node suites, zero failures** after the latest Veps list/storage and mirror changes; final targeted mirror regressions pass; the final mirror retry adjustment also passes its targeted regression. Correction and audit-progress regressions pass. The original 19 failures are resolved. The first complete EVERYTHING run passes all four stages: Meteor (**527**), import (**10**), Node E2E (**10**), three browsers, **103** conformance cases on each of SQLite/PostgreSQL/MySQL/MariaDB and FerretDB unit/vet/integration. Separate URL-prefix preference/logout/invalid-cookie checks pass in all browsers. Two WebKit retries exposed refresh readiness and competing template autofocus; both are repaired, and the refresh check passes ten repetitions without retries. #6691 partial-profile/impersonation regression passes in all three browsers without retries. The second EVERYTHING run finished with failures in the now-fixed Fossil menu registration check and Chromium board-export popup readiness; database conformance, FerretDB and the other two browsers passed. Board-export verification remains outstanding. Static mirror browser checks pass in Chromium and Firefox; WebKit cannot launch locally because ICU 74 is missing and Docker is unavailable. Fluent-speaker checks remain outstanding; translation repairs resume next.
-
-**Unresolved reviews:** Member popup click handlers in sidebarFilters.js appear to invoke opposite assignment operations; this requires separate runtime review. Apostrophe support for Klingon search operators is implemented in local commit `0026390bb`; actual Query runtime and card-number regressions pass. All 37 remaining search keywords are replaced and actual-locale parser regressions pass; localized browser verification remains pending. Silesian database terminology and 17 Tigre calendar findings need language-specific validation.
-
-**Origin:** not all errors came from Transifex. The audit covers 4,061 pulled changes and 16,020 additional local findings; Bosnian errors predate the pull (`bdb3b15886a749b725b5290ba0109fcba955f983`). Other origins remain unverified.
-
-[Detailed evidence](Audit-Evidence.md) retains categorized tables. Refresh counts after each repair batch with `node releases/translations/audit-progress.mjs --update-summary`, then record the fix commit and verification. No remote uploads performed.
+Not all wrong values came from Transifex: the audit tracks 4,061 pulled
+changes and 16,020 additional local findings; some Bosnian errors predate
+the pull. Correct-language human translations remain preferred. Keep the
+full review scope open until language and browser validation is supported
+by evidence. Issue #6692 post-bind optional-filter TypeError is repaired in local commit
+`2c5cdd78a`; live LDAP login remains unverified. Translation work continues.

docs/Features/Translations/Push-All.md

@@ -31,8 +31,22 @@ registration or upload does not stop later languages. It polls each asynchronous
 upload until Transifex reports success or failure; acceptance of the job alone is
 not counted as success. Source upload failure reports all targets as unpushed.
 
+Transient GET failures (HTTP 408/500/502/503/504, network failures and
+timeouts) retry the same read up to six attempts. This includes upload-job
+status reads: a temporary 502 does not immediately abandon an accepted source
+upload and prevent every target from uploading. HTTP 429 responses retry after
+at least one minute, respecting a longer `Retry-After` value in seconds or as an
+HTTP date. Other failed writes are not automatically resubmitted, because a
+failed response can leave an already-created upload job. Permanent errors and
+exhausted retries remain explicit failures.
+
+Output announces each upload, job acceptance and periodic pending status, and
+reports each retry with its delay. Long retry waits print progress at intervals
+of at most 30 seconds. This output goes to the existing terminal/status log.
+Transifex documents throttling as [HTTP 429](https://developers.transifex.com/reference/rate-limit).
+
 At the end it lists each failed language with its local file and reason, saves a
-JSON report under `.tools/log/translations-push-<timestamp>/report.json`, and
+JSON report under `.tools/log/translations-push/YYYY-MM-DD_HH-MM-SS/report.json`, and
 returns a nonzero exit status when any language failed. An entirely successful
 run prints `None` in the failure list. Invalid JSON, missing keys, empty values
 where the source is nonempty, and altered placeholders are reported as failures.

docs/Features/Translations/Veps-Review.md

@@ -0,0 +1,110 @@
+# Veps translation review
+
+Reviewed: **2026-09-14**. Review is incomplete; this document does not
+claim that the remaining Finnish-seeded strings are valid Veps.
+
+The registry names `ve-PP` **Vepsän kelʹ**. Its legacy `ve` identifier must
+not be interpreted as Venda when choosing terminology sources.
+
+Directly inspected [native MediaWiki Veps strings](https://raw.githubusercontent.com/wikimedia/mediawiki/master/languages/i18n/vep.json):
+
+| Meaning | Source key | Native value | Limit |
+| --- | --- | --- | --- |
+| Show | show | Ozuta | Direct imperative; full WeKan sentence still needs grammar review. |
+| Activate | tags-activate | pane radho | Software tag action; adaptation to another control needs review. |
+| Deactivate | tags-deactivate | kel'dä | Software tag action; distinguish disabling from deleting. |
+| Enabled | default-skin-not-found-row-enabled | om lasktud | Direct state wording inside a skin report. |
+| Disabled | default-skin-not-found-row-disabled | om kel'tüd | Direct state wording inside a skin report. |
+
+The inspected source has no keyboard/shortcut keys. Do not substitute
+its abbreviation term for Keyboard Shortcuts without evidence. Existing
+`keyboard-shortcuts` is Finnish **Pikanäppäimet** and needs broader review,
+even though it is outside the ten remaining original findings.
+
+The enabled/disabled shortcut tooltips each contain both the current state
+and an action that reverses it. Preserve both. The shortcut-list instruction
+must open the list, not merely describe a shortcut.
+
+Other original findings require complete native phrases: accessibility
+information not added **yet**, accessibility page **enabled**, custom URL
+schemes automatically clickable with **one per line**, **vertical**
+scrollbars enabled, parent displayed **in the minicard**, and the sum of
+fields displayed **at the top of the list**. Related Finnish vocabulary
+or shared loanwords alone do not validate full Finnish-seeded values.
+
+The advanced-filter description requires a separate full review. Preserve
+all comparisons and Boolean operators, single-quote rules and escape
+characters, left-to-right evaluation with parenthesized precedence, and
+the exact regular-expression example. Lexical repairs cannot silently
+simplify or omit these rules. Verify examples against English and the
+actual filter parser, then run placeholder/example regression checks;
+those checks do not establish fluency.
+
+No locale values were changed by this review. Native terminology for the
+full remaining labels, inflection and UI phrasing still need verification.
+
+Follow-up review: **2026-09-14**. Direct JSON inspection confirms the
+local advanced-filter example contains `Field1 = I\\'m`, while English
+contains `Field1 == I\'m`. The locale has a single equality sign and two
+literal backslashes rather than the source's comparison operator and single
+escape. The first review description incorrectly called this an absent
+escape; the exact decoded JSON establishes malformed operator/escaping.
+Repairing only the example would not resolve the wrong-language sentence;
+keep its language review open rather than count a syntax-only repair as a
+completed translation. Literal apostrophe/backslash rules must remain
+visible in the final native help.
+
+Additional directly inspected native MediaWiki evidence: `apisandbox-alert-field`
+uses `pöudon` for a field's value/size, `apisandbox-alert-page` uses plural
+`Pöudod`, and `authmanager-create-from-login` asks to fill `nene pöudod`.
+These provide native field terminology and inflected forms; they do not
+prove a complete Sum Of Fields At Top Of List translation. Mathematical
+Sum and the top-of-list position still need separate evidence and grammar
+review. Preserve all three concepts when repairing that label.
+
+Syntax repair applied **2026-09-14**: restored the comparison operator,
+source escape example, control-character group, quoted field/value example
+and parenthesized Boolean example. Regression coverage checks every canonical
+English executable example and explicitly asserts the Veps language queue
+remains open. Finnish prose is still awaiting full translation; this repair
+is not entered as a completed wrong-language correction.
+
+Further syntax repair **2026-09-14**: the standalone escape instruction
+still had two literal backslashes despite the repaired examples. Reduced it
+to the English single-backslash marker and extended regression coverage to
+compare the complete backslash-run inventory, not just selected examples.
+Full Finnish-prose translation remains pending.
+
+Additional dictionary access review **2026-09-14**: the Language Bank of
+Finland identifies the digitized Kettunen Veps lexicon, but its linked Kotus
+endpoint returned HTTP 403 in this review; VepKar returned 502. Those results
+do not validate or invalidate terminology. The metadata page describes
+historical field notes, not modern computer vocabulary. Further sources
+remain available for review; this is not a language-repair completion claim.
+Source: https://www.kielipankki.fi/lexical-conceptual-resources/vepsa/
+
+Expanded local-value review **2026-09-14** found additional unflagged
+wrong-language values. These remain repair work; they must not be hidden
+by the ten-row original-finding count.
+
+| Key | Current local value | Problem |
+| --- | --- | --- |
+| subtask-inherit-parent-labels | Ḓadzhela zwiredzo zwa khadi ya mubebi | Venda wording in the Veps locale; requires the complete label-inheritance instruction. |
+| accessibility | Saavutettavuus | Finnish, not Veps. |
+| accessibility-title | Saavutettavuus otsikko | Finnish, not Veps. |
+| accessibility-content | Saavutettavuus sisältö | Finnish, not Veps. |
+| parent-card | Ylätehtäväkortti | Finnish, not Veps. |
+| change-card-parent | Muuta kortin ylätehtävää | Finnish, not Veps. |
+| prefix-with-parent | Etuliite ylätehtävällä | Finnish, not Veps. |
+| subtext-with-parent | Aliteksti ylätehtävällä | Finnish, not Veps. |
+| no-parent | Älä näytä ylätehtävää | Finnish, not Veps; preserve display-only meaning. |
+| trello-parent-workspace-top | Ylä taso | Finnish, not Veps. |
+
+The source-language key `subtask-inherit-parent-labels` is
+“Inherit parent's labels”; local `labels` is `Znamad` and `card` is `Kart`.
+Those two nouns do not establish a native inheritance verb or the complete
+parent-card relationship phrase. No replacement is claimed by this review.
+Direct MediaWiki inspection also confirms `pageinfo-title` uses `Tedod`
+for information and `pageinfo-robot-index` / `pageinfo-robot-noindex` use
+`Lasktud` / `Kel'tüd` for enabled and disabled indexing. These support
+terminology, but do not validate the Finnish accessibility noun.

docs/Platforms/Propietary/OS/Windows/Offline.md

@@ -10,7 +10,7 @@ This is without container (without Docker or Snap).
 
 Right click and download files 1-4:
 
-1. [wekan-11.74-win64.zip](https://github.com/wekan/wekan/releases/download/v11.74/wekan-11.74-win64.zip) or newest available at https://github.com/wekan/wekan/releases/
+1. [wekan-11.78-win64.zip](https://github.com/wekan/wekan/releases/download/v11.78/wekan-11.78-win64.zip) or newest available at https://github.com/wekan/wekan/releases/
 
 2. [node.exe](https://nodejs.org/dist/latest-v24.x/win-x64/node.exe)
 
@@ -22,7 +22,7 @@ Right click and download files 1-4:
 
 6. Double click `mongodb-windows-x86_64-7.0.34-signed.msi` . In installer, uncheck downloading MongoDB compass.
 
-7. Unzip `wekan-11.74-win64.zip` , inside it is directory `bundle`, to it copy other files:
+7. Unzip `wekan-11.78-win64.zip` , inside it is directory `bundle`, to it copy other files:
 
 ```
 bundle (directory)

docs/Security/Remediation/WeKansec21.md

@@ -0,0 +1,36 @@
+# WeKansec21 remediation progress
+
+Reviewed: 2026-09-14. All ten inputs have source repairs or a test-only
+resolution recorded below. Broader build and live security validation remain
+incomplete; no security release is claimed.
+
+The ten saved reports in `.tools/wekansec21` are the review inputs.
+Reporter credit in the advisories: Wenhao Wu, Southeast University.
+
+| Report | Current progress |
+| --- | --- |
+| Private-only board creation bypass | Confirmed in current method and sibling card-to-board conversion. Both now force private visibility under the setting. Catalog key `authz.board-visibility` records blocked overrides. Two targeted suites and Hall of Fame catalog coverage pass, including logging-failure conversion and existing server board-insert inventory coverage. Local source commit `962debc12`; browser test added and syntax-checked, live execution pending. Hall of Fame pages and critical upcoming changelog added. |
+| Arbitrary private boards in sendInvitation | Confirmed configuration-gated grant bypass; repaired in `af9362126`. Every requested board must exist and grant the configured inviter role, or caller must be site admin. All grants validated before code mutation or mail. Role/grant inventory and email suites pass; browser syntax-check passes, live mail/redemption not executed. Problems key `authz.invitation-boards`, critical changelog and Hall of Fame added. |
+| Linked-card source writes by comment-only members | Confirmed and repaired in `26e9e7030`: method and DDP link creation/pointer changes require source write access. Explicit non-writing source roles block delegated writes even through legacy links. UI follows the ceiling and no longer offers linking to non-writers. Actual permission/role decisions and link inventories pass; browser syntax-check passes, live execution pending. Problems key `authz.linked-write`, critical changelog and Hall of Fame added. |
+| Removed-member acceptInvite reentry | Confirmed and repaired in `055cf42d4`: client updates cannot plant invitedBoards through operators, parent replacement or rename destinations. Actual modifier paths preserve ordinary preferences despite top-level field reporting. Profile guard and existing invitation suites pass; browser syntax-check passes, live execution pending. Problems key `authz.invitation-profile`, critical changelog and Hall of Fame added. |
+| REST board title writes by normal members | Confirmed and repaired in `c33e9c3bf`: board title, card settings and three rule mutation endpoints now use the board-admin guard, retaining site-admin access. Actual guard and endpoint inventory tests, card-settings and rule suites pass. Problems key `authz.manage-board`; browser regression syntax-checked, live execution pending. Critical changelog and Hall of Fame added. |
+| moveList clone/archive by comment-only members | Confirmed and repaired in `9b1fb5214`, including moveSwimlane, moveChecklist, importScoped, renameAttachment and changeHistory write siblings. Canonical role decisions, reported method attack and sibling guard inventory pass; browser regression syntax-check passes, live execution pending. Bounded Problems key `authz.mutation`; Hall of Fame and critical changelog updated. |
+| Button-rule cross-board writes | Confirmed and repaired in `64123a603`: manual method and shared action dispatcher both enforce write capability and card-to-rule board binding. Board buttons without cards remain supported. Role/boundary decisions, dispatcher inventory and existing rule suites pass; browser syntax-check passes, live execution pending. Problems key `authz.rule-button`, critical changelog and Hall of Fame added. |
+| Cross-board comment creation | Confirmed REST and DDP insert boundary bypass; repaired in `d7ac619d6`, including DDP identity rebinding. Actual REST-prefix and DDP-deny decisions, foreign-card tests and server insert inventory pass; live browser execution pending. Problems key `authz.comment-card`, Hall of Fame and critical changelog added. |
+| Unvalidated subtask deposit-board disclosure | Confirmed and repaired in `c50d7b4ea`: source scope excludes unvalidated deposits and null IDs. Deposit content sits below its reactive visible-board cursor, with destination assignment policy and reactive per-card children for assigned-only roles. Status counts filter visible assigned scopes. Destination writes checked before landing structures; pointer insert/update/rename gates added. Targeted and existing subtask/status suites pass; browser syntax-check passes, live revocation/DDP pending. Problems key `authz.subtask-deposit`, critical changelog and Hall of Fame added. |
+| Code scanning alert 540, HTML-filter regexp | Exact location is `tests/activityViewer.test.cjs:26`, a test-only regex substitute. Replaced with the existing sanitize-html parser in `11d2fe037`; malformed closing-tag cases and negative stub-shape check pass. No application exploit is claimed; no runtime attempt exists to log or new vulnerability Hall of Fame row to publish. |
+
+Targeted test log: `.tools/tmp/sec21-private-only-tests.log`.
+No live browser/server security reproduction has been run yet.
+Translation review remains open at `docs/Features/Translations/Audit.md`.
+No remote writes or publishing were performed.
+
+Broader guard-inventory review continues, including trusted board-copy/helper
+inserts and compatibility of the new reactive deposit publication.
+
+
+Private-only insertion follow-up — 2026-09-14: local commit `749467c80`
+enforces the policy in Boards.before.insert for trusted copies, imports and
+lazy helpers. Hook regression covers enabled/disabled policy and failing
+security logging. The policy and visibility-settings suites pass. Live
+browser/server validation remains pending.

docs/Security/Skills/Audit.md

@@ -65,3 +65,14 @@ No application code or dependencies changed in this report-only pass.
 Next: repair confirmed findings with positive/negative/UI coverage, review
 publication audiences, then expand endpoint and async-call-site coverage.
 All proposed runtime changes must retain offline on-premise operation.
+
+## Build follow-up — 2026-09-14
+
+Meteor debugging and Rspack migration guidance identified an undeclared
+Moment import in the assignee client graph. Commit `43adfe1a7` uses the
+existing native date formatter, retaining selected-calendar rendering.
+The Meteor bundle build passed on Linux arm64; focused date/view and
+release-preflight regressions passed. Build log:
+`.tools/log/build-dev-bundle/2026-09-14/03-54-13/dev.txt`.
+Live browser tests and builds on other operating systems were not run.
+The security findings above remain open.

imports/i18n/data/bm.i18n.json

@@ -299,9 +299,9 @@
   "calendar-system": "Kalandiriye fɛɛrɛ (don jira)",
   "calendar-system-gregorian": "Gregoriana",
   "calendar-system-jalali": "Jalali kalandiriye (perisanikan)",
-  "calendar-system-buddhist": "Buddhist",
+  "calendar-system-buddhist": "Buddha ka kalandiriye",
   "calendar-system-chinese": "Siniwajamana ka kalandiriye",
-  "calendar-system-coptic": "Coptic",
+  "calendar-system-coptic": "Kɔpti kalandiriye",
   "calendar-system-dangi": "Dangi kalandiriye",
   "calendar-system-ethioaa": "Etiopi ka Amete Alem kalandiriye",
   "calendar-system-ethiopic": "Etiopi ka kalandiriye",

imports/i18n/data/da.i18n.json

@@ -1921,7 +1921,7 @@
   "Dot": "Prik-ventespinner",
   "Double-Bounce": "Dobbelt hoppende ventespinner",
   "Rotateplane": "Roterende plan-ventespinner",
-  "Scaleout": "Skalerende ventespinner",
+  "Scaleout": "Ventespinner, der skalerer udad",
   "Wave": "Bølge-ventespinner",
   "maximize-card": "Maksimér kort",
   "minimize-card": "Minimér kort",
@@ -1964,9 +1964,9 @@
   "Node_heap_total_available_size": "Node heap: samlet tilgængelig størrelse",
   "Node_heap_used_heap_size": "Node heap: brugt heap-størrelse",
   "Node_heap_heap_size_limit": "Node heap: grænse for heap-størrelse",
-  "Node_heap_malloced_memory": "Node heap: allokeret hukommelse",
-  "Node_heap_peak_malloced_memory": "Node heap: højeste allokerede hukommelse",
-  "Node_heap_does_zap_garbage": "Node heap: rydder ubrugte objekter",
+  "Node_heap_malloced_memory": "Node heap: hukommelse allokeret med malloc",
+  "Node_heap_peak_malloced_memory": "Node heap: højeste hukommelsesforbrug allokeret med malloc",
+  "Node_heap_does_zap_garbage": "Node heap: overskriver ubrugte heap-data med et bitmønster",
   "Node_heap_number_of_native_contexts": "Node heap: antal native kontekster",
   "Node_heap_number_of_detached_contexts": "Node heap: antal frakoblede kontekster",
   "Node_memory_usage_rss": "Node hukommelsesforbrug: resident set size",
@@ -1979,7 +1979,7 @@
   "to-create-organizations-contact-admin": "Kontakt administratoren for at oprette organisationer.",
   "custom-legal-notice-link-url": "Brugerdefineret URL til side med juridisk meddelelse",
   "acceptance_of_our_legalNotice": "Ved at fortsætte accepterer du vores",
-  "legalNotice": "juridiske meddelelse",
+  "legalNotice": "juridisk meddelelse",
   "copied": "Kopieret!",
   "checklistActionsPopup-title": "Tjeklistehandlinger",
   "moveChecklist": "Flyt tjekliste",

imports/i18n/data/dz.i18n.json

@@ -301,7 +301,7 @@
   "calendar-system-jalali": "Jalali ཟླ་ཐོ (པར་ཤི་ཡཱན)",
   "calendar-system-buddhist": "ནང་པའི་ཟླ་ཐོ",
   "calendar-system-chinese": "རྒྱ་ནག་གི་ཟླ་ཐོ",
-  "calendar-system-coptic": "Coptic",
+  "calendar-system-coptic": "ཀོཔ་ཊིཀ་ཟླ་ཐོ",
   "calendar-system-dangi": "Dangi ཟླ་ཐོ",
   "calendar-system-ethioaa": "ཨི་ཐི་ཡོ་པི་ཡ་གི་ཟླ་ཐོ (Amete Alem)",
   "calendar-system-ethiopic": "ཨི་ཐི་ཡོ་པི་ཡ་གི་ཟླ་ཐོ",

imports/i18n/data/ee.i18n.json

@@ -309,7 +309,7 @@
   "calendar-system-indian": "india dukɔ ƒe kalenda",
   "calendar-system-islamic": "Hijri kalenda",
   "calendar-system-islamic-civil": "islam subɔlawo ƒe sivil kalenda",
-  "calendar-system-islamic-rgsa": "Islamic (Saudi Arabia)",
+  "calendar-system-islamic-rgsa": "Hijri kalenda (Saudi Arabia nutome, ɣleti kpɔkpɔ)",
   "calendar-system-islamic-tbla": "Islamic tabular",
   "calendar-system-islamic-umalqura": "Hijri kalenda (Umm al-Qura)",
   "calendar-system-iso8601": "ISO 8601",

imports/i18n/data/eo.i18n.json

@@ -17,7 +17,7 @@
   "act-activity-notify": "Agado Sciigo",
   "act-addAttachment": "aldonita alligitecon __attachment__ al karto __card__ en la listo __list__ en la naĝotubo __swimlane__ en la tabulo __board__",
   "act-deleteAttachment": "forigita alligitecon __attachment__ al karto __card__ en la listo __list__ en la naĝotubo __swimlane__ en la tabulo __board__",
-  "act-addSubtask": "aldonita subtaskon __subtask__ al karto __card__ en la listo __list__ en la naĝotubo __swimlane__ en la tabulo __board__",
+  "act-addSubtask": "aldonis subtaskon __subtask__ al karto __card__ en la listo __list__ en la naĝlinio __swimlane__ en la tabulo __board__",
   "act-addLabel": "Aldonita etikedo __label__ al karto __card__ en la listo __list__ en la naĝvojo __swimlane__ en la tabulo __board__",
   "act-addedLabel": "Aldonita etikedo __label__ al karto __card__ en la listo __list__ en la naĝvojo __swimlane__ en la tabulo __board__",
   "act-removeLabel": "Forigita etikedo __label__ de karto __card__ en la listo __list__ en la naĝotubo __swimlane__ en la tabulo __board__",
@@ -210,7 +210,7 @@
   "attachment-soft-delete-pop": "La kunsendaĵo estas forigita el ĉi tiu karto kaj ĝia dosiero estas konservita. Ĉiu, kiu povas redakti la karton, povas restaŭri ĝin el la historio de la karto.",
   "attachmentDeletePopup-title": "Ĉu forigi aldonaĵon?",
   "attachments": "Aldonaĵoj",
-  "auto-watch": "Aŭtomate rigardi tabulojn kiam ili estas kreitaj",
+  "auto-watch": "Aŭtomate observi tabulojn kiam ili estas kreitaj",
   "avatar-too-big": "La avataro estas tro granda (maks. __size__)",
   "back": "Reen",
   "board-change-color": "Ŝanĝi koloron",
@@ -242,7 +242,7 @@
   "allBoardsChangeBackgroundImagePopup-title": "Ŝanĝi fonbildon",
   "boardChangeTitlePopup-title": "Renomi tavolon",
   "boardChangeVisibilityPopup-title": "Ŝanĝi videblecon",
-  "boardChangeWatchPopup-title": "Ŝanĝi rigardadon",
+  "boardChangeWatchPopup-title": "Ŝanĝi observadon",
   "boardMenuPopup-title": "Agordoj de tabulo",
   "allBoardsMenuPopup-title": "Agordoj",
   "boardChangeViewPopup-title": "Tabula vido",
@@ -589,7 +589,7 @@
   "custom-field-dropdown": "Falmenuo",
   "custom-field-dropdown-none": "(nenio)",
   "custom-field-dropdown-options": "Opcioj de listo",
-  "custom-field-dropdown-options-placeholder": "Premu Enen por aldoni pliajn opciojn",
+  "custom-field-dropdown-options-placeholder": "Premu la klavon Enter por aldoni pliajn opciojn",
   "custom-field-dropdown-unknown": "(nekonata)",
   "custom-field-dropdownMultiSelect": "Falmenuo (plurelekto)",
   "custom-field-number": "Nombro",
@@ -597,9 +597,9 @@
   "custom-fields": "Propraj kampoj",
   "date": "Dato",
   "date-format": "Datformato",
-  "date-format-yyyy-mm-dd": "JJJJ-MM-TT",
-  "date-format-dd-mm-yyyy": "TT-MM-JJJJ",
-  "date-format-mm-dd-yyyy": "MM-TT-JJJJ",
+  "date-format-yyyy-mm-dd": "YYYY-MM-DD",
+  "date-format-dd-mm-yyyy": "DD-MM-YYYY",
+  "date-format-mm-dd-yyyy": "MM-DD-YYYY",
   "decline": "Malakcepti",
   "default-avatar": "Defaŭlta avataro",
   "delete": "Forigi",
@@ -729,7 +729,7 @@
   "filter-to-selection": "Filtri al elekto",
   "other-filters-label": "Aliaj filtriloj",
   "advanced-filter-label": "Altnivela filtrilo",
-  "advanced-filter-description": "La altnivela filtrilo permesas skribi ĉenon kun la jenaj operatoroj: == != <= >= && || ( ) Spaco estas uzata kiel apartigilo inter la operatoroj. Vi povas filtri laŭ ĉiuj propraj kampoj tajpante iliajn nomojn kaj valorojn. Ekzemple: Kampo1 == Valoro1. Rimarko: se kampoj aŭ valoroj enhavas spacojn, vi devas meti ilin inter unuopajn citilojn. Ekzemple: 'Kampo 1' == 'Valoro 1'. Por preterlasi unuopajn regsignojn (' \\/) vi povas uzi \\. Ekzemple: Kampo1 == I\\'m. Vi ankaŭ povas kombini plurajn kondiĉojn. Ekzemple: F1 == V1 || F1 == V2. Normale ĉiuj operatoroj estas interpretataj de maldekstre dekstren. Vi povas ŝanĝi la ordon per krampoj. Ekzemple: F1 == V1 && ( F2 == V2 || F2 == V3 ). Vi ankaŭ povas serĉi en tekstaj kampoj per regulesprimo: F1 == /Tes.*/i",
+  "advanced-filter-description": "La altnivela filtrilo permesas skribi ĉenon kun la jenaj operatoroj: == != <= >= && || ( ) Spaco estas uzata kiel apartigilo inter la operatoroj. Vi povas filtri laŭ ĉiuj propraj kampoj tajpante iliajn nomojn kaj valorojn. Ekzemple: Field1 == Value1. Rimarko: se kampoj aŭ valoroj enhavas spacojn, vi devas meti ilin inter unuopajn citilojn. Ekzemple: 'Field 1' == 'Value 1'. Por trakti la specialajn signojn (' \\/) kiel literalajn signojn, vi povas uzi \\. Ekzemple: Field1 == I\\'m. Vi ankaŭ povas kombini plurajn kondiĉojn. Ekzemple: F1 == V1 || F1 == V2. Normale ĉiuj operatoroj estas interpretataj de maldekstre dekstren. Vi povas ŝanĝi la ordon per krampoj. Ekzemple: F1 == V1 && ( F2 == V2 || F2 == V3 ). Vi ankaŭ povas serĉi en tekstaj kampoj per regulesprimo: F1 == /Tes.*/i",
   "text-contains-trigger-label": "Teksto serĉenda",
   "text-contains-trigger-description": "Kongruas kiam karto estas kreita, aŭ ĝia titolo aŭ priskribo estas ŝanĝita, kaj la nova teksto enhavas ĉi tion (sen distingo inter majuskloj kaj minuskloj).",
   "fullname": "Plena nomo",
@@ -900,7 +900,7 @@
   "normal-assigned-only-desc": "Nur atribuitaj kartoj videblas. Redaktas kiel normala uzanto.",
   "not-accepted-yet": "Invito ankoraŭ ne akceptita",
   "notify-participate": "Ricevi ĝisdatigojn pri ĉiuj kartoj, en kiuj vi partoprenas kiel kreinto aŭ membro",
-  "notify-watch": "Ricevi ĝisdatigojn pri ĉiuj tabuloj, listoj aŭ kartoj, kiujn vi rigardas",
+  "notify-watch": "Ricevi ĝisdatigojn pri ĉiuj tabuloj, listoj aŭ kartoj, kiujn vi observas",
   "optional": "laŭvola",
   "or": "aŭ",
   "page-maybe-private": "Ĉi tiu paĝo eble estas privata. Vi eble povos vidi ĝin post <a href='%s'>ensaluto</a>.",
@@ -928,7 +928,7 @@
   "remove-member": "Forigi membron",
   "deleted-user": "Forigita uzanto",
   "remove-member-from-card": "Forigi de karto",
-  "remove-member-pop": "Ĉu forigi __name__ (__username__) el __boardTitle__? La membro estos forigita el ĉiuj kartoj en ĉi tiu tabulo. Ili ricevos sciigon.",
+  "remove-member-pop": "Ĉu forigi __name__ (__username__) el __boardTitle__? La membro estos forigita el ĉiuj kartoj en ĉi tiu tabulo. La membro ricevos sciigon.",
   "sandstorm-remove-member-warning": "Ĉi tio nur kaŝas la membron ene de WeKan. Ĝi ne nuligas la aliron al la Sandstorm-greno. Nuligu ankaŭ ties aliron en la dialogo Kunhavigi aliron de Sandstorm.",
   "removeMemberPopup-title": "Ĉu forigi membron?",
   "rename": "Renomi",
@@ -940,7 +940,7 @@
   "search": "Serĉi",
   "rules": "Reguloj",
   "search-cards": "Serĉi en titoloj de kartoj/listoj, priskriboj kaj propraj kampoj en ĉi tiu tabulo",
-  "search-example": "Skribu la serĉatan tekston kaj premu Enen",
+  "search-example": "Skribu la serĉatan tekston kaj premu la klavon Enter",
   "select-color": "Elekti koloron",
   "select-board": "Elekti tabulon",
   "set-wip-limit-value": "Agordi limon por la maksimuma nombro de taskoj en ĉi tiu listo",
@@ -979,8 +979,8 @@
   "this-board": "ĉi tiu tabulo",
   "this-card": "ĉi tiu karto",
   "spent-time-hours": "Pasigita tempo (horoj)",
-  "overtime-hours": "Kroma tempo (horoj)",
-  "overtime": "Kroma tempo",
+  "overtime-hours": "Kromlaboro (horoj)",
+  "overtime": "Kromlaboro",
   "flowtime": "Flutempo",
   "flow-start": "Ekigi Fluon",
   "flow-stop": "Halti Fluon",
@@ -991,7 +991,7 @@
   "pomodoro-work": "Laboro",
   "pomodoro-break": "Paŭzo",
   "pomodoro-completed": "%s kompletigitaj",
-  "has-overtime-cards": "Havas kartojn kun kroma tempo",
+  "has-overtime-cards": "Havas kartojn kun kromlaboro",
   "has-spenttime-cards": "Havas kartojn kun pasigita tempo",
   "time": "Tempo",
   "title": "Titolo",
@@ -1003,7 +1003,7 @@
   "type": "Tipo",
   "unassign-member": "Malatribui membron",
   "unsaved-description": "Vi havas nekonservitan priskribon.",
-  "unwatch": "Ĉesi rigardi",
+  "unwatch": "Ĉesi observi",
   "upload": "Alŝuti",
   "upload-avatar": "Alŝuti avataron",
   "uploaded-avatar": "Alŝutis avataron",
@@ -1228,7 +1228,7 @@
   "activity-removed-label-card": "forigis etikedon '%s'",
   "activity-delete-attach-card": "forigis aldonaĵon",
   "activity-set-customfield": "agordis propran kampon '%s' al '%s' en %s",
-  "activity-unset-customfield": "malagordis propran kampon '%s' en %s",
+  "activity-unset-customfield": "forigis la valoron de la propra kampo '%s' en %s",
   "r-rule": "Regulo",
   "r-add-trigger": "Aldoni ekigilon",
   "r-add-action": "Aldoni agon",
@@ -1863,7 +1863,7 @@
   "custom-field-stringtemplate": "Ĉena ŝablono",
   "custom-field-stringtemplate-format": "Formato (uzu %{value} kiel lokokupilon)",
   "custom-field-stringtemplate-separator": "Apartigilo (uzu &#32; aŭ &nbsp; por spaco)",
-  "custom-field-stringtemplate-item-placeholder": "Premu Enen por aldoni pliajn erojn",
+  "custom-field-stringtemplate-item-placeholder": "Premu la klavon Enter por aldoni pliajn erojn",
   "creator": "Kreinto",
   "creator-on-minicard": "Kreinto sur minikarto",
   "filesReportTitle": "Raporto pri dosieroj",
@@ -1966,10 +1966,10 @@
   "Node_heap_heap_size_limit": "Node-amaso: limo de amasa grando",
   "Node_heap_malloced_memory": "Node-amaso: memoro asignita per malloc",
   "Node_heap_peak_malloced_memory": "Node-amaso: pinta memoro asignita per malloc",
-  "Node_heap_does_zap_garbage": "Node-amaso: ĉu nuligas rubon",
+  "Node_heap_does_zap_garbage": "Node-amaso: ĉu superskribas rubon per bitŝablono",
   "Node_heap_number_of_native_contexts": "Node-amaso: nombro de indiĝenaj kuntekstoj",
   "Node_heap_number_of_detached_contexts": "Node-amaso: nombro de malligitaj kuntekstoj",
-  "Node_memory_usage_rss": "Node-memoruzo: rezida aro (RSS)",
+  "Node_memory_usage_rss": "Node-memoruzo: grando de la rezida aro (RSS)",
   "Node_memory_usage_heap_total": "Node-memoruzo: tuta grando de la asignita amaso",
   "Node_memory_usage_heap_used": "Node-memoruzo: efektive uzata memoro",
   "Node_memory_usage_external": "Node-memoruzo: ekstera",
@@ -2138,7 +2138,7 @@
   "accounts-lockout-unknown-users": "Agordoj por nekonataj uzantoj (neekzistanta uzantnomo)",
   "accounts-lockout-failures-before": "Malsukcesoj antaŭ ŝloso",
   "accounts-lockout-period": "Ŝlosa periodo (sekundoj)",
-  "accounts-lockout-failure-window": "Malsukcesa fenestro (sekundoj)",
+  "accounts-lockout-failure-window": "Tempofenestro por malsukcesoj (sekundoj)",
   "accounts-lockout-settings-updated": "Agordoj de protekto kontraŭ krudforta atako estas ĝisdatigitaj",
   "accounts-lockout-locked-users": "Ŝlositaj uzantoj",
   "accounts-lockout-locked-users-info": "Uzantoj nun ŝlositaj pro tro multaj malsukcesaj ensalutprovoj",

imports/i18n/data/eu.i18n.json

@@ -41,10 +41,10 @@
   "act-setCustomField": "__customField__ eremu pertsonalizatua editatu du: __customFieldValue__, __card__ txartelean, __list__ zerrendan, __swimlane__ errailean, __board__ arbelean",
   "act-createList": "__list__ zerrenda gehitu du __board__ arbelera",
   "act-addBoardMember": "__member__ kidea gehitu du __board__ arbelera",
-  "act-archivedBoard": "__board__ arbela biltegira eraman da",
-  "act-archivedCard": "__card__ txartela biltegira eraman da, __list__ zerrendatik, __swimlane__ errailean, __board__ arbelean",
-  "act-archivedList": "__list__ zerrenda biltegira eraman da, __swimlane__ errailean, __board__ arbelean",
-  "act-archivedSwimlane": "__swimlane__ erraila biltegira eraman da, __board__ arbelean",
+  "act-archivedBoard": "__board__ arbela artxibora eraman da",
+  "act-archivedCard": "__card__ txartela artxibora eraman da, __list__ zerrendatik, __swimlane__ errailean, __board__ arbelean",
+  "act-archivedList": "__list__ zerrenda artxibora eraman da, __swimlane__ errailean, __board__ arbelean",
+  "act-archivedSwimlane": "__swimlane__ erraila artxibora eraman da, __board__ arbelean",
   "act-importBoard": "__board__ arbela inportatu da",
   "act-importCard": "__board__ arbeleko __swimlane__  erraileko __list__  zerrendako  __card__ txartela inportatu da",
   "act-importList": "__board__ arbeleko __swimlane__ erraileko __list__ zerrenda inportatu da",
@@ -1339,8 +1339,8 @@
   "set-filter": "Ezarri iragazkia",
   "r-moved-to": "Eramaten denean hona:",
   "r-moved-from": "Eramaten denean hemendik:",
-  "r-archived": "Biltegira eraman da",
-  "r-unarchived": "Biltegitik berreskuratu da",
+  "r-archived": "Artxibora eraman da",
+  "r-unarchived": "Artxibotik berreskuratu da",
   "r-a-card": "txartel bat",
   "r-when-a-label-is": "Etiketa bat",
   "r-when-the-label": "Etiketa hau",
@@ -1773,7 +1773,7 @@
   "globalSearch-instructions-operator-modified": "`__operator_modified__:<n>` - fitxes que es van modificar *<n>* fa dies o menys",
   "globalSearch-instructions-operator-status": "`__operator_status__:<status>` - non *<status>* hauetako bat den:",
   "globalSearch-instructions-status-archived": "`__predicate_archived__` - fitxes arxivades",
-  "globalSearch-instructions-status-all": "`__predicate_all__` - biltegiratutako eta biltegiratu gabeko txartel guztiak",
+  "globalSearch-instructions-status-all": "`__predicate_all__` - artxibatutako eta artxibatu gabeko txartel guztiak",
   "globalSearch-instructions-status-ended": "`__predicate_ended__`: fitxes amb una data de finalització",
   "globalSearch-instructions-status-public": "`__predicate_public__` - fitxes només als taulers públics",
   "globalSearch-instructions-status-private": "`__predicate_private__` - arbel pribatuetako txartelak soilik",

imports/i18n/data/ff.i18n.json

@@ -299,9 +299,9 @@
   "calendar-system": "Njuɓɓudi haatumeere (hollirde ñalnde)",
   "calendar-system-gregorian": "Gregoriana",
   "calendar-system-jalali": "Haatumeere Jalali (Perseere)",
-  "calendar-system-buddhist": "Buddhist",
+  "calendar-system-buddhist": "Ñalɗimere Buudayanko",
   "calendar-system-chinese": "Haatumeere Siin",
-  "calendar-system-coptic": "Coptic",
+  "calendar-system-coptic": "Ñalɗimere Koptinko",
   "calendar-system-dangi": "Haatumeere Dangi",
   "calendar-system-ethioaa": "Haatumeere Amete Alem Ecoppi",
   "calendar-system-ethiopic": "Haatumeere Ecoppi",
@@ -309,7 +309,7 @@
   "calendar-system-indian": "Haatumeere leydi (Enndo)",
   "calendar-system-islamic": "Haatumeere Lislaam",
   "calendar-system-islamic-civil": "Islamic civil",
-  "calendar-system-islamic-rgsa": "Islamic (Saudi Arabia)",
+  "calendar-system-islamic-rgsa": "Haatumeere Lislaam (Arabii Sawdit, yiide lewru)",
   "calendar-system-islamic-tbla": "Islamic tabular",
   "calendar-system-islamic-umalqura": "Haatumeere Lislaam (Umm al-Qura)",
   "calendar-system-iso8601": "ISO 8601",

imports/i18n/data/gl.i18n.json

@@ -752,7 +752,7 @@
   "import-board-instruction-asana": "Pega un JSON de exportación de tarefas de Asana ({ \"data\": [...] } da exportación de Asana ou GET /tasks). As tarefas agrúpanse en seccións (memberships); as tarefas completadas van a Feito.",
   "import-board-instruction-zenkit": "Pega un JSON de exportación de lista de ZenKit ({ \"title\", \"stages\":[...], \"items\":[...] }). As stages convértense en listas e os items en cartões.",
   "import-board-instruction-markdown": "Pegue unha lista de tarefas en markdown (a convención que usan ferramentas markdown-kanban como Obsidian Kanban): cabeceiras \"## Nome da lista\", con elementos \"- [ ]\"/\"- [x]\" debaixo. As cabeceiras convértense en listas e os elementos en tarxetas; unha simple lista de viñetas sen caixas tamén se importa, como tarxetas abertas.",
-  "import-board-instruction-trello": "No teu taboleiro de Trello, vai a 'Menú', despois a 'Máis', 'Imprimir e exportar', 'Exportar JSON', e copia o texto resultante.",
+  "import-board-instruction-trello": "No teu taboleiro de Trello, vai a 'Menu', despois a 'More', 'Print and Export', 'Export JSON', e copia o texto resultante.",
   "import-board-instruction-csv": "Pega os teus valores separados por comas (CSV) / valores separados por tabulacións (TSV).",
   "import-board-instruction-jira": "Pega o JSON da busca de incidencias da API REST de Jira Cloud (GET /rest/api/2/search), ou un obxecto equivalente { \"issues\": [...] }. Os estados de Jira convértense en listas e as incidencias en cartões. Opcionalmente inclúe unha matriz \"automationRules\" para importar regras.",
   "import-board-instruction-excel": "Escolle unha folla de cálculo .xlsx ao estilo de WeKan (as mesmas columnas que a exportación a Excel: Title, Description, Status/List, Members, Labels, datas, campos personalizados). A primeira fila é a cabeceira.",
@@ -1167,8 +1167,8 @@
   "team-propagate-members-to-boards": "Propagar membros aos quadros",
   "team-sync-members-from-auth": "Sincronizar membros desde o provedor de autenticación",
   "active-person": "Persoa activa",
-  "card-received": "Recibido",
-  "card-received-on": "Recibido o",
+  "card-received": "Recibida",
+  "card-received-on": "Recibida o",
   "card-end": "Fim",
   "card-end-on": "Remata o",
   "editCardReceivedDatePopup-title": "Cambiar a data de recepción",
@@ -1228,7 +1228,7 @@
   "activity-removed-label-card": "quitou a etiqueta '%s'",
   "activity-delete-attach-card": "eliminou un anexo",
   "activity-set-customfield": "estableceu o campo personalizado '%s' a '%s' en %s",
-  "activity-unset-customfield": "quitou o campo personalizado '%s' en %s",
+  "activity-unset-customfield": "quitou o valor do campo personalizado '%s' en %s",
   "r-rule": "Regra",
   "r-add-trigger": "Engadir disparador",
   "r-add-action": "Engadir acción",
@@ -1353,10 +1353,10 @@
   "r-when-a-attach": "Cando un anexo",
   "r-when-a-card-matches-advanced-filter": "Cando unha tarxeta coincide co filtro avanzado",
   "r-when-a-card-title-or-description-contains": "Cando o título ou a descrición da tarxeta contén",
-  "r-when-a-due-date-changed": "Data limite: a data cambiou",
-  "r-when-a-start-date-changed": "Data de início: a data cambiou",
-  "r-when-a-end-date-changed": "Fim: a data cambiou",
-  "r-when-a-received-date-changed": "Recebido: a data cambiou",
+  "r-when-a-due-date-changed": "Cando se establece ou cambia a data de vencemento",
+  "r-when-a-start-date-changed": "Cando se establece ou cambia a data de inicio",
+  "r-when-a-end-date-changed": "Cando se establece ou cambia a data de fin",
+  "r-when-a-received-date-changed": "Cando se establece ou cambia a data de recepción",
   "r-when-a-checklist": "Cando unha lista de verificación é",
   "r-when-the-checklist": "Cando a lista de verificación",
   "r-completed": "Completada",
@@ -1966,7 +1966,7 @@
   "Node_heap_heap_size_limit": "Memoria heap de Node: límite de tamaño do heap",
   "Node_heap_malloced_memory": "Memoria heap de Node: memoria asignada con malloc",
   "Node_heap_peak_malloced_memory": "Memoria heap de Node: pico de memoria asignada con malloc",
-  "Node_heap_does_zap_garbage": "Memoria heap de Node: limpa o lixo (zap garbage)",
+  "Node_heap_does_zap_garbage": "Memoria heap de Node: sobrescribe o lixo cun patrón de bits",
   "Node_heap_number_of_native_contexts": "Memoria heap de Node: número de contextos nativos",
   "Node_heap_number_of_detached_contexts": "Memoria heap de Node: número de contextos desvinculados",
   "Node_memory_usage_rss": "Uso de memoria de Node: tamaño do conxunto residente",
@@ -2480,7 +2480,7 @@
   "step-fix-file-urls": "Corrixindo os URL dos ficheiros",
   "cleanup": "Limpeza",
   "cleanup-old-jobs": "Limpar os traballos antigos",
-  "completed": "Completado",
+  "completed": "Completada",
   "conversion-info-text": "Esta conversión realízase unha vez por taboleiro e mellora o rendemento. Pode seguir usando o taboleiro con normalidade.",
   "converting-board": "Convertendo o taboleiro",
   "converting-board-description": "Convertendo a estrutura do taboleiro para mellorar a funcionalidade. Pode tardar uns instantes.",

imports/i18n/data/qu.i18n.json

@@ -309,7 +309,7 @@
   "calendar-system-indian": "Mamallaqta intiwatana (India)",
   "calendar-system-islamic": "Hijri Intiwatana",
   "calendar-system-islamic-civil": "Hijri Intiwatana (tabular, epoca civil)",
-  "calendar-system-islamic-rgsa": "Islamic (Saudi Arabia)",
+  "calendar-system-islamic-rgsa": "Hijri Intiwatana (Arabia Saudita rikusqa)",
   "calendar-system-islamic-tbla": "Islamic tabular",
   "calendar-system-islamic-umalqura": "Hijri Intiwatana (Umm al-Qura)",
   "calendar-system-iso8601": "ISO-8601 Intiwatana",

imports/i18n/data/ve-PP.i18n.json

@@ -729,7 +729,7 @@
   "filter-to-selection": "Suodata valintaan",
   "other-filters-label": "Muut suodattimet",
   "advanced-filter-label": "Edistynyt suodatin",
-  "advanced-filter-description": "Edistynyt suodatin mahdollistaa merkkijonon, joka sisältää seuraavat operaattorit: == != <= >= && || ( ) Operaattorien välissä käytetään välilyöntiä. Voit suodattaa kaikki mukautetut kentät kirjoittamalla niiden nimet ja arvot. Esimerkiksi: Field1 == Value1. Huom: Jos kentillä tai arvoilla on välilyöntejä, sinun on sijoitettava ne yksittäisiin lainausmerkkeihin. Esimerkki: 'Kenttä 1' == 'Arvo 1'. Voit hypätä yksittäisen kontrollimerkkien (' \\\\/) yli käyttämällä \\\\. Esimerkki: Field1 = I\\\\'m. Voit myös yhdistää useita ehtoja. Esimerkiksi: F1 == V1 || F1 == V2. Yleensä kaikki operaattorit tulkitaan vasemmalta oikealle. Voit muuttaa järjestystä asettamalla sulkuja. Esimerkiksi: F1 == V1 && (F2 == V2 || F2 == V3). Voit myös etsiä tekstikentistä regexillä: F1 == /Tes.*/i",
+  "advanced-filter-description": "Edistynyt suodatin mahdollistaa merkkijonon, joka sisältää seuraavat operaattorit: == != <= >= && || ( ) Operaattorien välissä käytetään välilyöntiä. Voit suodattaa kaikki mukautetut kentät kirjoittamalla niiden nimet ja arvot. Esimerkiksi: Field1 == Value1. Huom: Jos kentillä tai arvoilla on välilyöntejä, sinun on sijoitettava ne yksittäisiin lainausmerkkeihin. Esimerkki: 'Field 1' == 'Value 1'. Voit hypätä yksittäisen kontrollimerkkien (' \\/) yli käyttämällä \\. Esimerkki: Field1 == I\\'m. Voit myös yhdistää useita ehtoja. Esimerkiksi: F1 == V1 || F1 == V2. Yleensä kaikki operaattorit tulkitaan vasemmalta oikealle. Voit muuttaa järjestystä asettamalla sulkuja. Esimerkiksi: F1 == V1 && ( F2 == V2 || F2 == V3 ). Voit myös etsiä tekstikentistä regexillä: F1 == /Tes.*/i",
   "text-contains-trigger-label": "Umbhalo ozofunwa",
   "text-contains-trigger-description": "Iyahambisana lapho ikhadi lidalwa, noma isihloko noma incazelo yalo ishintshwa, futhi umbhalo omusha unalokhu (akunandaba nosayizi wezinhlamvu).",
   "fullname": "Koko nimi",

models/attachments.server.js

@@ -1,3 +1,4 @@
+import { requireBoardMutation } from '/models/lib/boardMutationGuard';
 import { ReactiveCache } from '/imports/reactiveCache';
 import { Meteor } from 'meteor/meteor';
 import { MongoInternals } from 'meteor/mongo';
@@ -378,12 +379,7 @@ Meteor.methods({
       throw new Meteor.Error('board-not-found', 'Board not found');
     }
 
-    if (!allowIsBoardMember(currentUserId, board)) {
-      if (process.env.DEBUG === 'true') {
-        console.warn(`Blocked unauthorized attachment rename attempt: user ${currentUserId} tried to rename attachment ${fileObjId} in board ${fileObj.meta?.boardId}`);
-      }
-      throw new Meteor.Error('not-authorized', 'You do not have permission to modify this attachment');
-    }
+    requireBoardMutation(currentUserId, board, 'renameAttachment', Meteor);
 
     rename(fileObj, newName, fileStoreStrategyFactory);
   },

models/boards.js

@@ -3079,6 +3079,13 @@ Boards.helpers({
   },
 
   async setSubtasksDefaultBoardId(subtasksDefaultBoardId) {
+    if (Meteor.isServer && subtasksDefaultBoardId) {
+      const { canWriteSubtaskDeposit, recordSubtaskDepositDenial } = require('/server/lib/subtaskDepositAccess');
+      if (!(await canWriteSubtaskDeposit(Meteor.userId(), subtasksDefaultBoardId))) {
+        recordSubtaskDepositDenial('setSubtasksDefaultBoardId');
+        throw new Meteor.Error('not-authorized');
+      }
+    }
     return await Boards.updateAsync(this._id, { $set: { subtasksDefaultBoardId } });
   },
 

models/import.js

@@ -1,3 +1,4 @@
+import { requireBoardMutation } from '/models/lib/boardMutationGuard';
 import { Meteor } from 'meteor/meteor';
 import { ReactiveCache } from '/imports/reactiveCache';
 import { TrelloCreator } from './trelloCreator';
@@ -179,12 +180,7 @@ Meteor.methods({
 
     const board = await ReactiveCache.getBoard(target.boardId);
     if (!board) throw new Meteor.Error('board-not-found', 'Board not found');
-    // Importing WRITES to this board, so it is not the export's "can you see
-    // it": it is "may you change it".
-    if (!board.isVisibleBy(await ReactiveCache.getCurrentUser())
-      || !board.isBoardMember()) {
-      throw new Meteor.Error('forbidden', 'Not allowed to import into this board');
-    }
+    requireBoardMutation(userId, board, 'importScoped', Meteor);
     if (doc._format && doc._format !== 'wekan-board-1.0.0') {
       throw new Meteor.Error('invalid-format', `Unknown export format: ${doc._format}`);
     }

models/lib/boardCardScope.js

@@ -1,13 +1,10 @@
 'use strict';
 
-// The selector matching cards that belong to a board: the board itself, plus its
-// subtasks-default board when one is configured.
-//
-// Keep the ordinary MongoDB selector shape. FerretDB is responsible for pushing
-// the null-containing `$in` into its backend without requiring clients to rewrite it.
+// A destination pointer is not read permission. Foreign deposit content is
+// published beneath its own reactive, authorized board cursor instead.
 function boardScopeIds(board) {
   if (!board || typeof board._id !== 'string' || board._id.length === 0) return [];
-  return [board._id, board.subtasksDefaultBoardId ?? null];
+  return [board._id];
 }
 
 // Spread this into a card selector: `{ ...boardCardScope(board), archived: false }`.

models/lib/boardMutationGuard.js

@@ -0,0 +1,19 @@
+'use strict';
+const { memberCan } = require('./boardRoleCapabilities');
+
+// Shared by server methods and their client stubs. The capability decision is
+// identical on both; only the server records attempted unauthorized writes.
+function requireBoardMutation(userId, board, source, Meteor) {
+  if (board && memberCan(board.members, userId, 'write')) return;
+  if (Meteor.isServer) {
+    try {
+      require('/server/lib/securityLog').record({
+        key: 'authz.mutation', action: 'blocked', source,
+        detail: 'Board mutation denied because the caller lacks write access.',
+      });
+    } catch (e) { /* logging must never break the guard */ }
+  }
+  throw new Meteor.Error('not-authorized', 'You cannot change this board.');
+}
+
+module.exports = { requireBoardMutation };

models/lib/buttonRulePermission.js

@@ -0,0 +1,20 @@
+'use strict';
+const { memberCan } = require('./boardRoleCapabilities');
+
+function buttonRuleAllowed(userId, board, cardId, card) {
+  return Boolean(board && memberCan(board.members, userId, 'write') &&
+    (cardId === undefined || (card && card._id === cardId && card.boardId === board._id)));
+}
+
+function requireButtonRuleContext(userId, board, cardId, card, Meteor) {
+  if (buttonRuleAllowed(userId, board, cardId, card)) return;
+  try {
+    require('/server/lib/securityLog').record({
+      key: 'authz.rule-button', action: 'blocked', source: 'rule:button',
+      detail: 'Button rule denied because its caller or card is outside the writable board context.',
+    });
+  } catch (e) { /* logging must never break the guard */ }
+  throw new Meteor.Error('not-authorized', 'Button rule context is not authorized.');
+}
+
+module.exports = { buttonRuleAllowed, requireButtonRuleContext };

models/lib/commentCardBoundary.js

@@ -0,0 +1,18 @@
+'use strict';
+
+function commentCardMatchesBoard(card, cardId, boardId) {
+  return Boolean(card && typeof cardId === 'string' && cardId &&
+    typeof boardId === 'string' && boardId &&
+    card._id === cardId && card.boardId === boardId);
+}
+
+function recordCommentBoundaryDenial(source) {
+  try {
+    require('/server/lib/securityLog').record({
+      key: 'authz.comment-card', action: 'blocked', source,
+      detail: 'Comment refused because its card does not belong to the requested board.',
+    });
+  } catch (e) { /* logging must never break the guard */ }
+}
+
+module.exports = { commentCardMatchesBoard, recordCommentBoundaryDenial };

models/lib/invitationBoardPermission.js

@@ -0,0 +1,10 @@
+'use strict';
+const { memberRoleOf } = require('./boardRoleCapabilities');
+function canInviteToBoard(user, board, allowedRoles) {
+  if (!user || !board) return false;
+  if (user.isAdmin) return true;
+  const member = Array.isArray(board.members) && board.members.find(item => item.userId === user._id);
+  const role = memberRoleOf(member);
+  return Boolean(role && Array.isArray(allowedRoles) && allowedRoles.includes(role));
+}
+module.exports = { canInviteToBoard };

models/lib/linkedWritePolicy.js

@@ -0,0 +1,15 @@
+'use strict';
+const { memberCan, memberRoleOf } = require('./boardRoleCapabilities');
+function sourceRoleBlocksDelegation(userId, board) {
+  const member = board && Array.isArray(board.members) && board.members.find(item => item.userId === userId);
+  return Boolean(memberRoleOf(member) && !memberCan(board.members, userId, 'write'));
+}
+function recordLinkedWriteDenial(source) {
+  try {
+    require('/server/lib/securityLog').record({
+      key: 'authz.linked-write', action: 'blocked', source,
+      detail: 'Linked-card write or link creation denied by the source board write policy.',
+    });
+  } catch (e) { /* logging must never break the guard */ }
+}
+module.exports = { sourceRoleBlocksDelegation, recordLinkedWriteDenial };

models/lib/securityCategories.js

@@ -9,6 +9,15 @@
 // so both the server ESM code and the tests/*.test.cjs guards can load it.
 
 const CATALOG = {
+  'authz.subtask-deposit': { category: 'authz', bleed: 'SubtaskDepositBleed', severity: 'high', cwe: 'CWE-639' },
+  'authz.linked-write': { category: 'authz', bleed: 'LinkedWriteBleed', severity: 'high', cwe: 'CWE-863' },
+  'authz.invitation-boards': { category: 'authz', bleed: 'InvitationBoardBleed', severity: 'high', cwe: 'CWE-639' },
+  'authz.invitation-profile': { category: 'authz', bleed: 'InviteProfileBleed', severity: 'high', cwe: 'CWE-863' },
+  'authz.rule-button': { category: 'authz', bleed: 'RuleButtonBleed', severity: 'high', cwe: 'CWE-639' },
+  'authz.manage-board': { category: 'authz', bleed: 'ManageBoardBleed', severity: 'high', cwe: 'CWE-863' },
+  'authz.comment-card': { category: 'authz', bleed: 'CommentBoundaryBleed', severity: 'high', cwe: 'CWE-639' },
+  'authz.mutation': { category: 'authz', bleed: 'MutationBleed', severity: 'high', cwe: 'CWE-863' },
+  'authz.board-visibility': { category: 'authz', bleed: 'VisibilityBleed', severity: 'medium', cwe: 'CWE-863' },
   'ssrf.redirect':   { category: 'ssrf', bleed: 'RedirectBleed', severity: 'high', cwe: 'CWE-918' },
   'ssrf.attachment': { category: 'ssrf', bleed: 'LiveBleed', severity: 'high', cwe: 'CWE-918' },
   'ssrf.fetch':      { category: 'ssrf', bleed: 'DnsBleed', severity: 'high', cwe: 'CWE-918' },

models/users.js

@@ -1191,6 +1191,7 @@ Users.attachSchema(
 export const USER_UPDATE_ALLOWED_EXACT = ['username', 'profile', 'modifiedAt'];
 export const USER_UPDATE_ALLOWED_PREFIXES = ['profile.'];
 export const USER_UPDATE_FORBIDDEN_PREFIXES = [
+  'profile.invitedBoards',
   'services',
   'emails',
   'roles',
@@ -1210,8 +1211,16 @@ export function isUserUpdateAllowed(fields) {
   return result;
 }
 
-export function hasForbiddenUserUpdateField(fields) {
-  const result = fields.some((f) => USER_UPDATE_FORBIDDEN_PREFIXES.some((p) => f === p || f.startsWith(p + '.')));
+export function hasForbiddenUserUpdateField(fields, modifier) {
+  // Meteor may report the top-level "profile" field for a leaf update. Inspect
+  // operator paths so ordinary preferences do not become forbidden merely
+  // because another profile descendant is a server-issued capability.
+  const paths = modifier && typeof modifier === 'object'
+    ? Object.entries(modifier).flatMap(([operator, value]) => {
+      if (!operator.startsWith('$') || !value || typeof value !== 'object') return [operator];
+      return operator === '$rename' ? [...Object.keys(value), ...Object.values(value)] : Object.keys(value);
+    }) : fields;
+  const result = paths.some((f) => USER_UPDATE_FORBIDDEN_PREFIXES.some((p) => f === p || f.startsWith(p + '.') || p.startsWith(f + '.')));
   return result;
 }
 

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "wekan",
-  "version": "v11.74.0",
+  "version": "v11.78.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "wekan",
-      "version": "v11.74.0",
+      "version": "v11.78.0",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v11.74.0",
+  "version": "v11.78.0",
   "description": "Open-Source kanban",
   "private": true,
   "repository": {

packages/wekan-ldap/server/ldap.js

@@ -369,7 +369,13 @@ export default class LDAP {
   getUserFilter(username) {
     const filter = [];
 
-    if (this.options.User_Search_Filter !== '') {
+    // The optional filter may be unset, especially in snap configurations.
+    // Binding succeeds before this method runs; indexing undefined made the
+    // subsequent search look like a bind failure (#6692).
+    if (this.options.User_Search_Filter != null && this.options.User_Search_Filter !== '') {
+      if (typeof this.options.User_Search_Filter !== 'string') {
+        throw new Error('LDAP_USER_SEARCH_FILTER must be a string');
+      }
       if (this.options.User_Search_Filter[0] === '(') {
         filter.push(`${this.options.User_Search_Filter}`);
       } else {

packages/wekan-ldap/server/logger.js

@@ -22,6 +22,15 @@ function sanitizeForLogging(value) {
 
     if (value && typeof value === 'object') {
         const sanitized = {};
+        // Error.name/message are non-enumerable. Object.keys alone turned
+        // bind, connection and certificate failures into an unhelpful {}.
+        if (value instanceof Error) {
+            ['name', 'message', 'code', 'reason'].forEach((key) => {
+                if (value[key] !== undefined) {
+                    sanitized[key] = sanitizeForLogging(value[key]);
+                }
+            });
+        }
         Object.keys(value).forEach((key) => {
             if (isSensitiveKey(key)) {
                 sanitized[key] = '[REDACTED]';

public/api/wekan.html

@@ -3,7 +3,7 @@
 
 <head>
   <meta charset="utf8" />
-  <title>WeKan REST API v11.74</title>
+  <title>WeKan REST API v11.78</title>
   <!-- needed for adaptive design -->
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <style>
@@ -427,7 +427,7 @@ data-styled.g139[id="sc-iIvZUO"]{content:"kAmnlO,"}/*!sc*/
           55.627 l 55.6165,55.627 -231.245496,231.24803 c -127.185,127.1864
           -231.5279,231.248 -231.873,231.248 -0.3451,0 -104.688,
           -104.0616 -231.873,-231.248 z
-        " fill="currentColor"></path></g></svg></div></div><div class="sc-jtyQFi ldXCvc api-content"><div class="sc-eCQgVK jleRXN"><div class="sc-iCECmn lhRBUS"><div class="sc-hKVpXn kktglN api-info"><h1 class="sc-fuztkK sc-ctiVdb eRMVDe cBgvIi">Wekan REST API<!-- --> <span>(<!-- -->v11.74<!-- -->)</span></h1><p>Download OpenAPI specification<!-- -->:</p><div class="sc-iJSMbW sc-cBEgGa fiNpIH htbHfQ"></div><div data-role="redoc-summary" html="" class="sc-iJSMbW sc-cBEgGa fiNpIH htbHfQ"></div><div data-role="redoc-description" html="&lt;p&gt;The REST API allows you to control and extend Wekan with ease.&lt;/p&gt;
+        " fill="currentColor"></path></g></svg></div></div><div class="sc-jtyQFi ldXCvc api-content"><div class="sc-eCQgVK jleRXN"><div class="sc-iCECmn lhRBUS"><div class="sc-hKVpXn kktglN api-info"><h1 class="sc-fuztkK sc-ctiVdb eRMVDe cBgvIi">Wekan REST API<!-- --> <span>(<!-- -->v11.78<!-- -->)</span></h1><p>Download OpenAPI specification<!-- -->:</p><div class="sc-iJSMbW sc-cBEgGa fiNpIH htbHfQ"></div><div data-role="redoc-summary" html="" class="sc-iJSMbW sc-cBEgGa fiNpIH htbHfQ"></div><div data-role="redoc-description" html="&lt;p&gt;The REST API allows you to control and extend Wekan with ease.&lt;/p&gt;
 &lt;p&gt;If you are an end-user and not a dev or a tester, &lt;a href=&quot;https://github.com/wekan/wekan/issues/new&quot;&gt;create an issue&lt;/a&gt; to request new APIs.&lt;/p&gt;
 &lt;blockquote&gt;
 &lt;p&gt;All API calls in the documentation are made using &lt;code&gt;curl&lt;/code&gt;.  However, you are free to use Java / Python / PHP / Golang / Ruby / Swift / Objective-C / Rust / Scala / C# or any other programming languages.&lt;/p&gt;
@@ -1197,13 +1197,13 @@ data-styled.g139[id="sc-iIvZUO"]{content:"kAmnlO,"}/*!sc*/
  key of the board, as &lt;code&gt;true&lt;/code&gt;/&lt;code&gt;false&lt;/code&gt;) and of the card-aging thresholds
  (&lt;code&gt;cardAgingDays1&lt;/code&gt;..&lt;code&gt;cardAgingDays3&lt;/code&gt;, non-negative integers). Keys not in
  the body are left as they are; a body with no recognised key is a 400.
- Requires board write access. Returns the settings in effect, in the same
+ Requires board administrator access. Returns the settings in effect, in the same
  shape as GET.&lt;/p&gt;
 " class="sc-iJSMbW sc-cBEgGa fiNpIH htbHfQ"><p>Sets any subset of the card feature toggles (any <code>allows*</code>
  key of the board, as <code>true</code>/<code>false</code>) and of the card-aging thresholds
  (<code>cardAgingDays1</code>..<code>cardAgingDays3</code>, non-negative integers). Keys not in
  the body are left as they are; a body with no recognised key is a 400.
- Requires board write access. Returns the settings in effect, in the same
+ Requires board administrator access. Returns the settings in effect, in the same
  shape as GET.</p>
 </div></div><div class="sc-fuYIqi kGZLat"><div class="sc-dalEhJ jdqJPb"><h5 class="sc-iqkkDd sc-jQQpTv jprlAr kEkHzF">Authorizations:</h5><svg class="sc-dYjPD bEEWJa" version="1.1" viewBox="0 0 24 24" x="0" xmlns="http://www.w3.org/2000/svg" y="0" aria-hidden="true"><polygon points="17.3 8.3 12 13.6 6.7 8.3 5.3 9.7 12 16.4 18.7 9.7 "></polygon></svg></div><div class="sc-jTPGds cVAkzL"><span class="sc-dtnsVa hFacFb"><span class="sc-hPfayn hAYuWG"><i>UserSecurity</i></span></span></div></div><div><h5 class="sc-iqkkDd jprlAr">path<!-- --> Parameters</h5><table class="sc-hHopjF bsjUmE"><tbody><tr class="last "><td kind="field" title="board" class="sc-hCcPtG sc-fFCZOx jFNAwF lcdEEX"><span class="sc-ieCSdj kkMuqc"></span><span class="property-name">board</span><div class="sc-gSILEF sc-eIYgEQ jMRTsl dHYagA">required</div></td><td class="sc-bjLslk gLpZiQ"><div><div><span class="sc-gSILEF sc-lbpDNm jMRTsl NncTE"></span><span class="sc-gSILEF sc-iNyHtD jMRTsl kUjPnZ">string</span></div> <div><div html="&lt;p&gt;the board ID&lt;/p&gt;
 " class="sc-iJSMbW sc-cBEgGa fiNpIH bWgCZK"><p>the board ID</p>
@@ -1215,13 +1215,13 @@ data-styled.g139[id="sc-iIvZUO"]{content:"kAmnlO,"}/*!sc*/
  key of the board, as &lt;code&gt;true&lt;/code&gt;/&lt;code&gt;false&lt;/code&gt;) and of the card-aging thresholds
  (&lt;code&gt;cardAgingDays1&lt;/code&gt;..&lt;code&gt;cardAgingDays3&lt;/code&gt;, non-negative integers). Keys not in
  the body are left as they are; a body with no recognised key is a 400.
- Requires board write access. Returns the settings in effect, in the same
+ Requires board administrator access. Returns the settings in effect, in the same
  shape as GET.&lt;/p&gt;
 " class="sc-iJSMbW sc-cBEgGa fiNpIH htbHfQ"><p>Sets any subset of the card feature toggles (any <code>allows*</code>
  key of the board, as <code>true</code>/<code>false</code>) and of the card-aging thresholds
  (<code>cardAgingDays1</code>..<code>cardAgingDays3</code>, non-negative integers). Keys not in
  the body are left as they are; a body with no recognised key is a 400.
- Requires board write access. Returns the settings in effect, in the same
+ Requires board administrator access. Returns the settings in effect, in the same
  shape as GET.</p>
 </div></div><div class="sc-fuYIqi kGZLat"><div class="sc-dalEhJ jdqJPb"><h5 class="sc-iqkkDd sc-jQQpTv jprlAr kEkHzF">Authorizations:</h5><svg class="sc-dYjPD bEEWJa" version="1.1" viewBox="0 0 24 24" x="0" xmlns="http://www.w3.org/2000/svg" y="0" aria-hidden="true"><polygon points="17.3 8.3 12 13.6 6.7 8.3 5.3 9.7 12 16.4 18.7 9.7 "></polygon></svg></div><div class="sc-jTPGds cVAkzL"><span class="sc-dtnsVa hFacFb"><span class="sc-hPfayn hAYuWG"><i>UserSecurity</i></span></span></div></div><div><h5 class="sc-iqkkDd jprlAr">path<!-- --> Parameters</h5><table class="sc-hHopjF bsjUmE"><tbody><tr class="last "><td kind="field" title="board" class="sc-hCcPtG sc-fFCZOx jFNAwF lcdEEX"><span class="sc-ieCSdj kkMuqc"></span><span class="property-name">board</span><div class="sc-gSILEF sc-eIYgEQ jMRTsl dHYagA">required</div></td><td class="sc-bjLslk gLpZiQ"><div><div><span class="sc-gSILEF sc-lbpDNm jMRTsl NncTE"></span><span class="sc-gSILEF sc-iNyHtD jMRTsl kUjPnZ">string</span></div> <div><div html="&lt;p&gt;the board ID&lt;/p&gt;
 " class="sc-iJSMbW sc-cBEgGa fiNpIH bWgCZK"><p>the board ID</p>
@@ -2543,7 +2543,7 @@ trigger and action stay as they are); true resumes it</p>
 " class="sc-iJSMbW sc-cBEgGa sc-ciCrSJ fiNpIH iHFyeq dDDioG"><p>200 response</p>
 </div></button></div></div></div><div class="sc-jSppWd sc-gKkgUA fpMlmc bdQQyo"><div class="sc-fXwuWv fYxpnv"><button class="sc-jWMFtl jzaJhV"><span type="post" class="sc-eEFuoE hOENFc http-verb post">post</span><span class="sc-FpjRO dsIRaZ">/api/boards/{board}/swimlanes/{swimlane}/move</span><svg class="sc-dYjPD bQKUih" style="margin-right:-25px" version="1.1" viewBox="0 0 24 24" x="0" xmlns="http://www.w3.org/2000/svg" y="0" aria-hidden="true"><polygon points="17.3 8.3 12 13.6 6.7 8.3 5.3 9.7 12 16.4 18.7 9.7 "></polygon></svg></button><div aria-hidden="true" class="sc-fmtEmb tUxhh"><div class="sc-ljIcGq bAnPPh"><div html="" class="sc-iJSMbW sc-cBEgGa fiNpIH bWgCZK"></div><div tabindex="0" role="button"><div class="sc-jlJOIR PEJyb"><span></span>/api/boards/{board}/swimlanes/{swimlane}/move</div></div></div></div></div></div></div></div></div><div class="sc-ekVkVN bjzTxL"></div></div></div>
       <script>
-      const __redoc_state = {"menu":{"activeItemIdx":-1},"spec":{"data":{"openapi":"3.0.0","info":{"title":"Wekan REST API","version":"v11.74","description":"The REST API allows you to control and extend Wekan with ease.\n\nIf you are an end-user and not a dev or a tester, [create an issue](https://github.com/wekan/wekan/issues/new) to request new APIs.\n\n> All API calls in the documentation are made using `curl`.  However, you are free to use Java / Python / PHP / Golang / Ruby / Swift / Objective-C / Rust / Scala / C# or any other programming languages.\n\n# Production Security Concerns\nWhen calling a production Wekan server, ensure it is running via HTTPS and has a valid SSL Certificate. The login method requires you to post your username and password in plaintext, which is why we highly suggest only calling the REST login api over HTTPS. Also, few things to note:\n\n* Only call via HTTPS\n* Implement a timed authorization token expiration strategy\n* Ensure the calling user only has permissions for what they are calling and no more\n"},"paths":{"/users/login":{"post":{"operationId":"login","summary":"Login with REST API","tags":["Login"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["username","password"],"properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"}}}},"application/x-www-form-urlencoded":{"schema":{"type":"object","required":["username","password"],"properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"}}}}},"description":"Login credentials","required":true},"responses":{"200":{"description":"Successful authentication","content":{"*/*":{"schema":{"type":"object","required":["id","token","tokenExpires"],"properties":{"id":{"type":"string","description":"User ID"},"token":{"type":"string","description":"Authentication token\n"},"tokenExpires":{"type":"string","format":"date-time","description":"Token expiration date\n"}}}}}},"400":{"description":"Error in authentication\n","content":{"*/*":{"schema":{"type":"object","properties":{"error":{"type":"string"},"reason":{"type":"string"}}}}}},"default":{"description":"Error in authentication\n"}}}},"/users/register":{"post":{"operationId":"register","summary":"Register with REST API","description":"Notes:\n  - You will need to provide the token for any of the authenticated methods.\n","tags":["Login"],"requestBody":{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"},"email":{"description":"Your email\n","type":"string"}},"required":["username","password","email"]}}},"required":true},"responses":{"200":{"description":"Successful registration","content":{"*/*":{"schema":{"items":{"properties":{"id":{"type":"string"},"token":{"type":"string"},"tokenExpires":{"type":"string"}}}}}}},"400":{"description":"Error in registration\n","content":{"*/*":{"schema":{"items":{"properties":{"error":{"type":"number"},"reason":{"type":"string"}}}}}}},"default":{"description":"Error in registration\n"}}}},"/api/admin/attachment-settings":{"get":{"operationId":"get_attachment_settings","summary":"Get the attachment storage / upload-block settings (GlobalAdmin)","description":"Only the global admin can call this. Returns the Admin Panel >\n Attachments settings document, including `limitSettings.attachmentsUploadBlocked`\n and `limitSettings.avatarsUploadBlocked` plus the size limits. Cloud-storage\n secret keys (S3 secretAccessKey, Azure accountKey/connectionString, GCS\n credentials) are masked and never returned; a boolean `<field>Set` marker\n shows whether a value exists.\n","tags":["AttachmentStorageSettings","Settings"],"security":[{"UserSecurity":[]}],"responses":{"200":{"description":"200 response","content":{"application/json":{"schema":{"type":"Object"}}}}}},"put":{"operationId":"update_attachment_settings","summary":"Update the attachment storage / upload-block settings (GlobalAdmin)","description":"Only the global admin can call this. The request body is a\n partial settings object (for example\n `{\"limitSettings\": {\"avatarsUploadBlocked\": true}}`). It is applied through\n the same update path as the `updateAttachmentStorageSettings` Meteor method,\n so validation and `$set` semantics are identical: cloud-storage secrets left\n blank are preserved. The masked, updated settings document is returned.\n","tags":["AttachmentStorageSettings","Settings"],"security":[{"UserSecurity":[]}],"responses":{"200":{"description":"200 response","content":{"application/json":{"schema":{"type":"Object"}}}}}}},"/api/admin/domains":{"get":{"operationId":"get_admin_domains","summary":"List email domains with their user counts (GlobalAdmin)","description":"Only the Line truncated
+      const __redoc_state = {"menu":{"activeItemIdx":-1},"spec":{"data":{"openapi":"3.0.0","info":{"title":"Wekan REST API","version":"v11.78","description":"The REST API allows you to control and extend Wekan with ease.\n\nIf you are an end-user and not a dev or a tester, [create an issue](https://github.com/wekan/wekan/issues/new) to request new APIs.\n\n> All API calls in the documentation are made using `curl`.  However, you are free to use Java / Python / PHP / Golang / Ruby / Swift / Objective-C / Rust / Scala / C# or any other programming languages.\n\n# Production Security Concerns\nWhen calling a production Wekan server, ensure it is running via HTTPS and has a valid SSL Certificate. The login method requires you to post your username and password in plaintext, which is why we highly suggest only calling the REST login api over HTTPS. Also, few things to note:\n\n* Only call via HTTPS\n* Implement a timed authorization token expiration strategy\n* Ensure the calling user only has permissions for what they are calling and no more\n"},"paths":{"/users/login":{"post":{"operationId":"login","summary":"Login with REST API","tags":["Login"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["username","password"],"properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"}}}},"application/x-www-form-urlencoded":{"schema":{"type":"object","required":["username","password"],"properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"}}}}},"description":"Login credentials","required":true},"responses":{"200":{"description":"Successful authentication","content":{"*/*":{"schema":{"type":"object","required":["id","token","tokenExpires"],"properties":{"id":{"type":"string","description":"User ID"},"token":{"type":"string","description":"Authentication token\n"},"tokenExpires":{"type":"string","format":"date-time","description":"Token expiration date\n"}}}}}},"400":{"description":"Error in authentication\n","content":{"*/*":{"schema":{"type":"object","properties":{"error":{"type":"string"},"reason":{"type":"string"}}}}}},"default":{"description":"Error in authentication\n"}}}},"/users/register":{"post":{"operationId":"register","summary":"Register with REST API","description":"Notes:\n  - You will need to provide the token for any of the authenticated methods.\n","tags":["Login"],"requestBody":{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"username":{"description":"Your username\n","type":"string"},"password":{"description":"Your password\n","type":"string","format":"password"},"email":{"description":"Your email\n","type":"string"}},"required":["username","password","email"]}}},"required":true},"responses":{"200":{"description":"Successful registration","content":{"*/*":{"schema":{"items":{"properties":{"id":{"type":"string"},"token":{"type":"string"},"tokenExpires":{"type":"string"}}}}}}},"400":{"description":"Error in registration\n","content":{"*/*":{"schema":{"items":{"properties":{"error":{"type":"number"},"reason":{"type":"string"}}}}}}},"default":{"description":"Error in registration\n"}}}},"/api/admin/attachment-settings":{"get":{"operationId":"get_attachment_settings","summary":"Get the attachment storage / upload-block settings (GlobalAdmin)","description":"Only the global admin can call this. Returns the Admin Panel >\n Attachments settings document, including `limitSettings.attachmentsUploadBlocked`\n and `limitSettings.avatarsUploadBlocked` plus the size limits. Cloud-storage\n secret keys (S3 secretAccessKey, Azure accountKey/connectionString, GCS\n credentials) are masked and never returned; a boolean `<field>Set` marker\n shows whether a value exists.\n","tags":["AttachmentStorageSettings","Settings"],"security":[{"UserSecurity":[]}],"responses":{"200":{"description":"200 response","content":{"application/json":{"schema":{"type":"Object"}}}}}},"put":{"operationId":"update_attachment_settings","summary":"Update the attachment storage / upload-block settings (GlobalAdmin)","description":"Only the global admin can call this. The request body is a\n partial settings object (for example\n `{\"limitSettings\": {\"avatarsUploadBlocked\": true}}`). It is applied through\n the same update path as the `updateAttachmentStorageSettings` Meteor method,\n so validation and `$set` semantics are identical: cloud-storage secrets left\n blank are preserved. The masked, updated settings document is returned.\n","tags":["AttachmentStorageSettings","Settings"],"security":[{"UserSecurity":[]}],"responses":{"200":{"description":"200 response","content":{"application/json":{"schema":{"type":"Object"}}}}}}},"/api/admin/domains":{"get":{"operationId":"get_admin_domains","summary":"List email domains with their user counts (GlobalAdmin)","description":"Only the Line truncated
 
       var container = document.getElementById('redoc');
       Redoc.hydrate(__redoc_state, container);

public/api/wekan.yml

@@ -1,7 +1,7 @@
 swagger: '2.0'
 info:
   title: Wekan REST API
-  version: v11.74
+  version: v11.78
   description: |
     The REST API allows you to control and extend Wekan with ease.
 
@@ -1139,7 +1139,7 @@ paths:
          key of the board, as `true`/`false`) and of the card-aging thresholds
          (`cardAgingDays1`..`cardAgingDays3`, non-negative integers). Keys not in
          the body are left as they are; a body with no recognised key is a 400.
-         Requires board write access. Returns the settings in effect, in the same
+         Requires board administrator access. Returns the settings in effect, in the same
          shape as GET.
       tags:
         - Boards

releases/check-upcoming-release.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+# Read-only preflight; safe to run independently of release/publishing commands.
+set -e
+changelog="${1:-$(cd "$(dirname "$0")/.." && pwd)/CHANGELOG.md}"
+if [ ! -f "$changelog" ]; then
+  echo "Error: changelog not found: $changelog" >&2
+  exit 1
+fi
+if ! awk '
+  /^# / { active = ($0 ~ /^# Upcoming WeKan ® release[[:space:]]*$/) }
+  active && /^# / { headings++ }
+  active && /<summary>.*<a[[:space:]][^>]*href="[^"]+"[^>]*>[^<[:space:]]/ { entries++ }
+  END { exit !(headings == 1 && entries > 0) }
+' "$changelog"; then
+  echo "Error: CHANGELOG.md must contain one '# Upcoming WeKan ® release' section with release entries." >&2
+  echo "Add Upcoming release notes before running releases/release-all.sh." >&2
+  exit 1
+fi

releases/db-conformance.sh

@@ -52,7 +52,7 @@ RUN_TS="$(date '+%Y-%m-%d_%H-%M-%S')"
 if [ -z "${WEKAN_LOG_ROOT:-}" ]; then
   WEKAN_LOG_ROOT=".tools/log"
 fi
-LOGDIR="${WEKAN_LOGDIR:-$WEKAN_LOG_ROOT/$RUN_TS}"
+LOGDIR="${WEKAN_LOGDIR:-$WEKAN_LOG_ROOT/test-db-conformance/$RUN_TS}"
 mkdir -p "$LOGDIR"
 LOGDIR="$(cd "$LOGDIR" && pwd)"
 

releases/debug-speed-ferretdb.sh

@@ -7,7 +7,7 @@ set -euo pipefail
 WEKAN_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 FERRET_DIR="$WEKAN_DIR/.tools/FerretDB"
 STAMP="$(date +%Y-%m-%d_%H-%M-%S)"
-LOG_DIR="${DEBUGSPEED_LOG_DIR:-$WEKAN_DIR/.tools/log/$STAMP/debug-speed}"
+LOG_DIR="${DEBUGSPEED_LOG_DIR:-$WEKAN_DIR/.tools/log/debug-speed/$STAMP}"
 FERRET_PORT="${DEBUGSPEED_FERRETDB_PORT:-37017}"
 FERRET_STATE="${DEBUGSPEED_FERRETDB_STATE:-$FERRET_DIR/state-debug-speed}"
 

releases/debug-speed-server.sh

@@ -42,7 +42,7 @@ if [ ! -x "$METEOR_BIN" ]; then
 fi
 
 STAMP="$(date +%Y-%m-%d_%H-%M-%S)"
-LOG_DIR="${DEBUGSPEED_LOG_DIR:-$WEKAN_DIR/.tools/log/$STAMP/debug-speed}"
+LOG_DIR="${DEBUGSPEED_LOG_DIR:-$WEKAN_DIR/.tools/log/debug-speed/$STAMP}"
 mkdir -p "$LOG_DIR"
 FERRET_PID=''
 BRIDGE_PID=''

releases/fix-changelog-hashes.sh

@@ -181,8 +181,10 @@ fix_commit_hashes() {
 
   if [ "$fixed" -gt 0 ]; then
     echo "--- Repointed $fixed of $checked commit link(s) in $CHANGELOG_FILE (history was rewritten since they were written) ---"
-  else
+  elif [ "${#unresolved[@]}" -eq 0 ]; then
     echo "    All $checked commit link(s) checked resolve to a commit in this clone."
+  else
+    echo "    $((checked - ${#unresolved[@]})) of $checked checked commit link(s) resolve; ${#unresolved[@]} remain unresolved."
   fi
   if [ "${#unresolved[@]}" -gt 0 ]; then
     echo ""

releases/mirror.md

@@ -159,7 +159,7 @@ to that category rather than assuming it was empty. Other categories and mirrors
 continue, and any failures/conflicts produce a nonzero exit status.
 
 Console status, `status.txt`, `report.json` and `source.json` snapshot are saved in
-`.tools/log/mirror-<timestamp>/`. Reports list copied/planned/checked items,
+`.tools/log/mirror-data/YYYY-MM-DD_HH-MM-SS/`. Reports list copied/planned/checked items,
 archive renames and each failure reason. Transfer files stay in `.tools/tmp`;
 completed source files remain in the persistent archive below. Available archived
 release binaries are reused for destination uploads. SourceForge also receives
@@ -242,7 +242,7 @@ reviews, releases and binaries through the existing engine. The source repositor
 actual default branch is used for merge recovery. Repositories with issues disabled
 still export PRs and their issue-style conversations. Errors in one repository or
 data category do not stop the remaining repositories. Reports and terminal output
-are saved under `.tools/log/mirror-organization-<timestamp>/`.
+are saved under `.tools/log/mirror-organization/YYYY-MM-DD_HH-MM-SS/`.
 
 Enabled wiki repositories are retained locally as `wiki.git` with files and Git
 history. GitLab/Codeberg use their native wiki Git repositories; empty native wikis
@@ -493,7 +493,7 @@ GitHub API requests identify the endpoint, page and retry attempt before fetchin
 without printing authentication headers or tokens. Rate-limit waits remain in effect.
 
 The `releases/mirror.sh` launcher also saves stdout and stderr to
-`.tools/log/mirror/YYYY-MM-DD_HH-MM_SS/mirror-log.txt` while printing them
+`.tools/log/mirror/YYYY-MM-DD_HH-MM-SS/mirror-log.txt` while printing them
 to stdout. It prints the log path at startup, after each sync/check menu operation (including
 failures), and on command exit, preserving command failure status.
 
@@ -501,3 +501,42 @@ If a comment references a parent missing from the paginated issue inventory, the
 collector fetches that issue and any pull metadata through the same rate-limited
 API client, saves them directly to their issue/pull directory and continues. A
 failed parent fetch preserves the checkpoint so a subsequent run retries the page.
+
+### Staged synchronization and concurrent destinations
+
+Menu option 1 first synchronizes the selected source Git branches and tags
+with every active destination. Only after Git succeeds does it collect source
+issues, pull conversations, releases and linked files into the durable
+`.tools/mirror/<host>/<organization>/<repo>/` archive and generate static pages.
+An archive failure stops destination content writes.
+
+After the local archive is ready, separate destination processes synchronize
+its content concurrently. They reuse the same snapshot, preserve completed
+resume checkpoints, and retain each forge's rate-limit handling. Live progress
+shows every active mirror together: start time, processed issues/total,
+processed releases/total and running/finished/failed state. Processed counters
+include checked existing items, failed items and unsupported/draft releases;
+they measure work examined, while copied/failed logs describe the result.
+
+Each run retains the combined mirror-log.txt plus github.txt, gitlab.txt,
+codeberg.txt or sourceforge.txt beside it, according to active destinations,
+in `.tools/log/mirror/YYYY-MM-DD_HH-MM-SS/`. These separate logs include Git
+and destination content output. Starting this script performs remote writes
+and is a human maintainer operation; offline tests use injected local commands.
+
+### Unavailable linked files and historical recovery
+
+Unavailable public issue/comment links are checked against archive.org's
+Wayback availability API using the content creation timestamp. The closest
+available successful capture is downloaded into the same comment directory,
+with recoveredFrom and captureTimestamp provenance in mirror-index.json.
+Original URLs remain the synchronization identity. Current links bypass this
+fallback; archive.org failures do not cause recursive recovery attempts.
+
+Attachment requests have a 30-second deadline covering redirects and body
+transfer. Long saved cooldowns and new rate limits defer the attachment to a
+later run instead of waiting; the saved cooldown remains respected. Optional
+linked-file failures are logged as skipped and preserve existing local bytes,
+so remaining content and target synchronization can continue. Repository/API
+inventory failures still stop incomplete synchronization. Private/local links
+remain blocked and no forge credentials are sent to archive.org or linked sites.

releases/mirror.sh

@@ -27,8 +27,15 @@ mirror "sourceforge" "ssh://wekan@git.code.sf.net/p/wekan/code"
 }
 # Bitbucket is inactive because its repository access is unreliable.
 # Stream both output channels to the terminal and retain the complete run log.
-MIRROR_LOG_DIR="$TOOLS_DIR/log/mirror/$(date +%Y-%m-%d_%H-%M_%S)"
-mkdir -p "$MIRROR_LOG_DIR"
+MIRROR_LOG_DIR="$TOOLS_DIR/log/mirror/$(date +%Y-%m-%d_%H-%M-%S)"
+if ! mkdir -p "$(dirname "$MIRROR_LOG_DIR")"; then exit 1; fi
+MIRROR_LOG_BASE="$MIRROR_LOG_DIR"
+MIRROR_LOG_SUFFIX=0
+until mkdir "$MIRROR_LOG_DIR" 2>/dev/null; do
+  if [ ! -d "$MIRROR_LOG_DIR" ]; then echo "Cannot create mirror log directory: $MIRROR_LOG_DIR" >&2; exit 1; fi
+  MIRROR_LOG_SUFFIX=$((MIRROR_LOG_SUFFIX + 1))
+  MIRROR_LOG_DIR="$MIRROR_LOG_BASE-$MIRROR_LOG_SUFFIX"
+done
 MIRROR_LOG_FILE="$MIRROR_LOG_DIR/mirror-log.txt"
 export WEKAN_MIRROR_LOG_FILE="$MIRROR_LOG_FILE"
 {

releases/provenance-table.sh

@@ -1,7 +1,8 @@
 #!/bin/bash
 #
 # provenance-table.sh - turn the collected provenance rows into the markdown
-# table that goes at the TOP of the release notes.
+# diagnostic table for manual inspection; never append it to release notes
+# or CHANGELOG.md. Build provenance stays in artifacts.
 #
 # Reads every provenance.tsv the build jobs uploaded (given as arguments, or
 # found under ./provenance/) and prints a markdown section. Sorted by bundle,

releases/release-all.sh

@@ -24,8 +24,8 @@ if [ -n "${ZSH_VERSION:-}" ]; then exec /bin/bash "$0" "$@"; fi
 #      amend or squash between writing an entry and releasing it changes the hashes,
 #      and the links would 404 once pushed. Each is remapped by commit subject.
 #   2. Determines PREVIOUS and NEW version automatically: renames the "# Upcoming
-#      WeKan ® release" heading to the next version, or (if already renamed) uses the
-#      newest release heading. An explicit "PREVIOUS NEW" pair overrides this.
+#      WeKan ® release" heading to the next version. Missing or empty Upcoming notes
+#      stop the script. An explicit "PREVIOUS NEW" pair overrides the versions.
 #   3. Commits and pushes pending changes (your CHANGELOG.md edit) to main so the
 #      workflow can read them.
 #   4. Triggers .github/workflows/release-all.yml.
@@ -40,6 +40,13 @@ if [ -n "${ZSH_VERSION:-}" ]; then exec /bin/bash "$0" "$@"; fi
 #   - builds:  tags v<new>, builds amd64/arm64/win64/mac bundles, creates the
 #              GitHub Release, builds+pushes Docker images, builds the snap.
 #
+# Release notes summarize translation details as updated language names.
+# Add **Languages updated:** metadata beneath the Translations group label.
+# Notes include only In short, Security, translation languages, thanks and
+# the changelog link. Other details stay in CHANGELOG.md. Never append
+# "Binaries in these bundles" or a provenance table; retain provenance.tsv
+# build artifacts and checksum verification separately.
+#
 # Track progress at: https://github.com/wekan/wekan/actions
 #
 # Required GitHub secrets (DOCKERHUB_AUTH, QUAY_AUTH, GHCR_AUTH, SNAP_AUTH,
@@ -48,13 +55,16 @@ if [ -n "${ZSH_VERSION:-}" ]; then exec /bin/bash "$0" "$@"; fi
 
 set -e
 
-# Install the tools this trigger needs (Ubuntu apt / macOS brew) if missing.
-. "$(cd "$(dirname "$0")" && pwd)/ensure-tools.sh"
-ensure_tools git gh
-
-# Resolve repo root from script location so this works regardless of CWD.
+# Check release notes before installing tools, changing files or contacting forges.
 REPO_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 cd "$REPO_DIR"
+bash "$REPO_DIR/releases/check-upcoming-release.sh" "$REPO_DIR/CHANGELOG.md"
+mkdir -p "$REPO_DIR/.tools/tmp"
+export TMPDIR="$REPO_DIR/.tools/tmp"
+
+# Install the tools this trigger needs if missing.
+. "$REPO_DIR/releases/ensure-tools.sh"
+ensure_tools git gh
 
 # ── Version helpers ─────────────────────────────────────────────────────────
 # WeKan versions are NN.MM with a 2-digit minor. Encode NN.MM as the integer
@@ -81,69 +91,24 @@ while IFS= read -r line; do RELEASED+=("$line"); done < <(grep -oE '^# v[0-9]+\.
 bash "$(dirname "$0")/fix-changelog-hashes.sh" || true
 
 # ── Determine PREVIOUS (OLD) and NEW version — no version argument needed ────
-# Explicit args still win. Otherwise:
-#   * if there is a "# Upcoming WeKan ® release" section, RENAME it to the next
-#     version (always +1 minor) dated today; OLD = newest release, NEW = that
-#     next version.
-#   * if there is NO Upcoming section, the newest heading is already the prepared
-#     release, so use it as NEW (checked to be the expected increment of OLD, and
-#     referenced by a recent commit, so an old entry is never re-released).
+# An Upcoming section with real entries is mandatory, including explicit versions.
 if [ -n "${1:-}" ] && [ -n "${2:-}" ]; then
   OLD="${1#v}"
   NEW="${2#v}"
-elif grep -qE '^# Upcoming WeKan' CHANGELOG.md; then
+else
   OLD="${RELEASED[0]:-}"
   if [ -z "$OLD" ]; then
     echo "Error: no released '# vNN.MM <date>' heading found in CHANGELOG.md." >&2
     exit 1
   fi
-  # Always +1, never "whatever the last gap between two headings happened to
-  # be": that used to be measured from RELEASED[0] vs RELEASED[1], so ONE
-  # missing or deleted heading (a release number that was prepared, then
-  # never published, then its CHANGELOG section removed instead of renamed
-  # back to Upcoming) made the gap look like the new normal cadence and
-  # every following release re-applied and widened it - v11.56 -> v11.58 ->
-  # v11.60 -> v11.62 skipped v11.57/59/61 this way, compounding a single
-  # incident into a permanent, ever-growing habit of skipping a number.
   NEW="$(wekan_dec $(( $(wekan_enc "$OLD") + 1 )) )"
-  DATE="$(date +%F)"
-  echo "--- Renaming '# Upcoming WeKan ® release' -> '# v$NEW $DATE WeKan ® release' ---"
-  _tmp="$(mktemp)"
-  sed "s|^# Upcoming WeKan ® release.*|# v$NEW $DATE WeKan ® release|" CHANGELOG.md > "$_tmp" && mv "$_tmp" CHANGELOG.md
-
-  # NO NEW EMPTY "# Upcoming" IS OPENED HERE ON PURPOSE. It used to be, with an
-  # "**In short:** nothing here yet." placeholder, so the file always had
-  # somewhere for the next entry to go and never carried a section saying
-  # nothing. Add "# Upcoming WeKan ® release" yourself, by hand, the moment
-  # there is a real entry for it - see
-  # docs/DeveloperDocs/Changelog-Upcoming-Template.md for the skeleton and why
-  # this is safe: tests/changelogEntriesBelongToTheirRelease.test.cjs is what
-  # actually catches an entry landing in the wrong (already-published)
-  # section, by asking git which commits a release contains, and it does that
-  # regardless of whether an empty Upcoming section existed first.
-else
-  NEW="${RELEASED[0]:-}"
-  OLD="${RELEASED[1]:-}"
-  if [ -z "$NEW" ] || [ -z "$OLD" ]; then
-    echo "Error: could not detect NEW and PREVIOUS version from CHANGELOG.md" >&2
-    echo "(no '# Upcoming WeKan ® release' section, and fewer than two '# vNN.MM' releases)." >&2
-    echo "Add an Upcoming section (preferred) or pass versions: $0 9.35 9.36" >&2
-    exit 1
-  fi
-  EXPECTED="$(wekan_dec $(( $(wekan_enc "$OLD") + 1 )) )"
-  if [ "$NEW" != "$EXPECTED" ]; then
-    echo "Error: newest CHANGELOG version v$NEW is not the +1 increment (v$EXPECTED) of the previous v$OLD." >&2
-    echo "Releases always advance by exactly one minor version. A gap here means a version" >&2
-    echo "number was prepared and never published, and its CHANGELOG section was deleted" >&2
-    echo "instead of renamed back to '# Upcoming WeKan ® release' (see this script's header" >&2
-    echo "comment on a failed-vs-broken release). Fix CHANGELOG.md, or if v$NEW is really" >&2
-    echo "the intended next release, say so explicitly: $0 $OLD $NEW" >&2
-    exit 1
-  fi
-  if git log -15 --format='%s' 2>/dev/null | grep -qF "$NEW"; then
-    echo "    (v$NEW is referenced in a recent commit — treating it as the prepared release.)"
-  fi
 fi
+DATE="$(date +%F)"
+echo "--- Renaming '# Upcoming WeKan ® release' -> '# v$NEW $DATE WeKan ® release' ---"
+_tmp="$(mktemp)"
+sed "s|^# Upcoming WeKan ® release.*|# v$NEW $DATE WeKan ® release|" CHANGELOG.md > "$_tmp" && mv "$_tmp" CHANGELOG.md
+
+# Do not open an empty Upcoming section. Add real notes before the next release.
 
 echo "=== WeKan remote release: v$OLD -> v$NEW ==="
 echo "    Previous version (from CHANGELOG.md): v$OLD"

releases/release-notes.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Print the CHANGELOG.md section that is this release's notes, to stdout.
+# Print release notes, summarizing translation details as affected languages.
 #
 # Usage: releases/release-notes.sh <version> [changelog-file]
 #
@@ -55,13 +55,59 @@ with open(os.environ["CHANGELOG_FILE"], encoding="utf-8") as f:
     content = f.read()
 
 patterns = [
-    rf"(# v{re.escape(version)} .*?)(?=\n# v[0-9]|\Z)",
-    r"(# Upcom\w* WeKan.*?)(?=\n# v[0-9]|\Z)",
+    rf"(^# v{re.escape(version)} [^\n]*\n.*?)(?=^# v[0-9]|\Z)",
+    r"(^# Upcom\w* WeKan [^\n]*\n.*?)(?=^# v[0-9]|\Z)",
 ]
 for pat in patterns:
-    m = re.search(pat, content, re.DOTALL)
+    m = re.search(pat, content, re.DOTALL | re.MULTILINE)
     if m:
-        print(m.group(1).strip())
+        notes = m.group(1).strip()
+        summary = re.search(r"^\*\*In short:\*\* (.*?)(?=\n\s*\n|\Z)", notes, re.MULTILINE | re.DOTALL)
+        if not summary:
+            sys.stderr.write("::error::release-notes: selected release needs an **In short:** summary.\n")
+            sys.exit(1)
+        lines = notes.splitlines(keepends=True)
+        security, languages = [], set()
+        i = 0
+        while i < len(lines):
+            line = lines[i]
+            is_translation = bool(re.match(r"^\*\*Translations\*\*", line))
+            is_security = bool(re.match(r"^\*\*Security(?: hardening)?\*\* - ", line, re.IGNORECASE))
+            is_security_header = bool(re.match(r"^(?:This release |and ).*(?:CRITICAL SECURITY ISSUE|security hardening)", line, re.IGNORECASE))
+            if not (is_translation or is_security or is_security_header):
+                i += 1
+                continue
+            j, depth = i + 1, 0
+            while j < len(lines):
+                next_line = lines[j]
+                boundary = re.match(r"^(?:\*\*[^\n]+\*\* - |and |This release |Thanks to above GitHub)", next_line)
+                if depth == 0 and boundary:
+                    break
+                depth += len(re.findall(r"<details(?:\s[^>]*)?>", next_line))
+                depth -= next_line.count("</details>")
+                j += 1
+            block = "".join(lines[i + 1:j]).strip()
+            if is_translation:
+                names = re.search(r"^\*\*Languages updated:\*\* (.+)$", block, re.MULTILINE)
+                if not names:
+                    sys.stderr.write("::error::release-notes: Translations group needs **Languages updated:** followed by comma-separated language names.\n")
+                    sys.exit(1)
+                languages.update(name.strip() for name in names.group(1).split(",") if name.strip())
+            elif block:
+                security.append((line.strip() + "\n\n" if is_security else "") + block)
+            i = j
+        heading = notes.splitlines()[0].removeprefix("# ")
+        if heading.startswith("Upcoming"):
+            from datetime import date
+            heading = f"v{version} {date.today().isoformat()} WeKan ® release"
+        anchor = re.sub(r"[^\w\s-]", "", heading.lower())
+        anchor = re.sub(r"\s", "-", anchor)
+        output = ["## In short\n\n" + summary.group(1).strip(),
+                  "## Security\n\n" + ("\n\n".join(security) if security else "No security changes."),
+                  "## Translations\n\n" + ("\n".join("- " + name for name in sorted(languages, key=str.casefold)) if languages else "No translation updates."),
+                  "Thanks to above GitHub users for their contributions and translators for their translations.",
+                  f"[More details at ChangeLog](https://github.com/wekan/wekan/blob/main/CHANGELOG.md#{anchor})"]
+        print("\n\n".join(output))
         sys.exit(0)
 # Neither section exists. Print nothing; the caller turns that into an error
 # with a message that says what to add, rather than publishing an empty release.

releases/translations/push-all-translations.mjs

@@ -2,11 +2,37 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import logDirectory from '../../tools/log-directory.cjs';
 import { api, readConfig, localLanguages, readToken } from './sync-transifex-languages.mjs';
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
 const wait = milliseconds => new Promise(resolve => setTimeout(resolve, milliseconds));
 
+export function retryingRequest(request, { sleep = wait, log = console.log, maxAttempts = 6 } = {}) {
+  return async (method, url, body) => {
+    for (let attempt = 1; ; attempt++) {
+      try { return await request(method, url, body); }
+      catch (error) {
+        const transientRead = method === 'GET' && (
+          [408, 500, 502, 503, 504].includes(error.status) ||
+          error instanceof TypeError || ['AbortError', 'TimeoutError'].includes(error.name));
+        // A 429 explicitly refuses the request; other failed writes may already
+        // have created a job, so do not blindly resubmit them.
+        if (attempt >= maxAttempts || !(transientRead || error.status === 429)) throw error;
+        let remaining = Math.max(error.retryAfterMs || 0,
+          error.status === 429 ? 60000 : Math.min(32000, 2000 * 2 ** (attempt - 1)));
+        log(`[tx] ${method} ${url}: ${error.status || error.name}; retry ${attempt + 1}/${maxAttempts} after ${Math.ceil(remaining / 1000)}s`);
+        while (remaining > 0) {
+          const chunk = Math.min(30000, remaining);
+          await sleep(chunk);
+          remaining -= chunk;
+          if (remaining > 0) log(`[tx] retry wait: ${Math.ceil(remaining / 1000)}s remaining`);
+        }
+      }
+    }
+  };
+}
+
 export function validateTranslation(content, source) {
   const data = JSON.parse(content);
   if (!data || Array.isArray(data) || typeof data !== 'object') throw new Error('Expected a JSON object');
@@ -20,7 +46,7 @@ export function validateTranslation(content, source) {
   return data;
 }
 
-export async function uploadFile({ request, resource, language, content, source = false, sleep = wait, maxPolls = 300 }) {
+export async function uploadFile({ request, resource, language, content, source = false, sleep = wait, log = console.log, maxPolls = 300 }) {
   const type = source ? 'resource_strings_async_uploads' : 'resource_translations_async_uploads';
   const relationships = { resource: { data: { type: 'resources', id: resource } } };
   if (!source) relationships.language = { data: { type: 'languages', id: `l:${language}` } };
@@ -30,6 +56,7 @@ export async function uploadFile({ request, resource, language, content, source
     ? { replace_edited_strings: true, keep_translations: true }
     : { file_type: 'default' }) };
   let job = await request('POST', `/${type}`, { data: { type, attributes, relationships } });
+  log(`[tx] upload accepted: ${source ? 'source' : language}; checking job status`);
   const pollURL = job?.data?.links?.self || (job?.data?.id && `/${type}/${encodeURIComponent(job.data.id)}`);
   for (let poll = 0; poll < maxPolls; poll++) {
     const state = job?.data?.attributes;
@@ -39,6 +66,7 @@ export async function uploadFile({ request, resource, language, content, source
     }
     if (!pollURL) throw new Error('Upload response has no job ID or status link');
     if (state?.status !== 'pending' && state?.status !== 'processing') throw new Error(`Unknown upload status: ${state?.status}`);
+    if (poll % 15 === 0) log(`[tx] ${source ? 'source' : language}: ${state.status} (status check ${poll + 1}/${maxPolls})`);
     await sleep(2000);
     job = await request('GET', pollURL);
   }
@@ -55,10 +83,12 @@ export async function pushTranslations({ config, languages, request, readContent
     const content = readContent(config.sourceFile);
     source = JSON.parse(content);
     validateTranslation(content, source);
-    await uploadFile({ request, resource, content, source: true, sleep });
+    log(`[tx] uploading source ${config.sourceLanguage}`);
+    await uploadFile({ request, resource, content, source: true, sleep, log });
     succeeded.push({ file: config.sourceFile, code: config.sourceLanguage, source: true });
     log(`[tx] uploaded source ${config.sourceLanguage}`);
   } catch (error) {
+    log(`[tx] FAILED source ${config.sourceLanguage}: ${error.message}; target uploads cannot proceed`);
     failures.push({ file: config.sourceFile, code: config.sourceLanguage, reason: error.message });
     for (const language of languages) failures.push({ ...language, reason: 'Not uploaded because the source upload failed' });
     return { succeeded, failures };
@@ -109,7 +139,8 @@ export async function pushTranslations({ config, languages, request, readContent
         }
         existing.add(language.code);
       }
-      await uploadFile({ request, resource, language: language.code, content, sleep });
+      log(`[tx] uploading ${language.code} (${language.file}.i18n.json)`);
+      await uploadFile({ request, resource, language: language.code, content, sleep, log });
       succeeded.push(language);
       log(`[tx] uploaded ${language.code} (${language.file}.i18n.json)`);
     } catch (error) {
@@ -170,9 +201,8 @@ export function printUploadSummary(result, log = console.log) {
 }
 
 async function main() {
-  const stamp = new Date();
-  const pad = value => String(value).padStart(2, '0');
-  const timestamp = `${stamp.getFullYear()}-${pad(stamp.getMonth() + 1)}-${pad(stamp.getDate())}_${pad(stamp.getHours())}-${pad(stamp.getMinutes())}-${pad(stamp.getSeconds())}`;
+  const logDir = logDirectory.reserve(path.join(root, '.tools/log'), 'translations-push');
+  const timestamp = path.basename(logDir);
   const statusFile = path.join(root, '.tools/log', `push-all-translations_${timestamp}.txt`);
   fs.mkdirSync(path.dirname(statusFile), { recursive: true });
   // Append so simultaneous invocations cannot truncate another run's status.
@@ -215,17 +245,15 @@ async function main() {
   }
   const token = readToken();
   if (!token) throw new Error('Set TX_TOKEN or configure ~/.transifexrc before uploading');
-  const request = async (method, url, body) => {
+  const request = retryingRequest(async (method, url, body) => {
       try { return await api(token, method, url, body); }
       catch (error) { error.message = error.message.replaceAll(token, '[redacted]'); throw error; }
-    };
+    });
   const result = await pushTranslations({ config, languages, request,
     readContent: filename => fs.readFileSync(filename, 'utf8'),
   });
   result.languageSupport = await languageSupportReport({ request, languages, result });
   const safeResult = JSON.parse(JSON.stringify(result).replaceAll(token, '[redacted]'));
-  const logDir = path.join(root, '.tools/log', `translations-push-${new Date().toISOString().replace(/[:.]/g, '-')}`);
-  fs.mkdirSync(logDir, { recursive: true });
   fs.writeFileSync(path.join(logDir, 'report.json'), `${JSON.stringify(safeResult, null, 2)}\n`);
   printUploadSummary(safeResult);
   console.log(`[tx] report: ${logDir}/report.json`);

releases/translations/sync-transifex-languages.mjs

@@ -120,6 +120,13 @@ export async function api(token, method, url, body) {
     const detail = json?.errors?.map(e => e.detail || e.title).join('; ') || text.slice(0, 300);
     const err = new Error(`${method} ${url} -> ${res.status}: ${detail}`);
     err.status = res.status;
+    const retryAfter = res.headers.get('retry-after');
+    if (retryAfter !== null) {
+      const seconds = Number(retryAfter);
+      const date = Date.parse(retryAfter);
+      const delay = Number.isFinite(seconds) ? seconds * 1000 : date - Date.now();
+      if (Number.isFinite(delay) && delay >= 0) err.retryAfterMs = delay;
+    }
     err.errors = json?.errors || [];
     throw err;
   }

sandstorm-pkgdef.capnp

@@ -22,10 +22,10 @@ const pkgdef :Spk.PackageDefinition = (
     appTitle = (defaultText = "Wekan"),
     # The name of the app as it is displayed to the user.
 
-    appVersion = 1174,
+    appVersion = 1178,
     # Increment this for every release.
 
-    appMarketingVersion = (defaultText = "11.74~2026-09-14"),
+    appMarketingVersion = (defaultText = "11.78~2026-09-14"),
     # Human-readable presentation of the app version.
 
     minUpgradableAppVersion = 0,

server/authentication.js

@@ -82,7 +82,18 @@ export const Authentication = {
     const board = await ReactiveCache.getBoard(boardId);
     Authentication.checkBoardExists(board);
     const adminAccess = board.members.some(e => e.userId === userId && e.isActive && e.isAdmin);
-    await Authentication.checkAdminOrCondition(userId, adminAccess);
+    try {
+      await Authentication.checkAdminOrCondition(userId, adminAccess);
+    } catch (error) {
+      try {
+        require('/server/lib/securityLog').record({
+          key: 'authz.manage-board', action: 'blocked',
+          source: 'rest:board-admin',
+          detail: 'Board management denied because the caller is not an administrator.',
+        });
+      } catch (e) { /* logging must never break the guard */ }
+      throw error;
+    }
   },
 
   // Helper function. Throws a 404 error when the board does not exist, so REST

server/lib/linkedCardPermission.js

@@ -2,6 +2,7 @@ import Boards from '/models/boards';
 import Cards from '/models/cards';
 import { allowIsBoardMemberWithWriteAccess } from '/server/lib/utils';
 import { canUserSeeBoard } from '/server/lib/visibleBoardIds';
+import { sourceRoleBlocksDelegation, recordLinkedWriteDenial } from '/models/lib/linkedWritePolicy';
 
 // Editing a linked card is delegated by the board that contains the link. A
 // user may therefore edit the source when they can write either the source
@@ -13,6 +14,13 @@ export async function canEditCardOrLinkedCard(userId, card, knownSourceBoard) {
 
   const sourceBoard = knownSourceBoard || await Boards.findOneAsync(card.boardId);
   if (allowIsBoardMemberWithWriteAccess(userId, sourceBoard)) return true;
+  // An explicit non-writing source role is a ceiling, including for links
+  // minted before link creation was restricted. A self-owned destination must
+  // not turn source comment/read access into general source write access.
+  if (sourceRoleBlocksDelegation(userId, sourceBoard)) {
+    recordLinkedWriteDenial('linked-card:source-write');
+    return false;
+  }
   // Delegation applies only to a link whose source is still visible. If source
   // access is revoked, a stale link on another board must not remain a write
   // tunnel into the now-hidden card.

server/lib/subtaskDepositAccess.js

@@ -0,0 +1,16 @@
+import Boards from '/models/boards';
+import { allowIsBoardMemberWithWriteAccess } from '/server/lib/utils';
+
+export async function canWriteSubtaskDeposit(userId, boardId) {
+  if (!userId || typeof boardId !== 'string' || !boardId) return false;
+  return allowIsBoardMemberWithWriteAccess(userId, await Boards.findOneAsync(boardId));
+}
+
+export function recordSubtaskDepositDenial(source) {
+  try {
+    require('/server/lib/securityLog').record({
+      key: 'authz.subtask-deposit', action: 'blocked', source,
+      detail: 'Subtask deposit reference or creation denied because the destination is not writable.',
+    });
+  } catch (e) { /* logging must never break the guard */ }
+}

server/lib/subtaskDepositPublication.js

@@ -0,0 +1,43 @@
+import Cards from '/models/cards';
+import CardComments from '/models/cardComments';
+import Checklists from '/models/checklists';
+import ChecklistItems from '/models/checklistItems';
+import CardTextNotes from '/models/cardTextNotes';
+import Attachments from '/models/attachments';
+const { assignedOnlyCardScope } = require('/models/lib/boardCardScope');
+
+// These cursors sit BELOW a reactive, visibility-filtered Boards cursor. Losing
+// destination visibility removes its entire subtree, rather than leaving a
+// snapshot of permission attached to a long-lived cards cursor.
+export function subtaskDepositChildren(userId, isArchived, boardIsLazy) {
+  const entries = [
+    [Cards, 'boardId'], [CardComments, 'boardId'], [Checklists, 'boardId'],
+    [ChecklistItems, 'boardId'], [CardTextNotes, 'boardId'], [Attachments, 'meta.boardId'],
+  ];
+  return entries.map(([collection, boardField]) => ({
+    async find(deposit, sourceBoard) {
+      if (await boardIsLazy(sourceBoard)) return null;
+      const assigned = assignedOnlyCardScope(deposit, userId);
+      let selector;
+      if (collection === Cards) {
+        selector = { boardId: deposit._id, archived: isArchived, ...assigned };
+      } else if (assigned) {
+        return null; // Assigned-only contents follow the reactive card cursor below.
+      } else {
+        selector = { [boardField]: deposit._id };
+      }
+      const result = collection.find(selector);
+      return result.cursor || result;
+    },
+    children: collection === Cards ? entries.slice(1).map(([child]) => ({
+      find(card, deposit) {
+        if (!assignedOnlyCardScope(deposit, userId)) return null;
+        const selector = {
+          [child === Attachments ? 'meta.cardId' : 'cardId']: card._id,
+        };
+        const result = child.find(selector);
+        return result.cursor || result;
+      },
+    })) : [],
+  }));
+}

server/lib/tests/clonebleed.security.tests.js

@@ -234,8 +234,8 @@ describe('CloneBleed authorization', function() {
     it('denies moving a checklist from a source card on a board the caller cannot access', async function() {
       sinon.stub(ReactiveCache, 'getChecklist').resolves({ _id: 'checklist-1', cardId: 'source-card' });
       sinon.stub(ReactiveCache, 'getCard').resolves({ _id: 'card', boardId: 'board-1' });
-      // allowIsBoardMemberByCard resolves the board via Boards.findOneAsync; deny membership.
-      sinon.stub(Boards, 'findOneAsync').resolves({ hasMember: () => false });
+      // The write guard resolves both card boards and denies an outsider.
+      sinon.stub(ReactiveCache, 'getBoard').resolves({ members: [] });
 
       let thrown;
       try {

server/models/boards.js

@@ -146,7 +146,7 @@ Meteor.methods({
     const {
       title,
       slug,
-      permission = 'private',
+      permission: requestedPermission = 'private',
       type = 'board',
       migrationVersion = 1,
       swimlanes = [],
@@ -182,6 +182,22 @@ Meteor.methods({
       }
     }
 
+    // Apply the instance visibility policy on this server-side insert too.
+    // Collection allow/deny does not run for insertAsync inside a method.
+    const privateOnly = await TableVisibilityModeSettings.findOneAsync(
+      'tableVisibilityMode-allowPrivateOnly',
+    );
+    const permission = privateOnly?.booleanValue ? 'private' : requestedPermission;
+    if (privateOnly?.booleanValue && requestedPermission === 'public') {
+      try {
+        require('/server/lib/securityLog').record({
+          key: 'authz.board-visibility', action: 'blocked',
+          source: 'createBoardWithInitialSwimlanes',
+          detail: 'Public board creation overridden by private-only policy.',
+        });
+      } catch (e) { /* logging must never break the guard */ }
+    }
+
     const boardId = await Boards.insertAsync({
       title,
       slug,
@@ -683,6 +699,20 @@ Meteor.methods({
 });
 
 Boards.before.insert(async (userId, doc) => {
+  // Trusted copies, imports and lazy helper creation bypass collection allow
+  // rules too. Enforce the instance policy at the shared insertion boundary.
+  if (doc.permission === 'public') {
+    const privateOnly = await TableVisibilityModeSettings.findOneAsync('tableVisibilityMode-allowPrivateOnly');
+    if (privateOnly?.booleanValue) {
+      doc.permission = 'private';
+      try {
+        require('/server/lib/securityLog').record({
+          key: 'authz.board-visibility', action: 'blocked', source: 'board:insert-policy',
+          detail: 'Public board insertion overridden by private-only policy.',
+        });
+      } catch (e) { /* logging must never break the guard */ }
+    }
+  }
   const lastBoard = await ReactiveCache.getBoard(
     { sort: { $exists: true } },
     { sort: { sort: -1 } },
@@ -1099,7 +1129,7 @@ WebApp.handlers.delete('/api/boards/:boardId', async function(req, res) {
 WebApp.handlers.put('/api/boards/:boardId/title', async function(req, res) {
   try {
     const boardId = req.params.boardId;
-    await Authentication.checkBoardWriteAccess(req.userId, boardId);
+    await Authentication.checkBoardAdmin(req.userId, boardId);
     const title = req.body.title;
 
     await Boards.direct.updateAsync({ _id: boardId }, { $set: { title } });
@@ -1294,7 +1324,7 @@ WebApp.handlers.get('/api/boards/:boardId/cardSettings', async function(req, res
  * key of the board, as `true`/`false`) and of the card-aging thresholds
  * (`cardAgingDays1`..`cardAgingDays3`, non-negative integers). Keys not in
  * the body are left as they are; a body with no recognised key is a 400.
- * Requires board write access. Returns the settings in effect, in the same
+ * Requires board administrator access. Returns the settings in effect, in the same
  * shape as GET.
  *
  * @param {string} boardId the board ID
@@ -1312,7 +1342,7 @@ WebApp.handlers.get('/api/boards/:boardId/cardSettings', async function(req, res
  */
 WebApp.handlers.put('/api/boards/:boardId/cardSettings', async function(req, res) {
   const id = req.params.boardId;
-  await Authentication.checkBoardWriteAccess(req.userId, id);
+  await Authentication.checkBoardAdmin(req.userId, id);
   const board = await ReactiveCache.getBoard(id);
   if (!board) {
     sendJsonResult(res, { code: 404, data: { error: 'Board not found' } });

server/models/cardComments.js

@@ -1,3 +1,4 @@
+import { commentCardMatchesBoard, recordCommentBoundaryDenial } from '/models/lib/commentCardBoundary';
 import { Meteor } from 'meteor/meteor';
 import { WebApp } from 'meteor/webapp';
 import { Authentication } from '/server/authentication';
@@ -166,6 +167,13 @@ WebApp.handlers.post('/api/boards/:boardId/cards/:cardId/comments', async functi
       allowIsBoardMemberCommentOnly(req.userId, board),
     );
 
+    const card = await ReactiveCache.getCard({ _id: paramCardId, boardId: paramBoardId });
+    if (!commentCardMatchesBoard(card, paramCardId, paramBoardId)) {
+      recordCommentBoundaryDenial('rest:comment-insert');
+      sendJsonResult(res, { code: 404, data: { error: 'Card not found' } });
+      return;
+    }
+
     // Validate the required `comment` parameter before inserting. Without this
     // an empty/missing comment reaches the schema-validated insert and throws a
     // circular validation error that previously surfaced as HTTP 500. See #5804.

server/models/cards.js

@@ -1,3 +1,5 @@
+import { canWriteSubtaskDeposit, recordSubtaskDepositDenial } from '/server/lib/subtaskDepositAccess';
+import { recordLinkedWriteDenial } from '/models/lib/linkedWritePolicy';
 import { Meteor } from 'meteor/meteor';
 import { WebApp } from 'meteor/webapp';
 import { check, Match } from 'meteor/check';
@@ -17,6 +19,7 @@ import { assertParentCardIsVisible } from '/server/lib/visibleBoardIds';
 import { computeSubtaskLabelIds } from '/models/lib/subtaskLabelInheritance';
 import Activities from '/models/activities';
 import Boards from '/models/boards';
+import TableVisibilityModeSettings from '/models/tableVisibilityModeSettings';
 import Cards, {
   addCronJob,
   cardAssignees,
@@ -84,6 +87,21 @@ Meteor.methods({
     const boardTitle = (title && title.trim()) || card.title || '';
     if (!boardTitle) throw new Meteor.Error('invalid-title');
 
+    const privateOnly = await TableVisibilityModeSettings.findOneAsync(
+      'tableVisibilityMode-allowPrivateOnly',
+    );
+    const requestedPermission = sourceBoard.permission === 'public' ? 'public' : 'private';
+    const permission = privateOnly?.booleanValue ? 'private' : requestedPermission;
+    if (privateOnly?.booleanValue && requestedPermission === 'public') {
+      try {
+        require('/server/lib/securityLog').record({
+          key: 'authz.board-visibility', action: 'blocked',
+          source: 'createBoardFromCard',
+          detail: 'Inherited public visibility overridden by private-only policy.',
+        });
+      } catch (e) { /* logging must never break the guard */ }
+    }
+
     const boardId = await Boards.insertAsync({
       title: boardTitle,
       slug: getSlug(boardTitle) || 'board',
@@ -97,7 +115,7 @@ Meteor.methods({
           isWorker: false,
         },
       ],
-      permission: sourceBoard.permission === 'public' ? 'public' : 'private',
+      permission,
       color: sourceBoard.color,
       migrationVersion: 1,
     });
@@ -140,7 +158,8 @@ Meteor.methods({
       throw new Meteor.Error('not-found');
     }
     const sourceBoard = await Boards.findOneAsync(sourceCard.boardId);
-    if (!sourceBoard || !allowIsBoardMember(this.userId, sourceBoard)) {
+    if (!sourceBoard || !allowIsBoardMemberWithWriteAccess(this.userId, sourceBoard)) {
+      recordLinkedWriteDenial('createLinkedCard');
       throw new Meteor.Error('not-authorized');
     }
     if (!allowIsBoardMemberWithWriteAccess(this.userId, destinationBoard)) {
@@ -348,6 +367,10 @@ Meteor.methods({
     // board + landing list. These getters never duplicate on the server.
     const targetBoard = await parentBoard.getDefaultSubtasksBoardAsync();
     if (!targetBoard) return undefined;
+    if (!(await canWriteSubtaskDeposit(this.userId, targetBoard._id))) {
+      recordSubtaskDepositDenial('addSubtaskCard');
+      throw new Meteor.Error('not-authorized');
+    }
     const targetList = await targetBoard.getDefaultSubtasksListAsync();
     if (!targetList) return undefined;
 

server/models/changeHistory.js

@@ -1,3 +1,4 @@
+import { requireBoardMutation } from '/models/lib/boardMutationGuard';
 import { Meteor } from 'meteor/meteor';
 import { check, Match } from 'meteor/check';
 import { ReactiveCache } from '/imports/reactiveCache';
@@ -67,9 +68,7 @@ const requireBoardVisible = async (userId, boardId) => {
 
 const requireBoardWrite = async (userId, boardId) => {
   const board = await ReactiveCache.getBoard(boardId);
-  if (!board || !board.hasMember(userId) || board.hasCommentOnly(userId)) {
-    throw new Meteor.Error('not-authorized', 'You cannot change this board.');
-  }
+  requireBoardMutation(userId, board, 'changeHistory:write', Meteor);
 };
 
 async function requireHistoryIntegrity(row, context) {

server/models/checklists.js

@@ -3,7 +3,7 @@ import { WebApp } from 'meteor/webapp';
 import { Authentication } from '/server/authentication';
 import { sendJsonResult } from '/server/apiMiddleware';
 import { ReactiveCache } from '/imports/reactiveCache';
-import { allowIsBoardMemberByCard } from '/server/lib/utils';
+import { requireBoardMutation } from '/models/lib/boardMutationGuard';
 import Checklists from '/models/checklists';
 import ChecklistItems from '/models/checklistItems';
 import Activities from '/models/activities';
@@ -29,15 +29,11 @@ Meteor.methods({
       throw new Meteor.Error('card-not-found', 'Target card not found');
     }
 
-    // allowIsBoardMemberByCard is async; it was previously both unimported and
-    // un-awaited, so the membership check never actually ran. Import + await it.
     const sourceCard = await ReactiveCache.getCard(checklist.cardId);
-    if (!(await allowIsBoardMemberByCard(this.userId, sourceCard))) {
-      throw new Meteor.Error('not-authorized', 'Not authorized to move checklist from source card');
-    }
-    if (!(await allowIsBoardMemberByCard(this.userId, newCard))) {
-      throw new Meteor.Error('not-authorized', 'Not authorized to move checklist to target card');
-    }
+    const sourceBoard = sourceCard && await ReactiveCache.getBoard(sourceCard.boardId);
+    const targetBoard = await ReactiveCache.getBoard(newCard.boardId);
+    requireBoardMutation(this.userId, sourceBoard, 'moveChecklist:source', Meteor);
+    requireBoardMutation(this.userId, targetBoard, 'moveChecklist:destination', Meteor);
 
     const activities = await ReactiveCache.getActivities({ checklistId });
     for (const activity of activities) {

server/models/lists.js

@@ -17,25 +17,10 @@ import { getFeatureFlags } from '/models/lib/featureFlags';
 import { softDeleteSet, restoreModifier, canPurge } from '/models/lib/softDelete';
 import { listsToUnbind } from '/models/lib/listUnbindRepair';
 import ChangeHistory from '/models/changeHistory';
+import { allowIsBoardMemberWithWriteAccess } from '/server/lib/utils';
+import { requireBoardMutation } from '/models/lib/boardMutationGuard';
 
-const hasBoardWriteAccess = (userId, board) => {
-  if (!userId || !board) {
-    return false;
-  }
-
-  if (typeof allowIsBoardMemberWithWriteAccess === 'function') {
-    return allowIsBoardMemberWithWriteAccess(userId, board);
-  }
-
-  return (
-    board.hasMember(userId) &&
-    !board.hasNoComments(userId) &&
-    !board.hasCommentOnly(userId) &&
-    !board.hasWorker(userId) &&
-    !board.hasReadOnly(userId) &&
-    !board.hasReadAssignedOnly(userId)
-  );
-};
+const hasBoardWriteAccess = allowIsBoardMemberWithWriteAccess;
 
 // Soft delete (docs/Features/Undo/Undo.md): mark a list — and cascade-mark its live
 // cards with the SAME deleteBatchId — instead of destroying them, and record a
@@ -333,18 +318,14 @@ Meteor.methods({
     }
 
     const sourceBoard = await Boards.findOneAsync(list.boardId);
-    if (!sourceBoard || !sourceBoard.hasMember(this.userId)) {
-      throw new Meteor.Error('not-authorized', 'Not a member of the source board.');
-    }
+    requireBoardMutation(this.userId, sourceBoard, 'moveList:source', Meteor);
 
     const targetBoard = await ReactiveCache.getBoard(boardId);
     if (!targetBoard) {
       throw new Meteor.Error('board-not-found', 'Target board not found');
     }
 
-    if (!hasBoardWriteAccess(this.userId, targetBoard)) {
-      throw new Meteor.Error('not-authorized', 'Not a member of the target board.');
-    }
+    requireBoardMutation(this.userId, targetBoard, 'moveList:destination', Meteor);
 
     let sort = (await ReactiveCache.getLists({ boardId, archived: false })).length;
     if (neighborListId) {
@@ -403,9 +384,7 @@ Meteor.methods({
     }
 
     const sourceBoard = await Boards.findOneAsync(list.boardId);
-    if (!sourceBoard || !sourceBoard.hasMember(this.userId)) {
-      throw new Meteor.Error('not-authorized', 'Not a member of the source board.');
-    }
+    requireBoardMutation(this.userId, sourceBoard, 'moveList:source', Meteor);
 
     const desiredTitle = typeof title === 'string' && title.trim().length > 0
       ? title.trim()
@@ -416,9 +395,7 @@ Meteor.methods({
       throw new Meteor.Error('board-not-found', 'Target board not found');
     }
 
-    if (!hasBoardWriteAccess(this.userId, targetBoard)) {
-      throw new Meteor.Error('not-authorized', 'Not a member of the target board.');
-    }
+    requireBoardMutation(this.userId, targetBoard, 'moveList:destination', Meteor);
 
     // #6670: a move within the same board now BINDS the list to the chosen
     // swimlane, so that swimlane has to be one of the target board's - binding a

server/models/rules.js

@@ -140,7 +140,7 @@ if (Meteor.isServer) {
   WebApp.handlers.post('/api/boards/:boardId/rules', async function(req, res) {
     try {
       const paramBoardId = req.params.boardId;
-      await Authentication.checkBoardWriteAccess(req.userId, paramBoardId);
+      await Authentication.checkBoardAdmin(req.userId, paramBoardId);
       const { title, trigger, action } = req.body;
       if (!trigger || !action) {
         throw new Meteor.Error('bad-request', 'trigger and action are required');
@@ -190,7 +190,7 @@ if (Meteor.isServer) {
   WebApp.handlers.put('/api/boards/:boardId/rules/:ruleId', async function(req, res) {
     try {
       const paramBoardId = req.params.boardId;
-      await Authentication.checkBoardWriteAccess(req.userId, paramBoardId);
+      await Authentication.checkBoardAdmin(req.userId, paramBoardId);
       const rule = await ReactiveCache.getRule({
         _id: req.params.ruleId,
         boardId: paramBoardId,
@@ -234,7 +234,7 @@ if (Meteor.isServer) {
   WebApp.handlers.delete('/api/boards/:boardId/rules/:ruleId', async function(req, res) {
     try {
       const paramBoardId = req.params.boardId;
-      await Authentication.checkBoardWriteAccess(req.userId, paramBoardId);
+      await Authentication.checkBoardAdmin(req.userId, paramBoardId);
       const rule = await ReactiveCache.getRule({
         _id: req.params.ruleId,
         boardId: paramBoardId,

server/models/settings.js

@@ -8,6 +8,9 @@ import { WebApp } from 'meteor/webapp';
 import { DDP } from 'meteor/ddp';
 import Settings from '/models/settings';
 import InvitationCodes from '/models/invitationCodes';
+import Boards from '/models/boards';
+import InviteToBoardRolesSettings from '/models/inviteToBoardRolesSettings';
+import { canInviteToBoard } from '/models/lib/invitationBoardPermission';
 import EmailLocalization from '/server/lib/emailLocalization';
 import { ensureIndex } from '/server/lib/mongoStartup';
 import { Authentication } from '/server/authentication';
@@ -654,13 +657,29 @@ Meteor.methods({
     let rc = 0;
     check(emails, [String]);
     check(boards, [String]);
+    if (!this.userId) throw new Meteor.Error('not-allowed');
 
     const user = await getReactiveCache().getCurrentUser();
-    if (!user.isAdmin && !(await isNonAdminAllowedToSendMail(user))) {
+    if (!user || (!user.isAdmin && !(await isNonAdminAllowedToSendMail(user)))) {
       rc = -1;
       throw new Meteor.Error('not-allowed');
     }
 
+    // Validate the complete grant before changing a code or sending any mail.
+    const allowedRoles = await InviteToBoardRolesSettings.allowedRoles();
+    for (const boardId of new Set(boards)) {
+      const board = await Boards.findOneAsync(boardId);
+      if (!canInviteToBoard(user, board, allowedRoles)) {
+        try {
+          require('/server/lib/securityLog').record({
+            key: 'authz.invitation-boards', action: 'blocked', source: 'sendInvitation',
+            detail: 'Invitation refused because the caller cannot invite to a requested board.',
+          });
+        } catch (e) { /* logging must never break the guard */ }
+        throw new Meteor.Error('not-allowed');
+      }
+    }
+
     for (const rawEmail of emails) {
       // #4043: store the invitee address lowercase — the sign-up form
       // lowercases the typed address and MongoDB string matching is case

server/permissions/boards.js

@@ -2,6 +2,27 @@ import Boards from '/models/boards';
 import TableVisibilityModeSettings from '/models/tableVisibilityModeSettings';
 import { findWhere, where } from '/imports/lib/collectionHelpers';
 import { allowIsBoardAdminOrSiteAdmin, canUpdateBoardSort, canUpdateBoardSameWidthValue } from '/server/lib/utils';
+import { canWriteSubtaskDeposit, recordSubtaskDepositDenial } from '/server/lib/subtaskDepositAccess';
+
+Boards.deny({
+  async insert(userId, doc) {
+    if (!doc.subtasksDefaultBoardId) return false;
+    if (await canWriteSubtaskDeposit(userId, doc.subtasksDefaultBoardId)) return false;
+    recordSubtaskDepositDenial('ddp:board-insert');
+    return true;
+  },
+  async update(userId, doc, fields, modifier) {
+    if (modifier.$rename && Object.values(modifier.$rename).includes('subtasksDefaultBoardId')) {
+      recordSubtaskDepositDenial('ddp:board-deposit-rename');
+      return true;
+    }
+    const id = modifier.$set && modifier.$set.subtasksDefaultBoardId;
+    if (!id) return false;
+    if (await canWriteSubtaskDeposit(userId, id)) return false;
+    recordSubtaskDepositDenial('ddp:board-deposit');
+    return true;
+  },
+});
 
 Boards.allow({
   async insert(userId, doc) {

server/permissions/cardComments.js

@@ -1,6 +1,24 @@
 import Boards from '/models/boards';
 import CardComments from '/models/cardComments';
+import Cards from '/models/cards';
 import { allowIsBoardMemberCommentOnly, allowIsBoardAdmin } from '/server/lib/utils';
+import { commentCardMatchesBoard, recordCommentBoundaryDenial } from '/models/lib/commentCardBoundary';
+
+CardComments.deny({
+  async insert(userId, doc) {
+    const card = await Cards.findOneAsync(doc.cardId);
+    if (commentCardMatchesBoard(card, doc.cardId, doc.boardId)) return false;
+    recordCommentBoundaryDenial('ddp:comment-insert');
+    return true;
+  },
+  update(userId, doc, fields) {
+    // Comments have no client move operation. Rebinding would otherwise skip
+    // the insert boundary check and inject an existing comment onto another card.
+    if (!fields.some(field => field === 'cardId' || field === 'boardId')) return false;
+    recordCommentBoundaryDenial('ddp:comment-rebind');
+    return true;
+  },
+});
 
 CardComments.allow({
   async insert(userId, doc) {

server/permissions/cards.js

@@ -6,6 +6,28 @@ import { canUserSeeBoard } from '/server/lib/visibleBoardIds';
 import { tripCanary, tripCanaryDeny } from '/server/lib/canary';
 import { canEditCardOrLinkedCard } from '/server/lib/linkedCardPermission';
 const { workerMayUpdateCard } = require('/models/lib/workerCardWrite');
+import { recordLinkedWriteDenial } from '/models/lib/linkedWritePolicy';
+
+async function denyUnauthorizedCardLink(userId, type, linkedId) {
+  if (type !== 'cardType-linkedCard') return false;
+  const source = typeof linkedId === 'string' && await Cards.findOneAsync(linkedId);
+  const board = source && await Boards.findOneAsync(source.boardId);
+  if (allowIsBoardMemberWithWriteAccess(userId, board)) return false;
+  recordLinkedWriteDenial('ddp:card-link');
+  return true;
+}
+
+Cards.deny({
+  async insert(userId, doc) {
+    return await denyUnauthorizedCardLink(userId, doc.type, doc.linkedId);
+  },
+  async update(userId, doc, fields, modifier) {
+    if (!fields.some(field => field === 'type' || field === 'linkedId')) return false;
+    const set = modifier.$set || {};
+    return await denyUnauthorizedCardLink(userId, set.type || doc.type, set.linkedId || doc.linkedId);
+  },
+  fetch: ['type', 'linkedId'],
+});
 
 // GHSA-jvv9-498p-hxrg: may this user name that card as a parent? Only if they
 // may see the board it is on — the same question the `board` publication asks

server/permissions/users.js

@@ -1,7 +1,7 @@
 import Users, { isUserUpdateAllowed, hasForbiddenUserUpdateField } from '/models/users';
 
 Users.allow({
-  update(userId, doc, fields /*, modifier */) {
+  update(userId, doc, fields, modifier) {
     // Only the owner can update, and only for allowed fields
     if (!userId || doc._id !== userId) {
       return false;
@@ -10,7 +10,7 @@ Users.allow({
       return false;
     }
     // Disallow if any forbidden field present
-    if (hasForbiddenUserUpdateField(fields)) {
+    if (hasForbiddenUserUpdateField(fields, modifier)) {
       return false;
     }
     // Allow only username and profile.*
@@ -28,8 +28,17 @@ Users.allow({
 
 // Deny any attempts to touch forbidden fields from client updates
 Users.deny({
-  update(userId, doc, fields /*, modifier */) {
-    const denied = hasForbiddenUserUpdateField(fields);
+  update(userId, doc, fields, modifier) {
+    const denied = hasForbiddenUserUpdateField(fields, modifier);
+    if (denied && fields.some(field => field === 'profile' ||
+      field === 'profile.invitedBoards' || field.startsWith('profile.invitedBoards.'))) {
+      try {
+        require('/server/lib/securityLog').record({
+          key: 'authz.invitation-profile', action: 'blocked', source: 'ddp:user-profile',
+          detail: 'Client modification of server-issued board invitations denied.',
+        });
+      } catch (e) { /* logging must never break the guard */ }
+    }
     return denied;
   },
   fetch: [],

server/publications/boards.js

@@ -1,3 +1,4 @@
+import { subtaskDepositChildren } from '/server/lib/subtaskDepositPublication';
 // This is the publication used to display the board list. We publish all the
 // non-archived boards:
 // 1. that the user is a member of
@@ -25,7 +26,7 @@ const {
   effectiveBoardCardsMode,
   DEFAULT_LAZY_THRESHOLD,
 } = require('/models/lib/cardsLoading');
-const { boardCardScope } = require('/models/lib/boardCardScope');
+const { boardCardScope, assignedOnlyCardScope } = require('/models/lib/boardCardScope');
 const { boardVisibilitySelectors } = require('/models/lib/boardVisibilitySelectors');
 
 // Card-loading mode (Admin Panel / Features): 'all' ships every card/checklist to
@@ -819,6 +820,15 @@ publishComposite('board', async function(boardId, isArchived, generation) {
       );
     },
     children: [
+      {
+        find(board) {
+          if (!board.subtasksDefaultBoardId || board.subtasksDefaultBoardId === board._id) return null;
+          return Boards.find({ _id: board.subtasksDefaultBoardId, $or }, {
+            fields: { title: 1, permission: 1, members: 1 },
+          });
+        },
+        children: subtaskDepositChildren(thisUserId, isArchived, boardIsLazy),
+      },
       // Lists
       {
         async find(board) {
@@ -897,7 +907,6 @@ publishComposite('board', async function(boardId, isArchived, generation) {
           // Lazy mode: checklists are published per visible card by boardCardsWindow.
           if (await boardIsLazy(board)) return null;
           const boardIds = [board._id];
-          if (board.subtasksDefaultBoardId) boardIds.push(board.subtasksDefaultBoardId);
           // Assigned-only members must not receive checklists for cards they are
           // not assigned to; boardId alone cannot express that, so fall back to
           // the assigned cards' ids for those members.
@@ -922,7 +931,6 @@ publishComposite('board', async function(boardId, isArchived, generation) {
           // Lazy mode: checklist items are published per visible card by boardCardsWindow.
           if (await boardIsLazy(board)) return null;
           const boardIds = [board._id];
-          if (board.subtasksDefaultBoardId) boardIds.push(board.subtasksDefaultBoardId);
           if (thisUserId && board.members) {
             const member = findWhere(board.members, { userId: thisUserId, isActive: true });
             if (member && (member.isNormalAssignedOnly || member.isCommentAssignedOnly || member.isReadAssignedOnly)) {
@@ -946,7 +954,6 @@ publishComposite('board', async function(boardId, isArchived, generation) {
           // Lazy mode: comments are published per visible card by boardCardsWindow.
           if (await boardIsLazy(board)) return null;
           const boardIds = [board._id];
-          if (board.subtasksDefaultBoardId) boardIds.push(board.subtasksDefaultBoardId);
           // Assigned-only members must only receive comments for cards assigned to
           // them; boardId alone cannot express that, so fall back to the assigned
           // cards' ids for those members (same as checklists above).
@@ -971,7 +978,6 @@ publishComposite('board', async function(boardId, isArchived, generation) {
         async find(board) {
           if (await boardIsLazy(board)) return null;
           const boardIds = [board._id];
-          if (board.subtasksDefaultBoardId) boardIds.push(board.subtasksDefaultBoardId);
           if (thisUserId && board.members) {
             const member = findWhere(board.members, { userId: thisUserId, isActive: true });
             if (member && (member.isNormalAssignedOnly || member.isCommentAssignedOnly || member.isReadAssignedOnly)) {
@@ -994,7 +1000,6 @@ publishComposite('board', async function(boardId, isArchived, generation) {
           // Lazy mode: attachments are published per visible card by boardCardsWindow.
           if (await boardIsLazy(board)) return null;
           const boardIds = [board._id];
-          if (board.subtasksDefaultBoardId) boardIds.push(board.subtasksDefaultBoardId);
           if (thisUserId && board.members) {
             const member = findWhere(board.members, { userId: thisUserId, isActive: true });
             if (member && (member.isNormalAssignedOnly || member.isCommentAssignedOnly || member.isReadAssignedOnly)) {
@@ -1316,11 +1321,16 @@ Meteor.methods({
     if (!board || !board.isVisibleBy({ _id: this.userId })) {
       throw new Meteor.Error('not-authorized');
     }
-    const boardIds = [board._id];
-    if (board.subtasksDefaultBoardId) boardIds.push(board.subtasksDefaultBoardId);
+    const statusClauses = [{ boardId: board._id, ...assignedOnlyCardScope(board, this.userId) }];
+    const visibleDeposits = await visibleBoardIds(this.userId, [board.subtasksDefaultBoardId]);
+    if (visibleDeposits.has(board.subtasksDefaultBoardId)) {
+      const deposit = await Boards.findOneAsync(board.subtasksDefaultBoardId);
+      if (deposit) statusClauses.push({ boardId: deposit._id, ...assignedOnlyCardScope(deposit, this.userId) });
+    }
+    const statusCardScope = { $or: statusClauses };
 
-    const cards = await Cards.find({ boardId: { $in: boardIds }, archived: false }).countAsync();
-    const archivedCards = await Cards.find({ boardId: { $in: boardIds }, archived: true }).countAsync();
+    const cards = await Cards.find({ ...statusCardScope, archived: false }).countAsync();
+    const archivedCards = await Cards.find({ ...statusCardScope, archived: true }).countAsync();
     const swimlanes = (await ReactiveCache.getSwimlanes({ boardId: board._id, archived: false })).length;
     const lists = (await ReactiveCache.getLists({ boardId: board._id, archived: false })).length;
     const customFields = (await ReactiveCache.getCustomFields({ boardIds: { $in: [board._id] } })).length;
@@ -1332,7 +1342,7 @@ Meteor.methods({
     // and how many are flagged overtime. Only cards WITH time are fetched (spentTime
     // > 0), so this stays cheap even on a large board.
     const timeCards = await Cards.find(
-      { boardId: { $in: boardIds }, archived: false, spentTime: { $gt: 0 } },
+      { ...statusCardScope, archived: false, spentTime: { $gt: 0 } },
       { fields: { spentTime: 1, isOvertime: 1 } },
     ).fetchAsync();
     const timeSpentTotal = timeCards.reduce((sum, c) => sum + (Number(c.spentTime) || 0), 0);

server/publications/swimlanes.js

@@ -1,3 +1,4 @@
+import { requireBoardMutation } from '/models/lib/boardMutationGuard';
 import { ReactiveCache } from '/imports/reactiveCache';
 import Boards from '/models/boards';
 import { allowIsBoardMember, allowIsBoardMemberWithWriteAccess } from '/server/lib/utils';
@@ -36,12 +37,10 @@ Meteor.methods({
     const swimlane = await ReactiveCache.getSwimlane(swimlaneId);
     if (!swimlane) throw new Meteor.Error('not-found');
     const sourceBoard = await Boards.findOneAsync(swimlane.boardId);
-    if (!allowIsBoardMember(this.userId, sourceBoard))
-      throw new Meteor.Error('not-authorized');
+    requireBoardMutation(this.userId, sourceBoard, 'moveSwimlane:source', Meteor);
     const toBoard = await ReactiveCache.getBoard(toBoardId);
     if (!toBoard) throw new Meteor.Error('not-found');
-    if (!allowIsBoardMemberWithWriteAccess(this.userId, toBoard))
-      throw new Meteor.Error('not-authorized');
+    requireBoardMutation(this.userId, toBoard, 'moveSwimlane:destination', Meteor);
 
     await swimlane.move(toBoardId, targetSwimlaneId, position, title);
     return true;

server/rulesButton.js

@@ -8,6 +8,7 @@ import Actions from '/models/actions';
 import { canDeleteBoardRule } from '/models/lib/ruleDeletePermission';
 import { allowIsBoardMemberWithWriteAccess } from '/server/lib/utils';
 import { tripCanary } from '/server/lib/canary';
+import { requireButtonRuleContext } from '/models/lib/buttonRulePermission';
 
 // Button rules are manual: a user clicks a card/board button and we run the
 // rule's action immediately. This method runs one button rule on demand.
@@ -15,6 +16,7 @@ Meteor.methods({
   async 'rules.runButton'(ruleId, cardId) {
     check(ruleId, String);
     check(cardId, Match.Optional(String));
+    if (!this.userId) throw new Meteor.Error('not-authorized');
 
     const rule = await ReactiveCache.getRule(ruleId);
     if (!rule) throw new Meteor.Error('not-found', 'Rule not found');
@@ -24,11 +26,10 @@ Meteor.methods({
       throw new Meteor.Error('not-a-button', 'Rule is not a button rule');
     }
 
-    // The user must be a member of the board the rule belongs to.
+    // A manual rule is a write, and its card must be on the rule's board.
     const board = await ReactiveCache.getBoard(rule.boardId);
-    if (!board || !board.hasMember(this.userId)) {
-      throw new Meteor.Error('not-authorized', 'Not a board member');
-    }
+    const card = cardId === undefined ? undefined : await ReactiveCache.getCard(cardId);
+    requireButtonRuleContext(this.userId, board, cardId, card, Meteor);
 
     const action = await ReactiveCache.getAction(rule.actionId);
     if (!action) throw new Meteor.Error('not-found', 'Action not found');

server/rulesHelper.js

@@ -1,3 +1,4 @@
+import { requireButtonRuleContext } from '/models/lib/buttonRulePermission';
 import { DDP } from 'meteor/ddp';
 import { ReactiveCache } from '/imports/reactiveCache';
 import { TAPi18n } from '/imports/i18n';
@@ -266,6 +267,10 @@ export const RulesHelper = {
   },
   async performAction(activity, action) {
     const card = await ReactiveCache.getCard(activity.cardId);
+    if (activity.activityType === 'button') {
+      const sourceBoard = await ReactiveCache.getBoard(activity.boardId);
+      requireButtonRuleContext(activity.userId, sourceBoard, activity.cardId, card, Meteor);
+    }
     // Most actions operate on a card. Scheduled / button rules may run a
     // board-level action with no card context (e.g. create a card every Monday),
     // so allow those specific action types to proceed without a card.

snapcraft.yaml

@@ -19,7 +19,7 @@
 #   base: core24 (not core26) · no build-base: devel · grade: stable
 # ─────────────────────────────────────────────────────────────────────────────
 name: wekan
-version: '11.74'
+version: '11.78'
 base: core24
 confinement: strict
 grade: stable
@@ -693,18 +693,18 @@ parts:
                 armhf)   WEKAN_ARCH="armhf"   ;;
                 *) echo "Unsupported architecture: ${CRAFT_ARCH_BUILD_FOR}"; exit 1 ;;
             esac
-            WEKAN_ZIP="wekan-11.74-${WEKAN_ARCH}.zip"
+            WEKAN_ZIP="wekan-11.78-${WEKAN_ARCH}.zip"
             echo "Cleaning environment first"
             rm -rf .build
             mkdir .build
             cd .build
-            #wget https://github.com/wekan/wekan/releases/download/v11.74/wekan-11.74-amd64.zip
+            #wget https://github.com/wekan/wekan/releases/download/v11.78/wekan-11.78-amd64.zip
             # Retry: a release asset can 404 for a short while right after it is
             # uploaded (CDN/propagation lag), and a plain wget treated that as
             # fatal. --retry-on-http-error covers the 404/5xx window; a genuinely
             # missing bundle still fails after the tries are spent.
             wget --tries=20 --waitretry=20 --retry-on-http-error=404,403,500,502,503 \
-              "https://github.com/wekan/wekan/releases/download/v11.74/${WEKAN_ZIP}"
+              "https://github.com/wekan/wekan/releases/download/v11.78/${WEKAN_ZIP}"
             unzip "${WEKAN_ZIP}"
             rm "${WEKAN_ZIP}"
             # Copy to Snap. Use the bundle's OWN arch-correct Node.js: the

tests/activityViewer.test.cjs

@@ -0,0 +1,73 @@
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const vm = require('node:vm');
+const test = require('node:test');
+const sanitizeHTML = require('sanitize-html');
+const source = fs.readFileSync('client/components/activities/activities.js', 'utf8');
+const jade = fs.readFileSync('client/components/activities/activities.jade', 'utf8');
+
+test('both activity feeds render values through the shared HTML/Markdown/emoji viewer', () => {
+  assert.match(jade, /\+activity\(activity=activityData card=card mode=mode\)/);
+  assert.doesNotMatch(jade, /\(sanitize |\{\{\{_ /);
+  assert.match(jade, /activityMessage 'activity-changedTitle' \(activityValue activity.value\)/);
+  assert.match(source, /activityValue\(value\)[\s\S]*?return titleViewerHtml/);
+  assert.match(source, /stripLinks: !!\(setting && setting.renderLinksAsPlainText\)/);
+  assert.match(source, /\^https\?:/);
+  assert.match(jade, /div\.activity-desc/);
+});
+
+test('rich activity links preserve allowed HTML and avoid nested anchors', () => {
+  const html = {
+    Raw: value => value,
+    A: (attrs, text) => `<a href="${attrs.href}">${text}</a>`,
+    SPAN: (...values) => `<span>${values.join('')}</span>`,
+  };
+  const context = { HTML: html, Blaze: { toHTML: value => value },
+    titleViewerHtml: value => value,
+    sanitizeHTML,
+  };
+  const start = source.indexOf('function linkedActivityValue(');
+  const end = source.indexOf('\nfunction createBoardLink', start);
+  vm.runInNewContext(source.slice(start, end), context);
+  assert.equal(context.linkedActivityValue('<strong>👍</strong>', '', 'card'), '<strong>👍</strong>');
+  assert.equal(context.linkedActivityValue('<strong>👍</strong><script>bad()</script>', '/card', 'card'),
+    '<a href="/card"><strong>👍</strong></a>');
+  const linked = context.linkedActivityValue('<a href="https://example.com">Title</a>', '/card', 'card');
+  assert.equal(linked, '<span><a href="https://example.com">Title</a> <a href="/card">↗</a></span>');
+});
+
+// Browsers accept malformed closing tags; exercise the real parser rather
+// than a regex substitute that could hide a sanitizer regression.
+test('activity sanitizer handles malformed script end tags', () => {
+  for (const input of ['<script>bad()</script foo="bar">', '<SCRIPT>bad()</SCRIPT >']) {
+    assert.equal(sanitizeHTML('<strong>Title</strong>' + input), '<strong>Title</strong>');
+  }
+  assert.doesNotMatch(fs.readFileSync(__filename, 'utf8'), /sanitizeHTML:\s*value\s*=>\s*value\.replace/);
+});
+
+// Use the actual formatter so literal placeholders cannot pass a mocked API.
+test('activity messages substitute all values and discard Spacebars options', async () => {
+  const i18next = require('i18next');
+  const sprintf = require('i18next-sprintf-postprocessor');
+  const i18n = i18next.createInstance().use(sprintf);
+  await i18n.init({ lng: 'en', resources: { en: { translation: {
+    added: "added label '%s' to %s", moved: 'moved %s from %s to %s',
+    comment: 'on %s', deleted: 'deleted an attachment from %s',
+  } } }, postProcess: ['sprintf'], interpolation: { escapeValue: false } });
+  let plainLinks = false;
+  const body = source.split('  activityMessage(key, ...values) {')[1].split('\n  },')[0];
+  const helper = new Function('ReactiveCache', 'TAPi18n', 'sanitizeHTML', `return function(key, ...values) {${body}}`)(
+    { getCurrentSetting: () => ({ renderLinksAsPlainText: plainLinks }) },
+    { __: (key, options) => i18n.t(key, options) },
+    (value, options) => sanitizeHTML(value, { allowedTags: options.stripLinks ? ['strong', 'em'] : ['a', 'strong', 'em'], allowedAttributes: { a: ['href'] } }),
+  );
+  const link = '<a href="/card">Demo 👍</a>';
+  assert.equal(helper('added', '<em>Feature</em>', link, { hash: {} }), "added label '<em>Feature</em>' to " + link);
+  assert.equal(helper('moved', 'CARD', 'OLD', 'NEW', { hash: {} }), 'moved CARD from OLD to NEW');
+  assert.equal(helper('comment', link, { hash: {} }), 'on ' + link);
+  assert.equal(helper('deleted', 'CARD', { hash: {} }), 'deleted an attachment from CARD');
+  assert.equal(helper('comment', '100% safe %s', { hash: {} }), 'on 100% safe %s');
+  assert.doesNotMatch(helper('comment', '<script>bad()</script><strong>Good</strong>', { hash: {} }), /script|bad/);
+  plainLinks = true;
+  assert.equal(helper('comment', link, { hash: {} }), 'on Demo 👍');
+});

tests/advancedFilterAuditedTranslations.test.cjs

@@ -9,7 +9,7 @@ const examples = ['== != <= >= && || ( )', 'Field1 == Value1', "'Field 1' == 'Va
 (async () => {
   const { repairProgress } = await import('../releases/translations/audit-progress.mjs');
   const result = repairProgress();
-  for (const locale of ['ar', 'ar-DZ', 'ar-EG', 'lt', 'mn', 'el', 'el-GR', 'sk']) {
+  for (const locale of ['ar', 'ar-DZ', 'ar-EG', 'lt', 'mn', 'el', 'el-GR', 'sk', 'eo']) {
     const data = read(locale);
     const help = data['advanced-filter-description'];
     assert.notEqual(help, source, locale);
@@ -25,6 +25,17 @@ const examples = ['== != <= >= && || ( )', 'Field1 == Value1', "'Field 1' == 'Va
       assert.doesNotMatch(data['import-board-instruction-trello'], /In your Trello board/);
     }
   }
+  assert.match(read('eo')['advanced-filter-description'], /specialajn signojn.*literalajn signojn/);
+  assert.doesNotMatch(read('eo')['advanced-filter-description'], /regsignojn|Kampo1|Valoro1/);
+  // Syntax-only repair: Finnish prose remains an open Veps language finding.
+  const vepsHelp = read('ve-PP')['advanced-filter-description'];
+  for (const example of examples) {
+    assert.ok(vepsHelp.includes(example), `Veps: exact executable example ${example}`);
+  }
+  assert.deepEqual(vepsHelp.match(/\\+/g), source.match(/\\+/g),
+    'Veps: standalone escape markers match source inventory');
+  assert.ok(result.pendingByLocale['ve-PP'] > 0, 'Veps language review stays open');
+  assert.ok(!vepsHelp.includes("Field1 = I"), 'Veps: reject malformed comparison');
   assert.match(read('lt')['advanced-filter-description'], /Išplėstinis filtras/);
   assert.match(read('mn')['advanced-filter-description'], /Нарийвчилсан шүүлтүүр/);
   assert.match(read('el')['advanced-filter-description'], /προηγμένο φίλτρο/);

tests/auditedTranslationCorrections.test.cjs

@@ -21,6 +21,11 @@ const tokens = value => [...value.matchAll(/__[A-Za-z0-9]+(?:_[A-Za-z0-9]+)*__|%
     assert.notEqual(row.before, row.after, identity);
     assert.equal(repairLocale(row.locale, { [row.key]: row.before }).data[row.key], row.after);
     assert.equal(repairLocale(row.locale, { [row.key]: 'NEW REVIEWED TRANSLATION' }).data[row.key], 'NEW REVIEWED TRANSLATION', 'preserve newer wording');
+    if (row.locale === 'zgh' && ['board-public-info', 'board-private-info'].includes(row.key)) {
+      assert.deepEqual(row.after.match(/<[^>]+>/g), english[row.key].match(/<[^>]+>/g), 'visibility notice retains source HTML emphasis');
+      assert.ok(!/[\u0600-\u06ff]/u.test(row.after), 'visibility notice no longer contains Arabic');
+      assert.ok(row.after.includes('ⵔⴰ ⴰⴷ ⵜⵉⵍⵉ'), 'visibility notice retains the future state');
+    }
     if (row.key === 'copyManyCardsPopup-format') {
       const example = JSON.parse(row.after);
       assert.ok(Array.isArray(example));
@@ -35,6 +40,8 @@ const tokens = value => [...value.matchAll(/__[A-Za-z0-9]+(?:_[A-Za-z0-9]+)*__|%
     assert.doesNotMatch(cache.zgh[key], /Mot de passe|Nom d.utilisateur|requis/);
     assert.match(cache.zgh[key], /ⵜⴰⴳⵓⵔⵉ ⵏ ⵓⵣⵔⴰⵢ/);
   }
+  assert.equal(cache.zgh['predicate-all'], 'ⴰⴽⴽⵯ');
+  assert.doesNotMatch(cache.zgh['predicate-all'], /[\s:]/, 'All remains a single query predicate token');
   assert.equal(cache.zgh.labels, 'ⵉⵔⵛⵓⵎⵏ');
   assert.equal(cache.zgh['no-results'], 'ⵓⵔ ⵍⵍⵉⵏⵜ ⵜⵢⴰⴼⵓⵜⵉⵏ');
   for (const key of ['user-username-not-found', 'label-not-found', 'label-color-not-found']) {
@@ -2893,8 +2900,8 @@ const tokens = value => [...value.matchAll(/__[A-Za-z0-9]+(?:_[A-Za-z0-9]+)*__|%
     assert.doesNotMatch(value, /[\u0600-\u06FF]|Connexion|Déconnexion|Les mots/, key);
   }
   assert.notEqual(cache.zgh.login, cache.zgh.logout);
-  assert.equal(cache.zgh['delete-all-notifications'], 'ⴽⴽⵙ ⵉⵍⵖⴰ ⴰⴽⴽ');
-  assert.match(cache.zgh['delete-all-notifications'], /ⵉⵍⵖⴰ ⴰⴽⴽ$/);
+  assert.equal(cache.zgh['delete-all-notifications'], 'ⴽⴽⵙ ⴰⴽⴽⵯ ⵜⵉⵏⵖⵎⵉⵙⵉⵏ');
+  assert.match(cache.zgh['delete-all-notifications'], /ⴰⴽⴽⵯ ⵜⵉⵏⵖⵎⵉⵙⵉⵏ$/);
   assert.doesNotMatch(cache.zgh['delete-all-notifications'], /Supprimer|notifications/);
   const quechuaBasicColors = {"color-black": "yana", "color-red": "puka", "color-white": "yuraq"};
   for (const [key, value] of Object.entries(quechuaBasicColors)) {
@@ -2931,3 +2938,74 @@ const tokens = value => [...value.matchAll(/__[A-Za-z0-9]+(?:_[A-Za-z0-9]+)*__|%
   assert.notEqual(cache.chr['calendar-system-islamic-rgsa'], cache.chr['calendar-system-islamic-tbla']);
   console.log(`auditedTranslationCorrections: ${corrections.length} corrections verified; tokens, JSON examples, key order, idempotency and newer translations preserved`);
 })().catch(error => { console.error(error); process.exitCode = 1; });
+
+// Danish restored-value review: legal-link agreement and the malloc metric.
+{
+  const da = JSON.parse(require('node:fs').readFileSync(require('node:path').join(__dirname, '../imports/i18n/data/da.i18n.json'), 'utf8'));
+  require('node:assert/strict').equal(da.legalNotice, 'juridisk meddelelse');
+  require('node:assert/strict').match(da.Node_heap_malloced_memory, /hukommelse allokeret med malloc$/);
+  require('node:assert/strict').notEqual(da.Node_heap_malloced_memory, 'Node heap: allokeret hukommelse');
+}
+
+// Galician automation date triggers must cover both first setting and changes.
+{
+  const gl = JSON.parse(require('node:fs').readFileSync(require('node:path').join(__dirname, '../imports/i18n/data/gl.i18n.json'), 'utf8'));
+  const assert = require('node:assert/strict');
+  const kinds = { due: 'vencemento', start: 'inicio', end: 'fin', received: 'recepción' };
+  for (const [kind, noun] of Object.entries(kinds)) {
+    const value = gl[`r-when-a-${kind}-date-changed`];
+    assert.equal(value, `Cando se establece ou cambia a data de ${noun}`);
+    assert.doesNotMatch(value, /início|Fim|Recebido|limite/);
+  }
+}
+
+// Clearing a Galician card field value must not claim its definition was deleted.
+{
+  const gl = JSON.parse(require('node:fs').readFileSync(require('node:path').join(__dirname, '../imports/i18n/data/gl.i18n.json'), 'utf8'));
+  const assert = require('node:assert/strict');
+  assert.equal(gl['activity-unset-customfield'], "quitou o valor do campo personalizado '%s' en %s");
+  assert.notEqual(gl['activity-unset-customfield'], "quitou o campo personalizado '%s' en %s");
+}
+
+{
+  const gl = JSON.parse(require('node:fs').readFileSync(require('node:path').join(__dirname, '../imports/i18n/data/gl.i18n.json'), 'utf8'));
+  const assert = require('node:assert/strict');
+  assert.equal(gl.Node_heap_does_zap_garbage, 'Memoria heap de Node: sobrescribe o lixo cun patrón de bits');
+  assert.notEqual(gl.Node_heap_does_zap_garbage, 'Memoria heap de Node: limpa o lixo (zap garbage)');
+}
+
+// Received date captions describe a feminine Galician tarxeta.
+{
+  const gl = JSON.parse(require('node:fs').readFileSync(require('node:path').join(__dirname, '../imports/i18n/data/gl.i18n.json'), 'utf8'));
+  const assert = require('node:assert/strict');
+  assert.equal(gl['card-received'], 'Recibida');
+  assert.equal(gl['card-received-on'], 'Recibida o');
+  assert.notEqual(gl['card-received'], 'Recibido');
+  assert.notEqual(gl['card-received-on'], 'Recibido o');
+}
+
+// Completed subtask tooltip agrees with feminine Galician subtarefa.
+{
+  const gl = JSON.parse(require('node:fs').readFileSync(require('node:path').join(__dirname, '../imports/i18n/data/gl.i18n.json'), 'utf8'));
+  const assert = require('node:assert/strict');
+  assert.equal(gl.completed, 'Completada');
+  assert.notEqual(gl.completed, 'Completado');
+}
+
+// Basque archived activity states use archive terminology, not generic storage.
+{
+  const eu = JSON.parse(require('node:fs').readFileSync(require('node:path').join(__dirname, '../imports/i18n/data/eu.i18n.json'), 'utf8'));
+  const assert = require('node:assert/strict');
+  for (const kind of ['Board', 'Card', 'List', 'Swimlane']) {
+    assert.match(eu['act-archived' + kind], /artxibora eraman da/);
+    assert.doesNotMatch(eu['act-archived' + kind], /biltegira/);
+  }
+}
+
+// Basque all-status search distinguishes archiving from generic storage.
+{
+  const eu = JSON.parse(require('node:fs').readFileSync(require('node:path').join(__dirname, '../imports/i18n/data/eu.i18n.json'), 'utf8'));
+  const assert = require('node:assert/strict');
+  assert.equal(eu['globalSearch-instructions-status-all'], '`__predicate_all__` - artxibatutako eta artxibatu gabeko txartel guztiak');
+  assert.doesNotMatch(eu['globalSearch-instructions-status-all'], /biltegiratu/);
+}

tests/auditedTranslationReviews.test.cjs

@@ -24,10 +24,11 @@ const root = path.resolve(__dirname, '..');
   assert.equal(reviews.find(row => row.locale === 'gl-ES' && row.key === 'r-items-list').value, 'elemento1,elemento2,elemento3', 'correct Galician example remains unchanged');
   const placeholderTemplate = fs.readFileSync(path.join(root, 'client/components/rules/actions/checklistActions.jade'), 'utf8');
   assert.match(placeholderTemplate, /input\(id="checklist-items",type=text,placeholder="{{_'r-items-list'}}"\)/);
-  for (const review of reviews.filter(row => row.key === 'r-items-list' && !['sk', 'gl', 'gl-ES', 'an'].includes(row.locale))) {
+  for (const review of reviews.filter(row => row.key === 'r-items-list' && !['sk', 'gl', 'gl-ES', 'an', 'eo'].includes(row.locale))) {
     assert.deepEqual(review.value.split(',').map(value => value.trim().replace(/ /g, '')), ['item1', 'item2', 'item3']);
     assert.match(review.reason, /placeholder demonstrates/);
   }
+  assert.equal(reviews.find(row => row.locale === 'eo' && row.key === 'r-items-list').value, 'ero1,ero2,ero3', 'Esperanto example item names remain translated; commas preserve input syntax');
   assert.equal(reviews.find(row => row.locale === 'an' && row.key === 'r-items-list').value, 'elemento1,elemento2,elemento3', 'native Aragonese example restored after mistaken English replacement');
   assert.equal(reviews.find(row => row.locale === 'sk' && row.key === 'r-items-list').value, 'položka1,položka2,položka3', 'valid Slovak example vocabulary remains unchanged');
   for (const locale of ['de', 'de-AT', 'de-CH', 'de_DE', 'sk', 'fr', 'fr-BE', 'fr-CA', 'fr-CH', 'fr-FR', 'cs', 'cs-CZ', 'hu', 'it', 'es', 'es-LA', 'pt', 'pt-BR', 'pt-PT', 'pt_PT', 'nl', 'nl-NL', 'nb', 'sv', 'vl-SS']) {

tests/basqueRuleArchive.test.cjs

@@ -0,0 +1,12 @@
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const test = require('node:test');
+test('Basque rule labels distinguish archiving from storage and restoration direction', () => {
+  const data = JSON.parse(fs.readFileSync('imports/i18n/data/eu.i18n.json', 'utf8'));
+  assert.equal(data['r-archived'], 'Artxibora eraman da');
+  assert.equal(data['r-unarchived'], 'Artxibotik berreskuratu da');
+  for (const key of ['r-archived', 'r-unarchived']) assert.doesNotMatch(data[key], /bilteg/i);
+  const template = fs.readFileSync('client/components/rules/triggers/boardTriggers.jade', 'utf8');
+  assert.match(template, /value="archived".*r-archived/);
+  assert.match(template, /value="unarchived".*r-unarchived/);
+});

tests/boardCardScope.test.cjs

@@ -20,29 +20,29 @@ const {
 let passed = 0;
 function check(name, fn) { fn(); passed += 1; console.log('  ok -', name); }
 
-check('a board with no subtasks-default board keeps the null $in member', () => {
-  assert.deepStrictEqual(boardScopeIds({ _id: 'B' }), ['B', null]);
-  assert.deepStrictEqual(boardCardScope({ _id: 'B' }), { boardId: { $in: ['B', null] } });
+check('a board without a deposit excludes null and orphan card boards', () => {
+  assert.deepStrictEqual(boardScopeIds({ _id: 'B' }), ['B']);
+  assert.deepStrictEqual(boardCardScope({ _id: 'B' }), { boardId: { $in: ['B'] } });
 });
 
 check('null and undefined subtasksDefaultBoardId use the same MongoDB selector', () => {
   assert.deepStrictEqual(boardCardScope({ _id: 'B', subtasksDefaultBoardId: null }),
-    { boardId: { $in: ['B', null] } });
+    { boardId: { $in: ['B'] } });
   assert.deepStrictEqual(boardCardScope({ _id: 'B' }),
-    { boardId: { $in: ['B', null] } });
+    { boardId: { $in: ['B'] } });
 });
 
 check('a real subtasks-default board -> an all-string $in (still pushes down)', () => {
-  assert.deepStrictEqual(boardScopeIds({ _id: 'B', subtasksDefaultBoardId: 'S' }), ['B', 'S']);
+  assert.deepStrictEqual(boardScopeIds({ _id: 'B', subtasksDefaultBoardId: 'S' }), ['B']);
   assert.deepStrictEqual(boardCardScope({ _id: 'B', subtasksDefaultBoardId: 'S' }),
-    { boardId: { $in: ['B', 'S'] } });
+    { boardId: { $in: ['B'] } });
 });
 
 check('tolerates a missing board', () => {
   assert.deepStrictEqual(boardScopeIds(undefined), []);
   assert.deepStrictEqual(boardScopeIds({}), []);
   assert.deepStrictEqual(boardCardScope({ _id: 'B', subtasksDefaultBoardId: 5 }),
-    { boardId: { $in: ['B', 5] } });
+    { boardId: { $in: ['B'] } });
 });
 
 // ── source guards: no card query still uses the null-containing $in ────────────